PL - SSI Mon SYN, tu l'aimes et tu l'acquittes en-us Thu, 05 Apr 2007 00:00:00 +0200 <![CDATA[N800 with scapy and metasploit]]> N800 with scapy and metasploit

Thanks to the python package provided by the Maemo “Extras” repository and to the osso-xterm provided by the Maemo-Hackers repository, I have had scapy running on my Nokia N800 for a while.

I have seen that some people had the Metasploit Framework running, thanks to an unreleased Ruby package.

As there is a Ruby file with mud-builder, I have built a Ruby package (you can get it here if you are too lazy to build it yourself) for N800, and… that’s it. Just get Metasploit, and run msfcli from an xterm, it works.

As it’s not that easy to work with an xterm on the N800 (as on any pocket-sized device), we really need a GUI. For metasploit, one could think of using msfweb plus the integrated web browser. But msfweb does not work for now (needs at least RubyGems and Rails).

Thu, 05 Apr 2007 00:00:00 +0200 <![CDATA[msfweb on N800]]> msfweb on N800

As I said earlier, I wanted to have msfweb (the Metasploit Framework web interface) running on my N800, because it could be far more easy to use on that kind of devices. Finally it works!

First of all, install Metasploit (read this).

Then, you “only” need to get RubyGems (you can try my package), and get gem files for Rails and its dependencies (you’ll find the whole set here). Install each dependency, then Rails itself (run “gem install package-version.gem”).

You should be able to run from an xterm (in the directory where you’ve put Metasploit) the command ./msfweb.

It’s a bit slow to start, but it seems to work:

../../../_images/screenshot-2007-04-10-16-11-11.png ]]>
Tue, 10 Apr 2007 00:00:00 +0200 <![CDATA[Metasploit Automated Exploitation on N800]]> Metasploit Automated Exploitation on N800

As suggested by spaceaquarium, I’ve tried to get Metasploit Automated Exploitation (one of the killer features of Metasploit Framework 3) working on my N800. And that’s easy.


Wed, 11 Apr 2007 00:00:00 +0200 <![CDATA[Scapext: Scapy Extended]]> Scapext: Scapy Extended

Scapy is a great tool for network packets manipulation (sniff, dissect, create, send,…).

When I use this tool, I feel some features miss. So I have written an extension (called Scapext) that, for now, includes:

  • GeoIP support (through Maxmind GeoIP Python API). This is faster than the method used in Scapy for now, and easier.
  • PFLog pcap type (used by the OpenBSD Packet Filter to log packets; this allows PF to store valuable information on what happened to the packets logged).
  • Early SunRPC support with state handling.

Interested? See my posts about Scapy.

Wed, 11 Apr 2007 00:00:00 +0200 <![CDATA[Scapy: using p0f]]> Scapy: using p0f

I’ve recently released a not-yet-applied patch for scapy which improves the use of p0f functionalities.

First, p0f now comes with databases designed for other TCP packets than only SYN packets (one database for SYN/ACK packets, one for RST and RST/ACK packets, and the last one for “stray” ACK packets). Those new databases are slightly different than the original one, and an effort was required to enable scapy’s p0f functions to use them.


Sun, 13 Jan 2008 00:00:00 +0100 <![CDATA[Le #fail de l’ANSSI / IGC/A / MINEFI (ce que j’en comprends)]]> Le #fail de l’ANSSI / IGC/A / MINEFI (ce que j’en comprends)

Ce billet reprend les éléments “publiés” sur pastee pour répondre à une question de @sandrinecassini (elle promettait un verre, il ne m’en fallait pas plus).


Wed, 11 Dec 2013 00:00:00 +0100 <![CDATA[Présentation de TorPylle]]> Présentation de TorPylle

Comme j’aime bien l’analyse de protocoles réseau, je me suis intéressé au protocole Tor, dont le logiciel Tor est la seule implémentation à ma connaissance. Et comme j’aime bien Scapy, j’ai commencé à écrire une implémentation du protocole Tor en Scapy, TorPylle (annoncée ici et il y a quelques temps déjà, et publiée sur GitHub et BitBucket).


Sat, 18 Jan 2014 00:00:00 +0100 <![CDATA[IPSec dans Scapy]]> IPSec dans Scapy

Un billet rapide pour mentionner l’arrivée dans Scapy de la prise en charge d’IPSec.

Œuvre de Robin Jarry (6WIND), cette contribution importante est, au delà de l’intérêt évident de ce qu’elle implémente, un modèle pour les personnes souhaitant contribuer à Scapy :

  • Le code est très propre et bien documenté ;
  • Le module vient avec ses tests ;
  • Le texte qui décrit la pull-request est très clair et détaillé.

Bref, merci et bravo à Robin !

Fri, 20 Jun 2014 00:00:00 +0200 <![CDATA[(Active) network recon with IVRE]]> (Active) network recon with IVRE

Let’s see how to use IVRE to dig some Nmap scan results.

I’ll assume you have (successfully) installed Docker and followed the instructions in the IVRE documentation about Docker.

You should now have two running containers (ivredb and ivreweb) and one ready to run (ivreclient). The database has been initialized from the client (the --init commands in the documentation).


Fri, 12 Sep 2014 00:00:00 +0200 <![CDATA[Scapy 2.3.1 is out, Merry Christmas!]]> Scapy 2.3.1 is out, Merry Christmas!

After the release of Scapy 2.3.0 just a few days ago, Guillaume Valadon figured out we actually needed some more fixes (PR 88 & PR 89).

After some work, Scapy 2.3.1 is out, with some good news (read Guillaume’s e-mail announcing Scapy 2.3.0 for a non-exhaustive list), including Robin Jarry’s excellent work to add IPSec support (FR).

You can download the release from Bitbucket (ZIP).

If you are a package maintainer for a Linux distribution, please consider updating Scapy to 2.3.1.


Tue, 23 Dec 2014 00:00:00 +0100 <![CDATA[Scanning Internet-exposed Modbus devices for fun & fun]]> Scanning Internet-exposed Modbus devices for fun & fun

There is a French expression that says (translation is mine) “you don’t shoot at an ambulance”. Well, I do. Shooting at ambulances is fun. Plus it has a lot of advantages:

  • It’s less risky than shooting at a tank.
  • As my friend Renzo likes to say, ambulances are easy to spot in the jungle and they bear cross-shaped targets.
  • There are often other easy targets hanging around (casualties, doctors, etc.).

Anyway, here is a scan I have run against the whole IPv4 address space, looking for Internet-exposed Modbus services.


Tue, 24 Feb 2015 00:00:00 +0100 <![CDATA[Mining public keys with IVRE]]> Mining public keys with IVRE


In my previous post I explain how I have run a scan against Internet-exposed Modbus-enabled devices, and share the results obtained.

I have been asked several times why had I chosen to run a Zmap + Nmap scan instead of a Zmap + Zgrab, which would have been a lot faster.

Here is my answer: I wanted to scan the other services running on the Modbus-enabled devices, because:

  • They tells a lot about the device behind the IP address (the screenshots is a feature I really like, but anonymous FTP file listing is also great, for example)
  • They often show intersting weaknesses.


Fri, 06 Mar 2015 00:00:00 +0100 <![CDATA[IVRE: new (cool) features]]> IVRE: new (cool) features

Long time no post… so here is a Prévert-style inventory of some recent IVRE’s features.


Wed, 01 Jul 2015 00:00:00 +0200 <![CDATA[Un job passionnant dans une équipe fun]]> Un job passionnant dans une équipe fun

Le CEA va recruter, pour son labo de SSI au moins deux ingénieurs-chercheurs.

Les activités sont très variées et couvrent de très nombreux domaines techniques de la sécurité des systèmes d’information (tests d’intrusion, détection et recherche d’intrusions, recherche et développement, etc.).

Plus d’infos dans le post LinkedIn correspondant. Contactez-moi !

Sun, 19 Jul 2015 00:00:00 +0200 <![CDATA[IVRE has a new home!]]> IVRE has a new home!

Together with a new logo, IVRE now has its own website:!

By the way, we have a demonstration instance there which is only accessible with an account. Just e-mail us to get an access! It runs the latest version from the repository, using Docker images.

For the record, the original domain ( has been deleted (after a one day notice!) because Afnic (who handles .re) discovered that the domain validity check for .re was broken and should not have allowed such a domain.

Wed, 12 Aug 2015 00:00:00 +0200 <![CDATA[IVRE: screenshot all the things!]]> IVRE: screenshot all the things!
The title of this blog comes from a nice article from 2014 named Scan Internet and Screenshot all the things

Some people have been asking us how the screenshots published with the Internet-wide Modbus scan had been taken.

Truth is, there was nothing to be proud of, and nothing worth publishing. As an example, I used a PhantomJS script to screenshot a Web-based RDP client…

But there are some great news: four Nmap scripts are now integrated to IVRE to take screenshots, and handle four different protocols.


Tue, 25 Oct 2016 00:00:00 +0200 <![CDATA[IVRE v0.9.13 release]]> IVRE v0.9.13 release

IVRE version 0.9.13 has been released, and is available on Github, PyPI and AUR.


The most notable changes since version 0.9.12 include:

  • Support for JA3 fingerprints and User-Agent values in view (Vincent Ruello)
  • IPv6 support:
    • in utils.get_addr_type() (Vivien Venuti)
    • DNS (AAAA) answers in passive (Angélique Baille)
  • Support DNS blacklist answers in passive (Marion Lafon)


Tue, 25 Jun 2019 00:00:00 +0200 <![CDATA[IVRE v0.9.14 release]]> IVRE v0.9.14 release

IVRE version 0.9.14 has just been released (three months after version 0.9.13), and is available on Github, PyPI and AUR.


The most notable changes since version 0.9.13 include:

  • Support for the MongoDB backend in flow (Vincent Ruello); the Neo4j backend is now deprecated and will be dropped in a near future.
  • Support for an experimental Elasticsearch backend in view (Angélique Baille); while it is far from comprehensive for now, it is enough to store view data in an Elasticsearch database and access if from other Elasticsearch-based tools, such as Kibana (the documentation already has a section IVRE with Kibana covering this; see also the screenshots).
  • IPv6 support in DNS blacklist answers (Olivier Croquin).


Wed, 25 Sep 2019 00:00:00 +0200 <![CDATA[IVRE v0.9.15 ‘lockdown’ release]]> IVRE v0.9.15 ‘lockdown’ release

IVRE version 0.9.15 has just been released (seven months after version 0.9.14), and is available on Github, PyPI and AUR.

Thanks a lot to the contributors!


The most notable changes since version 0.9.14 include:

  • Support for ZGrab2 (HTTP) & ZDNS results.
  • Improve Masscan integration (particularly with IVRE’s fork).
  • Improve Nmap fingerprints handling (for Masscan & Zgrab2 results).
  • Handle MAC addresses (in nmap, view and passive purposes).
  • Add TinyDB support (you can test IVRE without a database server!).
  • Add ivre auditdom tool (AXFR tests).


Sat, 25 Apr 2020 00:00:00 +0200