packet injecting

Hi people, this is my first post on the list, im not an expert, im only a newbie.You will have to excuse me about my english that i know its really bad.
Im trining to make some hacking on my local network only for testing, my idea is the following:
A man in the middle attack, with arp spoofing to sniff packetes between a host and a router or something, me in other machine in the middle of that traffic.
Ok, now host A send packets to the router, i can see the packets with a program like arp-fun, arp tool, packit or any other program for that.
Now i want to get the packets sending from host A to the router, modify them, and inject in the router, for example:
-Hosta A send a htttp request to go to www.hotmail.com
-I intercept the packet and send the router a request to www.sex.com
-Host A see www.sex.com
I dont have any programming skill so i will have to look for a program to make that, im asked to some people and one person recommend me NetRawIP.
I dont know any perl but i could learn if someone assures to me that the answer is on that program, if that is the answer please get me some ideas or something.
If any person knwon another programa for do this please let me know.
Well, thanx for everithing and bytes.

neuromante

Hi, and welcome to AO

You seem to have "double posted" so perhaps you would like to delete one (edit, then select the delete option)

Your question is a little "sensitive" for this site, as it is how to write adware/spyware?

I realise that your English is limited, but is certainly far less limited than my knowledge of your language :D

I would ask fellow members to treat your enquiry with a little sympathy.........if you were a bad person, and knew so little, you would be so far behind, that it would not matter?

Unfortunately, I do not know the answer to your question...........

Good luck

well, if your plugged into the hub and can sniff the traffic quite easily,
you can check out dnshijacker from packetstorm. it does exactly what your looking for, if your plugged into a hub. it may not work since your plugged into a router, as it tries to sniff the packets itself, without the help of arp. but since it comes as source, you should be able to get a firm start on a good coding project :)
http://packetstormsecurity.org/UNIX/...ijacker.tar.gz

Quote:

---

I would ask fellow members to treat your enquiry with a little sympathy

---

I was prepared to do that, untill i clicked the www,sex.com link.

POP UPS AND HARD CORE.

If you want help, with your interest. Please explane how this knowledge will benifit you.

Ok, im going to explain.
I work for a local magazine about security and hacking in linux(in spanish, im form Uruguay), the magazine its for newbies, im myself a newbie and we dont have money so we (2 persons) are trying to investigate for ourselves to make cool articles for a little group of computer freaks in my conutry.
I want to write an article about that but before i want to make it on my network to see this working.
Thanx for the helping answers and the people who like to help

Besides the purpose of doing that, i think you are faaaaaaaaar away to get there.
You must learn a lot about programming AND network before even think about do that kind of trick.
Just for start, you can learn a programming language, such as Perl, Python or Pascal.
With their features (in special python/pascal) you can do a lot of networking crafting.
After that, you can seek out for tools or just learn C++.

Thank you for your tolerance folks................I just felt that this was a genuine enquiry? Which I still believe.......

Sorry jinxy.............I never thought to look..........just thought it was a "for example"........it just seemed a bit too "obvious" to be real?.............hey don't get old like me mate..............it does your brain in :D

Hola neuromante............como esta usted?

a Dios

:D

Quote:

---

for a little group of computer freaks in my conutry

---

Last I looked that "little group" was quite a healthy "skiddie club"....... ;)

Cacasopo is right. What you are attempting seems to me to be a little advanced for both yourself and your intended audience. Why not start by learning and then teching how the network works and why. Then you can move on to other things.

To the over paranoid mind your request translated into:

Dear 1337 people at antionline. I am a student in a computer lab that wants to know how to make it so when the person across from me tries going to www.hotmail.com he actualy ends up and www.sex.com. Then I can laugh and all my script kiddie friends will think Im 1337 like you guys.


But this type of alteration is a bit advanced, and companies pay big bucks to those who have the ability to do this. It is called the adware industrie. Learn the programming, if nothing else it is just good to know. But please, if you are successful with this project do us all a favor and dont write a tutorial about it. We dont need a thouand more skiddies out there that can now make adware.

from a learning perspective I wish you the best of luck in your quest for knowledge, but as a person sick of adware and the retards that make it, I hope you just decided to do a different experiment.

Quote:

---

so when the person across from me tries going to www.hotmail.com he actualy ends up and www.sex.com

---

I want some of those big bucks!!!!! Now!!!!!!

Edit the hosts file on the target machine or place a fixed entry in the DNS of the appropriate server.

Bucks please.... ;)

Quote:

---

Originally posted here by Tiger Shark

Cacasopo is right

---

Hey Tager Shirk, watch your spell :P

Cacapoopy: Sorry... Dyslexic..... :p

Well, I do believe that I warned the young man in my first post?

Quote:

---

Your question is a little "sensitive" for this site, as it is how to write adware/spyware?

---

:D

neuromante, if your spanish is better than your english post your question in spanish and I'll translate it for you (i speak fluent spanish) so others can answer your question.

EDIT: neuromante, si tu español es mejor que tu ingles pues dime tu pregunta en español y yo te lo tradusco en ingles para que otros respondan tu pregunta.

thanx for everithing u are all very elie persons for me, sorry for posting here.
if i understand well a person that doesnt know network programming and ask for some network program is a script kiddie.
Salu2 a todos desde Uruguay

Quote:

---

if i understand well a person that doesnt know network programming and ask for some network program is a script kiddie.

---

Not exactly.....................after all, a lot of perfectly legitimate network management and support software works in a very similar way to "script kiddie" tools?

You buy it, instead of going to some dubious site on the web. I guess that makes me a "script kiddie" :)

However, I agree that you are looking at a rather complex subject, just take your time and be patient, it takes a fair bit of effort and study.

Cheers :)

Neuro:

No they aren't script kiddies unless they intend to do something bad with the information provided. If they ask for it so they can learn that's fine.

primero agradecer a Raion por traducirme los post a espa~ol ya que mi ingles no es bueno(gracias Rion).
Sinceramente no quiero ser un script kiddie l oque hago es explicar las tecnicas que se utilizan y cuando se trata de pruebas las hago en mis propias computadoras para ver como es que se realizan.
Nunca ataco a nadie al contrario trabajo mas en saber como defenderme pero me apasiona saber como es que en realidad los ataques funcionan y como la gente se aprovecha de los fallos en el protocolo.
Bueno en otro post una persona me recomienda dnshijacker, me parece un buen programa aunque no sea exactamente lo que busco me puede llegar a interesar, tengo un problema en la compilacion del programa, este requiere que tenga libpcap y libnet los cuales tengo instalados pero me da el siguiente error(espero no quedar como un imbecil de nuevo ya que mkis preguntas no son "elite" ...)
Bueno instalando como dice el README:

bash-2.05b# gcc dnshijacker.c -lpcap -lnet `libnet-config --defines` -o dnshijacker
bash: libnet-config: command not found
dnshijacker.c: In function `main':
dnshijacker.c:170: `LIBNET_ERR_FATAL' undeclared (first use in this function)
dnshijacker.c:170: (Each undeclared identifier is reported only once
dnshijacker.c:170: for each function it appears in.)
dnshijacker.c: In function `parse_dns':
dnshijacker.c:375: `LIBNET_IP_H' undeclared (first use in this function)
dnshijacker.c:389: structure has no member named `uh_sport'
dnshijacker.c:390: structure has no member named `uh_dport'
dnshijacker.c:477: structure has no member named `uh_sport'
dnshijacker.c:478: structure has no member named `uh_dport'
dnshijacker.c: In function `spoof_dns':
dnshijacker.c:722: `LIBNET_IP_H' undeclared (first use in this function)
dnshijacker.c:726: `LIBNET_ERR_FATAL' undeclared (first use in this function)
dnshijacker.c:760: warning: passing arg 3 of `libnet_build_udp' makes integer from pointer without a cast
dnshijacker.c:760: too few arguments to function `libnet_build_udp'
dnshijacker.c:780: warning: passing arg 1 of `libnet_do_checksum' from incompatible pointer type
dnshijacker.c:780: warning: passing arg 2 of `libnet_do_checksum' makes pointer from integer without a cast
dnshijacker.c:780: too few arguments to function `libnet_do_checksum'
dnshijacker.c:794: `LN_ERR_WARNING' undeclared (first use in this function)
bash-2.05b#

Ahora, este tipo de preguntas de programas que no compilan las puedo hacer??
Nada mas, muchas gracias a todos.

neuromante

nueromante's translated post:

First I would like to thank Raion for translating this post for me since my english isn't good (Thank you Raion).
Honestly I don't want to be a script kiddie what I do is explain technics that are used and I do the tests on my own computer.
I never attack somebody else but instead I try to defend myself but I'm interested in finding out how it's done and how people take advantage of protocool bugs/exploits.
Well, In another thread, someone reccommended dnshijacker, it looks like a good program although it isn't exactly what I'm looking for, also I'm having a compile error which requires me to have "libpcap" and "libnet" which I do have installed but I get the following error (I hope I don't look like an idiot since my posts aren't "elite")
Well installing it as the readme says:

bash-2.05b# gcc dnshijacker.c -lpcap -lnet `libnet-config --defines` -o dnshijacker
bash: libnet-config: command not found
dnshijacker.c: In function `main':
dnshijacker.c:170: `LIBNET_ERR_FATAL' undeclared (first use in this function)
dnshijacker.c:170: (Each undeclared identifier is reported only once
dnshijacker.c:170: for each function it appears in.)
dnshijacker.c: In function `parse_dns':
dnshijacker.c:375: `LIBNET_IP_H' undeclared (first use in this function)
dnshijacker.c:389: structure has no member named `uh_sport'
dnshijacker.c:390: structure has no member named `uh_dport'
dnshijacker.c:477: structure has no member named `uh_sport'
dnshijacker.c:478: structure has no member named `uh_dport'
dnshijacker.c: In function `spoof_dns':
dnshijacker.c:722: `LIBNET_IP_H' undeclared (first use in this function)
dnshijacker.c:726: `LIBNET_ERR_FATAL' undeclared (first use in this function)
dnshijacker.c:760: warning: passing arg 3 of `libnet_build_udp' makes integer from pointer without a cast
dnshijacker.c:760: too few arguments to function `libnet_build_udp'
dnshijacker.c:780: warning: passing arg 1 of `libnet_do_checksum' from incompatible pointer type
dnshijacker.c:780: warning: passing arg 2 of `libnet_do_checksum' makes pointer from integer without a cast
dnshijacker.c:780: too few arguments to function `libnet_do_checksum'
dnshijacker.c:794: `LN_ERR_WARNING' undeclared (first use in this function)
bash-2.05b#

What can I do about it??
Nothing more, Thank you everyone.

ettercap is the programa i was looking for.
Thanx to everyone who tried to help me.
Bytes.

neuromante,

Read your personal messages(PMs), you would have had it the day you posted the first message. :)

-Maestr0