Packet injection

src: i.ytimg.com

Packet injection (also known as forging packets or spoofing packets) is a computer networking term that refers to the process of interfering with an established network connection, by means of constructing packets to appear as if they are part of the normal communication stream. The packet injection process allows an unknown third party to disrupt or intercept packets from the consenting parties that are communicating, which can lead to degradation or blockage of users' ability to utilize certain network services or protocols. Packet injection is commonly used in man-in-the-middle attacks and denial-of-service attacks.

Video Packet injection

Capabilities

By utilizing raw sockets, NDIS function calls, or direct access to a network adapter kernel mode driver, arbitrary packets can be constructed and injected into a computer network. These arbitrary packets can be constructed from any type of packet protocol (ICMP, TCP, UDP, and others) since there is full control over the packet header while the packet is being assembled.

Maps Packet injection

General procedure

• Create a raw socket
• Create an Ethernet header in memory
• Create an IP header in memory
• Create a TCP header or UDP header in memory
• Create the injected data in memory
• Assemble (concatenate) the headers and data together to form an injection packet
• Compute the correct IP and TCP or UDP packet checksums
• Send the packet to the raw socket

src: slideplayer.com

Uses

Packet injection has been used for:

• Disrupting certain services (file sharing or HTTP) by Internet service providers and wireless access points
• Compromising wireless access points and circumventing their security
• Exploiting certain functionality in online games
• Determining the presence of internet censorship
• Allows for custom packet designers to test their custom packets by directly placing them onto a computer network
• Simulation of specific network traffic and scenarios
• Testing of network firewalls and intrusion detection systems
• Computer network auditing and troubleshooting computer network related issues

src: i.ytimg.com

Detecting packet injection

Through the process of running a packet analyzer or packet sniffer on both network service access points trying to establish communication, the results can be compared. If point A has no record of sending certain packets that show up in the log at point B, and vice versa, then the packet log inconsistencies show that those packets have been forged and injected by an intermediary access point. Usually TCP resets are sent to both access points to disrupt communication.

src: seclist.us

Software

• lorcon, part of Airpwn
• KisMAC
• pcap
• Winsock
• CommView for WiFi Packet Generator
• Scapy
• Kali Linux (BackTrack was the predecessor)
• NetHunter (Kali Linux on for Android)

src: i.ytimg.com

See also

• Packet capture
• Packet generation model
• Raw socket
• Packet crafting
• Packet sniffer

src: i.ytimg.com

External links

• Packet Injection using raw sockets

src: www.eff.org

References

Source of the article : Wikipedia