Lans.py: capture usernames, passwords, messages and inject arbitrary HTML | Hacker News Reader

Lans.py: capture usernames, passwords, messages and inject arbitrary HTML

github.com

64 pointsflingtriangle24 comments

Could anyone point me to a resource that offers a high level explanation of how stuff like this 'works'? I'm happy to spend time parsing the source code but that won't tell me how/why you're able to intercept HTTP requests or w/e is happening. I just want to understand :'((

EDIT Looking for something more complete than a wiki article on ARP spoofing

Buy the book Violent Python. It is exactly what you need, and is available on kindle.

Definitely going to check this out, thanks!

> how/why you're able to intercept HTTP requests or w/e is happening.

Basically, in a typical LAN, you think the server is communicating directly with you alone, but in fact it's broadcasting to everyone. Your NIC and OS just happen try not to receive it.

Usually if you have a normal ethernet switch/WiFi your TCP packets end up going to everyone.

Endpoints only self-choose to listen to stuff addressed to them.

That's the major difference between hubs and switches.

As a generalisation: hubs just push everything received from one port out to all ports.

Switches are cleverer in that they only direct the right traffic (that may include broadcast traffic) to all ports.

Of course, there are cheap 'switches' that are nothing more than hubs.

doesnt all switches protect you from arp poisoning? or am i missing something on the attack vector? i understand the proxy part is cool... but the vector appears to be a non issue. i just skimmed the readme...

Most certainly not. Many enterprise switches can be/should be/are configured to protect against it -- but most consumer grade (home) switches I've seen don't.

Not sure what the status of various wireless routers/aps (eg: software ap on *bsd/linux).

i think what you call home switches are hubs. they operate on different network layers, hence the different name.

I don't think hubs (ie. the sort of switch that indiscriminately transmits every packet to every port) have been in widespread use for ages anymore.

Hi,

This is for wireless networks I believe.

Yes, some of those offer client isolation but it's often not the default. (Or maybe I'm thinking RADIUS keys per client since the isolation won't stop you sniffing?)

So assuming you've authenticated (I.e. you have the WEP or WPA key), you'll see all the traffic.

Cheers, Victor

Can't wait to see what they call the GTK version

The name would be appropriate, anyway, because it can be used for penetration testing :D

Please use 2 or 4 spaces while writing python code. It becomes impossible to read.

I agree with you for code samples in READMEs, but for actual code allow people to respectfully disagree [1].

The benefit of tabs is that you can open it in your editor and set you editor to view tabs at whatever your spacing preference (2 or 4 spaces).

That github doesn't let you specify the tab-sizing you wish to view the code at is no fault of the author's (it would be a nice feature for github to add).

Please don't throw PEP8 at me :)

[1] http://lea.verou.me/2012/01/why-tabs-are-clearly-superior/

Why not? It's a convention almost everyone has agreed upon. More than 95% of python code out there uses spaces[1]. The new PEP-8 prefers spaces over tabs. I have configured my text editor to put 4 spaces when I press the tab key and auto-indent with 4 spaces as well. Now, if I want to contribute to a project which uses tabs instead of spaces or use such a project in my own code, I have to change my text editor preferences every time I open those files or fork the project and convert tabs to spaces.

Tabs may have some advantages over spaces, but uniformity is far more important.

[1] http://sideeffect.kr/popularconvention/#python

Spaces look uniformed everywhere. Configuring every tool to use tabs with the right size is just crazy:

* SVN diff tools

* Web SVN webbrowsers

* Vi

* Eclipse

* Chrome

Does this defeat SSL or SSH?

unless this is the github account of the NSA, i would sure as hell hope not

There is a tool, SSL strip that removes SSL from the target machines https request dynamically. While not breaking SSL it is effective on a non observant user. https://github.com/moxie0/sslstrip

inject a javascript that intercepts the form submit action. Send it to another server, don't stop the event.

You have all passwords now ^^

any penetration testing companies after you yet? you have some amazing potential! fantastic work.

I wish! That's the dream job.

hahaha aawesome! :P

Reply on news.ycombinator.com