用python编写的无线AP扫描器

代码如下：

 #coding=utf-8

 import os
 import sys
 import subprocess
 from scapy.all import *

 RSN = 48    #管理帧信息元素（Dot11Elt)ID48是RSN信息
 WPA = 221   #管理帧信息元素ID221是WPA信息
 Dot11i = {0:'GroupCipher',
           1:'WEP-40',
           2:'TKIP',
           4:'CCMP',
           5:'WEP-104'
           } #RSN信息的第6字节
 WPA_Auth = {1:'802.11x/PMK',
             2:'PSK'
            } #RSN信息的第22字节
 DN = open(os.devnull,'w')

 def get_wlan_interfaces():
     '''
     返回当前PC上所有的无线网卡以及网卡所处的模式
     '''
     interfaces = {'monitor':[],'managed':[],'all':[]}
     proc = subprocess.Popen(['iwconfig'],stdout=subprocess.PIPE,stderr=DN)
     lines = proc.communicate()[0].split('\n')
     for line in lines:
         if line:
             if line[0] != ' ':
                 iface = line.split(' ')[0]
                 if 'Mode:Monitor' in line:
                     interfaces['monitor'].append(iface)
                 if 'IEEE 802.11' in line:
                     interfaces['managed'].append(iface)
                 interfaces['all'].append(iface)
     if len(interfaces['managed']) == 0:
         sys.exit('[!]没有无线网卡，请插入网卡')
     return interfaces

 interfaces = get_wlan_interfaces()  #获取当前的无线网卡

 def get_strongest_inface():
     '''
     通过iwlist dev scan命令，根据无线网卡可获取到的AP数量来判断哪个网卡的功率最强
     '''
     iface_APs = []
     #interfaces = get_wlan_interfaces()
     for iface in interfaces['managed']:
         count = 0
         if iface:
             proc = subprocess.Popen(['iwlist',iface,'scan'],stdout=subprocess.PIPE,stderr=DN)
             lines = proc.communicate()[0].split('\n')
             for line in lines:
                 if line:
                     if '- Address:' in line:
                         count += 1
             iface_APs.append((count,iface))
     interface = max(iface_APs)[1]
     return interface

 def start_monitor_mode():
     '''
     通过airmon-ng工具将无线网卡启动为监听状态
     '''
     if interfaces['monitor']:
         print '[*]监听网卡为：%s' % interfaces['monitor'][0]
         return interfaces['monitor'][0]
     interface = get_strongest_inface()
     print '[*]网卡%s开启监听模式...' % interface
     try:
         os.system('/usr/sbin/airmon-ng start %s' % interface)
         moni_inface = get_wlan_interfaces()['monitor']
         print '[*]监听网卡为：%s' % moni_inface[0]
         return moni_inface
     except:
         sys.exit('[!]无法开启监听模式')

 def get_AP_info(pkt):
     '''
     从Dot11数据包中获取AP的SSID，BSSID，chanle，加密等信息
     '''
     AP_info = {}
     bssid = pkt[Dot11][Dot11Elt].info
     ssid = pkt[Dot11].addr2
     chanle = str(ord(pkt[Dot11][Dot11Elt][:3].info))
     AP_infos = [bssid,chanle]
     wpa_info,cipher_info = get_Dot11_RSN(pkt)
     if wpa_info and cipher_info:
         AP_infos = AP_infos + [wpa_info,cipher_info]
     AP_info[ssid]=AP_infos
     return AP_info

 APs_info = {}
 def get_APs_info(pkt):
     global APs_info
     if pkt.haslayer(Dot11) and (pkt.haslayer(Dot11Beacon) or pkt.haslayer(Dot11ProbeResp)):
         AP_info = get_AP_info(pkt)

         if not APs_info.has_key(AP_info.keys()[0]):
             APs_info.update(AP_info)
     return APs_info

 already_shows = []
 def show_APs_info(pkt):
     global already_shows
     APs_info = get_APs_info(pkt)
     for (key,value) in APs_info.items():
         if key not in already_shows:
             already_shows.append(key)
             print '-' * 40
             print ' [+]AP的BSSID：%s' % value[0]
             print ' [+]AP的SSID：%s' % key
             print ' [+]AP当前的chanle:%s' % value[1]
             if len(value) == 4:
                 print ' [+]AP的认证方式为：%s' % value[2]
                 print ' [+]AP的加密算法为：%s' % value[3]
             else:
                 print ' [+]开放验证！！'
             print '-' * 40

 def get_Dot11_RSN(pkt):
     '''
     从Beacon帧以及ProbeResponse帧获取cipher及auth信息
     '''
     ssid = pkt[Dot11].addr2
     len_Elt = len(pkt[Dot11Elt].summary().split('/'))
     #print pkt.show()
     for i in range(len_Elt):
         if pkt[Dot11Elt][i].ID == RSN:
             try:
                 RSN_info = hexstr(pkt[Dot11Elt][i].info)
                 cipher_index = RSN_info.find('ac') #第一个00 0f ac 02中的‘02’代表cipher
                 auth_index = RSN_info.rfind('ac')   #从后往前数第一个00 0f ac 02中的‘02’代表AUTH
                 cipher_num = int(RSN_info[(cipher_index + 3):(cipher_index + 5)])
                 auth_num = int(RSN_info[(auth_index + 3):(auth_index + 5)])
                 for key,value in Dot11i.items():
                     if cipher_num == key:
                         cipher_info = value
                 for key,value in WPA_Auth.items():
                     if auth_num == key:
                         wpa_info = value
             #print wpa_info,cipher_info
                 return wpa_info,cipher_info
             except:
                 pass
     return None,None

 def sniffering(interface,action):
     '''
     嗅探5000个数据包
     '''
     print '[*]附近AP信息如下：'
     sniff(iface=interface,prn=action,count=5000,store=0)

 def main():
     moni_inface = start_monitor_mode()
     sniffering(moni_inface, show_APs_info)

 if __name__ == '__main__':
     main()

运行结果如下：

 # python test_sniff.py
 WARNING: No route found for IPv6 destination :: (no default route?)
 [*]监听网卡为：wlan1mon
 [*]附近AP信息如下：
 ----------------------------------------
  [+]AP的BSSID：100msh-XXX
  [+]AP的SSID：84:82:f4:xx:xx:xx
  [+]AP当前的chanle:11
  [+]开放验证！！
 ----------------------------------------
 ----------------------------------------
  [+]AP的BSSID：��¡����
  [+]AP的SSID：d0:c7:c0:xx:xx:xx
  [+]AP当前的chanle:11
  [+]AP的认证方式为：PSK
  [+]AP的加密算法为：CCMP
 ----------------------------------------
 ----------------------------------------
  [+]AP的BSSID：FAST_XXX
  [+]AP的SSID：78:eb:14:xx:xx:xx
  [+]AP当前的chanle:11
  [+]AP的认证方式为：PSK
  [+]AP的加密算法为：CCMP
 ----------------------------------------
 ----------------------------------------
  [+]AP的BSSID：FAST_XXX
  [+]AP的SSID：0c:72:2c:xx:xx:xx
  [+]AP当前的chanle:11
  [+]AP的认证方式为：PSK
  [+]AP的加密算法为：CCMP
 ----------------------------------------
 ----------------------------------------
  [+]AP的BSSID：XXX
  [+]AP的SSID：80:81:10:xx:xx:xx
  [+]AP当前的chanle:8
  [+]AP的认证方式为：PSK
  [+]AP的加密算法为：TKIP
 ----------------------------------------
 ----------------------------------------
  [+]AP的BSSID：XXX
  [+]AP的SSID：80:81:10:xx:xx:xx
  [+]AP当前的chanle:8
  [+]AP的认证方式为：PSK
  [+]AP的加密算法为：TKIP
 ----------------------------------------
 ----------------------------------------
  [+]AP的BSSID：360免费WiFi-44
  [+]AP的SSID：24:05:0f:xx:xx:xx
  [+]AP当前的chanle:11
  [+]AP的认证方式为：PSK
  [+]AP的加密算法为：CCMP
 ----------------------------------------