Mallory: Transparent TCP and UDP proxy tool

Mallory is a transparent TCP and UDP proxy.It can be used to get at those hard to intercept network streams,assess those tricky mobile web applications, or maybe just pull a prank on your friend.

Mallory is,what to say it is bit of a pain to install if your trying to run the setup other than ubuntu.

List of Dependency for mallory:

• sudo apt-get install mercurial
• sudo apt-get install python-pyasn1
• sudo apt-get install python-netfilter
• sudo apt-get install libnetfilter-conntrack-dev
• sudo apt-get install python2.6-dev
• sudo apt-get install python-setuptools
• sudo easy_install pynetfilter_conntrack
• sudo apt-get install netfilter-extensions-source
• sudo apt-get install libnetfilter-conntrack3-dbg
• sudo apt-get install python-paramiko
• sudo apt-get install python-imaging

The goal is to man in the middle traffic for testing purposes. The ideal setup for Mallory is to have a “LAN” or “Victim” network that Mallory acts as the gateway for. This can be configured within a virtal machine environment using host only network interfaces. The victim virtual machines then configures the Mallory machine as the gateway by manually setting its gateway. The gateway machine will have at least one WAN interface that grants Internet access. The victim network then uses the Mallory gateway to route traffic.

Download Mallory from here: Download

How to grab a IP easily with CommView | IMAGES INCLUDED

Im show you a easy method on how to grab a IP verify easily. Ofcourse you can use cmd and use commands there, but that's more advanced than this(<- in my opinion).

Step 1

Install CommView, You can download it here

Step 2

Open CommView and press the "Start capture"-button.
Also make sure you have the right adapter selected in the list.
Where can I find that button.?

You'll now see alot of IP's, these are all IP's you have connect to you.

Step 3

I will as an example steal the IP from a guy over skype.
Lets call him by pressing "call"

Step 4

The guy don't need to answer, but we gotta do this step fast, because usually they'll deny or w/e. Just do this step as fast as you can.
While you're calling him switch to CommView.
Now you will have press "Bytes"

to see which one those IP's is taken the most bytes, which should be the one you're calling.
Now we got the IP at the top.

Step 5

To copy the IP to your clipboard right on it press Copy -> and then Remote IP Address.

After a few attempts, you will be able to do this very fast.
Usually I always take the IP of someone when speaking over skype, I rename his name with the NAME - IP, so whenever I want to I can DDoS him. Very Useful to me.

what is packet sniffing

Its a cruel irony in information security that many of the features that make using computers easier or more efficient and the tools used to protect and secure the network can also be used to exploit and compromise the same computers and networks. This is the case with packet sniffing.

A packet sniffer, sometimes referred to as a network monitor or network analyzer, can be used legitimately by a network or system administrator to monitor and troubleshoot network traffic. Using the information captured by the packet sniffer an administrator can identify erroneous packets and use the data to pinpoint bottlenecks and help maintain efficient network data transmission.

In its simple form a packet sniffer simply captures all of the packets of data that pass through a given network interface. Typically, the packet sniffer would only capture packets that were intended for the machine in question. However, if placed into promiscuous mode, the packet sniffer is also capable of capturing ALL packets traversing the network regardless of destination.

By placing a packet sniffer on a network in promiscuous mode, a malicious intruder can capture and analyze all of the network traffic. Within a given network, username and password information is generally transmitted in clear text which means that the information would be viewable by analyzing the packets being transmitted.

A packet sniffer can only capture packet information within a given subnet. So, its not possible for a malicious attacker to place a packet sniffer on their home ISP network and capture network traffic from inside your corporate network (although there are ways that exist to more or less “hijack” services running on your internal network to effectively perform packet sniffing from a remote location). In order to do so, the packet sniffer needs to be running on a computer that is inside the corporate network as well. However, if one machine on the internal network becomes compromised through a Trojan or other security breach, the intruder could run a packet sniffer from that machine and use the captured username and password information to compromise other machines on the network.

Detecting rogue packet sniffers on your network is not an easy task. By its very nature the packet sniffer is passive. It simply captures the packets that are traveling to the network interface it is monitoring. That means there is generally no signature or erroneous traffic to look for that would identify a machine running a packet sniffer. There are ways to identify network interfaces on your network that are running in promiscuous mode though and this might be used as a means for locating rogue packet sniffers.

If you are one of the good guys and you need to maintain and monitor a network, I recommend you become familiar with network monitors or packet sniffers such as Ethereal. Learn what types of information can be discerned from the captured data and how you can put it to use to keep your network running smoothly. But, also be aware that users on your network may be running rogue packet sniffers, either experimenting out of curiosity or with malicious intent, and that you should do what you can to make sure this does not happen.

Studying and analyzing sniffed packets:

 It is important to analyze the sniffed packets to a system administrator to protect his network from intruders, different port scanning techniques .although many tools are available to do this work.
               From attackers view it is important to analyze this packets for information gathering, predicting the sequence numbers and building the malformed packets to avoid the ACL’s and firewalls and for DOS attacks.

Here we go

This tutorial is education purpose only

The sniffed packet looks like this

44 45 53 54 00 00 20 53 52 43 00 00 08 00 45 00 28 00 00 40 00 29 06 43 CA C2 01 81
E7 CB 5E FE BE 00 50 04 69 68 04 AE 96 00 14 2A E3 50 11 19 20 42 62 00 00

The entire chunk of data, which totals up to 54 bytes, can be broken down into the following smaller parts:

The MAC address part: this consists of bytes 1 to 14.
The IP address part: this consists of bytes 15 to 34.
The TCP header part: this consists of bytes 35 to 54.

If the captured packet is carrying an icmp message, then instead of having a TCP header part, it will contain fields relating to the ICMP protocol.

The MAC address part: the MAC address part consists of bytes 1 to 14 and stores information about the data transfer’s source and destination IP addresses as well as the protocol used for the transmission of the data packet.
The MAC address part of the above example is the part that reads as follows:
      44 45 53 54 00 00 20 53 52 43 00 00 08 00

•   The first 6 bytes comprise the source MAC address. In this example, the source MAC address is 44 45 53 54 00 00
•   The second six bytes comprise the destination MAC address. In this example
      The destination MAC address is 20 53 52 43 00 00
•   The final two bytes stand for the protocol used to transmit that particular packet. in this case, it value is 08 00, which indicates that the protocol used to transmit the packet is DOD(IP).

The IP header part:

445 00 00 28 00 00 40 00 29 06 43 CA C2 01 81 E7 CB 5E FE BE

The IP header part consists of bytes 15 to 34 and contains various kinds of information, including the following:
•   IP version: IP versions are revealed in the first byte of IP header part, in this case the first bit is 4 so it is IPV4 and the second bit revels the header length. in this case 5

•   Type of service: the type of service indicated by the second byte in the IP header part. In this case the value is 00 in hexadecimal, which in the decimal system is 0.

•   IP data gram length: the third and the fourth byte represents the IP data gram length in this case the values are 00 28.

•   IB number: the fifth and sixth byte contains the packets ID number

•   Fragment offset value: the seventh and the eight byte represent the fragment offset value. This value is used to keep track of each fragment.

•   Time to live value: the ninth byte represents the packet’s TTL value.

•   Type of protocol: the tenth byte contains information about the protocol being used by this particular packet.

•   Checksum value: the eleventh and twelfth bytes stand for the checksum value of the packet, which is needed for data integrity. In this example, 43 CA

•   Source and destination IP addresses: the final eight bytes represents the source and destination ip address, respectively. In this Ex. The source IP address is C2 01 81 E7, and the destination IP address is CB 5E FE BE.

The TCP header part:

00 50 04 69 68 04 AE 96 00 14 2A E3 50 11 19 20 42 62 00 00

•   Source port: the source port is raveled in the first and second bytes of the TCP header part. In this example, the source port is 00 50
•   Destination port: the destination port is revealed in the third and fourth bytes of the TCP header part.
•   Sequence number: bytes 5 to 8 of the TCP header part reveal the sequence number.

•   ACK number: bytes 9 to 12 of the TCP header part reveal the ACK number.
•   Window size: the window size revealed in bytes 15 and 16 of the TCP header part
•   Checksum value: the check sum is revealed in bytes 17 and 18 of the TCP header part.
•    Urgent point: the urgent point is revealed in bytes 19 20 of the TCP header part.