EV: IDS Evasion via Packet Manipulation

Related tags

Networkingev
Overview

EV: IDS Evasion via TCP/IP Packet Manipulation

中文文档

Introduction

EV is a tool that allows you crafting TCP packets and leveraging some well-known TCP/IP packet manipulation techniques to evade IDS devices.

It supports HTTP protocol but unfortunately not HTTPS protocol. The handshake process of TLS is quite complecated and I haven't figure out how to craft TLS packets elegantly.

This tools is written in Python and QT5, using Scapy to make packets. So though this software is tested on Windows platform only, it theoretically works on other platforms like Linux or MacOS.

Setup&run

Run following commands in your cmd/terminal to pull the latest version of the software and install required python packages:

git clone https://github.com/TomAPU/ev.git
cd ev
pip3 install -r requirements.txt

Run this command to start the software:

python3 ev.py

or you can click run.bat in the root directory of the software to start it.

Basic Usage

Fill IP,Port,and Payload field and click "Send" button to send the TCP packet to target. You can also set TCP options and source port. Remeber that TCP options are tcp options supported by scapy.

You can view response packets in "Received packets" window and click packet to view it in "View Received Packet" window. This is implemented by scapy's sniff() function, it finds packets that matches the target IP or is ICMP protocol(so that you can find TTL exceeded packets). However, sniff() sometimes records packets duplicately.So I strongly recommend users use WireShark if you've installed one to see received packets.

Request Split

You can use TCP Segmentation and IP Fragmentation to break the TCP packet into pieces and send them to target. This may defeats IDS devices which doesn't support TCP/IP reassembly.

Increasing wait time or sending packets out of order may also circumvent IDS devices who has a very limited capability in TCP/IP reassembly.

Sending Distractor Packets

Distractor packets are packets that might be ignored by target and be recognized by IDS devices.

Small TTL distractor packets are packets' TTL are subtracted to 0 between IDS device and the target. The target will not receive this packet because the packet has been dropped before reaching the target. But IDS might think that the packet arrives the target. Therefore, sending small TTL distractor packets containing junk data or RST flag may distract the process of reassembling TCP packets, leading to an evasion.

Bad Checksum packets are packets with wrong TCP checksum. Packets with wrong checksum are ignored by target, but IDS devices may not calculate checksum and reassemble all packets directly, which leads to an evasion.

Corrupt ack distractor packets are packets' ACK field is corrupted. The target ignore such packets because of the wrong ACK field, but IDS might reassemble all packets directly, which leads to an evasion.

English Document

介绍

EV是一个通过各种著名的TCP/IP报文操纵技术实现IDS绕过的工具。你可以用它自定义TCP包并且利用其中内置的逃逸手段对IDS执行测试。

当前支持HTTP协议但是不支持HTTPS协议,HTTPS协议的握手比较复杂,我还没搞懂怎么优雅地构造TLS包。

这个工具是用 Python 和 QT5 编写的,使用 Scapy 来制作数据包。 因此,虽然该软件仅在 Windows 平台上进行了测试,但理论上它可以在 Linux 或 MacOS 等其他平台上运行。

安装&运行

在CMD或者终端中运行如下命令来获取最新版本的软件并且安装所需的Python包:

git clone https://github.com/TomAPU/ev.git
cd ev
pip3 install -r requirements.txt

运行如下命令启动程序

python3 ev.py

或者你可以点击软件根目录下的run.bat 文件打开程序。

基本使用

填写IP、Port和Payload字段,点击 "发送 "按钮,将TCP数据包发送到目标。您还可以设置TCP选项和源端口。请注意,TCP选项是scapy支持的TCP选项。

您可以在 "Received packets"窗口查看响应数据包,点击数据包在 "View Received Packet"窗口查看。这个功能由scapy的sniff()函数实现的,它找到与目标IP相匹配的数据包,或者是ICMP协议的数据包(这样你可以找到因为TTL过期而返回的ICMP包)。然而,sniff()有时会重复记录数据,所以如果安了Wireshark,我强烈建议用户使用WireShark而不是这个

请求拆分

你可以使用TCP分段和IP分片,将TCP数据包分成几块并发送给目标。这可能会使不支持TCP/IP重组的IDS设备失效。

也可以增加等待时间或不按顺序发送数据包,这样可能规避在TCP/IP重组能力非常有限的IDS设备。

发送干扰包

干扰包是被目标忽略而被IDS设备识别的数据包。

TTL过小的干扰包是指在IDS设备和目标之间的TTL被减为0的数据包。目标不会收到这个数据包,因为该数据包在到达目标之前因为TTL为0而已经被丢弃。但IDS可能认为该数据包到达了目标。因此,发送含有垃圾数据或RST标志的TTL过小的干扰包可能会让IDS重组出错,导致绕过。

坏校验数据包是具有错误TCP校验的数据包。具有错误校验和的数据包会被目标忽略,但IDS设备可能不会计算校验和并直接重新组装所有数据包,这导致了绕过。

坏ACK干扰数据包是指数据包具有错误的ACK字段。目标忽略这些ACK错误的包,但IDS可能会直接重新组装所有的数据包,这可能导致绕过。

ARTEMIS: Real-Time Detection and Automatic Mitigation for BGP Prefix Hijacking.

ARTEMIS: Real-Time Detection and Automatic Mitigation for BGP Prefix Hijacking. This is the main ARTEMIS repository that composes artemis-frontend, artemis-backend, artemis-monitor and other needed c

INSPIRE Group @FORTH-ICS 273 Jan 01, 2023
ThorFI: A Novel Approach for Network Fault Injection as a Service

ThorFI: a Novel Approach for Network Fault Injection as a Service This repo includes ThorFI, a novel fault injection solution for virtual networks in

DESSERT research lab (Federico II University of Naples, Italy) 6 Dec 14, 2022
QUIC and HTTP/3 implementation in Python

aioquic What is aioquic? aioquic is a library for the QUIC network protocol in Python. It features a minimal TLS 1.3 implementation, a QUIC stack and

1.2k Dec 29, 2022
NSX-T infrastructure as code - SDDC deployment

Deploy NSX-T Infrastructure - Simple Topology by Nicolas MICHEL @vpackets / LinkedIn Introduction The purpose of this entire repository is to automate

21 Nov 28, 2022
Light, simple RPC framework for Python

Agileutil是一个Python3 RPC框架。基于微服务架构,封装了rpc/http/orm/log等常用组件,提供了简洁的API,开发者可以很快上手,快速进行业务开发。

16 Nov 22, 2022
PyBERT is a serial communication link bit error rate tester simulator with a graphical user interface (GUI).

PyBERT PyBERT is a serial communication link bit error rate tester simulator with a graphical user interface (GUI). It uses the Traits/UI package of t

David Banas 59 Dec 23, 2022
Ping IP addresses and domains in parallel to find the accessible and inaccessible ones.

🚀 IPpy Parallel testing of IP addresses and domains in python. Reads IP addresses and domains from a CSV file and gives two lists of accessible and i

Shivam Mathur 54 May 21, 2022
A Network tool kit for scanning active IP addresses and open ports

Network scanner A small project that I wrote on the fly for (IT351) Computer Networks University Course to identify and label the devices in my networ

Mohamed Abdelrahman 10 Nov 07, 2022
Way find out if DNS is down or your instance

DNS-PING Way to find out if DNS is down or your instance Problem: At times it happens that DNS provider services of a website URL is down and so to re

Giten Mitra 4 Nov 18, 2022
Synchronised text editor over TCP, for live editing with others.

SyncTEd Synchronised text editor over TCP, for live editing with others. Written in Python with PyGame. Run Install requirements: pip install -r requi

Marko Živić 1 May 13, 2022
This python script can change the mac address after some attack

MAC-changer Hello people, this python script was written for people who want to change the mac address after some attack, I know there are many ways t

5 Oct 10, 2022
MQTT Explorer - MQTT Subscriber client to explore topic hierarchies

mqtt-explorer MQTT Explorer - MQTT Subscriber client to explore topic hierarchies Overview The MQTT Explorer subscriber client is designed to explore

Gambit Communications, Inc. 4 Jun 19, 2022
Discord RPC Generator With Python

Discord-RPC-Generator Thank you for using this Discord Custom RP Generator. This is 100% safe and open source. Download Discord for your computer here

1 Nov 09, 2021
Home Assistant integration for MyEnergi devices

myenergi for Home Assistant myenergi custom component for Home Assistant This is a very early release, will add more documentations soon! This compone

Johan Isacsson 70 Dec 18, 2022
BaseSpec is a system that performs a comparative analysis of baseband implementation and the specifications of cellular networks.

BaseSpec is a system that performs a comparative analysis of baseband implementation and the specifications of cellular networks. The key intuition of BaseSpec is that a message decoder in baseband s

SysSec Lab 35 Dec 06, 2022
订阅转换,添加免流host

普通订阅转免流订阅 原理 将原来的订阅解析后添加免流host 使用方法 服务器域名/&&订阅链接&&免流host&&转换后服务器前缀 我这里已经在服务器上搭建好了

163 Apr 01, 2022
A python 3 library which helps in using nmap port scanner.

A python 3 library which helps in using nmap port scanner. This is done by converting each nmap command into a callable python3 method or function. System administrators can now automatic nmap scans

Nmmapper 179 Dec 19, 2022
Interact remotely with the computer using Python and MQTT protocol 💻

Comandos_Remotos Interagir remotamento com o computador através do Python e protocolo MQTT. 💻 Status: em desenvolvimento 🚦 Objetivo: Interagir com o

Guilherme_Donizetti 6 May 10, 2022
Very simple and tiny file sharing service written in python

Simple File sharing tool Sharing client usage (You will need to use python3 for linux) main.py --send -f file/path Optionnal flags : pwd : set a passw

2 Jul 26, 2022
Uses machine learning to scan the similarity of two texts

PlagiarismChecker Uses machine learning to scan the similarity of two documents. End Points: http://localhost:3000/register (create a/c) http://localh

Elvis Chege 2 Aug 10, 2022