代码如下：
1 #coding=utf-8 2 3 import os 4 import sys 5 import subprocess 6 from scapy.all import * 7 8 9 RSN = 48 #管理帧信息元素（Dot11Elt)ID48是RSN信息 10 WPA = 221 #管理帧信息元素ID221是WPA信息 11 Dot11i = {0:'GroupCipher', 12 1:'WEP-40', 13 2:'TKIP', 14 4:'CCMP', 15 5:'WEP-104' 16 } #RSN信息的第6字节 17 WPA_Auth = {1:'802.11x/PMK', 18 2:'PSK' 19 } #RSN信息的第22字节 20 DN = open(os.devnull,'w') 21 22 def get_wlan_interfaces(): 23 ''' 24 返回当前PC上所有的无线网卡以及网卡所处的模式 25 ''' 26 interfaces = {'monitor':[],'managed':[],'all':[]} 27 proc = subprocess.Popen(['iwconfig'],stdout=subprocess.PIPE,stderr=DN) 28 lines = proc.communicate()[0].split(' ') 29 for line in lines: 30 if line: 31 if line[0] != ' ': 32 iface = line.split(' ')[0] 33 if 'Mode:Monitor' in line: 34 interfaces['monitor'].append(iface) 35 if 'IEEE 802.11' in line: 36 interfaces['managed'].append(iface) 37 interfaces['all'].append(iface) 38 if len(interfaces['managed']) == 0: 39 sys.exit('[!]没有无线网卡，请插入网卡') 40 return interfaces 41 42 interfaces = get_wlan_interfaces() #获取当前的无线网卡 43 44 def get_strongest_inface(): 45 ''' 46 通过iwlist dev scan命令，根据无线网卡可获取到的AP数量来判断哪个网卡的功率最强 47 ''' 48 iface_APs = [] 49 #interfaces = get_wlan_interfaces() 50 for iface in interfaces['managed']: 51 count = 0 52 if iface: 53 proc = subprocess.Popen(['iwlist',iface,'scan'],stdout=subprocess.PIPE,stderr=DN) 54 lines = proc.communicate()[0].split(' ') 55 for line in lines: 56 if line: 57 if '- Address:' in line: 58 count += 1 59 iface_APs.append((count,iface)) 60 interface = max(iface_APs)[1] 61 return interface 62 63 def start_monitor_mode(): 64 ''' 65 通过airmon-ng工具将无线网卡启动为监听状态 66 ''' 67 if interfaces['monitor']: 68 print '[*]监听网卡为：%s' % interfaces['monitor'][0] 69 return interfaces['monitor'][0] 70 interface = get_strongest_inface() 71 print '[*]网卡%s开启监听模式...' % interface 72 try: 73 os.system('/usr/sbin/airmon-ng start %s' % interface) 74 moni_inface = get_wlan_interfaces()['monitor'] 75 print '[*]监听网卡为：%s' % moni_inface[0] 76 return moni_inface 77 except: 78 sys.exit('[!]无法开启监听模式') 79 80 def get_AP_info(pkt): 81 ''' 82 从Dot11数据包中获取AP的SSID，BSSID，chanle，加密等信息 83 ''' 84 AP_info = {} 85 bssid = pkt[Dot11][Dot11Elt].info 86 ssid = pkt[Dot11].addr2 87 chanle = str(ord(pkt[Dot11][Dot11Elt][:3].info)) 88 AP_infos = [bssid,chanle] 89 wpa_info,cipher_info = get_Dot11_RSN(pkt) 90 if wpa_info and cipher_info: 91 AP_infos = AP_infos + [wpa_info,cipher_info] 92 AP_info[ssid]=AP_infos 93 return AP_info 94 95 APs_info = {} 96 def get_APs_info(pkt): 97 global APs_info 98 if pkt.haslayer(Dot11) and (pkt.haslayer(Dot11Beacon) or pkt.haslayer(Dot11ProbeResp)): 99 AP_info = get_AP_info(pkt) 100 101 if not APs_info.has_key(AP_info.keys()[0]): 102 APs_info.update(AP_info) 103 return APs_info 104 105 106 already_shows = [] 107 def show_APs_info(pkt): 108 global already_shows 109 APs_info = get_APs_info(pkt) 110 for (key,value) in APs_info.items(): 111 if key not in already_shows: 112 already_shows.append(key) 113 print '-' * 40 114 print ' [+]AP的BSSID：%s' % value[0] 115 print ' [+]AP的SSID：%s' % key 116 print ' [+]AP当前的chanle:%s' % value[1] 117 if len(value) == 4: 118 print ' [+]AP的认证方式为：%s' % value[2] 119 print ' [+]AP的加密算法为：%s' % value[3] 120 else: 121 print ' [+]开放验证！！' 122 print '-' * 40 123 124 def get_Dot11_RSN(pkt): 125 ''' 126 从Beacon帧以及ProbeResponse帧获取cipher及auth信息 127 ''' 128 ssid = pkt[Dot11].addr2 129 len_Elt = len(pkt[Dot11Elt].summary().split('/')) 130 #print pkt.show() 131 for i in range(len_Elt): 132 if pkt[Dot11Elt][i].ID == RSN: 133 try: 134 RSN_info = hexstr(pkt[Dot11Elt][i].info) 135 cipher_index = RSN_info.find('ac') #第一个00 0f ac 02中的‘02’代表cipher 136 auth_index = RSN_info.rfind('ac') #从后往前数第一个00 0f ac 02中的‘02’代表AUTH 137 cipher_num = int(RSN_info[(cipher_index + 3):(cipher_index + 5)]) 138 auth_num = int(RSN_info[(auth_index + 3):(auth_index + 5)]) 139 for key,value in Dot11i.items(): 140 if cipher_num == key: 141 cipher_info = value 142 for key,value in WPA_Auth.items(): 143 if auth_num == key: 144 wpa_info = value 145 #print wpa_info,cipher_info 146 return wpa_info,cipher_info 147 except: 148 pass 149 return None,None 150 151 152 153 154 155 def sniffering(interface,action): 156 ''' 157 嗅探5000个数据包 158 ''' 159 print '[*]附近AP信息如下：' 160 sniff(iface=interface,prn=action,count=5000,store=0) 161 162 163 def main(): 164 moni_inface = start_monitor_mode() 165 sniffering(moni_inface, show_APs_info) 166 167 if __name__ == '__main__': 168 main() 169
运行结果如下：
1 # python test_sniff.py 2 WARNING: No route found for IPv6 destination :: (no default route?) 3 [*]监听网卡为：wlan1mon 4 [*]附近AP信息如下： 5 ---------------------------------------- 6 [+]AP的BSSID：100msh-XXX 7 [+]AP的SSID：84:82:f4:xx:xx:xx 8 [+]AP当前的chanle:11 9 [+]开放验证！！ 10 ---------------------------------------- 11 ---------------------------------------- 12 [+]AP的BSSID：��¡���� 13 [+]AP的SSID：d0:c7:c0:xx:xx:xx 14 [+]AP当前的chanle:11 15 [+]AP的认证方式为：PSK 16 [+]AP的加密算法为：CCMP 17 ---------------------------------------- 18 ---------------------------------------- 19 [+]AP的BSSID：FAST_XXX 20 [+]AP的SSID：78:eb:14:xx:xx:xx 21 [+]AP当前的chanle:11 22 [+]AP的认证方式为：PSK 23 [+]AP的加密算法为：CCMP 24 ---------------------------------------- 25 ---------------------------------------- 26 [+]AP的BSSID：FAST_XXX 27 [+]AP的SSID：0c:72:2c:xx:xx:xx 28 [+]AP当前的chanle:11 29 [+]AP的认证方式为：PSK 30 [+]AP的加密算法为：CCMP 31 ---------------------------------------- 32 ---------------------------------------- 33 [+]AP的BSSID：XXX 34 [+]AP的SSID：80:81:10:xx:xx:xx 35 [+]AP当前的chanle:8 36 [+]AP的认证方式为：PSK 37 [+]AP的加密算法为：TKIP 38 ---------------------------------------- 39 ---------------------------------------- 40 [+]AP的BSSID：XXX 41 [+]AP的SSID：80:81:10:xx:xx:xx 42 [+]AP当前的chanle:8 43 [+]AP的认证方式为：PSK 44 [+]AP的加密算法为：TKIP 45 ---------------------------------------- 46 ---------------------------------------- 47 [+]AP的BSSID：360免费WiFi-44 48 [+]AP的SSID：24:05:0f:xx:xx:xx 49 [+]AP当前的chanle:11 50 [+]AP的认证方式为：PSK 51 [+]AP的加密算法为：CCMP 52 ----------------------------------------