菜鸟分析网络数据：网络执法官分析 （1）

领测软件测试网

如果没有回应,那netbug就会把网关的MAC做为对方的MAC

然后封装ethern网包.发送出去.

OK,原理就说到这里,大家看出什么漏洞了吗?

对,如果我门在arp缓存里修改网关的mac那.netbug就上去网了.

那如何远程去修改对方的arp缓存呢?

有办法.

就是arp的一个属性.免费arp.

1.一个主机可以通过她来确定另一个主机是否设置了相同的IP地址.

2.如果发送免费ARP的主机正好改变了硬件地址.那这个分组就可以更新其它主机缓存中的硬件地址.

C:\>arp /?

Displays and modifies the IP-to-Physical address translation tables used by

address resolution protocol (ARP).

ARP -s inet_addr eth_addr [if_addr] <===添加arp条目

ARP -d inet_addr [if_addr] <====删除arp条目

ARP -a [inet_addr] [-N if_addr] <====显示arp条目

-a Displays current ARP entries by interrogating the current

protocol data. If inet_addr is specified, the IP and Physical

addresses for only the specified computer are displayed. If

more than one network interface uses ARP, entries for each ARP

table are displayed.

-g Same as -a.

inet_addr Specifies an internet address.

-N if_addr Displays the ARP entries for the network interface specified

by if_addr.

-d Deletes the host specified by inet_addr. inet_addr may be

wildcarded with * to delete all hosts.

-s Adds the host and associates the Internet address inet_addr

with the Physical address eth_addr. The Physical address is

given as 6 hexadecimal bytes separated by hyphens. The entry

is permanent.

eth_addr Specifies a physical address.

if_addr If present, this specifies the Internet address of the

interface whose address translation table should be modified.

If not present, the first applicable interface will be used.

Example:

> arp -s 157.55.85.212 00-aa-00-62-c6-09 .... Adds a static entry.

> arp -a .... Displays the arp table.

C:\>

<<上一页 1 2 3 4 下一页>>

文章来源于领测软件测试网 https://www.ltesting.net/