Passive fingerprinting

.gitignore

@@ -102,3 +102,15 @@ venv.bak/
 
 # mypy
 .mypy_cache/
+
+# Sqlite DB files
+*.db
+
+# VScode Launch.json files
+.vscode/
+
+# Packet Capture Files
+*.pcap
+
+# Python Non Integrated Test
+trial.py

Dockerfile

@@ -1,4 +1,4 @@
-FROM python:2.7-alpine
+FROM python:3.9-alpine
 
 # Shorten common strings
 ARG GH=https://raw.githubusercontent.com
@@ -9,6 +9,7 @@ ADD $GH/nmap/nmap/master/nmap-mac-prefixes              $USR/nmap/nmap-mac-prefi
 ADD $GH/wireshark/wireshark/master/manuf                $USR/wireshark/manuf
 ADD $GH/royhills/arp-scan/master/ieee-oui.txt           $USR/arp-scan/ieee-oui.txt
 ADD $GH/nmap/nmap/master/nmap-service-probes            $USR/nmap/nmap-service-probes
+ADD $GH/p0f/p0f/v2.0.8/p0f.fp                           /etc/p0f/p0f.fp
 
 # tcpdump is needed by scapy to replay pcaps
 RUN apk update && apk add --no-cache tcpdump
@@ -22,8 +23,7 @@ echo 'noenum = [ Resolve(), TCP_SERVICES, UDP_SERVICES ]' >> $HOME/.scapy_startu
 mkdir $HOME/.passer/
 VOLUME $HOME/.passer/
 
-COPY passer.py /passer.py
-COPY passer_lib.py /passer_lib.py
+COPY *.py /
 
 ENTRYPOINT ["python", "/passer.py"]
 

README.md

@@ -18,9 +18,10 @@ glad to update the script.
 ## Installation
 
 ### Requirements
-- Python >=2.4 and <3.0
+- Python >=2.4
 - Python libraries (see [requirements.txt](/requirements.txt))
   - ipaddress
+  - maxminddb-geolite2
   - pytz
   - scapy>=2.4.0
 
@@ -81,12 +82,7 @@ You can then use this script just as you would in any of the examples below. For
 docker run --rm --name=passer -i --init --net=host --cap-add=net_raw activecm/passer -i eth0
 ```
 
-In order to stop passer run:
-
-```bash
-docker stop passer
-```
-
+In order to stop passer, press `Ctrl-C`.
 
 ## Examples
 

analysis/README.md

@@ -0,0 +1,27 @@
+# Analyzing Passer Results
+### Running the program
+If you're working wiwth the source code just cd to the directory of the analyser file and run  
+```Python3 analyzer.py -i <name-of-logfile-to-import>```  
+The file extension does not matter, but the file must be comma separated
+### Filters
+The filter options are listed below. After running the program type ```filter``` followed by any combination of the following  
+- type={TC, TS, UC, US, RO, DN, MA}  
+- ip={127.0.0.1, or whatever} 
+  - set 'ippref=true' to do searches such as 10.0.*
+- ipv={4, 6, 0 for all} 
+- state={open, suspicious, etc...}
+
+example: If you wanted to show all ipv4 addresses that were flagged as suspicious, you would type the following  
+```filter ipv=4 state=suspicious```  
+or to see all TCP clients starting wih address 10.0.0.*  
+```filter type=TC ip=10.0.0 ippref=true```  
+to reset the filters type ```reset``` at the command prompt
+
+### Commands
+- reset --resets the filters  
+- show --shows the results (shrinks to fit on screen)  
+- show-all --shows all results (use with caution)  
+- quit --gracefully exits the program  
+
+### Bugz
+feel free to report bugs or suggestions to [email protected]

analysis/analyzer.py

@@ -0,0 +1,133 @@
+import pandas as pd
+from numpy import sum
+import sys
+
+
+class Options:
+    def __init__(self):
+        self.type = ''
+        self.ip = ''
+        self.state = ''
+        self.port = ''
+        self.ippref = False
+        self.protocol = ''
+        self.ip_version = 0  # 0 == any
+        self.des = ''
+
+    def reset(self):
+        self.type = ''
+        self.ip = ''
+        self.state = ''
+        self.port = ''
+        self.ippref = False
+        self.protocol = ''
+        self.ip_version = 0
+        self.des = ''
+
+
+# TODO: implement buffering for large files?
+def load(filename):
+    df = pd.read_csv(filename, names=['Type', 'IPAddress', 'Port/info', 'State', 'description'],
+                     header=None, error_bad_lines=False)
+    op = (df.State.values == 'open').sum()
+    warnings = (df['description'].str.startswith('Warning')).sum()
+    suspicious = (df.State.values == 'suspicious').sum()
+    n = len(pd.unique(df['IPAddress']))
+    print(len(df), "records,", n, "distinct addresses,", op, "open ports", suspicious, "suspicious entries,", warnings,
+          "warnings")
+    return df
+
+
+# shows every entry in the dataframe as a string. Output can be a lot...
+def show_all(dframe):
+    pd.reset_option('max_columns')
+    sys.stdout.flush()
+    if len(dframe) == 0:  # faster than the builtin .empty function
+        print("Nothing to see here :)")
+        return
+    df_string = dframe.to_string(index=False)
+    print(df_string)
+
+
+def show(dframe):
+    if len(dframe) == 0:  # faster than the builtin .empty function
+        print("Nothing to see here :)")
+        return
+
+    warnings = (dframe['description'].str.startswith('Warning')).sum()
+    suspicious = (dframe.State.values == 'suspicious').sum()
+    n = len(pd.unique(dframe['IPAddress']))
+    print(len(dframe), "records,", n, "distinct addresses,", suspicious, "suspicious entries,", warnings, "warnings")
+
+    print(dframe)
+
+
+def wraper_function(dframe, options):
+    if options.state != '':
+        dframe = dframe.loc[dframe['State'] == options.state]
+
+    if options.port != '':
+        dframe = dframe[dframe['Port/info'].str.contains(options.port, na=False)]
+
+    if options.ip_version == 6:
+        dframe = dframe[dframe['IPAddress'].str.contains(':', na=False)]
+    elif options.ip_version == 4:
+        dframe = dframe[~dframe['IPAddress'].str.contains(':', na=False)]
+
+    if options.type != '':
+        dframe = dframe[dframe['Type'] == (options.type.upper())]
+
+    if options.ippref:
+        dframe = dframe[dframe['IPAddress'].str.startswith(options.ip, na=False)]
+    elif options.ip != '':
+        dframe = dframe[dframe['IPAddress'] == options.ip]
+
+    if options.des != '':
+        dframe = dframe[dframe['description'].str.contains(options.des, na=False)]
+
+    return dframe
+
+# TODO: add sorting and exporting
+if __name__ == '__main__':
+    import argparse
+
+    parser = argparse.ArgumentParser(description='Passer analytics tool.')
+    parser.add_argument('-i', '--logfile', help='file to ingest', required=True, default='', nargs=1)
+    (parsed, unparsed) = parser.parse_known_args()
+    cl_args = vars(parsed)
+    df = load(cl_args['logfile'][0])
+    opts = Options()
+    while True:
+        command = (input('>')).lower()
+        if command[:6] == 'filter':
+            rol = (command[6:]).split()
+            for item in rol:
+                if item[:5] == 'type=':
+                    opts.type = (item[5:]).upper()
+                if item[:5] == 'port=':
+                    opts.port = (item[5:]).upper()
+                if item[:6] == 'state=':
+                    opts.state = item[6:]
+                if item[:4] == 'ipv=':
+                    opts.ip_version = int(item[4:])
+                if item[:3] == 'ip=':
+                    opts.ip = item[3:]
+                if item[:7] == 'ippref=':
+                    if item[7] == 't':
+                        opts.ippref = True
+                    else:
+                        opts.ippref = False
+                if item[:12] == 'description=':
+                    opts.des = item[12:]
+        elif command[:8] == 'show-all':
+            ndf = wraper_function(df, opts)
+            show_all(ndf)
+        elif command[:4] == 'show':
+            ndf = wraper_function(df, opts)
+            show(ndf)
+        elif command == 'reset':
+            opts.reset()
+        elif command == 'quit':
+            exit(0)
+        else:
+            print("Unrecognised command")