Packing and Unpacking with Python

Let’s try to understand the code. What is happening here exactly?

Binary data is stored in files, or you can get the binary data from the network. The struct module in Python generally refers to conversations between Python and C structs, and it is represented by Python byte objects. While describing the layout of the C structs, it uses format strings. The conversion is to Python values or from Python values; you can also use format strings.

Figure 9-1 shows how this binary packet looks.

The pack method of struct returns a bytes object containing the values 1, 2, 3, ...; it is packed according to the format string fmt. The unpack method unpacks from the buffer, and the results are displayed in a tuple even if there is exactly one item.

Sometimes exceptions are thrown. For example, the string size may not match.

Please read Python’s documentation for further details about this.

Why Wireless Media Is Vulnerable

Now you have an idea of how you can display the packet data. Some sophisticated sniffer tools can intercept this data and display it in its original form such as an e-mail or document. To reiterate, the term packet has a direct reference to the data at layer 3, which is also called the network layer of the OSI model; we have seen it in our “Network” chapter. The term frame refers to data at layer 2, or the data link layer. Frames have MAC addresses inside them. Packets have IP addresses inside them.

Usually, all host-to-host network communication is based on the TCP/IP data communications model. This model maps to the OSI model, which has seven layers of data communication.

By now, you can guess that the goal of a sniffer is to obtain important information sent from a target system.

When data travels over the network, the header information is added to the beginning of the data. There are two types of header data: an IP header contains the source and destination IP addresses, and the MAC header contains the source and destination MAC addresses. IP addresses are necessary for routing traffic to the correct IP network. MAC addresses ensure one thing: that the data is sent to the correct destination network. Delivery to the correct host is also ensured in such cases.

In a normal situation, a host gets the data intended for it. It will never receive data intended for another host. However, a sniffer can receive data not intended for it.

In cases of hubs or wireless media, all hosts on the network can see all the traffic, and this makes the life of a sniffer much easier. A passive sniffer can capture traffic going to and from all hosts connected via the wireless media.

The switch works in a different way. It sends data according to the MAC address. It is organized, and it maintains a MAC table of all the systems and port numbers to which it is connected. For this reason, switches are always safer than hubs. However, this is not foolproof. Using a span port or port mirroring may enable all data to be duplicated to another port.

Protocols are always susceptible to sniffers if they are not encrypted. By using a sniffer, you can easily capture protocols such as HTTP, POP3, Simple Network Management Protocol (SNMP), and FTP. Username and passwords can be extracted from sniffing.

In normal cases, any system will read and respond to the traffic sent directly to the MAC address. However, changing a network interface card (NIC) to promiscuous mode changes the game completely.

Many hacking tools change the system-dependent NIC to promiscuous mode. In promiscuous mode, the NIC reads all traffic and sends it to the sniffer. Many hacking tools also incorporate a specially designed promiscuous mode driver that facilitates the sniffing process.

ARP Poisoning Is a Threat

The Address Resolution Protocol plays a major role while data travels over a network. To reach one host, another host needs the MAC address, although the IP address is the first necessity. ARP translates the IP address to the MAC address to help the host get to the proper address. If the host has a past conversation record with another host, it first searches its ARP cache to find the MAC address. If it has not done that, it asks for the IP address first through the ARP broadcast.

What an attacker does is simple. An attacker sends a fake or spoofed ARP message to the Ethernet LAN. These frames contain false MAC addresses that are enough to confuse network devices like switches, and this allows the packets to be sniffed. Alternatively, they can be sent to unreachable addresses in a denial-of-service (DoS) attack . These methods are known as ARP spoofing or poisoning.

Analyzing Protocols Using Wireshark

Another good protocol analyzer is Wireshark. Just type Wireshark in the Kali Linux terminal to open the software. You can start capturing packets through it.

In addition, if you open the browser and browse any web site, the packets are shown automatically in the Wireshark GUI (Figure 9-2).

You can save all the traffic captured, before closing the Wireshark, using the File ➤ Save option.

Figure 9-3 shows all the traffic captured on this interface through Wireshark. If you look at the protocols closely, you will find that there are many protocols such as TCP, HTTP, SMT, and so on. If you browse any HTTPS-enabled web site, it will immediately start showing in the interface.

By learning the protocols, you can do all the necessary scanning later. The basic purpose here is to capture the network traffic for later scanning, and in addition you can try to understand how ARP spoofing might start at this point.

Detecting SQL Injection Vulnerabilities

How can you detect whether an application has vulnerabilities? It is easy to find out. You can check it by studying the URL and passing in some extra data. For example, suppose a company allows people to access employee details. A URL for accessing the president’s page might look like this:

http://company.com/employee.php?ID=1

Quite naturally, the database servers respond by returning the data for the first employee. The web page CSS styling will format the response into a good-looking HTML page.

If this request returns the same employee ID, the application has SQL injection vulnerabilities. This is because the user’s input has been interpreted as SQL code. It should not have happened that way. If the site were secure, it would have rejected the request. In that case, it would treat the user’s input as a value, and the requested value combination, 1AND1=1, at the end of the URL would result in a type mismatch.

You can use sqlmap to ascertain whether a web application has vulnerabilities.

How to Use sqlmap

To test sqlmap , you can get help from the DVWA web site, which is a PHP/MySQL web application that was created to be vulnerable. You can download this web application to your local server and run tests on it. The application is actually not as vulnerable as it claims; however, you can try to break it by injecting some poison into it. This is a safe, legal practice.

Before you start using sqlmap, remember one important thing: you cannot and should not use it on any live system without getting permission from the proper authorities. Therefore, the main purpose of DVWA is to help security professionals test their skills and tools in a legal environment.

I will now show how you can do that. First, go the DVWA web site and download the zipped application folder. If your host machine is Windows, then the best bet is to use XAMPP to run the localhost web server. In any Linux distribution, you can upgrade your PHP version to 7.*. If your local web Apache2 web server runs perfectly, it looks like Figure 9-4.

The next step is to install DVWA application on your local server (Figure 9-5). At the first go, it shows you many discrepancies in your PHP configuration.

Once you have managed those discrepancies, the application will guide you to the login page (Figure 9-6). In the username input field, provide admin, and in the password field provide password. Now you can log in to the DVWA secured web application.

Before testing vulnerabilities, you need to check whether your MySQL database server is working well.

Next, you need to tweak some parts of the system’s php.ini file to run DVWA locally. Now you can safely reset the database through the DVWA application so that it creates a database called dvwa in your MySQL server.

It is wise not to use your virtual Kali Linux local Apache2 server to run DVWA. You should use your host system to do that. In the case of Kali Linux, it uses MariaDB instead of MySQL, so the DVWA application might not act properly in your virtual Kali Linux. However, you can learn how to create a database on the Kali Linux terminal.

Now you can open your Kali Linux Applications listing and run sqlmap. It has full support for six SQL injection techniques: boolean-based blind, time-based blind, error-based, UNION queries, and out-of-band.

You can see that there are several other options available in sqlmap. You can append the --level option to 5. That is the maximum value it can take; the default value is 1. The --risk option can be appended, and the maximum value is 3; the default value is 1. The level option depends on what type of system you are using sqlmap on.