- Don't get hung up and get into arguments
about where stuff is in the OSI model
or where it is in the TCP/IP model.
Just be aware that if you're an application developer
or you're a hacker, you can do all kinds of weird things,
and you can mix things around.
You can take some layers
and put them on top of other layers.
We can create tunnels where we take ethernet, IP,
VXLAN, ethernet, IP, and then other stuff on top of it
and send that into the network.
♪ I will get the ♪
(upbeat music)
- In previous videos, I've shown you
how to use Scapy to hack protocols, such as BGP.
How to, for instance, reset the neighbor relationships,
how to inject fake routes into BGP.
I've shown you how to hack protocols such as EIGRP
which is a routing protocol.
I've shown you how to circumvent VLANs
and do other interesting things with Scapy,
but a lot of you have told me
that you've struggled to understand the basics of Scapy.
In this video, I'm gonna show you how to use Scapy
to generate packets, but not just standard packets,
dodgy packets or weird packets, if you like.
I'm gonna also show you that what a lot of people believe
about the OSI or TCP/IP model is incorrect.
People who are studying for their CCNA, as an example,
are taught that we have the application layer,
and then we have the transport layer,
then we have the network layer, and then we data link,
and then we have a physical layer.
And then we're taught how protocol data units
are sent from, say, the application layer.
Then we get header for the transport layer,
TCP, as an example.
Then we get an IP header.
Then we get a ethernet header,
and then it sends bits on the wire,
but in reality, you can actually mix your layers.
The TCP/IP model and the OSI model are just models.
They don't always relate to reality.
I have a YouTube video where I talk
about the OSI model being a lie.
I'll link that below where I talk about some of the theory
about how developers don't do what they supposed to do,
and not everything fits neatly into the OSI or TCP/IP model,
but what I'm gonna show you here
is how you can easily create
your own malicious packets, if you like,
or your own dodgy packets that you can send into the network
using only a few commands.
We're gonna use Python and Scapy to do this.
In this example, I'm using Kali
within a virtual machine on a Windows 11 laptop.
I'm controlling that from my Mac,
but, basically, you need to have a system
that supports Scapy and Python.
Kali makes this very, very easy
because it's installed by default.
So what I'm gonna do is open up a terminal.
I'm gonna use sudo.
I want to use sudo privileges because I want to send packets
into the network and I need sudo privileges to do that.
I don't just want to create the packets.
I actually wanna send them into the network
and show you what they look like.
So I need sudo privileges.
In this example, I am going to be using Python 3, 9, 10.
Basically, you just need a version of Python
that supports Scapy.
Scapy is installed by default on Kali
so all I need to do in Python is type
from scapy.all import *
Now you could limit the modules that you import,
but I'm just gonna keep those very, very simple
and import everything, so import all of Scapy.
I'm gonna create a variable.
I'll just call this Layer2,
and I'm going to make this equal to ethernet.
This is ethernet header.
Just by doing that, I can show you
what my ethernet packet looks like.
Scapy generates some of this for me.
So the destination is a broadcast, a bunch of Fs.
Source is this.
Type is set to this.
Now what about Layer3?
So let's create a variable Layer3,
and I'll set that to IP, as in IPv4,
and then I can say a Layer3.show,
and you can see the defaults used here,
are IPv4
Source address is this.
Destination address is this.
You may wanna change that.
I could do something for IPv6.
Don't forget about IPv6.
So IPv6 equals IPv6,
and then I can do a show once again to have a look
at what that looks like.
You can see that similar to IPv4,
the IPv6 address is all loop back addresses.
So all I've done now is I've imported Scapy into Python,
I've created some variables,
and I've made them to equal to various layers
of the OSI or TCP/IP model Layer2,
and then I've got Layer3 for IPv4.
So again, if I have a look
at Layer2, that's the settings.
Now, you probably want to change that.
This Mac address is the Mac address
of the Kali virtual machine.
So if I type IP address in Kali
and look at the ethernet zero Mac address,
notice 00:0c ends in 76,
and there you go, that's the Mac address that was created.
You may wanna spoof your Mac address, as an example.
So let's set a Layer2=ethernet source
01:02:03:04:05:06,
and I need to specify source equals.
So that's my Mac address.
If I have a look at Layer2 again, so Layer2 show,
notice, the Mac address has changed.
I've just created a random Mac address.
So rather than using the actual Mac address
of the virtual machine,
I'm spoofing my Mac address by simply doing that.
Now, let's change the Layer3 IP address.
So I'm gonna set the Layer3 IP address
to have a destination of 192.168.1.249.
So now Layer3.show,
you can see, and I need to use brackets,
you can see that the source IP address is this.
The destination IP address is that.
The IP address of my Kali virtual machine is 192.168.1.59.
So I could change that IP address if I wanted to,
but for the moment,
let's just leave the IP address as it is.
So, again, Layer3.show looks like that.
Layer2.show looks like that.
That's okay, but we wanna send traffic into the network.
So I'm gonna say send=sendp
and then I'm gonna, only for the moment, send Layer2.
A lot of people are under the misconception that
you have to send Layer2, Layer3, Layer4,
Layer7, if you like.
You don't have to do that.
I could just send Layer2.
Remember, here, I could create my own malicious packets.
I could create weird and wonderful packets.
So I could send whatever I wanted to.
Before I send that into the network,
let's run Wiresharks so we can see what's going on.
So I'm gonna start capturing on my ethernet interface.
I get a lot of traffic,
but what I'm gonna do is filter for that Mac address.
So at the moment, nothing is captured,
but if I send that packet into the network,
that's captured in Wireshark.
You can see, we're told that it's a malformed packet.
It's a broadcast from this Mac address.
Ethernet II is the frame that was sent out.
It's a broadcast with this source Mac address,
01:02 up to 06.
It says it's a loop back.
Remember, that when we looked at Layer2,
the type was this, so loop back.
We told that this is a malformed packet,
but we were able to send a Layer2 frame into the network.
Now, rather than just sending Layer2,
I'm gonna use /
That / just allows me
to put another layer on top of this layer.
So I've got Layer2, let's put Layer3 on top, so Layer3.
We'll send Layer2, Layer3, and in our Wireshark capture,
we can see that that information is displayed.
Source Mac address is this.
Destination Mac address is a Cisco router
in my local infrastructure,
and if we have a look at the IP packet,
you can see source IP address is 192.168.1.59
Destination is 249.
What's great about Scapy
is it doesn't force you to set all the options.
It just fills in a bunch of options for you
if you haven't filled them in already.
At Ethernet II, we didn't specify the type,
but that's changed from the previous frame,
which was loop back.
Notice the type is 9000.
Here at Layer2, the type at Layer3 is IPv4
Scapy filled that in for us.
We didn't have to fill in those details.
The only thing we changed was the source Mac address.
Scapy changed the type field
to reference the Layer3 protocol correctly.
So we've got Ethernet II at Layer2,
and we've got IP version four at Layer3,
but now let's do some weird stuff.
Let's break the OSI theory and send two Layer3 packets.
So I'm sending Layer2, Layer3, and then Layer3 again,
and if we have a look at that,
you can see that's exactly what's sent into the network.
We've got Layer2, we've got IPv4
and then we've got IPv4 again.
I'm sending IPv4 twice into the network
and that doesn't stop me doing other weird things like this.
Let's put Layer3 three times.
So we've got IPv4, IPv4,
and IPv4.
That's what happens in the real world.
In the real world, we may be running multiple protocols
so we might have ethernet, and then we might have MPLs,
multi protocol label switching,
then we might have IPv4,
and we might have a GRE tunnel, then we might have IP sec,
and inside there, we may do other weird things.
You can, as an example, put Layer2 on top of Layer3.
So let's do that.
It won't necessarily like it.
Wireshark won't like this,
but notice I've got Layer2, Layer3, Layer2.
So if I look at that, I've got Ethernet II at Layer2.
I've got IPv4
and now it's not quite sure how to interpret this.
It's seeing this as IPv6
where I'm actually sending an ethernet frame
on top of IPv4
This is why the theory of CCNA
isn't always true in the real world
because if you're a developer or, in this case,
using an application like Scapy, you could, as a hacker,
send malicious packets into the network to do weird things.
Let's have a look at Layer4.
So Layer4, let's make our variable equal to TCP so that,
and let's have a look at what Layer4 looks like.
So that's our variable.
We've set it to TCP.
Source port is port 20, which is FTP data.
Destination port is port 80.
Scapy has just selected port 20 here,
but you could change that if you wanted to,
but for the moment, I'll leave that as it is.
Let's send a more realistic packet into the network.
So we are gonna send Layer2, Layer3, and Layer4.
That's been sent into the network,
and now you can see we've got Ethernet II.
Source Mac address is the Mac address
that we were using previously.
Destination Mac address is my Cisco router.
Type field is IPv4
Now, if you are wondering, how does it know that Mac address
and op could have been sent to the network
to discover that device?
So we've got the destination Mac address,
source Mac address, and if we look at the type field,
that's IPv4
Protocol at Layer3's IPv4, once again,
source and destination Mac address,
and if we look at the protocol field, it's telling us that
the protocol at Layer4 is TCP,
and here, we've got our TCP information source port,
as mentioned, is 20.
Destination port is 80,
but now, let me show you some more advanced stuff.
Let's load something into Scapy.
So some of the Scapy stuff that has to be brought in.
and I'm breaking the rules here.
Now, those of you who know Python
know that this is bad practice.
I'm using single inverted commas
rather than double inverted commas here
or quotation marks if you're from the States.
That doesn't matter for our demonstration.
I'm just gonna do that.
I'm gonna import MPLS,
and now I'm gonna say MPLS.show,
and I need double brackets there.
We can see information about MPLS,
like the label number, ttl, and other settings.
Now, if you're not sure what that is,
MPLS or Multi-Protocol Label Switching
is used in service provider networks,
big companies like AT&T or BT
will often have an MPLS environment.
It allows them to more efficiently
move traffic through the network,
allows them to create what are called Layer3 VPNs,
and do other things more easily
using MPLs than traditional protocols,
such as IP4 and access lists.
We won't get into that.
All I wanna show you is
that I can stitch MPLS into our packets.
Now, before I do that, what I'm gonna do
is I'm gonna make something called MyMPLS.
So I'll create a variable, and I'll set that to MPLS,
and then what I'll do now is send Layer2,
send MyMPLS, send Layer3, send Layer4.
Okay, packet has been sent, and now,
notice we've got ethernet at Layer2.
We've got multi-protocol label switching.
We can see bottom of stack equals one.
So that's what the S is, if you're not sure about that.
We've got IPv4 at Layer3 or is that now Layer4?
This is where the OSI model gets a little bit interesting
because this MPLS Layer2 is a Layer3.
A lot of people will see it as Layer2 and a half.
So we've got ethernet at Layer2.
We've got MPLS at Layer2 and a half.
We've got IP at Layer3,
and we've got TCP at Layer4, but as you can see,
the lines are already getting blurred.
Let's do some other crazy stuff.
So let's do something like this
where we stack MPLS on top of Layer3.
So MyMPLS and Layer4 now.
So it's accepted that.
Packet's been sent to the network.
Notice, we've got ethernet.
We've got MPLS.
We've got IPv4
We've got MPLS, and now it's seeing that as ethernet.
So it got a bit confused
with the data that was sent into the network.
Wireshark is not reading that properly.
So why don't we do this then?
Let's do this.
We put Layer2 on top of MPLS,
and then we put our Layer3, and then we have Layer4.
So we'll send that into the network.
Notice what we've done here.
Now, Wireshark is not reading this properly.
It's seeing this as data now rather than ethernet.
So it just says, "Okay, this is just data."
It doesn't like that.
So let's try Layer3 on top of MPLS rather than Layer4.
Okay, so we've got ethernet at Layer2,
MPLS at Layer2 and a half, IP at Layer3.
MPLS said "What layer is that?"
Then we've got IP, and then we've got TCP.
Notice how we've stacked layers on top of other layers.
Now, this happens, as I've mentioned,
all the time in the real world.
Think about it.
If you use a VPN, so you connect
to some VPN provider somewhere,
on the internet, the router on the internet are gonna see
the IP address is from your device,
as in like your home router, to the VPN service provider.
So they're gonna see those IP addresses.
Other information is gonna be encrypted
so your actual IP address will be encrypted.
So what we've got is we've got IP on top of IP.
So this kind of stuff happens
all the time in the real world.
Don't get hung up with trying to put
protocols into specific layers
because the TCP/IP model and the OSI model are models,
but they don't always perfectly reflect reality
because developers might create weird protocols
that do weird things.
As an example, voice protocols, like VoIP protocols,
put stuff into the VoIP packets
that would typically not be there
that would be at high layers.
stuff gets mixed in by developers.
Here, I've just shown you a simple example
of how to forge weird packets,
and I mean, you could do all kinds of things with Scapy.
So as an example,
rather than doing this kind of crazy stuff,
let's just send Layer2, Layer3, and ICMP,
so ICMP like that.
So all I've done there is send a proper ethernet frame,
a proper IPv4 packet and ICMP,
but now here we get the question,
"At what layer does ICMP reside?
Is it Layer3?
Is it Layer4?
Is it Layer3 and a half?"
Don't get hung up and get into arguments
about where stuff is in the OSI model
or where it is in the TCP/IP model.
Just be aware that if you're an application developer
or you're a hacker, you can do all kinds of weird things
and you can mix things around.
You can take some layers
and put them on top of other layers.
As an example, in data centers,
they use something called VXLAN rather than MPLS.
We can create tunnels where we take ethernet, IP,
VXLAN, ethernet, IP, and other stuff on top of it,
and send that into the network.
I'm hoping this gives you a good idea
of how to get started with Scapy.
If you're interested, let me know,
and I'll create more Scapy videos.
Scapy is extremely powerful.
I've created other videos where I show you how to pack BGP
or protocols like Spanning Tree or do VLAN hoppings
or circumvent VLANs and other protocols on a network.
I'm David Bombal.
If you enjoyed this video, please like it,
please consider subscribing to my YouTube channel,
and clicking on the bell to get notifications.
I wanna wish you all the very best
♪ I will get the ♪
(upbeat music)