如何伪造数据包？

write2me 2012-03-08 11:59:13



GET /Item/vote.asp?m=111&id=342 HTTP/1.1



Host: tp.tongxinjiaoyu.com



Connection: keep-alive



User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.46 Safari/535.11



Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8



Referer: http://tp.tongxinjiaoyu.com/html/bbtp/bbtp_1220_342.html



Accept-Encoding: gzip,deflate,sdch



Accept-Language: zh-CN,zh;q=0.8



Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3



Cookie: ASPSESSIONIDCASADTTC=AAJDAIJDMOGDLAAMDMMFJKPC







HTTP/1.1 200 OK



Date: Thu, 08 Mar 2012 15:32:33 GMT



Server: Microsoft-IIS/6.0



X-Powered-By: ASP.NET



Content-Length: 154



Content-Type: text/html



Cache-control: private







<script language=JavaScript>



alert('........342..............');location.replace('http://tp.tongxinjiaoyu.com/html/bbtp/bbtp_1220_342.html')



</script>



GET /favicon.ico HTTP/1.1



Host: tp.tongxinjiaoyu.com



Connection: keep-alive



Accept: */*



User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.46 Safari/535.11



Accept-Encoding: gzip,deflate,sdch



Accept-Language: zh-CN,zh;q=0.8



Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3



Cookie: ASPSESSIONIDCASADTTC=AAJDAIJDMOGDLAAMDMMFJKPC







HTTP/1.1 404 Not Found



Content-Length: 1308



Content-Type: text/html



Server: Microsoft-IIS/6.0



X-Powered-By: ASP.NET



Date: Thu, 08 Mar 2012 15:32:34 GMT







<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">



<HTML><HEAD><TITLE>............</TITLE>



<META HTTP-EQUIV="Content-Type" Content="text/html; charset=GB2312">



<STYLE type="text/css">



  BODY { font: 9pt/12pt .... }



  H1 { font: 12pt/15pt .... }



  H2 { font: 9pt/12pt .... }



  A:link { color: red }



  A:visited { color: maroon }



</STYLE>



</HEAD><BODY><TABLE width=500 border=0 cellspacing=10><TR><TD>







<h1>............</h1>



................................................



<hr>



<p>................</p>



<ul>



<li>........................................................</li>



<li>................................................................................



</li>



<li>....<a href="javascript:history.back(1)">....</a>....................</li>



</ul>



<h2>HTTP .... 404 - ..................<br>Internet ........ (IIS)</h2>



<hr>



<p>..............................</p>



<ul>



<li>.... <a href="http://go.microsoft.com/fwlink/?linkid=8180">Microsoft ............</a>..........“HTTP”..“404”........</li>



<li>....“IIS ....”...... IIS ...... (inetmgr) ........................“........”..“............”..“..................”........</li>



</ul>







</TD></TR></TABLE></BODY></HTML>



GET /Item/GetVote.asp?m=111&ID=342 HTTP/1.1



Host: tp.tongxinjiaoyu.com



Connection: keep-alive



User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.46 Safari/535.11



Accept: */*



Referer: http://tp.tongxinjiaoyu.com/html/bbtp/bbtp_1220_342.html



Accept-Encoding: gzip,deflate,sdch



Accept-Language: zh-CN,zh;q=0.8



Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3



Cookie: ASPSESSIONIDCASADTTC=AAJDAIJDMOGDLAAMDMMFJKPC







HTTP/1.1 200 OK



Date: Thu, 08 Mar 2012 15:32:36 GMT



Server: Microsoft-IIS/6.0



X-Powered-By: ASP.NET



Content-Length: 20



Content-Type: text/html



Cache-control: private







document.write('1');GET /plus/ajax.asp?action=SQL&labelid=SQLksu%u540D%u6B21ksl342ksr342p20123036732259%7D&labtype=0&channelid=0&classid=20123036732259}&infoid=342 HTTP/1.1



Host: tp.tongxinjiaoyu.com



Connection: keep-alive



User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.46 Safari/535.11



Accept: */*



Referer: http://tp.tongxinjiaoyu.com/html/bbtp/bbtp_1220_342.html



Accept-Encoding: gzip,deflate,sdch



Accept-Language: zh-CN,zh;q=0.8



Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3



Cookie: ASPSESSIONIDCASADTTC=AAJDAIJDMOGDLAAMDMMFJKPC







HTTP/1.1 200 OK



Date: Thu, 08 Mar 2012 15:32:36 GMT



Server: Microsoft-IIS/6.0



X-Powered-By: ASP.NET



pragma: no-cache



Content-Length: 3



Content-Type: text/html; Charset=gb2312



Expires: Wed, 07 Mar 2012 15:32:36 GMT



Cache-control: no-cache

156

上面是我在一个投票系统中抓的包，通过抓包我发现投票时用get方法，传递的是“m=111&id=342”的这样参数，并没有传递IP地址，而实际上这个投票系统做了一个IP的限制，即如果某个IP下投票之后不能再投票了。所以，我猜肯定是在服务器端利用request对象查询到了投票者的IP（这个方法是有的吧）。我现在想，如果想刷票的话只要突破这个IP限制就可以了，可以通过发送假的数据包啊，于是我想我现在构造了一个IP报文（里面IP报文头部填写一个假的IP地址），然后通过socket发送到对方80端口。后来又想了一下，服务器80端口接收到的socket会去提取封装的这个假IP地址还是。。。？想到这块想不明白了，故在此问一下大家，这个究竟是怎么玩的？

...全文