Package: scapy-p0f
scapy-p0fA native implementation of p0f v3 in Python.scapy-p0f allows you to accurately guess the source OS or user application of a givenScapypacket with passive fingerprinting.scapy-p0f supports Python 2.7 and Python 3 (3.4 to 3.7).InstallationYou can install scapy-p0f by running$ pip install scapy-p0fUsagescapy-p0f has 4 main functions:p0f,p0f_impersonate,prnp0fandfingerprint_mtu.Note:p0f v3 supports SYN/SYN+ACK and HTTP packets. If the given packet isn't valid for p0f, an exception is raised.Fingerprint Match FormatTCP MatchHTTP MatchMTU MatchOverview(label, distance, fuzzy)(label, dishonest)labelTypes(tuple, int, bool)(tuple, bool)strp0f FunctionThe mainp0ffunction is used to fingerprint the OS/user application.
The function receives aScapypacket, and returns a TCP/HTTP match (or None if no match was found):fromscapy.layers.inetimportIPimportscapy_p0fpkt=IP(b'E\x00\x00<\x00\x00@\x008\x06N;?t\xf3a\xc0\xa8\x01\x03\x00P\xe5\xc0\xa3\xc4\x80\x9f\xe5\x94=\xab\xa0\x12\x16\xa0N\x07\x00\x00\x02\x04\x05\xb4\x04\x02\x08\n\x8d\x9d\x9d\xfa\x00\x17\x95e\x01\x03\x03\x05')match=scapy_p0f.p0f(pkt)# (("s", "unix", "Linux", "2.6.x"), 8, False)p0f_impersonate FunctionThep0f_impersonatefunction is able to modify a packet so that it impersonates a certain OS.
For now, only TCP SYN/SYN+ACK packets are supported.The function receives a packet and multiple optional arguments:defp0f_impersonate(pkt,osgenre=None,osdetails=None,signature=None,extrahops=0,mtu=1500,uptime=None):To impersonate a packet, eitherosgenreorsignaturemust be specified.Ifsignatureis specified (as a string), we use the signature.The specified signature must follow the p0f signature format:ip_ver:ttl:ip_opt_len:mss:window,wscale:opt_layout:quirks:pay_classIfosgenreis specified, we randomly pick a signature with a label
that matchesosgenre(andosdetails, if specified).Note:osgenreis case sensitive ("Linux" instead of "linux" , etc.), andosdetailsis a substring of a label flavor ("7", "8" and "7 or 8" will
all match the label "s:win:Windows:7 or 8").extrahopscan be specified to decrease the TTL by a certain amount to simulate hops.mtucan be specified to calculate window size if the window is based on the mtu. Defaults to 1500.uptimecan be specified to insert a custom value on a timestamp if the signature includes it.Examplesfromscapy.layers.inetimportIP,TCPfromscapy_p0fimportp0f,p0f_impersonatesig="*:64:0:*:mss*20,10:mss,sok,ts,nop,ws:df,id+:0"# Signature of Linux 3.11 and newerpkt=p0f_impersonate(IP()/TCP(),signature=sig)match=p0f(pkt)# (("s", "unix", "Linux", "3.11 and newer"), 0, False)pkt=p0f_impersonate(IP()/TCP(),osgenre="Windows",osdetails="7")match=p0f(pkt)# (("s", "win", "Windows", "7 or 8"), 0, False)prnp0f FunctionTheprnp0ffunction simply callsp0fand prints a user-friendly output, emulating the original p0f output:>>>fromscapy.layers.inetimportIP>>>importscapy_p0f>>>pkt=IP(b'E\x00\x00<\x00\x00@\x008\x06N;?t\xf3a\xc0\xa8\x01\x03\x00P\xe5\xc0\xa3\xc4\x80\x9f\xe5\x94=\xab\xa0\x12\x16\xa0N\x07\x00\x00\x02\x04\x05\xb4\x04\x02\x08\n\x8d\x9d\x9d\xfa\x00\x17\x95e\x01\x03\x03\x05')>>>scapy_p0f.prnp0f(pkt).-[63.116.243.97:http->192.168.1.3:58816(SYN+ACK)]-||Server=63.116.243.97:http|OS=Linux2.6.x|Distance=8|Rawsig=4:56+8:0:1460:5792,5:mss,sok,ts,nop,ws:df:0`____fingerprint_mtu FunctionThefingerprint_mtufunction fingerprints the MTU based on the maximum segment size specified in TCP options.
The function receives aScapyTCP packet, and returns a MTU match (or None if no match was found):fromscapy.layers.inetimportIPimportscapy_p0fpkt=IP(b'E\x00\x00<\x00\x00@\x008\x06N;?t\xf3a\xc0\xa8\x01\x03\x00P\xe5\xc0\xa3\xc4\x80\x9f\xe5\x94=\xab\xa0\x12\x16\xa0N\x07\x00\x00\x02\x04\x05\xb4\x04\x02\x08\n\x8d\x9d\x9d\xfa\x00\x17\x95e\x01\x03\x03\x05')match=scapy_p0f.fingerprint_mtu(pkt)# "Ethernet or modem"AuthorsItay Margolin-Nisitay