Question

我正在尝试使用以下代码捕获并发送信标帧

def SniffIncomingProbes():

#create a general socket to monitor ongoing traffic
sniffer = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, socket.htons(0x0003))
sniffer.bind((interface, 0x0003))


#byte [30] in the packet is the packet type/subtype field
#\x40 is a probe request, \x80 is a beacon probe
while True: 
    if frame_subtype==8:
        packet =  sniffer.recvfrom(2048)[0]


        if packet[30] == "\x80":
            #byte [67] in the packet contains the length of the SSID
            SSID = packet[68: 68 + ord(packet[67])]
            MAC  = packet[40:46].encode('hex')
            association_set.add((MAC,SSID)) 
            PrintNicely()
            #try and send a beacon on my own
            if len(SSID) == 4:
                newPacket = packet[:68] + "MOSS" + packet[72:]      
                newPacket = newPacket[:46] + ("\xAC\xDC\xDE\xAD\xBE\xEF") + newPacket[52:]

                #get the FRC into unsigned form, convert to a
                #string, and remove the "0x" characters in the beginning of the string
                FCS = str(hex(abs(binascii.crc32(newPacket[:len(packet)-4]))))[2:]          

                if len(FCS)%2 == 1:
                    FCS = "0" + FCS
                print FCS
                print len(FCS)
                newPacket = newPacket[:len(newPacket)-4]+ FCS.decode("hex")

                sniffer.send(newPacket)

    elif frame_subtype==4:
        packet =  sniffer.recvfrom(2048)[0]

        if packet[30] == "\x40":
            #byte [55] in the packet contains the length of the SSID
            SSID = packet[56: 56 + ord(packet[55])]
            MAC  = packet[40:46].encode('hex')
            association_set.add((MAC,SSID)) 
            PrintNicely()

当我运行Wireshark和airodump时，我可以看到SSID为“MOSS”的数据包通过，它显示为airodump上的信标。然而，当我在远程计算机上运行Windows网络监视器时，我看不到这些数据包通过。另外，我的CRC校验和似乎是错误的（用wireshark检查）。好像我没有正确发送数据包而FCS检查失败

任何输入将不胜感激，提前谢谢你。

更新帧序列检查（FSC）返回 Good ，并且不再由wireshark标记，但数据包仍未传输到网络上的任何远程计算机。

我将FSC代码更改为：

def FSCCheckSum(data):

    #get the crc32 checksum of the data, 
    #without the radiotap header(first 30 bytes) and the FSC (last 4 bytes) 
    #and change it to unsigned form
    #convert the hex representation to a string
    #and remove the "0x" characters at the beginning of the string

    FSC = binascii.crc32(data[30:-4]) % (1<<32)
    FSC = str(hex(FSC))[2:]

    #we might get zeroes(not showing) from the left, 
    #so we pad the number from the left with "0"s to match 4 bytes(4 hex pairs)
    FSC = "0" * (8-len(FSC)) + FSC

    #reverse the byte ordering
    return FSC.decode("hex")[::-1]

所以我只使用以下代码来修改数据包。 * 注意我现在也改变了源地址

newPacket = packet[:68] + "MOSS" + packet[72:]                  
newPacket = newPacket[:40] + ("\xAC\xDC\xDE\xAD\xBE\xEF") + newPacket[46:]
newPacket = newPacket[:46] + ("\xAC\xDC\xDE\xAD\xBE\xEF") + newPacket[52:]
newPacket = newPacket[:-4] + FSCCheckSum(newPacket)
sniffer.send(newPacket)

（我将它与BSSID分开设置，以便更容易阅读和理解，我知道它可以合并）

python广播802.11帧，使用套接字模块

0 个答案: