WS8 - Offensive Packet Wizardry with Scapy

Instructed by:  Mike “Chicolinux” Guirao

Level of Difficulty: Intermediate

Abstract: 

Offensive Packet Wizardry with Scapy is a four-hour, 100% hands-on workshop that teaches attendees to build offensive networking tools from scratch in Python using Scapy, the packet crafting library used by red teams, malware analysts, and vulnerability researchers worldwide.

Starting from first principles, raw packet construction, layer stacking, and send/receive mechanics, the workshop moves progressively through active reconnaissance, ARP cache poisoning with live credential interception, TCP/IP stack abuse (session injection, SYN flood, RST killing), protocol fuzzing against an intentionally vulnerable binary service, and full covert channel implementation (ICMP C2 shell, DNS file exfiltration, TCP header steganography).

Every technique is implemented live in Python against an isolated lab network. Students leave with a working, importable red team toolkit, a Python package with a unified CLI, that they built themselves and can adapt for future engagements.

The workshop concludes with "Silent Pivot," a scored capstone scenario that chains all techniques into a realistic kill-chain: stealth discovery, service identification, fuzzer-triggered crash, ICMP command execution, DNS exfiltration of /etc (slash) shadow, and network cleanup, all subject to an IDS alert budget.

Pre-Requisites: 

Required:

• Python - Comfortable writing Python scripts (functions, classes, loops, file I/O, importing modules). Students will write Python throughout. No advanced Python required, but students who struggle with basic syntax will fall behind.

• Networking fundamentals - Must understand the OSI model through layer 4, IP addressing and subnetting, the purpose of ARP, TCP three-way handshake, UDP, ICMP, and DNS. Students should be able to read a Wireshark capture and identify what they see.

• Linux command line - Comfortable running commands in a terminal: sudo, file navigation, ip/ifconfig, ping, basic text editing. All lab work is done on Linux VMs.

Helpful but not required:

• Prior exposure to any packet capture tool (Wireshark, tcpdump)

• Basic familiarity with network security concepts (scanning, sniffing, spoofing)

• Any prior red team or CTF experience

Not required:

• Prior Scapy experience (it is taught from scratch)

• C/C++ or assembly knowledge

• Experience with commercial pentesting tools (Metasploit, Burp, Cobalt Strike)