Skip to content

Instantly share code, notes, and snippets.

from netfilterqueue import NetfilterQueue
import subprocess
import signal
import dpkt
import traceback
import socket
import sys
TARGET_IP = '173.252.110.27'
@fqrouter
fqrouter / half_stream_filtering_observer.py
Created January 18, 2013 15:04
we send the packet through GFW without reaching facebook, it still can trigger GFW returning FAKE ACK and FAKE RESET
import dpkt
import socket
import binascii
hex_ip_packets = [
'binascii.hexlify output of SYN' # replace with your own captured output
'binascii.hexlify output of HTTP GET' # replace with your own captured output
]
raw_socket = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_RAW)
if [ -f /tmp/skip-only-enable-connectable-sta-mode-wifi-interface ] ; then
logger -s -t fqrouter skip-only-enable-connectable-sta-mode-wifi-interface found
return
fi
if [ "remove" == "$ACTION" -a "wlan0" == "$INTERFACE" ] ; then
/etc/init.d/disable_sta_mode_wifi_interfaces start
fi
if [ "add" == "$ACTION" -a "wlan0" == "$INTERFACE" ] ; then
logger -s -t fqrouter try to bring up sta mode wifi interface
@fqrouter
fqrouter / probe_fake_dns_response.py
Last active December 12, 2015 03:09
GFW 定位原理性脚本
from scapy.all import *
import time
dst = sys.argv[1]
src = ''
for ttl in range(1, 15):
send(IP(dst=dst,src=src,id=ttl,ttl=ttl)/UDP()/DNS(rd=1,qd=DNSQR(qname="www.twitter.com")))
send(IP(dst=dst,src=src,id=ttl,ttl=ttl)/TCP(dport=80,sport=8081)) # 非必要参照物
time.sleep(2)
@fqrouter
fqrouter / probe_dns_fake_response.py
Last active December 12, 2015 04:29
using udp socket and icmp socket which works on OpenVZ venet networking environment
import socket
import dpkt.ip
import dpkt.dns
import sys
import os
dst = sys.argv[1]
udp_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM, socket.IPPROTO_UDP)
udp_socket.settimeout(2)
icmp_socket = sock = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_ICMP)
@fqrouter
fqrouter / probe_tcp_packet_drop.py
Created February 5, 2013 16:07
probe if the router is dropping tcp packet for specific source port
import socket
import dpkt
import sys
dst = sys.argv[1]
sport1 = 8080
sport2 = 8081
icmp_socket = sock = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_ICMP)
icmp_socket.settimeout(2)
trace = []
#!/usr/bin/env python
import socket
import re
import struct
import random
import sys
# Generate random ip from ip range of specific network carrier
# It is useful because for same carrier, GFW tend to install device in a very narrow ip range
# There are at least 6 major network carriers in China which have GFW attached to its boarder gateway
@fqrouter
fqrouter / tcpdump_wrapper.py
Created February 9, 2013 02:31
make tcpdump output to stdout and use dpkt to parse the pcap file captured
@contextlib.contextmanager
def capture(ifname, src, dst):
events = []
filter = '(host %s and host %s) or icmp[0] = 11' % (src, dst)
p = subprocess.Popen(
['tcpdump', '-i', ifname, '-w', '-', filter],
stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE)
try:
yield events
finally:
class TcpdumpSniffer(object):
def __init__(self, iface, src, dst):
self.iface = iface
self.src = src
self.dst = dst
self.packets = []
def start_sniffing(self):
self.pcap_file_path = tempfile.mktemp()
filter = '(dst host %s and src host %s) or icmp' % (self.src, self.dst)
ERROR_NO_DATA = 11
class L3Sniffer(threading.Thread):
def __init__(self, src, dst):
super(L3Sniffer, self).__init__()
self.daemon = True
self.src = src
self.dst = dst
self.started = threading.Event()
self.started.clear()