Winarp3.0Beta1.rar提交时间：2005-11-24 更新时间：2005-11-25 提交用户：stqc 工具分类：攻击程序 运行平台：Windows 工具大小：681466 Bytes 文件MD5 ：51f229559a84f7623c5a422de8e248c1 工具来源：stqc WinArpAttacker1.5的升级版本 1、增加ARP检测功能。 2、修改了一些BUG。 WinArpAttacker 3.00 Readme Oct. 7th 2005 Author : unshadow Email : asia_message@hotpop.com Website: no, i'm looking for free website, if you have good advice you can tell me. ----------------------------------------------------------------------------- Caution: This program is dangerous, it is released just for research, any possible loss caused by this program is no relation with the author (unshadow), if you don't permit this, you must delete it immediately. If you use this program, I think you permit all of these. ----------------------------------------------------------------------------- WinArpAttacker is based on wpcap, you must install wpcap driver before running it. wpcap: http://winpcap.polito.it/install/bin/WinPcap_3_0.exe If you had installed old version of winpcap, just install WinPcap_3_0.exe overwrite it. ----------------------------------------------------------------------------- Contents 1. Overview 2. System Requirement 3. What's New 4. Getting Started 5. Known Issues 6. Revision History 7. To do ----------------------------------------------------------------------------- 1. Overview ------------------------------------ WinArpAttacker is a program that can scan and attack computers on local area network. WinArpAttacker has three important features: 1.1 Scan -. It can scan and show the active hosts on the LAN within a very short time (~2-3 seconds). It has two scan mode, one is normal scanning, the other is antisniff scanning. The later is to find who is sniffing on the lan. -. It can save and load computer list file. -. It can scan the Lan regularly for new computer list. -. It can update the computer list in passive mode using sniffing technology, that is, it can update the computer list from the sender's address of arp request packets without scanning the lan. -. It can perform advaned scanning when you open advanced scanning dialg on menu. -. It can scan acthost listed in event listview. 1.2 Attack -. It can pull and collect all the packets on the LAN. -. It can perform six attacking actions as following: (1) Arp Flood - Send ip conflict packets to target computers as fast as possible, if you send too much, the target computers will down. :-( (2) BanGateway - Tell the gateway a wrong mac address of target computers, so the targets can't receive packet from the internet. This attack is to forbid the targets access the internet. (3) IPConflict - Like Arp Flood, send ip conflict packets to target computers regularly, maybe the users can't work because of regular ip conflict message. what's more, the targets can't access the lan. (4) SniffGateway - Spoof the targets and the gateway, you can use sniffer to collect packets between them. (5) SniffHosts - Spoof among two or above targets, you can use sniffer to collect packets among all of them. (dangerous!!!!) (6) SniffLan - Just like SniffGateway, the difference is that SniffLan sends broadcast arp packets to tell all computers on the lan that this host is just the gateway, So you can sniff all the data between all hosts with the gateway.(dangerous!!!!!!!!!!!!!!) -. While spoofing ARP tables, it can act as another gateway (or ip-forwarder) without other users' recognition on the LAN. -. It can collect and forward packets through WinArpAttacker's ipforward function, you had best check disable system ipforward function because WinArpAttacker can do well. -. All data sniffed by spoofing and forwarded by WinArpAttacker ipforward function will be counted, as you can see on main interface. -. As your wish, an ARP table is recovered automatically in a little time (about 5 seconds). Your also can select not to recover. 1.3 Detect -. What is the most important function, it can detect almost all attacking actions metioned as above as well as host status. the event WinArpAttacker can detect is listed as following: SrcMac_Mismath - Host sent an arp packet, its src_mac doesn't match,so the packet will be ignored. DstMac_Mismath - Host recv an arp packet, its dst_mac doesn't match,so the packet will be ignored. Arp_Scan - Host is scanning the lan by arp request for a hosts list. Arp_Antisniff_Scan - Host is scanning the lan for sniffing host,thus the scanner can know who is sniffing. Host_Online - Host is online now. Host_Modify_IP - Host modified its ip to or added a new IP. Host_Modify_MAC - Host modified its mac address. New_Host - New gost was found. Host_Add_IP - Host added a new ip address. Multi_IP_Host - Host has multi-ip addresses. Multi_Mac_Host - Host has multi-mac addresses. Attack_Flood - Host sends a lot of arp packets to another host ,so the target computer maybe slow down. Attack_Spoof - Host sends special arp packets to sniff the data two targets , so the victims' data exposed. Attack_Spoof_Lan - Host lets all host on the lan believe that it's just a gateway, so the intruder can sniff all hosts' data to the real gateway. Attack_Spoof_Ban_Access - Host told host that host has a inexist mac,so the targets can't communicate with each other. Attack_Spoof_Ban_Access_GW - Host told host that the gateway has a inexist mac, so the target can't access the internet through the gateway. Attack_Spoof_Ban_Access_Lan - Host broadcast host's mac as a inexist mac, so the target can't communicate with all hosts on the lan. Attack_IP_Conflict - Host found another host has same ip as its, so the target would be disturbed by ip conflict messages. -. It can explain each event which WinArpAttacker detected. -. It can save events to file. 1.4 other features. -. Support multi-network adapter and multi-ip address and multi-gateway on a computer, you can select different adapter and ip address to scan different lan. -. Support DHCP and fixed ip address. -. Count all the arp packets for each host, including sen and recieved arp packets. 2. System Requirement. ------------------------------------ -. Local : Windows XP/2000/2003(But I hadn't tested it under Windows XP/2003) -. Remote : All computers including network devices -. WinPcap driver 3.1/lastest must be needed. 3. What's New ------------------------------------ + It can detect attacking actions. + Add serval scanning mode. + It can update the host list from ip packets. 4. Getting Started ------------------------------------ -. Firtly, install the latest WinPcap driver. -. second, just run WinArpAttacker.exe -. click scan button and start button -. look at arp information on remote computer with "arp -a" -. to stop attack, click stop button. -. to select adapter or ip address, click options button. -. to modify attacking setup, click options button. 5. Known Issues 1) This program should be run with the administrator privilege. If not, the program will work abnormally. 2) The attacking action is dangerous, so you must be caution. 3) If there are many active hosts (more than 50) and the real gateway may be down on LAN. 6. Revision History ------------------------------------ = bug fixed + improvement/modification [Start of Versions History] Version 3.00 ( Oct. 07, 2005) -------------------------------- + It can detect attacking actions. + Add serval scanning mode. + It can update the host list from ip packets. Version 1.50 ( May. 16, 2005) -------------------------------- + It can scan the Lan regularly for new computer list. + It can update the computer list in passive mode using sniffing technology, that is, it can update the computer list from the sender's address of arp request packets without scanning the lan. + Add two options: auto scan and update in passive mode. + It can diplay localhost's ip address , mac address, gateway ip address and current computer list status on status bar. + Add taskbar icon support, if you close the WinArpAttacker's window, it will leave a icon on taskbar, not really close, thus it can update computer list on the background. Version 1.10 ( April. 27, 2005) -------------------------------- + Support DHCP and fixed ip address. = When flood attack started, to click stop can't really stop flood attacking. = IP address is incorrectly sorted when 10.1.0.1 and 192.168.1.1 coexists. = When PacketSendPacket failed, to exit program will encounter an invalid operator. Version 1.00 ( April. 16, 2005) -------------------------------- This program is released. [End of Versions History] 7. To do none now, if you have good advice you can mailto me(asia_message@hotpop.com). >> 下载 << |
