Spoofing ICMP Echo Request with scapy

Scapy is a powerful packet generator. Here's a quick example how to spoof an ICMP Echo Request packet with Scapy.

# scapy

Welcome to Scapy (2.1.0)

>>> ip=IP()

>>> ip.src='192.168.0.255'

>>> ip.dst='192.168.0.1'

>>> ip.display

<bound method IP.display of <IP src=192.168.0.255 dst=192.168.0.1 |>>

>>> icmp=ICMP()

>>> icmp.type=8

>>> icmp.code=0

>>> icmp.display

<bound method ICMP.display of <ICMP  type=echo-request code=0 |>>

>>> send(ip/icmp)

.

Sent 1 packets.

>>>

ICMP Parameters

A quick revision on the ICMP type (for reference).

Commonly used ICMP types and codes:

• 0, 0 - echo reply
• 8, 0 - echo request
• 3, 0 - dest. unreachable: network
• 3, 1 - dest. unreachable: host
• 3, 2 - dest. unreachable: protocol
• 3, 3 - dest. unreachable: port
• 3, 4 - dest. unreachable: frag needed and DF was set
• 13, 0 - timestamp request
• 14, 0 - timestamp reply
• 15, 0 - info request
• 16, 0 - info reply
• 17, 0 - mask request
• 18, 0 - mask reply

For the full list, please refer to IANA site.

WiFi at Airport

You're sitting in an airport or in a cafe, and they provide WiFi access with some fees. However, they do allow ICMP or DNS traffic, though for free. What can you do?

The answer is tunneling: IP-over-ICMP or IP-over-DNS.

Check this out to get yourself ready for this situation:

• ICMPTX
• NSTX