-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy patharpspf_block.py
159 lines (138 loc) · 6.82 KB
/
arpspf_block.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
import requests
import warnings
import re
from datetime import datetime
from datetime import timedelta
warnings.filterwarnings("ignore", message= "Unverified HTTPS request ")
# Import class with SmartZone API calls
#from vSZapi import vSZ_calls
# SmartZone variables
host = 'https://vsz-beta.ruckusdemos.net:8443'
username = "admin"
password = "xxxx"
domain = ".Karthik."
r = requests.Session()
#API version
response = r.get(host + '/wsg/api/public/apiInfo',verify=False).json()
print(response)
api_ver = response['apiSupportVersions'][2]
print(api_ver)
# Initializing global variables
token = None
domainID = None
zoneID = None
ievents=0
iblkmac=0
macpresent=0
pattern = None
#Get time now
currtime = datetime.now()
time3minago = currtime - timedelta(minutes = 3)
time3minago = (currtime - timedelta(minutes = 3)).strftime("%Y-%m-%d %H:%M:%S")
# Instantiate class
#mySmartZone = vSZ_calls()
#Get authentication token
response = r.post(host + '/wsg/api/public/'+ api_ver +'/serviceTicket', json={'username': username, 'password': password}, verify=False).json()
print(response)
serviceTicket = response['serviceTicket']
print(serviceTicket)
szver = response['controllerVersion']
print(szver)
#List Blocklist
blkresponse = r.post(host + '/wsg/api/public/'+ api_ver +'/blockClient/query?serviceTicket=' + serviceTicket, json={'filters': [],'fullTextSearch': {'type': 'AND','value': '','fields': ['eventCode']}},verify=False).json()
print(blkresponse)
totalblocked = blkresponse['totalCount']
print(totalblocked)
#Query Events
querylimit = 3 ##Dummy alert. Change to 100
response = r.post(host + '/wsg/api/public/'+ api_ver +'/alert/event/list?serviceTicket=' + serviceTicket, json={'filters': [],'fullTextSearch': {'type': 'AND','value': '236','fields': ['eventCode']},'sortInfo': {"sortColumn": "insertionTime","dir": "DESC"},"limit":querylimit},verify=False).json()
print(response)
totalevents = response['totalCount']
#Query Domains
domainresponse = r.get(host + '/wsg/api/public/'+ api_ver +'/domains/byName/' + domain + '?serviceTicket=' + serviceTicket, verify=False).json()
print(domainresponse)
domainID = domainresponse['list'][0]['id']
if totalevents==0: #Do not execute while loop
icount = 0
ievents = 1
elif querylimit<totalevents: #100<1-99 = false ; 100<100-infinity = true
icount = querylimit #100-infinity
ievents = 0
print("Found ...", querylimit ," events happened last 3 min. Checking if any packet spoofing events present...")
else:
icount = totalevents #1-99
ievents = 0
print("Found ", totalevents ," events happened last 3 min. Checking if any packet spoofing events present...")
print("total filtered events", icount)
while ievents < icount:
print("iteration", ievents)
eventcode = response['list'][ievents]['eventCode']
eventid = response['list'][ievents]['id']
eventtype = response['list'][ievents]['eventType']
eventtime1 = response['list'][ievents]['insertionTime']
eventtime1 = int(eventtime1/1000)
eventtime2 = datetime.fromtimestamp(eventtime1).strftime("%Y-%m-%d %H:%M:%S")
eventdesc = response['list'][ievents]['activity']
###Dummy values alert
eventtype='Packet spoofing detected'
eventdesc="Packet spoofing detected [[Antispoof]DAI - ARP spoofing detected] from client [F4:96:34:AF:5C:[email protected]] on WLAN [NITT] [wlan32] from AP [RuckusAP@34:20:E3:2D:19:A0]"
###
if eventtime2 < time3minago: ####Dummy alert - Change < to > once dummy testing over
if ((eventtype=='Packet spoofing detected') and (eventdesc.find('ARP spoofing') != -1)):
print("Found recent packet spoofing incidents. Extracting details of offenders...")
#Search for pattern and extract client mac
pattern = "from client \[(.*?)\] on WLAN"
substring1 = re.search(pattern, eventdesc).group(1)
substring2 = substring1.split('@')
clientmac = substring2[0]
#Search for pattern and extract AP mac
pattern = "from AP \[(.*?)\]"
substring1 = re.search(pattern, eventdesc).group(1)
substring2 = substring1.split('@')
apmac = substring2[1]
###Dummy values alert
clientmac="2A:0A:14:F3:55:70"
domainID="cbfb00fb-55ae-4a1d-9921-7be7d4045119"
###
print(clientmac)
print(totalblocked)
if(totalblocked > 0):
while iblkmac < totalblocked:
#if (clientmac == blkresponse['list'][iblkmac]['mac']):
if (clientmac == clientmac): #dummy alert
print(clientmac + "==" + blkresponse['list'][iblkmac]['mac'])
macpresent=1
print("MAC present")
iblkmac=iblkmac+1
if(macpresent != 1):
#Get more info about client - Username, hostname
client_response = r.post(host + '/wsg/api/public/'+ api_ver +'/query/client?serviceTicket=' + serviceTicket, json={'filters': [{"type": "DOMAIN","value": domainID}],'fullTextSearch': {'type': 'AND','value': clientmac},'sortInfo': {"sortColumn": "clientMac","dir": "ASC"},"limit":1},verify=False).json()
if client_response['totalCount']!=0:
udescription = "ARP Spoof User-" + client_response['list'][0]['userName'] + ";Host-" + client_response['list'][0]['hostname'] + ";"
udescription = udescription[:64]
else:
udescription = "ARP Spoof"
#Disconnect client
deauth_response = r.post(host + '/wsg/api/public/'+ api_ver +'/client/deauth?serviceTicket=' + serviceTicket, json={'mac': clientmac,'apMac': apmac},verify=False).json()
#Add client into blacklist
block_response = r.post(host + '/wsg/api/public/'+ api_ver +'/blockClient/byApMac/' + apmac + '?serviceTicket=' + serviceTicket, json={'mac': clientmac, 'description': udescription},verify=False).json()
#Print variables for log
print("")
print("New ARP spoof event occoured from now to 3min ago - Empty")
print("Event iteration:", ievents+1)
print("Event ID: ", eventid)
print("Time: ", eventtime1)
print("Desc: ", eventdesc)
print("Type: ",eventtype)
print("Code: ",eventcode)
print("Client MAC+IP", str(substring2))
print("Client MAC address", clientmac)
print("AP MAC+IP", str(substring2))
print("AP MAC address", apmac)
print(udescription)
print(deauth_response)
print(block_response)
ievents=ievents+1
print()
print("Total events:",totalevents, ", Filtered:", icount, ", Reported/Disconnected/Blocked:", iblkmac )
exit()