devoinc / pcraft

pCraft is a PCAP Crafter, which creates a PCAP from an AMI scenario.

pCraft

pCraft is a PCAP Crafter, which creates a PCAP from an AMI scenario.

When generating data for testing, it is rather hard to do for the following reasons:

• Lack of consistency between clients and servers
• Make sure no personal data leaks
• Consistency across different services.
• Keeping timing right
• etc.

This program helps solving this problem, one simply creates a script in AMI and the program outputs a PCAP.

AMI?

AMI is a language that was designed to build highly readable scenarios to generate PCAPs. It is a C library with C++ bindings generating the Python bindings used by pcraft.

You can find more documentation on AMI with the Programming with AMI guide.

Creating a Hello World script

Create a file called "hello.ami", we want to add the following content:

ami_version 1

action Generate_a_new_domain {
  exec GenerateNewDomain
}

sleep 3

repeat 3 as $index {
       action dns {
       	      exec DNSConnection
       }
       sleep 0.2
}

sleep 0.3

Now execute the pcraft program:

pcrafter hello.ami hello.pcap

Let's read the result pcap using tshark:

$ tshark -r hello.pcap 
    1   0.000000 192.168.127.116 ? 1.1.1.1      DNS 83 Standard query 0x0000 A alice-kaleidoscopes.com
    2   0.000000      1.1.1.1 ? 192.168.127.116 DNS 122 Standard query response 0x0000 A alice-kaleidoscopes.com A 10.81.21.0
    3   0.200000 192.168.34.135 ? 1.1.1.1      DNS 83 Standard query 0x0000 A alice-kaleidoscopes.com
    4   0.200000      1.1.1.1 ? 192.168.34.135 DNS 122 Standard query response 0x0000 A alice-kaleidoscopes.com A 10.171.215.203
    5   0.400000 192.168.234.128 ? 1.1.1.1      DNS 83 Standard query 0x0000 A alice-kaleidoscopes.com
    6   0.400000      1.1.1.1 ? 192.168.234.128 DNS 122 Standard query response 0x0000 A alice-kaleidoscopes.com A 10.0.8.113

Writing a Scenario

Please look at the documentation on this topic to understand more about the engine: "Writing a Scenario".

Available Plugins

The Plugins documentation is generated from themselves: Plugins Documentation

pcraft's Issues

Domain generator indexing off by one

pCraft/pcraft/plugins/GenerateNewDomain.py

Line 34 in 089bac6

word1_idx = random.randint(1,len(words))

pCraft/pcraft/plugins/GenerateNewDomain.py

Line 35 in 089bac6

word2_idx = random.randint(1,len(words))

Problem: In a 100-line wordlist, this indexes lines 1 though 100. It should index 0 through 99. As written, when 100 is chosen, the function fails.
Recommended fix:

word1_idx = random.randint(0,len(words)-1)
word2_idx = random.randint(0,len(words)-1)

Feature request: Ability to append to existing log output

Feature request: Ability to append to existing log output

Currently if the log output folder exists pcraft will either fail (no flag provided) or clobber the directory (-f flag provided).

To facilitate generating logs at volume (or generating a scenario) having a "-a" flag to allow appending to existing output log files would be beneficial.

GenerateNewDomain plugin fails inside Docker Container

I am dealing with the following issue inside a docker container running pcraft:

I can ping 8.8.8.8 and other ips just fine. Also, the rest of the plugins work fine, but the GenerateNewDomain one is having the issues displayed in the image.

ip.cidr option to avoid having 0 and 255

When we lookup over the ip.cidr function we can have 0 and 255 suffix. Let's have an option to avoid this.

Inserting an existing pcap in a scenario

Would it possible to add an existing pcap in a scenario? The idea is to write a scenario with a lot of traffics and you have already a specific crafted pcap. The inserted pcap would be with the same timestamp of the scenario. I suppose PcapImport would do the job but just wondering if the timestamp are modified accordingly the scenario.

Bug in tcp session tracker

if you try to generate a raw tcp stream, using the tracker, than there is an off by one created by the special needs for SYN and FIN flags.

class: Session
file: pcraft/Sessionizer.py

I will upload a patch soon

Improve variables vs field variables

field["var"] is confusing with $var; As we sometimes need a variable that contains a space, it could be a better idea to have variables made this way:
$"var with space"
this would avoid having to use the keyword field["var with space"]

Building pCraft (main or ami2?)

I was wondering what's the branch to use for building pCraft main or ami2? and if there is an install documentation somewhere.

I could build ami but after installing the following requirements:

• pybind11
• libcsv
• libavro23

and the install of the Python package seems not possible with pip3. It would be super cool to have a small documentation for the installation process.