So I'd like to preface this with I'm brand new to python...I'm trying to access values from a complex object. When using a for loop in a for loop I keep getting errors like...
TypeError: object does not support assignment
or
AtributeError: 'str' object has no attribute 'syn'
...which I think are stemming from either assignment to scan.results object in section #1 connect(packet.s or improper construction of classes. In #2 area of the method connect_scan_exist we can see issues accessing value.flags.XX. I think it is due to the way I have constructed the supporting class objects that are utilized in the dictionary.
# determine if a connect scan takes place
def connect_scan_exist(packets):
s = scan()
# 1. grab all TCP syn
for key, value in packets.items():
# add tcp packets with syn that are not already entered
if ( value.packet_type == 'TCP'
and value.source_ip
and value.destination_ip
and value.destination_port
and value.flags.syn
and value.flags.ack == False
and value.flags.rst == False
and value.flags.fin == False):
s.results[str(value.source_ip) + '|'+ str(value.destination_ip) + '|' + str(value.destination_port)] = connect(packet.source_ip, packet.destination_ip, packet.destination_port, True, packet.timestamp, None, None, None, None)
# 2. iterate over all TCP syn looking for matching syn/ack
for skey, svalue in s.results.items():
for key, value in packets.items():
# print(len(value.flags))
if ( value.destination_ip == svalue.source_ip
and value.source_ip == svalue.destination_ip
and value.source_port == svalue.destination_port
# and value.scan_categories.is_null_scan ## <---this one works
and value.flags.syn
and value.flags.ack
and value.flags.rst == False
and value.flags.fin == False
and value.timestamp > svalue.source_syn_time
and svalue.destination_synack is None):
# update scan result with cooresponding syn/ack
s.results[str(value.source_ip) + '|' +
str(value.destination_ip) + '|' +
str(value.destination_port)].destination_synack = True
s.results[str(value.source_ip) + '|'+
str(value.destination_ip) + '|' +
str(value.destination_port)].destination_synack_time = value.timestamp
# 3. iterate over all TCP syn looking for matching ack
for skey, svalue in s.results.items():
for key, value in packets.items():
if ( value.source_ip == svalue.source_ip
and value.destination_ip == svalue.destination_ip
and value.destination_port == svalue.destination_port
and value.flags.syn == False
and value.flags.ack
and value.flags.rst == False
and value.flags.fin == False
and value.timestamp > svalue.source_synack_time
and svalue.source_ack is None):
# update scan result with cooresponding syn/ack
s.results[str(value.source_ip) + '|' +
str(value.destination_ip) + '|' +
str(value.destination_port)].source_ack = True
s.results[str(value.source_ip) + '|'+
str(value.destination_ip) + '|' +
str(value.destination_port)].source_ack_time = value.timestamp
# 4. remove all incomplete ? maybe
# 5. analysis
s.scanfound = (True if (len(s.results) > 10) else False)
s.description = 'Very primative observation. Found more than 10 entries starting with TCP Syn'
return s
# define connect scan class
class connect(object):
def __init__(self, src_ip=None, dst_ip=None, dst_port=None, src_syn=None, src_syn_time=None, dst_synack=None, dst_synack_time=None,
src_ack=None, src_ack_time=None):
self.source_ip = src_ip
self.destination_ip = dst_ip
self.destination_port = dst_port
self.source_syn = src_syn
self.source_syn_time = src_syn_time
self.destination_synack = dst_synack
self.destination_synack_time = dst_synack_time
self.source_ack = src_ack
self.source_ack_time = src_ack_time
# define half open scan class
class scan(object):
def __init__(self, scan=False, desc=None):
self.scanfound = scan
self.description = desc
self.results = dict()
# define generic packet class
class generic_packet(object):
def __init__(self, packet_type=None, time=None, src_mac=None, src=None, src_port=None, dst_mac=None, dst=None,
dst_port=None, seq=None, ack=None, flags=None, options=None, data=None):
self.packet_type = packet_type
self.timestamp = time
self.scan_categories = scan_type()
self.source_mac = src_mac
self.source_ip = src
self.source_port = src_port
self.destination_mac = dst_mac
self.destination_ip = dst
self.destination_port = dst_port
self.sequence = seq
self.acknowledge = ack
self.flags = flags # tcp_flags(flags)
self.options = options
self.data = data
When running the code it looks like some elements of packets are str, not tcp_flags.
You can skip these elements adding this line 186:
if not isinstance(value.flags, tcp_flags):
continue
Or since packets appears to contain TCP and UDP you can check for value.packet_type == 'TCP' in steps #2 and #3. The program is failing on UDP packets which have generic_packet.flags = None so the object has no syn,ack etc in scope.
# determine if a connect scan takes place
def connect_scan_exist(packets):
s = scan()
# 1. grab all TCP syn
for key, value in packets.items():
# add tcp packets with syn that are not already entered
if ( value.packet_type == 'TCP'
and value.source_ip
and value.destination_ip
and value.destination_port
and value.flags.syn
and value.flags.ack == False
and value.flags.rst == False
and value.flags.fin == False):
s.results[str(value.source_ip) + '|'+ str(value.destination_ip) + '|' + str(value.destination_port)] = connect(packet.source_ip, packet.destination_ip, packet.destination_port, True, packet.timestamp, None, None, None, None)
# 2. iterate over all TCP syn looking for matching syn/ack
for skey, svalue in s.results.items():
for key, value in packets.items():
# print(len(value.flags))
if (value.packet_type == 'TCP'
and value.destination_ip == svalue.source_ip
and value.source_ip == svalue.destination_ip
and value.source_port == svalue.destination_port
# and value.scan_categories.is_null_scan ## <---this one works
and value.flags.syn
and value.flags.ack
and value.flags.rst == False
and value.flags.fin == False
and value.timestamp > svalue.source_syn_time
and svalue.destination_synack is None):
# update scan result with cooresponding syn/ack
s.results[str(value.source_ip) + '|' +
str(value.destination_ip) + '|' +
str(value.destination_port)].destination_synack = True
s.results[str(value.source_ip) + '|'+
str(value.destination_ip) + '|' +
str(value.destination_port)].destination_synack_time = value.timestamp
# 3. iterate over all TCP syn looking for matching ack
for skey, svalue in s.results.items():
for key, value in packets.items():
if ( **value.packet_type == 'TCP'**
and value.source_ip == svalue.source_ip
and value.destination_ip == svalue.destination_ip
and value.destination_port == svalue.destination_port
and value.flags.syn == False
and value.flags.ack
and value.flags.rst == False
and value.flags.fin == False
and value.timestamp > svalue.source_synack_time
and svalue.source_ack is None):
# update scan result with cooresponding syn/ack
s.results[str(value.source_ip) + '|' +
str(value.destination_ip) + '|' +
str(value.destination_port)].source_ack = True
s.results[str(value.source_ip) + '|'+
str(value.destination_ip) + '|' +
str(value.destination_port)].source_ack_time = value.timestamp
# 4. remove all incomplete ? maybe
# 5. analysis
s.scanfound = (True if (len(s.results) > 10) else False)
s.description = 'Very primative observation. Found more than 10 entries starting with TCP Syn'
return s