Forum Replies Created

Viewing 4 posts - 1 through 4 (of 4 total)
  • Author
    Posts
  • September 20, 2008 at 11:47 pm in reply to: Packet Injection – Solved #6690
    HennieP
    Participant

    Disregard the last statement about tunnel mode. It is working 100% in all modes now. My test code was a mess with all the changing and adding so I cleaned everything up and repaired some loops and now it works great. :mrgreen:

    September 20, 2008 at 9:12 pm in reply to: Packet Injection – Solved #6689
    HennieP
    Participant

    I did it!

    You can not believe the simple little errors you pick up when you start checking every last number that is generated. My seq+ack formula was correct but it turns out the ntohl (uint32) function I used was bogus. .NET has NetworkToHostOrder functions but they dont work with UINT types (VB.NET) so I had to use a custom bit swap function to do the job. That function was all wrong!

    All of this works 100% in listen mode now. I can reset server to which request was sent and display custom page.

    Now all I need is to figure out why it does not work in tunnel mode. I have an idea about this though. I think in tunnel mode the packet is stopped before syn ack ack handshaking so server can’t respond to reset request.

    Any ideas?

    September 20, 2008 at 1:58 pm in reply to: Packet Injection – Solved #6688
    HennieP
    Participant

    Finally some success!!

    I had a casting error in my checksum functions. I calculated the checksums by hand and I saw that I was getting the wrong values. It seems that you MUST cast a byte value to unsigned short in .Net to do the bit shifting.

    If I switch from tunnel mode to listen mode everything works! I read packet and send reset and google dies an instant death. Now I just need to get that blockpage to display but I’m sure that is a problem with the seq/ack numbers.

    Is there no way to do all this in tunnel mode?

    September 19, 2008 at 6:31 pm in reply to: Packet Injection – Solved #6687
    HennieP
    Participant

    Hmm, I checked the response header for Google and it’s not going to be that easy.

    It sends response which just says the data will follow next in gzip compressed format so I will have to implement a compression library to check actual content.

    You have given me an idea though. I will check outgoing packets for censored words and if any is found add the dest ip to a list. Then I can match incoming response packages to the list and inject them with redirect string and then remove the ip from the list again.

    Does this sound right?

  • Author
    Posts
Viewing 4 posts - 1 through 4 (of 4 total)