Skip to content

Fixing source ip#1005

Merged
Mzack9999 merged 6 commits intodevfrom
bufgix-990-source-ip
May 9, 2024
Merged

Fixing source ip#1005
Mzack9999 merged 6 commits intodevfrom
bufgix-990-source-ip

Conversation

@Mzack9999
Copy link
Copy Markdown
Member

@Mzack9999 Mzack9999 commented Mar 18, 2024

Closes #990

Todos:

  • Latest Linux kernel seems to override/rewrite TCP/UDP headers if custom options are used (ex. custom ip)
  • In case custom ip and interface are specified naabu should go one level down to L2 and bypass the kernel (Info to infer: souce MAC, destination MAC, Gateway IP)

Example

Add secondary address:

$ ip address add 30.0.0.1/32 dev eth0

Nmap:

# nmap -p 80 -S 30.0.0.1 188.42.216.83 -Pn -e eth0
...
# tcpdump -n host 188.42.216.83
10:46:06.351401 IP 30.0.0.1.54407 > 188.42.216.83.80: Flags [S], seq 1184607835, win 1024, options [mss 1460], length 0
10:46:07.352534 IP 30.0.0.1.54409 > 188.42.216.83.80: Flags [S], seq 1184476761, win 1024, options [mss 1460], length 0

Naabu

# ./naabu -host 188.42.216.83 -source-ip 30.0.0.1 -i eth0 -port 80 -debug -Pn
...
# tcpdump -n host 188.42.216.83
10:50:39.161762 IP 30.0.0.1.35757 > 188.42.216.83.80: Flags [S], seq 0, win 1024, options [mss 1460], length 0
10:50:39.161797 IP 30.0.0.1.35757 > 188.42.216.83.80: Flags [S], seq 1, win 1024, options [mss 1460], length 0
10:50:39.161806 IP 30.0.0.1.35757 > 188.42.216.83.80: Flags [S], seq 2, win 1024, options [mss 1460], length 0

@Mzack9999 Mzack9999 added the Type: Bug Inconsistencies or issues which will cause an issue or problem for users or implementors. label Mar 18, 2024
@Mzack9999 Mzack9999 self-assigned this Mar 18, 2024
@Mzack9999 Mzack9999 linked an issue Mar 19, 2024 that may be closed by this pull request
@Mzack9999 Mzack9999 marked this pull request as ready for review March 19, 2024 12:49
@Mzack9999 Mzack9999 requested a review from dogancanbakir March 19, 2024 12:50
@dogancanbakir
Copy link
Copy Markdown
Member

dogancanbakir commented Mar 20, 2024

nmap:

$ nmap -p 80 -S 30.0.0.1 188.42.216.83 -Pn -e en0
...
$ tcpdump -n host 188.42.216.83
15:43:01.301878 IP 30.0.0.1.53957 > 188.42.216.83.80: Flags [S], seq 1524061434, win 65535, options [mss 1460,nop,wscale 6,nop,nop,TS val 396366718 ecr 0,sackOK,eol], length 0
15:43:02.302677 IP 30.0.0.1.53957 > 188.42.216.83.80: Flags [S], seq 1524061434, win 65535, options [mss 1460,nop,wscale 6,nop,nop,TS val 396367719 ecr 0,sackOK,eol], length 0

naabu:

$ go run .-host 188.42.216.83 -source-ip 30.0.0.1 -i en0 -port 80 -debug -Pn
...
$ tcpdump -n host 188.42.216.83
15:48:50.496326 IP 192.168.50.13.54057 > 188.42.216.83.80: Flags [S], seq 1500303991, win 65535, options [mss 1460,nop,wscale 6,nop,nop,TS val 2096519124 ecr 0,sackOK,eol], length 0
15:48:50.564183 IP 188.42.216.83.80 > 192.168.50.13.54057: Flags [S.], seq 71956256, ack 1500303992, win 65160, options [mss 1452,sackOK,TS val 4076747498 ecr 2096519124,nop,wscale 7], length 0

tested on Mac.

Copy link
Copy Markdown
Member

@ehsandeep ehsandeep left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

merge conflict

@Mzack9999 Mzack9999 requested a review from ehsandeep May 8, 2024 16:45
@dogancanbakir
Copy link
Copy Markdown
Member

@Mzack9999 I still get the same result -testing on Mac, following exactly the same steps.

@Mzack9999
Copy link
Copy Markdown
Member Author

cross-posting linux repro steps:

$ docker run -it --cap-add=NET_ADMIN ubuntu:23.10 bash
# apt update
# apt install apt install golang build-essential git wget curl zip unzip net-tools iproute2 tcpdump libpcap-dev
# ip address add 30.0.0.1/32 dev eth0
# git clone https://github.com/projectdiscovery/naabu.git
# cd naabu/v2/cmd/naabu/
# git checkout bufgix-990-source-ip
# go build .
# ./naabu -host 188.42.216.83 -source-ip 30.0.0.1 -i eth0 -port 80 -debug -Pn

With another session in the same docker container;

$ docker ps
ubuntu xxx ...
$ docker exec -it xxx bash
# tcpdump -n host 188.42.216.83
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
06:34:08.276865 IP 30.0.0.1.40955 > 188.42.216.83.80: Flags [S], seq 0, win 1024, options [mss 1460], length 0
06:34:08.277043 IP 30.0.0.1.40955 > 188.42.216.83.80: Flags [S], seq 1, win 1024, options [mss 1460], length 0
06:34:08.277097 IP 30.0.0.1.40955 > 188.42.216.83.80: Flags [S], seq 2, win 1024, options [mss 1460], length 0

@dogancanbakir
Copy link
Copy Markdown
Member

Yes, it works for linux - maybe we should add a small note that says it may not work for osx.

@Mzack9999 Mzack9999 merged commit 99ca209 into dev May 9, 2024
@Mzack9999 Mzack9999 deleted the bufgix-990-source-ip branch May 9, 2024 11:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Type: Bug Inconsistencies or issues which will cause an issue or problem for users or implementors.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

-source-ip is ignored

3 participants