[38;5;12m                                                                                 [39m[38;2;255;187;0m[1m[4mAwesome Scapy [0m[38;5;14m[1m[4m![0m[38;2;255;187;0m[1m[4mAwesome[0m[38;5;14m[1m[4m (https://awesome.re/badge.svg)[0m[38;2;255;187;0m[1m[4m (https://awesome.re)[0m

[38;5;12m  [39m


[38;5;12mA curated list of tools, add-ons, articles or cool exploits using [39m[38;5;12mScapy[39m[38;5;14m[1m (https://scapy.net)[0m[38;5;12m, the Python-based interactive packet manipulation program & library. [39m
[38;5;12mFeel free to [39m[38;5;14m[1mcontribute[0m[38;5;12m (https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fsecdev%2Fawesome-scapy%2Fedit%2Fmain%2FREADME.md)![39m

[38;5;12mYou can also [39m[38;5;14m[1mexplore Scapy topics[0m[38;5;12m (https://github.com/topics/scapy) on GitHub![39m

[38;2;255;187;0m[4mContents[0m

[38;5;12m- [39m[38;5;14m[1mTools[0m[38;5;12m (#tools)[39m
[38;5;12m- [39m[38;5;14m[1mExploits[0m[38;5;12m (#exploits)[39m

[38;2;255;187;0m[4mTools[0m

[48;2;30;30;40m[38;5;13m[3mTools that use Scapy (a lot) or extend it[0m

[38;5;12mFun[39m
[38;5;12m- [39m[38;5;14m[1mpwnagotchi[0m[38;5;12m (https://github.com/evilsocket/pwnagotchi) - Your AI pet that hacks WiFI to grow. It's super cute.[39m

[38;5;12mDDoS[39m
[38;5;12m- [39m[38;5;14m[1mufonet[0m[38;5;12m (https://github.com/epsylon/ufonet) - Create your own botnet to send untraceable DDoS attacks.[39m

[38;5;12mWi-Fi.[39m
[38;5;12m- [39m[38;5;14m[1mtrackerjacker[0m[38;5;12m (https://github.com/calebmadrigal/trackerjacker) - Maps and tracks Wi-Fi networks and devices through raw 802.11 monitoring.[39m
[38;5;12m- [39m[38;5;14m[1mwifiphisher[0m[38;5;12m (https://github.com/wifiphisher/wifiphisher) - Create rogue access point.[39m

[38;5;12mIPv6[39m
[38;5;12m- [39m[38;5;14m[1mChiron[0m[38;5;12m (https://github.com/aatlasis/Chiron) - An IPv6 security assessment framework.[39m
[38;5;12m- [39m[38;5;14m[1mmitm6[0m[38;5;12m (https://github.com/fox-it/mitm6) - Performs MiTM for IPv6.[39m

[38;5;12mMeasurements[39m
[38;5;12m- [39m[38;5;14m[1mmtraceroute[0m[38;5;12m (https://github.com/rwhalb/mtraceroute) - Create cool graphs over multiple traceroute analysis.[39m
[38;5;12m- [39m[38;5;14m[1mNetwork Security Toolkit (NST)[0m[38;5;12m (https://wiki.networksecuritytoolkit.org/nstwiki/index.php?title=HowTo_Use_The_Scapy:_Multi-Traceroute_-_MTR) - Includes an enhanced version of [39m[48;5;235m[38;5;249mmtraceroute[49m[39m[38;5;12m with IP Geolocation and GUI management.[39m
[38;5;12m- [39m[38;5;14m[1mnetprobify[0m[38;5;12m (https://github.com/criteo/netprobify) - Network probing tool crafted for datacenters (but not only). Probing using: TCP, UDP or ICMP.[39m

[38;5;12mProtocols[39m
[38;5;12m- [39m[38;5;14m[1mCotopaxi[0m[38;5;12m (https://github.com/Samsung/cotopaxi) - Set of tools for security testing of Internet of Things devices using specific network IoT protocols (AMQP, CoAP, DTLS, HTCPCP, KNX, mDNS, MQTT, MQTT-SN, QUIC, RTSP, SSDP) .[39m
[38;5;12m- [39m[38;5;14m[1mproject-memoria-detector[0m[38;5;12m (https://github.com/Forescout/project-memoria-detector) - Determine whether a network device runs a specific embedded TCP/IP stack.[39m
[38;5;12m- [39m[38;5;14m[1mroutopsy[0m[38;5;12m (https://github.com/sensepost/routopsy) - Toolkit to attack DRP & FHRP.[39m
[38;5;12m- [39m[38;5;14m[1mTorPylle[0m[38;5;12m (https://github.com/cea-sec/TorPylle) - Implementation of the OR (TOR) protocol.[39m

[38;5;12mUnit Tests[39m
[38;5;12m- [39m[38;5;14m[1mLinux Kernel[0m[38;5;12m (https://github.com/torvalds/linux/blob/master/tools/testing/selftests/tc-testing/plugin-lib/scapyPlugin.py) - Linux Traffic Control (tc) testing suite.[39m
[38;5;12m- [39m[38;5;14m[1mOpenBSD[0m[38;5;12m (https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fsearch%3Fq%3Dscapy%2Brepo%253Aopenbsd%252Fsrc%2Bpath%253Aregress%252F%26type%3DCode%26ref%3Dadvsearch%26l%3D%26l%3D) - IPv6 stack testing suite.[39m
[38;5;12m- [39m[38;5;14m[1mRIOT-OS[0m[38;5;12m (https://github.com/RIOT-OS/RIOT/search?l=Python&q=scapy&type=Code) - RIOT OS networking testing suite.[39m

[38;5;12mVisualization[39m
[38;5;12m- [39m[38;5;14m[1mScapy-Packet-Viewer[0m[38;5;12m (https://pypi.org/project/scapy-packet-viewer/) - Minimal packet viewer similar to tshark/mitmproxy. Based on urwid.[39m

[38;5;12mMisc[39m
[38;5;12m- [39m[38;5;14m[1maioblescan[0m[38;5;12m (https://github.com/frawau/aioblescan) - Scan and decode advertised BLE info.[39m
[38;5;12m- [39m[38;5;14m[1mfenrir[0m[38;5;12m (https://github.com/Orange-Cyberdefense/fenrir-ocd) - Bypass wired 802.1x protection.[39m
[38;5;12m- [39m[38;5;14m[1mflowsynth[0m[38;5;12m (https://github.com/secureworks/flowsynth) - Tool for rapidly modeling network traffic.[39m
[38;5;12m- [39m[38;5;14m[1mFragscapy[0m[38;5;12m (https://github.com/AMOSSYS/Fragscapy) - Fuzz network protocols by automating the modification of outgoing network packets.[39m
[38;5;12m- [39m[38;5;14m[1mHabu[0m[38;5;12m (https://github.com/fportantier/habu) - Toolkit with a lot of little hacking tools. Many of them use Scapy.[39m
[38;5;12m- [39m[38;5;14m[1mmirage[0m[38;5;12m (https://redmine.laas.fr/projects/mirage) - Powerful and modular framework dedicated to the security analysis of wireless communications.[39m
[38;5;12m- [39m[38;5;14m[1mnetenum[0m[38;5;12m (https://github.com/redcode-labs/Netenum) - A tool to passively discover active hosts on a network.[39m
[38;5;12m- [39m[38;5;14m[1mnet-creds[0m[38;5;12m (https://github.com/DanMcInerney/net-creds) - Sniff and catch all sensitive data on an interface.[39m
[38;5;12m- [39m[38;5;14m[1mpacketweaver[0m[38;5;12m (https://github.com/ANSSI-FR/packetweaver) - A Python framework for script filing and task sequencing.[39m
[38;5;12m- [39m[38;5;14m[1mp0f3plus[0m[38;5;12m (https://github.com/FlUxIuS/p0f3plus) - An implementation of with extra analysis features.[39m
[38;5;12m- [39m[38;5;14m[1mpysap[0m[38;5;12m (https://github.com/SecureAuthCorp/pysap) - Interact with SAP using custom built frames & tools.[39m
[38;5;12m- [39m[38;5;14m[1mResponder[0m[38;5;12m (https://github.com/SpiderLabs/Responder) -  LLMNR, NBT-NS and MDNS poisoner.[39m
[38;5;12m- [39m[38;5;14m[1mscapy\_unroot[0m[38;5;12m (https://github.com/scapy-unroot/scapy_unroot) - Tooling to use Scapy without root permissions.[39m
[38;5;12m- [39m[38;5;14m[1mscapy-benchmarks[0m[38;5;12m (https://github.com/gpotter2/scapy-benchmarks) - A small test suite that tracks the evolution of Scapy's performance.[39m
[38;5;12m- [39m[38;5;14m[1msshame[0m[38;5;12m (https://github.com/HynekPetrak/sshame) - Tool to brute force SSH public-key authentication.[39m
[38;5;12m- [39m[38;5;14m[1mTIDoS Framework[0m[38;5;12m (https://github.com/0xInfection/TIDoS-Framework) - The Offensive Manual Web Application Penetration Testing Framework.[39m

[38;2;255;187;0m[4mExploits[0m

[48;2;30;30;40m[38;5;13m[3mExploits that use Scapy. This does not count the ones included by default[0m

[38;5;12m2022[39m

[38;5;12m- [39m[38;5;14m[1mCVE-2021-28444[0m[38;5;12m (http://blog.champtar.fr/VLAN0_LLC_SNAP) - Windows Hyper-V Security Feature Bypass Vulnerability.[39m

[38;5;12m2021[39m

[38;5;12m- [39m[38;5;14m[1mCVE-2021-24086[0m[38;5;12m (https://blog.quarkslab.com/analysis-of-a-windows-ipv6-fragmentation-vulnerability-cve-2021-24086.html) - Analysis of a Windows IPv6 Fragmentation Vulnerability.[39m
[38;5;12m- [39m[38;5;14m[1mfragattacks[0m[38;5;12m (https://github.com/vanhoefm/fragattacks) - Fragmentation & Aggregation Attacks.[39m

[38;5;12m2020[39m

[38;5;12m- [39m[38;5;14m[1mCVE-2020-25577[0m[38;5;12m (https://blog.quarkslab.com/bad-neighbor-on-freebsd-ipv6-router-advertisement-vulnerabilities-in-rtsold-cve-2020-25577.html) - Bad Neighbor on FreeBSD: IPv6 Router Advertisement Vulnerabilities in rtsold.[39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mCVE-2020-16898[0m[38;5;12m [39m[38;5;12m(https://blog.quarkslab.com/beware-the-bad-neighbor-analysis-and-poc-of-the-windows-ipv6-router-advertisement-vulnerability-cve-2020-16898.html)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mBeware[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mBad[39m[38;5;12m [39m[38;5;12mNeighbor:[39m[38;5;12m [39m[38;5;12mAnalysis[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mPoC[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mWindows[39m[38;5;12m [39m[38;5;12mIPv6[39m[38;5;12m [39m[38;5;12mRouter[39m[38;5;12m [39m
[38;5;12mAdvertisement[39m[38;5;12m [39m[38;5;12mVulnerability.[39m

[38;5;12m2019[39m
[38;5;12m- [39m[38;5;14m[1mCVE-2019-5597[0m[38;5;12m (https://www.synacktiv.com/ressources/Synacktiv_OpenBSD_PacketFilter_CVE-2019-5597_ipv6_frag.pdf) - IPv6 fragmentation vulnerability in OpenBSD Packet Filter.[39m

[38;5;12m2018[39m

[38;5;12m- [39m[38;5;14m[1mCVE-2018-4407[0m[38;5;12m (https://github.com/r3dxpl0it/CVE-2018-4407) - A heap buffer overflow in the networking code in the XNU operating system kernel (iOS and macOS).[39m

[38;5;12m2017[39m
[38;5;12m- [39m[38;5;14m[1mkrackattacks-scripts[0m[38;5;12m (https://github.com/vanhoefm/krackattacks-scripts) - Test if clients or access points (APs) are affected by the KRACK attack against WPA2.[39m

[38;5;12m2016[39m
[38;5;12m- [39m[38;5;14m[1mCVE-2016-6366[0m[38;5;12m (https://github.com/RiskSense-Ops/CVE-2016-6366) - The EXTRABACON exploit, a remote code execution for Cisco ASA written by the Equation Group (NSA) and leaked by the Shadow Brokers.[39m

[38;5;12mMisc[39m
[38;5;12m- [39m[38;5;14m[1misf[0m[38;5;12m (https://github.com/dark-lbp/isf) - ISF (Industrial Control System Exploitation Framework). A suite that provides exploits various industrial protocols.[39m

