1

Stephen Northcutt, SANS Director, make a pcap contest (see here) where the .pcap file had a hidden information in checksum field. I solved it using wireshark and it was an interesting activity. So, I would like to do some challenge based in the Stephen's contest. How can I modify a set of packets to do some contest like these?

In advance, I apologize if I'm using the wrong community to ask this question. I didn't found another more appropriate.

Improve this question

1 Answer 1

Reset to default
2

There are different options. The easiest would be using a tool like scapy.

Scapy is a powerful interactive packet manipulation program. It is able to forge or decode packets of a wide number of protocols, send them on the wire, capture them, match requests and replies, and much more. It can easily handle most classical tasks like scanning, tracerouting, probing, unit tests, attacks or network discovery (it can replace hping, 85% of nmap, arpspoof, arp-sk, arping, tcpdump, tethereal, p0f, etc.). It also performs very well at a lot of other specific tasks that most other tools can't handle, like sending invalid frames, injecting your own 802.11 frames, combining technics (VLAN hopping+ARP cache poisoning, VOIP decoding on WEP encrypted channel, ...), etc.

Improve this answer
1
  • Now I don't remember if the information was in checksum field or was just found because of bad checksums. I will check it later. But your answer gave me the necessary elements to modify packets. Thank you.
    – eightShirt
    Commented May 13, 2016 at 6:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .