search

SpiderLabs / thicknet

TCP session interception and injection framework
GNU General Public License v3.0
56 stars 15 forks source link

Vamp hangs with IP Ranges #4

Closed ravenium closed 13 years ago

ravenium commented 13 years ago

When attempting to ARP poison IP ranges (not CIDR or individual IPs), the script hangs under Backtrack 4 R2. Have not tested on other OS yet. Individual IPs (1.2.3.4 1.2.3.5) and CIDR (1.2.3.4 1.2.3.1/24) seem to work fine.

Sample syntax:

perl vamp.pl 192.168.1.10-15 192.168.1.1 eth0

silence

I can watch a tcpdump if this helps to see if anything is being performed.

nosteve commented 13 years ago

I got the other syntax to work using quotes:

perl vamp.pl "192.168.1.91 - 192.168.1.93" 192.168.1.94 eth0

This also works:

perl vamp.pl "192.168.1.91 + 2" 192.168.1.94 eth0

the "192.168.1.10-15" syntax isn't supported by Net::IP, so it won't work for us either yet.

nosteve commented 13 years ago

Updated usage to include this:

If using a syntax with spaces, make sure to enclose with quotes: vamp.pl "192.168.2.10 + 5" 192.168.2.1 eth0

ravenium commented 13 years ago

That makes sense - basically you just need complete ranges (not ettercap-ish) or individual IPs, encased by quotes. Am guessing it populates the 0+5+2 business based on the last octet, so you couldn't do "192.168.2.10 + 3.14" on a /16 network or something. Not a huge issue, I'd just be curious how that sucker gets parsed.

Thanks!