Excercises for the SPSE exam.

2017-10-12 21:26:45 +02:00 · 2017-10-12 21:26:45 +02:00 · a002d96104
parent 6ed9490982
commit a002d96104
11 changed files with 321 additions and 0 deletions
--- a/spse_excercises/exc_mod1_p9_user_defined_exception.py
+++ b/spse_excercises/exc_mod1_p9_user_defined_exception.py
@ -0,0 +1,13 @@
 #!/usr/bin/python
 # -*- coding: utf-8 -*-
 # Derive from Exception class (inheritance)
 class MyError(Exception):
    def __init__(self, value):
        self.value = "...oooops!"
 try:
    raise(MyError(3*2))
 except MyError as error:
    print('User defined exception says: ',error.value)
--- a/spse_excercises/exc_mod2_p4_syn_scan_threaded.py
+++ b/spse_excercises/exc_mod2_p4_syn_scan_threaded.py
@ -0,0 +1,24 @@
 #!/usr/bin/python
 # -*- coding: utf-8 -*-
 # Python multi-thread syn scanner
 #import thread
 from threading import Thread
 from scapy.all import *
 import time
 ip = "127.0.0.1"
 ports = [20,21,22,23,53,80,139,443,445,5222,8080]
 result=""
 def scan(ip,cur_port):
    syn=IP(dst=ip)/TCP(dport=cur_port, flags="S")  # "sr1" is used as only one packet is needed to be received.
    answer = sr1(syn, verbose=0, timeout=2)
    print answer.summary()
    # For return values and communiaction between Threads: use queue
 for port in ports:
    th = Thread(target=scan, args=(ip,port))
    th.start()
--- a/spse_excercises/exc_mod2_p5_syn_scan_multiprocessing.py
+++ b/spse_excercises/exc_mod2_p5_syn_scan_multiprocessing.py
@ -0,0 +1,21 @@
 #!/usr/bin/python
 # -*- coding: utf-8 -*-
 import multiprocessing
 from scapy.all import *
 ip = "127.0.0.1"
 ports = [20,21,22,23,53,80,139,443,445,5222,8080]
 def worker(ip,cur_port):
    syn=IP(dst=ip)/TCP(dport=cur_port, flags="S")  # "sr1" is used as only one packet is needed to be received.
    answer = sr1(syn, verbose=0, timeout=2)
    print answer.summary()
    return
 if __name__ == '__main__':
    jobs = []
    for port in ports:
        p = multiprocessing.Process(target=worker, args=(ip,port))
        jobs.append(p)
        p.start()
--- a/spse_excercises/exc_mod2_p5_thread_queue_ftp.py
+++ b/spse_excercises/exc_mod2_p5_thread_queue_ftp.py
@ -0,0 +1,36 @@
 #!/usr/bin/python
 # -*- coding: utf-8 -*-
 from Queue import Queue
 from threading import Thread
 import ftplib
 # Random list from random hosts
 # For complete excercie, 10 ftp sites... but it's working already at least.
 ftp_list = ["210.222.148.126","81.177.6.66", "69.168.79.145", "79.24.166.214", "103.209.143.86"]
 def do_work(q,cur_ftp):
  while True:
    ftp = ftplib.FTP(cur_ftp)
    ftp.login("anonymous", "")
    data = []
    ftp.dir(data.append)
    ftp.quit()
    for line in data:
        print "-", line
    q.task_done()
 q = Queue(maxsize=0)
 num_threads = 5
 for cur_ftp in ftp_list:
  worker = Thread(target=do_work, args=(q,cur_ftp))
  worker.setDaemon(True)
  worker.start()
 # Wait until threads finish
 for x in range(50):
  q.put(x)
 q.join()
--- a/spse_excercises/exc_mod3_p3_cgi.py
+++ b/spse_excercises/exc_mod3_p3_cgi.py
@ -0,0 +1,25 @@
 #!/usr/bin/python
 # -*- coding: utf-8 -*-
 # - Python can be used as CGI script
 # - There is cgi module
 # - Flask can handle cgi scripts too
 # https://docs.python.org/2/library/cgi.html
 # http://cgi.tutorial.codepoint.net/hellow-world
 # http://flask.pocoo.org/docs/0.12/deploying/cgi/
 import cgitb
 cgitb.enable(display=1)
 # ..and cgi scripting
 # Or cgi called directly by other app:
 print "Content-Type: text/html"
 print
 print """\
 <html>
 <body>
 <h2>Hello World!</h2>
 </body>
 </html>
 """
--- a/spse_excercises/exc_mod3_p5_raw_socket_arp.py
+++ b/spse_excercises/exc_mod3_p5_raw_socket_arp.py
@ -0,0 +1,26 @@
 #!/usr/bin/python
 # -*- coding: utf-8 -*-
 import socket
 import struct
 rawSocket = socket.socket(socket.PF_PACKET, socket.SOCK_RAW, socket.htons(0x0800))
 rawSocket.bind(("eth0", socket.htons(0x0800)))
 # layer 2 message, then data
 # src mac / dst mac / eth type
 # arpaket = struct.pack("!6s6s2s", '\xaa\xaa\xaa\xaa\xaa\xaa', '\xbb\xbb\xbb\xbb\xbb\xbb','\x08\x60') # 14 bytes
 # ARP --> dst mac / src mac / type 8006 / |ARP ~ hw type / proto type / hw addr / proto addr / operation code / 
 # / src hw addr / src proto addr / target hw addr / target proto addr | / Padding / CRC - note here is that padding and crc is not mandatory :)
 # https://www.netometer.com/qa/arp.html
 arpaket = struct.pack("!6s6s2s2s2s1s1s2s6s4s6s4s", '\xaa\xaa\xaa\xaa\xaa\xaa', '\xbb\xbb\xbb\xbb\xbb\xbb', '\x08\x06','\x00\x01','\x08\x00','\x06','\x04','\x00\x01','\xcc\xcc\xcc\xcc\xcc\xcc','\xc0\xa8\x06\x06','\xdd\xdd\xdd\xdd\xdd\xdd','\xc0\xa8\x06\x07')
 rawSocket.send(arpaket)
 #print "Length of the ARP packet sent: " + str(len(arpaket))
 #arpreply = struct.pack("!6s6s2s2s2s1s1s2s6s4s6s4s", '\xaa\xaa\xaa\xaa\xaa\xaa', '\xbb\xbb\xbb\xbb\xbb\xbb', '\x08\x06','\x00\x01','\x08\x00','\x06','\x04','\x00\x02','\xcc\xcc\xcc\xcc\xcc\xcc','\xc0\xa8\x06\x06','\xdd\xdd\xdd\xdd\xdd\xdd','\xc0\xa8\x06\x07')
 #rawSocket.send(arpreply)
--- a/spse_excercises/exc_mod3_p6_sniff_http_with_scapy.py
+++ b/spse_excercises/exc_mod3_p6_sniff_http_with_scapy.py
@ -0,0 +1,18 @@
 #!/usr/bin/python
 # -*- coding: utf-8 -*-
 from scapy.all import sniff
 def http_header(packet):
        http_packet=str(packet)
        if http_packet.find('GET') or http_packet.find('POST'):
                return GET_print(packet)
 def GET_print(packet1):
    http_out = "\n".join(packet1.sprintf("{Raw:%Raw.load%}\n").split(r"\r\n")) + "\n"
    return http_out
 sniff(iface="eth0", prn=http_header, filter="tcp port 80", count=99)
 # Another solution: pip install scapy-http
--- a/spse_excercises/exc_mod3_p6_wifi_ssid_sniff.py
+++ b/spse_excercises/exc_mod3_p6_wifi_ssid_sniff.py
@ -0,0 +1,17 @@
 #!/usr/bin/python
 # -*- coding: utf-8 -*-
 # Note: general solution posted multiple times.
 from scapy.all import sniff, Dot11
 aps = []
 def PacketHandler(pkt):
    if pkt.haslayer(Dot11):
        if pkt.type == 0 and pkt.subtype == 8:
            if pkt.addr2 not in aps :
                aps.append(pkt.addr2)
                print "SSID found: %s " %(pkt.info)
 sniff(iface="wlan0mon", prn=PacketHandler)
--- a/spse_excercises/exc_mod3_p8_scapy_fuzz.py
+++ b/spse_excercises/exc_mod3_p8_scapy_fuzz.py
@ -0,0 +1,13 @@
 #!/usr/bin/python
 #-*- coding: utf-8 -*-
 # Docs for interactive use
 # https://scapy.readthedocs.io/en/latest/usage.html?highlight=fuzz#fuzzing
 # Interactive example: >>> send(IP(dst="127.0.0.1")/fuzz(UDP()/NTP(version=4)),loop=1)
 from scapy.all import sr1,IP,fuzz,UDP,NTP
 target="127.0.0.1"
 target="192.168.49.39"
 while True:
    sr1(IP(dst=target)/fuzz(UDP()/NTP(version=4)),inter=4,timeout=1)
--- a/spse_excercises/exc_mod3_raw_packet_as_user.txt
+++ b/spse_excercises/exc_mod3_raw_packet_as_user.txt
@ -0,0 +1,9 @@
 #!/bin/sh
 # cp /usr/bin/python2.7 python
 # setcap cap_net_raw+ep python                          
 # chmod +x python
 # ./python 29_raw_socket_struct_binascii.py
 # or a restricted sudo privilege which is probably better, not allowing priv esc :)
--- a/spse_excercises/exc_mod4_p7_multithread_web_spider_mysql.py
+++ b/spse_excercises/exc_mod4_p7_multithread_web_spider_mysql.py
@ -0,0 +1,119 @@
 #!/usr/bin/python
 # -*- coding: utf-8 -*-
 # A project for parsing a website, then inserting the data into mysql and serving the mysql data through socket http server.
 # All is managed through multithreading.
 #
 # If the mysql table does not exist, this script will create it, but the database and user should be created in advance!
 import multiprocessing
 import MySQLdb as mdb
 from lxml import html
 import requests
 import time
 from time import gmtime, strftime
 import SocketServer
 import SimpleHTTPServer
 # Proxy
 proxies = {
    'http': "socks5://127.0.0.1:9050",
    'https': "socks5://127.0.0.1:9050"}
 # Spidering
 def spidering_l(proc):
    while True:
        # Sprudeling
        # Get the page
        page = requests.get('https://riskdiscovery.com/'), proxies=proxies)
        tree = html.fromstring(page.content)
        # Vars
        state_time = strftime("%Y%m%d%H%M%S", gmtime())
        spider_list_link = []
        spider_list_text = []
        spider_state = str(state_time)
        # Loop around links //a
        for link in tree.xpath('//a'):
            spider_list_link.append(link.get('href'))
            spider_list_text.append(link.text)
        # MySQL
        con = ""
        try:
            con = mdb.connect('localhost', 'someuser', 'somepass', 'news_parse')
            cur = con.cursor()
            zp = zip(spider_list_link,spider_list_text)
            for zipo in zp:
                link_c = zipo[0]
                text_c = zipo[1]
                cur.execute("CREATE TABLE IF NOT EXISTS news_data ( id INT(6) UNSIGNED AUTO_INCREMENT PRIMARY KEY, state_time VARCHAR(30) NOT NULL, link VARCHAR(512) NOT NULL, text VARCHAR(1024))")
                con.commit()
                cur.execute("INSERT INTO news_data (id, state_time, link, text) VALUES (NULL, %s, %s, %s)",(state_time,link_c,text_c))
                con.commit()
        except mdb.Error, e:
            print e
        finally:
            if con:
                con.close()
        time.sleep(60)
    return
 # Serve HTTP
 class HttpRequestHandler (SimpleHTTPServer.SimpleHTTPRequestHandler) :
    def do_GET(self) :
        last_list=""
        if self.path == "/":
            try:
                con = mdb.connect('localhost', 'someuser', 'somepass', 'news_parse')
                cur = con.cursor()
                cur.execute("SELECT * FROM news_data")
                data = cur.fetchall()
                # Unique identifiers (that's why it's a set)
                sset=set()
                for x in data:
                    sset.add(x[2])
                for xx in sset:
                    last_list = last_list + xx + '\n'
 # Note, playing with sets
 #                final_out = []
 #                for xx in sset:
 #                    curr_st = xx
 #                        for x in data:
 #                            if curr_st == x[1]:
 #                                final_out.(x[2][3])
            except mdb.Error, e:
                print e
            finally:
                if con:
                    con.close()
            self.wfile.write('The latest news from the past 72 hours: \n' + str(last_list))
        else:
            SimpleHTTPServer.SimpleHTTPRequestHandler.do_GET(self)
 def serve_http(proc):
    SocketServer.TCPServer.allow_reuse_address = True
    httpServer = SocketServer.TCPServer(("127.0.0.1", 8080), HttpRequestHandler)
    print "It should listen on 8080."
    httpServer.serve_forever()
    pass
 if __name__ == '__main__':
    jobs = []
    # Start spidering
    mp = multiprocessing.Process(target=spidering_l, args=(0,))
    jobs.append(mp)
    mp.start()
    # Serve the results on HTTP
    hp = multiprocessing.Process(target=serve_http, args=(0,))
    jobs.append(hp)
    hp.start()