Python uses raw sockets for Ethernet frame injection

1. Frame Injection

For an introduction to Ethernet frames and raw sockets, refer to a previous post that uses raw sockets for Ethernet frame sniffing. Features of frame injection:
　　

• Packets from the original data format can be injected into the network.
• Very powerful in analog network response.

• The original socket package structure is not malleable.

  　Random Injection

  If you can randomly inject data into the network, you can send any data to the network. ^_^

2. Code Experiment

To enter the Python runtime, you need to add root privileges. ( sudo python ).
　　

>>>
>>> Import socket
>>> import struct
>>>
> >>
>>> rawsocket = socket.socket (socket. Pf_packet, Socket. Sock_raw, Socket.htons (0x0800))
>>>
>>> rawsocket.bind (("Eth0", Socket.htons (0x0800)))
>>> packet = struct.pack ("!6s6s2s", ' \xaa\xaa\xaa\xaa\xaa\xaa ', ' \xbb\xbb\xbb\xbb\xbb\xbb ', ' \x08\x00 ')
>>>
>>> packet
' \xaa\xaa\xaa\xaa\xaa\xaa\xbb\xbb\xbb\xbb\xbb\xbb\x08\x00 '
> >>
>>> len (packet)

>>>
>>> rawsocket.send (packet + "Hello, there." )
+
>>>

　
This still uses the Pf_packet protocol family, bound to the Eth0 network interface, the port number 0x0800. Use the pack () function of the struct module to seal the binding. The Ethernet frame header has 14 bytes, 6 byte destination MAC address, 6 byte source MAC address, and 2 byte protocol type, respectively. The "!6s6s2s" ! represents a group package by network order. We use the Len () function to find the length of the packet, which is exactly 14 bytes. Then add the data that we want to send to the network, and the result returned is the length of the data being sent.
Use tcpdump or Wireshark to view the data we send. I use the Tcpdump method here, enter the following command under terminal (I use the Ubuntu server,ssh connection. For easy viewing, filter out data with Port 22. Remove clutter), and then resend the data:
　　$ sudo tcpdump -i eth0 -vv -XX "not port 22 and not arp and not udp"

From the second packet of results, our random data has been injected into the network.
　　

Python uses raw sockets for Ethernet frame injection