Smart Home firewall
Profile-based Smart Home firewall
Functions | Variables
https_wrong_endpoint Namespace Reference

Functions

def main ()
 FUNCTIONS ###.
 

Variables

string mac_plug = "50:c7:bf:ed:0a:54"
 GLOBAL VARIABLES ###.
 
string mac_gateway = "c0:56:27:73:46:0b"
 
string ip_plug = "192.168.1.135"
 
string ip_wrong = "192.18.1.2"
 
int port_https = 443
 

Detailed Description

Attack towards the `dns-https-tplinkra` policy of the TP-Link smart plug.
First, issue a DNS request for the TP-Link cloud server domain name "euw1-api.tplinkra.com",
and waits for the DNS response.
Then, issue HTTPS requests for an IP address not present in the DNS table.
Packets have the following signature:
    - Source MAC address:       50:c7:bf:ed:0a:54 (TP-Link smart plug MAC address)
    - Destination MAC address:  c0:56:27:73:46:0b (gateway MAC address)
    - Source IPv4 address:      192.168.1.135 (TP-Link smart plug IPv4 address)
    - Destination IPv4 address: 192.18.1.2    (incorrect IP address)
    - Destination UDP port:     443
All packets should be blocked.