KAMENE(1)

📦 version 0.32, in arch rolling

💅 KAMENE ✨ (section 1 of the general commands manual, bestie)

okay so. gather round. this is the manual page for kamene, and it is genuinely one of the most iconic tools ever, so let's get into it 💖

🌸 NAME 🌸

kamene — the interactive packet manipulation tool. that's it. that's the vibe. she sends packets, she receives packets, she does literally everything 🎀

✨ SYNOPSIS ✨

kamene [options]

🦋 DESCRIPTION 🦋

bestie. this page documents kamene briefly, but honestly? brief is all you need to fall in love.

kamene is a powerful interactive packet manipulation tool — she's a packet generator, a network scanner, a network discovery tool, a packet sniffer, all of it 🌈. for the moment she can replace hping, parts of nmap, arpspoof, arp-sk, arping, tcpdump, tshark, p0f, ... the list literally keeps going, iykyk 👑

here's the thing that makes her special: kamene uses the python interpreter as a command board 😌. which means you can just... use python directly. assign variables, use loops, define functions, all that. and if you give a file as a parameter when you run kamene, your whole session (variables, functions, instances, ...) gets saved when you leave the interpretor, and restored the next time you launch kamene. no cap, she remembers everything about you 🫶

the idea is simple, fr fr. those kind of tools do two things: sending packets and receiving answers. that's exactly what kamene does 💅 you define a set of packets, she sends them, receives answers, matches requests with answers, and returns a list of packet couples (request, answer) plus a list of unmatched packets. this has the big advantage over tools like nmap or hping that an answer is not reduced to (open/closed/filtered) — you get the whole packet. the whole thing. main character energy ⭐

on top of this you can build more high level functions, for example:

  • one that does traceroutes and gives as a result only the start TTL of the request and the source IP of the answer 🧚
  • one that pings a whole network and gives the list of machines answering
  • one that does a portscan and returns a LaTeX report (yes, a LaTeX report, she's academic like that 🎀)

💜 OPTIONS 💜

options for kamene are, and I quote, the following:

  • -h — display usage. short king behavior 😌
  • -d — increase log verbosity. can be used many times. spam her, she likes it 🔥
  • -s FILE — use FILE to save/load session values (variables, functions, instances, ...) 💾
  • -p PRESTART_FILE — use PRESTART_FILE instead of $HOME/.kamene_prestart.py as pre-startup file
  • -P — do not run prestart file. she's skipping the pregame 🙈
  • -c STARTUP_FILE — use STARTUP_FILE instead of $HOME/.kamene_startup.py as startup file
  • -C — do not run startup file

🍓 COMMANDS 🍓

only the vital commands to begin are listed here for the moment (she's growing, give her a sec 🌱).

  • ls() — lists supported protocol layers. if a protocol layer is given as parameter, lists its fields and types of fields 👑
  • lsc() — lists some user commands. if a command is given as parameter, its documentation is displayed 💖
  • conf — this object contains the configuration. that's her little settings purse 👜

🧚 FILES 🧚

$HOME/.kamene_prestart.py — this file is run before kamene core is loaded. only the is available. (that's what the page says, bestie, don't come for me 💀) this file can be used to manipulate conf.load_layers list to choose which layers will be loaded:

conf.load_layers.remove("bluetooth")
conf.load_layers.append("new_layer")

$HOME/.kamene_startup.py — this file is run after kamene is loaded. it can be used to configure some of the kamene behaviors:

conf.prog.pdfreader="xpdf"
split_layers(UDP,DNS)

🌈 EXAMPLES 🌈

more verbose examples are available at https://phaethon.github.io/kamene/ — but honestly, just run kamene and try the following commands in the interpreter 🫶

packet sniffing and dissection (with a bpf filter or thetereal-like output):

a=sniff(filter="tcp port 110")
a=sniff(prn = lambda x: x.display)

sniffed packet reemission:

a=sniff(filter="tcp port 110")
sendp(a)

pcap file packet reemission:

sendp(rdpcap("file.cap"))

manual TCP traceroute:

sr(IP(dst="www.google.com", ttl=(1,30))/TCP(seq=RandInt(), sport=RandShort(), dport=dport)

protocol scan:

sr(IP(dst="172.16.1.28", proto=(1,254)))

ARP ping:

srp(Ether(dst="ff:ff:ff:ff:ff:ff")/ARP(pdst="172.16.1.1/24"))

ACK scan:

sr(IP(dst="172.16.1.28")/TCP(dport=(1,1024), flags="A"))

ARP cache poisonning:

sendp(Ether(dst=tmac)/ARP(op="who-has", psrc=victim, pdst=target))

reporting:

report_ports("192.168.2.34", (20,30))

💀 SEE ALSO 💀

http://github.com/phaethon/kamene — go follow her, she's literally right there 🌟

🙈 BUGS 🙈

okay, real talk, she's not perfect, nobody is:

  • does not give the right source IP for routes that use interface aliases 😭
  • may miss packets under heavy load 💀
  • session saving is limited by Python ability to marshal objects. as a consequence, lambda functions and generators can't be saved, which seriously reduce usefulness of this feature 🥲
  • BPF filters don't work on Point-to-point interfaces. periodt.

👑 AUTHOR 👑

original scapy author is Philippe Biondi <phil@secdev.org> 💜

porting to python3 and further improvements by Eriks Dobelis and community 🫶

this manual page was written by Alberto Gonzalez Iniesta <agi@agi.as>, Philippe Biondi, and Eriks Dobelis ✨

so yeah, that's kamene. she's iconic, she's chaotic, she's your new best friend. now go sniff some packets, bestie 🦋💖

sign-off time: this little love letter to a packet tool is dated December 2, 2016, and it's the General Commands Manual's very own KAMENE(1) page — mwah 💋🌸

📦 where this page comes from