开发者

TCP ACK spoofing

I am writing a program that fakes TCP requests and collects the data to store in a local buffer. For this, in the system connected to the client i have configured the iptables to keep all the incoming packets to a queue before routing. Then i use the netfilter library to read the packets from the queue. After this using RAW sockets I send the fake TCP packets to the client. With this I am able to fake the SYN/ACK packet in response to the SYN request from the client.

But issue happens when I try to fake an ACK to the client in response to the incoming data. In this case the real ip of the source comes in the packet and not the faked one. Please see 7th trace below marked with ">>>". In this the source ip is shown as 192.168.10.10 where as it has to be 212.58.246.81. In the 4th trace(i.e. SYN/ACK packet) its showing as fine.

3  0.073852000  192.168.10.100  212.58.246.81  TCP  38307 > http [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=502233100 TSER=0 WS=6
4  0.103102000  212.58.246.81  192.168.10.100  TCP  http > 38307 [SYN, ACK] Seq=0 Ack=1 Win=31744 Len=0
5  0.103147000  192.168.10.100  212.58.246.81  TCP  38307 > http [ACK] Seq开发者_JAVA百科=1 Ack=1 Win=5840 Len=0
6  0.103349000  192.168.10.100  212.58.246.81  HTTP  GET /go/rss/int/news/-/sport2/hi/tennis/9519762.stm HTTP/1.1
>>> 7  1.118729000  192.168.10.10  192.168.10.100  TCP  http > 38307 [ACK] Seq=1 Ack=1 Win=31744 Len=0
8  1.118788000  192.168.10.100  192.168.10.10  TCP  38307 > http [RST] Seq=1 Win=0 Len=0
9  3.102627000  192.168.10.100  212.58.246.81  HTTP  [TCP Retransmission] GET /go/rss/int/news/-/sport2/hi/tennis/9519762.stm HTTP/1.1
10  3.148590000  192.168.10.10  192.168.10.100  TCP  [TCP Dup ACK 7#1] http > 38307 [ACK] Seq=1 Ack=1 Win=31744 Len=0
11  3.148606000  192.168.10.100  192.168.10.10  TCP  38307 > http [RST] Seq=1 Win=0 Len=0

Also I have tried out "sendip" command like below to send a fake TCP ACK

sendip -p ipv4 -p tcp -is 212.58.246.81 -id 192.168.10.100 -ts 80 -td 4567 -tfa 1 -tfs 0 -d "Data" 192.168.10.100

here tfa and tfs stands for ack and syn flags respectively. This also didnt work as expected and its shown as orginating from 192.168.10.10 instead of 212.58.246.81. But if I set both flags(syn and ack) as 1 then its working fine.

The OS is Ubuntu. Can anyone please let me know where I am going wrong. Thanks a lot for your help.

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜