你若安好
便是晴天

SYN无状态扫描程序开发(二)

构造报文,生成seq和sport

根据srcip和dstip生成一串16字节的校验码,校验码第一个4字节(uint32类型)当做seq,第二个4字节用于从指定sport范围(比如:32768~60000)中选择一个sport。剩下的8字节保留。

  1. 主要使用rijndael算法,参考AES。先初始化一个静态key,然后使用这个key和srcip,dstip生成一串16字节的密文。
#define AES_ROUNDS 10
#define AES_BLOCK_WORDS 4
#define AES_KEY_BYTES 16

static int inited = 0;
static uint32_t aes_input[AES_BLOCK_WORDS];
static uint32_t aes_sched[(AES_ROUNDS + 1) * 4];

void validate_init()
{
    for (int i = 0; i < AES_BLOCK_WORDS; i++) {
        aes_input[i] = 0;
    }
    uint8_t key[AES_KEY_BYTES];
    if (!random_bytes(key, AES_KEY_BYTES)) {
        log_fatal("validate", "couldn't get random bytes");
    }
    if (rijndaelKeySetupEnc(aes_sched, key, AES_KEY_BYTES * 8) !=
        AES_ROUNDS) {
        log_fatal("validate", "couldn't initialize AES key");
    }
    inited = 1;
}

void validate_gen(const uint32_t src, const uint32_t dst,
          uint8_t output[VALIDATE_BYTES])
{
    assert(inited);
    aes_input[0] = src;
    aes_input[1] = dst;
    rijndaelEncrypt(aes_sched, AES_ROUNDS, (uint8_t *)aes_input, output);
}
  1. seq值的为validate前四个字节组成的uint32类型值。
tcp_header->th_seq = htonl(validation[0]); // 根据srcip dstip计算出来的密文前四个字节
  1. 我们先设定一个sport的范围,然后按取模的方式从这个范围中选出一个sport。
#define source_port_first 32768 // 源端口起始位置
#define source_port_last 61000 // 源端口结束位置
uint16_t get_src_port(int num_ports, int probe_num/* 对同一个目的端口发送多个syn包时,syn包的序号 */, uint32_t *validation) {
    return source_port_first + ((validation[1] + probe_num) % num_ports);
}
  1. 到这里,完整的报文就构造完成了,接下来就是sendto了,由于sendto不阻塞,发送太快会出现丢包情况,所以需要控制发包速率,请继续往下阅读。

发送syn包并自动调整发包速率,防止丢包

数据构造好了,只需要向原始套接字进行send动作。sockaddr填充网关的mac,数据包发送到网关进行路由。需要注意的是,sendto是网络io操作,虽然不阻塞,但会出现线程安全问题,如果是多线程则需要加线程锁。在这里单线程sendto就已经够用了。

int send_packet(int sock, void *buf, int len) {
    ++ssend.sent; // 记录发包数量
    return sendto(sock, buf, len, 0, (struct sockaddr *) &sockaddr, sizeof(struct sockaddr_ll));
}
  1. packet_streams是对同一目的端口发包的数量。while循环根据当前计算出来的速率,添加延时,使发送速率不超过设定的最大值rate。(速率表示每秒发送的数据包数量。)
#define VALIDATE_BYTES 16
for (int i = 0; i < packet_streams; ++i) {
    uint32_t validation[VALIDATE_BYTES / sizeof(uint32_t)];
    validate_gen((uint32_t) index, sconf.src_ip, dst_ip, (uint8_t *) validation);
    synscan_make_packet(buf, 54, sconf.src_ip, dst_ip, dst_port, validation, i);
    send_packet(sock, buf, length);
    while (ssend.sent/*当前发包数量*/ / (now()/*当前时间*/ - ssend.start/*send开始时间*/) > sconf.rate) usleep(100);
}
  1. 计算系统最大发包速率。rate = bandwidth / pkt_len;,带宽除以一个数据包的总bits数,表示每秒发送的最大数据包个数
// 计算packet长度
size_t pkt_len = 54; // ether header + ip header + tcp header (bytes)
pkt_len *= 8; // bits
// 7 byte MAC preamble, 1 byte Start frame, 4 byte CRC, 12 byte
// inter-frame gap
pkt_len += 8 * 24;
// adjust calculated length if less than the minimum size of an
// ethernet frame
if (pkt_len < 84 * 8) {
    pkt_len = 84 * 8;
}

// 计算带宽,例如带宽为bandwidth = 10m
uint64_t bandwidth *= 1000000;

// 计算速率
uint32_t rate = bandwidth / pkt_len;
if (rate > 0xFFFFFFFFu) { /* 防止溢出 */
    rate = 0;
}

libpcap嗅探网卡,过滤出目的ip回传的报文(根据ack和dport)

作者太懒,明天继续

原创作品未经允许不得转载:WTF博客 » SYN无状态扫描程序开发(二)

评论 59

  • 昵称 (必填)
  • 邮箱 (必填)
  • 网址
  1. #1

    There is visibly a bunch to realize about this. I suppose you made various good points in features also. Kalie Brok Gariepy

    yabanci9个月前 (12-20)回复
  2. #2

    Well I really liked studying it. This tip procured by you is very practical for correct planning. Gusti Pieter Torto

    yify9个月前 (12-23)回复
  3. #3

    This is very interesting. I like the animations and the thorough explanations. Adelind Jozef Darice

    download9个月前 (12-23)回复
  4. #4

    PlayStation 4 has been definitely takes the cake. Dalila Andonis Kadner

    bluray9个月前 (12-24)回复
  5. #5

    Thanks a lot. It helps me much instagram font

    more8个月前 (01-20)回复
  6. #6

    Thanks a lot. It helps me much instagram font

    anitamusic8个月前 (01-26)回复
  7. #7

    Hello. In my opinion you are mistaken. I can prove it.

    عکس پروفایل8个月前 (01-31)回复
  8. #8

    The turnkey franchise provider offers anything else, including. Nerissa Iorgo Justina

    dublaj8个月前 (02-01)回复
  9. #9

    This is my kind of fun park. Did they have an Aussie option? Katina Granger Westfall

    anime7个月前 (02-07)回复
  10. #10

    Do you want to open a training school for nursing assistants? Jeanelle Jeddy Addis

    hindi movie7个月前 (02-11)回复
  11. #11

    arnui stkir itvq

    ClarkteR7个月前 (03-02)回复
  12. #12

    The road seemed to stretch on endlessly before us, but Alexis assured me that our journey was near an end. We’d turn before long into thick woods and travel through narrow, winding roads until we reached her family’s cabin. I had no choice but to trust her as GPS had given out nearly 20 minutes ago.

    “There’s good wifi and okay reception at the cabin,” she’d told me, “but you can’t get there unless you know the way.”
    https://murdockdelbosque34807.jimdofree.com/
    So here I was, driving alone in the middle of god knows where with a girl who was my student just a couple of weeks ago. Her and her four best friends had been together from first grade all the way through high school and now they had graduated with very different futures ahead of them. They had decided to kick off “the best summer ever” with a week long stay at Alexis’s family cabin. Alexis and I were heading up before everyone else, the four other girls and four guys.

    jimdofreeHoibe5个月前 (04-11)回复
  13. #13
    Google5个月前 (04-12)回复
  14. #14

    The road seemed to stretch on endlessly before us, but Alexis assured me that our journey was near an end. We’d turn before long into thick woods and travel through narrow, winding roads until we reached her family’s cabin. I had no choice but to trust her as GPS had given out nearly 20 minutes ago.

    “There’s good wifi and okay reception at the cabin,” she’d told me, “but you can’t get there unless you know the way.”
    https://medium.com/@zavertnikcheryl/sky-pays-the-rent-pt-05-f71430cf1cbe
    So here I was, driving alone in the middle of god knows where with a girl who was my student just a couple of weeks ago. Her and her four best friends had been together from first grade all the way through high school and now they had graduated with very different futures ahead of them. They had decided to kick off “the best summer ever” with a week long stay at Alexis’s family cabin. Alexis and I were heading up before everyone else, the four other girls and four guys.

    jimdofreeHoibe5个月前 (04-16)回复
  15. #15

    The road seemed to stretch on endlessly before us, but Alexis assured me that our journey was near an end. We’d turn before long into thick woods and travel through narrow, winding roads until we reached her family’s cabin. I had no choice but to trust her as GPS had given out nearly 20 minutes ago.

    “There’s good wifi and okay reception at the cabin,” she’d told me, “but you can’t get there unless you know the way.”
    https://notepin.co/shared/ijuayip
    So here I was, driving alone in the middle of god knows where with a girl who was my student just a couple of weeks ago. Her and her four best friends had been together from first grade all the way through high school and now they had graduated with very different futures ahead of them. They had decided to kick off “the best summer ever” with a week long stay at Alexis’s family cabin. Alexis and I were heading up before everyone else, the four other girls and four guys.

    jimdofreeHoibe5个月前 (04-22)回复
  16. #16

    The road seemed to stretch on endlessly before us, but Alexis assured me that our journey was near an end. We’d turn before long into thick woods and travel through narrow, winding roads until we reached her family’s cabin. I had no choice but to trust her as GPS had given out nearly 20 minutes ago.

    “There’s good wifi and okay reception at the cabin,” she’d told me, “but you can’t get there unless you know the way.”
    https://telegra.ph/Downfall-of-the-CEO-Pt-04-01-14
    So here I was, driving alone in the middle of god knows where with a girl who was my student just a couple of weeks ago. Her and her four best friends had been together from first grade all the way through high school and now they had graduated with very different futures ahead of them. They had decided to kick off “the best summer ever” with a week long stay at Alexis’s family cabin. Alexis and I were heading up before everyone else, the four other girls and four guys.

    jimdofreeHoibe5个月前 (04-26)回复
  17. #17

    The road seemed to stretch on endlessly before us, but Alexis assured me that our journey was near an end. We’d turn before long into thick woods and travel through narrow, winding roads until we reached her family’s cabin. I had no choice but to trust her as GPS had given out nearly 20 minutes ago.

    “There’s good wifi and okay reception at the cabin,” she’d told me, “but you can’t get there unless you know the way.”
    https://rentry.co/7afen
    So here I was, driving alone in the middle of god knows where with a girl who was my student just a couple of weeks ago. Her and her four best friends had been together from first grade all the way through high school and now they had graduated with very different futures ahead of them. They had decided to kick off “the best summer ever” with a week long stay at Alexis’s family cabin. Alexis and I were heading up before everyone else, the four other girls and four guys.

    jimdofreeHoibe5个月前 (05-01)回复
  18. #18

    The road seemed to stretch on endlessly before us, but Alexis assured me that our journey was near an end. We’d turn before long into thick woods and travel through narrow, winding roads until we reached her family’s cabin. I had no choice but to trust her as GPS had given out nearly 20 minutes ago.

    “There’s good wifi and okay reception at the cabin,” she’d told me, “but you can’t get there unless you know the way.”
    https://txt.fyi/-/2153/7b80bd1b/
    So here I was, driving alone in the middle of god knows where with a girl who was my student just a couple of weeks ago. Her and her four best friends had been together from first grade all the way through high school and now they had graduated with very different futures ahead of them. They had decided to kick off “the best summer ever” with a week long stay at Alexis’s family cabin. Alexis and I were heading up before everyone else, the four other girls and four guys.

    jimdofreeHoibe4个月前 (05-06)回复
  19. #19
    top adult games4个月前 (05-09)回复
  20. #20

    Sites of interest we have a link to

    SEO Los Angeles4个月前 (05-13)回复
  21. #21
    gas fireplace4个月前 (05-17)回复
  22. #22
    Architectural design4个月前 (05-20)回复
  23. #23

    below you will come across the link to some web sites that we feel you should visit

    dudullu escort4个月前 (05-24)回复
  24. #24

    Sites of interest we have a link to

  25. #25

    “How may I satisfy you best, Sirs? In my mouth or … perhaps my pussy? One at a time or together?”
    Nothing was said for a moment, so I interjected my own thought, “May I suggest?” They numbly nodded. “Let’s do both at the same time.
    Mr. Wilson, if you’ll lay yourself against the headboard …”
    He did as I directed after quickly shedding his remaining clothes.
    I crawled up onto the bed after him thinking the reputation of hotel bed covers being a haven for bodily fluids was about to become even truer.
    With him settled, I crawled onto the bed to him and looked over my shoulder. In a deliciously devious gesture that only I understood I patted my ass for Tenor to come and fuck me.
    https://telegra.ph/My-favorite-slut-05-31

    ThomasNex4个月前 (06-02)回复
  26. #26

    Summertime in Phoenix sucks!! Let me tell you unless you have a pool your summers will be full of boredom! The house I grew up in had a older style pool. Wasnt the beautiful pools we see now but it was something. My name is Alexandra but I go by Alex Allie or Al. I was excited summer had finally come and I could stay home and relax. My best friend Kate comes over all of the time. On a hot Monday she came over so we could swim in my pool. At the time I remember I was a little jealous of Kate because she was super skinny had a nice body. Anyways we head upstairs to my room to put on our bathing suits. Kate and I have never been shy around each other. At least my boobs were bigger than hers. As we get undressed i glance over at Kate looking at her from head to toe. I never knew why my pussy was just a little slit and the only way I can describe hers was meaty. She had what looked like an overgrown clit hood.
    https://telegra.ph/Daddy-and-Me-06-04

    Vincenttycle3个月前 (06-05)回复
  27. #27

    So there I was still shaking and standing between Johns legs with my hands on his knees and him sitting there with no pants on still catching our breath when we hear someone yell John and a flashlight comes our way. Im sure we looked like deer in the headlights when the flashlight hits us and didnt move. John! What the? Who is this? as his pace picked up and he got closer to us.Uhh, Steven umm uh John replied We send you for firewood and you get some action in. Lucky Bastard. Im Steven he said to me, not sure if we shake hands or what to do in a situation like this. Im still speechless and he says what are you wearing dude? Thats hot. I introduced myself and grabbed my beer and took a big long swig. Im Scott and yeah I come out here for privacy so I can crossdress. I guess I got caught… again. I stepped back out from between Johns legs and stepped back over the bench.
    https://telegra.ph/Cross-dressing-camper-Part-2-06-04

    AndrewSmeli3个月前 (06-05)回复
  28. #28

    When I met the person that I wanted to spend my life with I never expected that it would be before I left school, someone older, who was married and least of all a woman. When I left England with my mother at the age of 16 to live in Italy in an attempt to help me with the problems I acquired when my parents divorced. I never thought it would be the best decision of my life.
    https://telegra.ph/Nurse-Kate-pt2-06-07

    ClydeMam3个月前 (06-08)回复
  29. #29

    My wife was going to get her annual complete physical. She had never seen this doctor before. We just found him in the local listings.
    We were both very excited as we waited in his exam room. My wife was terrified. She hated doctor exams. They are hugely embarrassing and humiliating and often painful for her.
    I could see the fear on her face as we waited and waited.
    After a forty-five minute wait because the doctor had some sort of emergency he had to deal with, the door opened and the doctor came in. The long wait and the anticipation made us both as wound up as people can be. Every nerve in my body felt electric. And then…
    https://telegra.ph/My-wifes-physical-exam-06-07

    RonaldMains3个月前 (06-08)回复
  30. #30

    we came across a cool site that you could appreciate. Take a search in the event you want

    Santana Pos Login3个月前 (06-17)回复
  31. #31

    The facts mentioned in the report are a number of the best offered

    Oc phone repair3个月前 (06-22)回复
  32. #32
    strap on for pegging3个月前 (06-28)回复
  33. #33
    best finger vibrator3个月前 (07-03)回复
  34. #34

    The info mentioned inside the report are several of the most effective readily available

    vibrator for women3个月前 (07-04)回复
  35. #35
    olgun escort2个月前 (07-13)回复
  36. #36

    https://theclearconcerntrate.com/ The Clear classic oil is mixed with CBD isolate and our preparatory flavorings for the best taste and consistency on the market today.

    Thc Cartridge2个月前 (07-15)回复
  37. #37

    Every as soon as inside a whilst we select blogs that we study. Listed below are the newest websites that we select

  38. #38

    Every when in a even though we select blogs that we read. Listed beneath would be the newest websites that we pick out

    buy weed in Arkansas2个月前 (07-26)回复
  39. #39

    Wonderful story, reckoned we could combine a handful of unrelated information, nonetheless really really worth taking a appear, whoa did 1 master about Mid East has got additional problerms also

    teachings of Christ2个月前 (07-29)回复
  40. #40

    Here are a number of the websites we advocate for our visitors

    best male stroker1个月前 (08-13)回复
  41. #41

    Here are some of the web sites we advocate for our visitors

  42. #42
    mersin escort1个月前 (08-16)回复
  43. #43
    Takeout4周前 (08-22)回复
  44. #44

    we came across a cool site that you just may take pleasure in. Take a search in the event you want

  45. #45
  46. #46

    just beneath, are various completely not related web pages to ours, having said that, they’re certainly really worth going over

    lottovip3周前 (08-25)回复
  47. #47

    the time to study or take a look at the subject material or web sites we’ve linked to beneath the

    ground leases3周前 (08-27)回复
  48. #48

    The information and facts talked about within the post are some of the top accessible

    huay3周前 (08-28)回复
  49. #49

    Every once inside a even though we choose blogs that we study. Listed below are the most recent websites that we select

    99defi.network2周前 (09-02)回复
  50. #50

    The information mentioned inside the write-up are several of the most effective obtainable

  51. #51

    Here are some of the websites we recommend for our visitors

  52. #52

    Sites of interest we have a link to

  53. #53

    below you will find the link to some sites that we assume you need to visit

  54. #54

    Wonderful story, reckoned we could combine some unrelated information, nonetheless definitely really worth taking a look, whoa did one discover about Mid East has got additional problerms at the same time

  55. #55

    here are some links to web sites that we link to since we think they are really worth visiting

    orgasm1周前 (09-08)回复
  56. #56
  57. #57

    Wonderful story, reckoned we could combine a couple of unrelated data, nevertheless actually worth taking a search, whoa did a single find out about Mid East has got additional problerms as well

    w88ok1周前 (09-08)回复
  58. #58

    usually posts some incredibly interesting stuff like this. If you are new to this site

  59. #59

    the time to read or check out the subject material or web sites we’ve linked to beneath the