Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Packet Proxy Plugins

Plugins for the [packet.proxy](https://github.com/bettercap/bettercap/wiki/packet.proxy) module.
Plugins for the [packet.proxy](https://www.bettercap.org/modules/ethernet/proxies/packet.proxy/) module.

**IMPORTANT**

Expand Down
15 changes: 9 additions & 6 deletions gopacket.example.go
Original file line number Diff line number Diff line change
@@ -1,16 +1,19 @@
package main

import (
"github.com/bettercap/bettercap/log"
"github.com/bettercap/bettercap/v2/log"

"github.com/chifflier/nfqueue-go/nfqueue"
nfqueue "github.com/florianl/go-nfqueue/v2"
"github.com/google/gopacket"
"github.com/google/gopacket/layers"
)

func OnPacket(payload *nfqueue.Payload) int {
packet := gopacket.NewPacket(payload.Data, layers.LayerTypeIPv4, gopacket.Default)
log.Info("%s", packet.Dump())
payload.SetVerdict(nfqueue.NF_ACCEPT)
func OnPacket(queue *nfqueue.Nfqueue, attribute nfqueue.Attribute) int {
if attribute.PacketID != nil {
id := *attribute.PacketID
packet := gopacket.NewPacket(*attribute.Payload, layers.LayerTypeIPv4, gopacket.Default)
log.Info(packet.Dump())
queue.SetVerdict(id, nfqueue.NfAccept)
}
return 0
}
21 changes: 11 additions & 10 deletions tls.downgrade.go
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,12 @@ import (
"net"
"regexp"

"github.com/bettercap/bettercap/log"
"github.com/bettercap/bettercap/packets"
"github.com/bettercap/bettercap/session"
"github.com/bettercap/bettercap/v2/log"
"github.com/bettercap/bettercap/v2/packets"
"github.com/bettercap/bettercap/v2/session"

"github.com/chifflier/nfqueue-go/nfqueue"
"github.com/evilsocket/islazy/tui"
nfqueue "github.com/florianl/go-nfqueue/v2"
"github.com/google/gopacket"
"github.com/google/gopacket/layers"
)
Expand Down Expand Up @@ -71,11 +71,12 @@ func tcpReset(src net.IP, dst net.IP, srcPort layers.TCPPort, dstPort layers.TCP
}

// as per https://p16.praetorian.com/blog/man-in-the-middle-tls-ssl-protocol-downgrade-attack
func OnPacket(payload *nfqueue.Payload) int {
verdict := nfqueue.NF_ACCEPT
func OnPacket(queue *nfqueue.Nfqueue, attribute nfqueue.Attribute) int {
id := *attribute.PacketID
verdict := nfqueue.NfAccept

if clientHelloRe.Match(payload.Data) == true {
packet := gopacket.NewPacket(payload.Data, layers.LayerTypeIPv4, gopacket.Default)
if clientHelloRe.Match(*attribute.Payload) == true {
packet := gopacket.NewPacket(*attribute.Payload, layers.LayerTypeIPv4, gopacket.Default)
ip, tcp, ok := getLayers(packet)
if ip != nil && tcp != nil && ok == true {
log.Warning("[%s] Dropping TLS ClientHello from %s to %s:%d", tui.Green("tls.downgrade"), ip.SrcIP.String(), ip.DstIP.String(), tcp.DstPort)
Expand All @@ -85,14 +86,14 @@ func OnPacket(payload *nfqueue.Payload) int {
log.Error("Error sending FIN+ACK packet: %s", err)
} else {
log.Debug("Sent %d bytes of FIN+ACK packet", len(raw))
verdict = nfqueue.NF_DROP
verdict = nfqueue.NfDrop
}
} else {
log.Error("Error creating FIN+ACK packet: %s", err)
}
}
}

payload.SetVerdict(verdict)
queue.SetVerdict(id, verdict)
return 0
}