Intranet traffic interception method, medium and terminal

Abstract

The invention is applicable to the technical field of network security, and relates to an intranet traffic interception method, a medium and a terminal, which can be used for intercepting and capturing an intranet traffic without depending on high-risk vulnerabilities of an attacked device, an intranet switch and an intranet router system or application and a third-party professional traffic monitoring system on the premise of remote non-physical contact with the attacked device. An attacker only needs to access the intranet based on the TCP / IP underlying network combination attack concept, the purpose of intercepting and capturing the flow of the attacked equipment can be achieved, the conditions for initiating attacks to the intranet are greatly reduced, the attack purpose of intercepting and monitoring the flow of the intranet based on the black box current situation can be truly achieved, and the method is wide in application range, wide in attack object coverage and high in practicability. In addition, the method has concealment, after the attack is successful, the existing service operation of the attacked equipment is not influenced, the flow of the attacked equipment is normally transmitted and received, and meanwhile, the attacked equipment is difficult to find that the flow of the attacked equipment is intercepted and monitored, so that the method promotes defense by attack, and better maintains the safety of a network bottom layer.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to an intranet flow interception method, medium and terminal. Background Art

[0002] Intranet security is the top priority of network security. It not only carries a large amount of business secrets, control rights, important information and financial data, but also serves as an important platform for employees to work and communicate. Especially for industrial control systems or other sensitive infrastructures, its control rights, control instructions, sensor data, process status and other core confidential information are crucial. To some extent, it can be regarded as the last barrier to network security protection or attack. It can be seen that its importance is self-evident.

[0003] There are many kinds of protection or attack strategies for intranet security, and their concepts vary depending on the network security protection object or attack object. However, these security protection or attack measures all have one thing in common, that is, they are directly or indirectly inseparable from network traffic (network data flow), which is one of the fundamentals of intranet security protection or attack. Most intranet security protection or attack strategies are directly or indirectly carried out on the basis of network traffic. Whether it is business confidentiality, availability, integrity or identity authentication, permission bypass, permission control, attack injection, etc., they are inseparable from network traffic. Therefore, how to effectively intercept and monitor intranet traffic is a key link in the intranet attack chain. Traditional intranet traffic interception and monitoring generally involves installing malicious Trojan software in the attacked device to send the upstream and downstream communication link traffic of the device to the attacker; or attacking the critical infrastructure of the intranet switch or router to obtain its control authority, redirecting the attacked device through key network configuration or obtaining the network traffic of the attacked device by accessing the mirror port; or adding a "stealth monitoring device" in the middle of the physical connection of the attacked device network to obtain its traffic (a typical MITM man-in-the-middle attack); or deploying and installing a professional traffic monitoring system in the intranet to obtain device traffic. Although the above measures can achieve the purpose of intercepting and monitoring intranet traffic, they all have certain limitations. That is, it is necessary to install professional traffic monitoring equipment or systems in advance, or to physically contact the attacked equipment, or to ensure that there are high-risk security vulnerabilities in the intranet infrastructure equipment in order to meet the purpose of traffic interception and monitoring. The attack conditions are relatively high and the concealment is also relatively low, which affects the efficiency of intranet traffic interception.

[0004] Therefore, how to provide an intranet traffic interception method with lower attack condition requirements and higher concealment to improve the efficiency of intranet traffic interception is an urgent problem to be solved by personnel in this technical field. Summary of the invention

[0005] In view of the shortcomings of the prior art, the purpose of the present invention is to provide a method for intercepting intranet traffic to solve the problem that the attack conditions in the prior art for intercepting intranet traffic are high and the concealment is low, resulting in low efficiency of intercepting intranet traffic; in addition, the present invention also provides an intranet traffic interception medium and terminal.

[0006] In order to solve the above technical problems, the present invention adopts the following technical solutions:

[0007] In a first aspect, the present invention provides a method for intercepting intranet traffic, comprising the following steps:

[0008] S10. The attacker's device is normally connected to the intranet environment and the DHCP client dynamic IP application service is enabled; S20. ARP dynamic scanning and sniffing is initiated for the intranet to calculate the valid IP address range of the intranet. After the ARP scanning and sniffing is completed, the ARP scanning results are cached inside the attacker's device; S30. The attacking device is analyzed and selected based on the ARP scanning results; S40. The attacker pretends to be the attacked device and sends a DHCP Decline spoofing message to the DHCP server in the identity of the attacked device; S50. The attacker monitors the intranet DHCP Discover broadcast packet in real time and identifies the identity of the other device through the MAC address. If the identity of the other device is the attacked device, the DHCP server spoofing attack is carried out on the attacked device before the DHCP server responds normally; S60. After receiving the DHCP Offer spoofing message, the attacked device sends a DHCP Request unicast request message to the attacker. The attacker receives the DHCP of the attacked device. After the Request unicast message is sent, a specific DHCPACK configuration message is sent to the attacked device; S70, after the traffic is successfully intercepted, the attacker transparently forwards the intercepted traffic to the real receiver. When receiving the data stream sent by the third-party device, it is analyzed to determine whether to forward it transparently to the attacked device.

[0009] Furthermore, in step S20, the IP parameters of the attacker's device include: MAC address 89-67-9A-3D-6F-1C, local IPV4 192.168.1.5, subnet mask 255.255.255.0, IPV4 gateway 192.168.1.1, DHCP server 192.168.1.1, and DHCP lease time 12h;

[0010] The DHCP server IP and MAC address information includes: local IPV4 is 192.168.1.1, and MAC address is 9C-10-3C-67-2A-8F.

[0011] Furthermore, the valid IP address range of the intranet is 192.168.1.1 to 192.168.1.254, and caching the ARP scan result inside the attacker's device is to establish a cache mapping table of the MAC addresses and IP addresses of all devices in the intranet.

[0012] Furthermore, in step S30, the MAC address and IP parameters of the attacked device are as follows:

[0013] The MAC address is 3C-90-F7-02-16-CC, the local IPV4 is 192.168.1.20, the subnet mask is 255.255.255.0, the IPV4 gateway is 192.168.1.1, the DHCP server is 192.168.1.1, and the DHCP lease time is 12h.

[0014] Furthermore, in step S40, the characteristics of the spoofed message sent include: the TCP / IP protocol type is UDP, the message type is a DHCP Decline spoofed message, the source MAC address is 3C-90-F7-02-16-CC, the source IP address is 192.168.1.20, the source port number is 68, the destination MAC address is 9C-10-3C-67-2A-8F, the destination IP address is 192.168.1.1, and the destination port number is 67.

[0015] Furthermore, in step S60, the characteristics of the message sent by the attacker include: the TCP / IP protocol type is UDP, the message type is a DHCP Offer spoofing message, the source MAC address is 89-67-9A-3D-6F-1C, the source IP address is 192.168.1.5, the source port number is 67, the destination MAC address is 3C-90-F7-02-16-CC, the destination IP address is 192.168.1.20, and the destination port number is 68.

[0016] Furthermore, in step S60, the parameters related to the IP configuration of the attacked device in the DHCP ACK message sent by the attacker are described as follows:

[0017] Set the local IP address of the attacked device to 192.168.1.20;

[0018] The gateway address of the attacked device is set to the attacker's IP address 192.168.1.5. When the attacked device determines that the destination address of the data packet to be sent is an external network address, it will actively send the data packet to the attacker's device, that is, the external network communication traffic of the attacked device is successfully intercepted;

[0019] The subnet mask address of the attacked device is set to 255.255.255.254. When the destination address of the data packet to be sent by the attacked device is an IP address in the intranet, the attacked device itself is mistakenly judged as an external IP address after passing through the subnet mask bit and algorithm, and the data packet is sent to the attacker's device, that is, the intranet communication traffic of the attacked device is successfully intercepted.

[0020] Furthermore, according to the ARP scanning and sniffing result of step S20, NetBIOS scanning detection and port monitoring are implemented to grasp the device name, workgroup, network status, and port usage of the intranet.

[0021] In a second aspect, the present invention further provides a computer-readable storage medium, wherein the storage medium stores a computer program, and the computer program implements the above method when executed by a processor.

[0022] In a third aspect, the present invention further provides an electronic terminal, comprising: a processor and a memory; the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory, so that the terminal executes the method as described above.

[0023] Compared with the prior art, the intranet traffic interception method, medium and terminal provided by the present invention have at least the following beneficial effects:

[0024] The existing technologies for intercepting and monitoring intranet traffic have certain limitations. It is necessary to install professional traffic monitoring equipment or systems in advance, or to physically contact the attacked equipment, or to ensure that there are high-risk security vulnerabilities in the intranet infrastructure equipment in order to meet the purpose of traffic interception and monitoring. While the attack conditions are relatively high, the concealment is also relatively low, which affects the efficiency of intranet traffic interception. The present invention uses the principle of promoting defense by attack, and can be carried out under the premise of remote non-physical contact with the attacked device, without relying on the high-risk vulnerabilities of the attacked device, the intranet switch, the intranet router's own system or application and the third-party professional traffic monitoring system. The attacker only needs to access the intranet and attack based on the TCP / IP underlying network combination concept. The attack methods include but are not limited to ARP attack, MAC address attack, IP attack, DHCP attack, redirection attack, subnet mask attack and other forms, so as to achieve the purpose of intercepting the attacked device traffic, greatly reducing the conditions for launching attacks on the intranet, and can truly achieve the attack purpose of intercepting and monitoring the intranet traffic based on the "black box" status quo; the present invention has a wide scope of application and covers a wide range of attack objects, including but not limited to servers, PCs, laptops, industrial control equipment, Internet of Things terminals and other intranet networking devices. At the same time, the present invention is also concealed. After the attack is successful, it will not affect the existing business operation of the attacked device, and its traffic will be normally sent and received. At the same time, it is also difficult for the attacked device to be discovered that its own traffic has been intercepted and monitored. The entire invention has high efficiency in intercepting intranet traffic, promotes defense by attack, and better maintains the bottom layer security of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the scheme of the present invention, a brief introduction is given below to the figures required for use in the description of the embodiments. Obviously, the figures described below are some embodiments of the present invention. For ordinary technicians in this field, other figures can be obtained based on these figures without paying any creative work.

[0026] Figure 1 A flowchart of a method for intercepting intranet traffic provided by an embodiment of the present invention;

[0027] Figure 2 A schematic diagram of intranet access for an intranet traffic interception method provided by an embodiment of the present invention;

[0028] Figure 3 A schematic diagram of an ARP scanning sniffing path of an intranet traffic interception method provided by an embodiment of the present invention;

[0029] Figure 4 A schematic diagram of a NetBIOS scanning detection and port monitoring path of an intranet traffic interception method provided by an embodiment of the present invention;

[0030] Figure 5 A schematic diagram of attack target selection of an intranet traffic interception method provided by an embodiment of the present invention;

[0031] Figure 6 A schematic diagram of a DHCP Decline spoofing attack link of an intranet traffic interception method provided by an embodiment of the present invention;

[0032] Figure 7 A schematic diagram of a subnet mask attack link of an intranet traffic interception method provided by an embodiment of the present invention;

[0033] Figure 8 A schematic diagram of a transparent forwarding link for data streams after traffic interception of an intranet traffic interception method provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0034] In order to facilitate the understanding of the present invention, the present invention will be described more fully below with reference to the relevant drawings. The preferred embodiments of the present invention are given in the drawings. However, the present invention can be implemented in many different forms and is not limited to the embodiments described herein. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present invention more thorough and comprehensive.

[0035] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the specification of the present invention herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0036] The present invention provides an intranet traffic interception method, which is applied to an attack process of intercepting and monitoring intranet traffic. The intranet traffic interception method comprises the following steps:

[0037] S10. The attacker's device is normally connected to the intranet environment and the DHCP client dynamic IP application service is enabled; S20. ARP dynamic scanning and sniffing is initiated on the intranet to calculate the valid IP address range of the intranet. After the ARP scanning and sniffing is completed, the ARP scanning results are cached inside the attacker's device; S30. The attack device is analyzed and selected based on the ARP scanning results; S40. The attacker pretends to be the attacked device and sends a DHCP Decline spoofing message to the DHCP server in the identity of the attacked device; S50. The attacker monitors the intranet DHCP Discover broadcast packet in real time and identifies the identity of the other device through the MAC address. If the identity of the other device is the attacked device, the DHCP server spoofing attack is carried out on the attacked device before the DHCP server responds normally; S60. After receiving the DHCP Offer spoofing message, the attacked device sends a DHCP Request unicast request message to the attacker. After receiving the DHCP Request unicast request message from the attacked device, the attacker sends a specific DHCP ACK configuration message to the attacked device; S70, after the traffic is successfully intercepted, the attacker transparently forwards the intercepted traffic to the real receiver. When receiving the data stream sent by the third-party device, it is analyzed to determine whether to forward it transparently to the attacked device.

[0038] The present invention has low attack condition requirements, high concealment, and high efficiency in intercepting intranet traffic.

[0039] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings.

[0040] The present invention provides an intranet traffic interception method, which is applied to the attack process of intranet traffic interception monitoring, combined with Figures 1 to 8 In this embodiment, the intranet traffic interception method includes the following steps:

[0041] S10, Intranet access, the attacker's device is normally connected to the intranet environment, and the DHCP client dynamic IP application service is enabled to ensure successful access to the intranet.

[0042] Specifically, in this embodiment, after successful access, it is assumed that the attacker's device IP parameters are assigned as follows:

[0043] MAC address: 89-67-9A-3D-6F-1C, local IPV4: 192.168.1.5, subnet mask: 255.255.255.0, IPV4 gateway: 192.168.1.1, DHCP server: 192.168.1.1, DHCP lease time: 12h (time to obtain the lease ~ time when the lease expires).

[0044] The DHCP server IP and MAC address information are as follows:

[0045] Local IPV4: 192.168.1.1, MAC address: 9C-10-3C-67-2A-8F.

[0046] Combining the above gateway IP, subnet mask, and local IP key parameters, we can calculate that the valid IP address range of the intranet device is 192.168.1.1 to 192.168.1.255, preparing for the next step of ARP scanning and sniffing.

[0047] In this embodiment, the attacker's device includes but is not limited to a laptop, a PC, a server, a tablet, an embedded device, or other homemade devices.

[0048] S20, ARP full network scan code sniffing, initiate ARP full network dynamic scan sniffing on the intranet, calculate the valid IP address range of the intranet according to step S10, it can be determined that the IP address range of the ARP scan is 192.168.1.1 ~ 192.168.1.254 (the scan does not include the attacker's own IP: 192.168.1.5), after the ARP scan sniffing is completed, all ARP scan results are cached inside the attacker's device to facilitate the attacker to call, query and browse, that is, to establish a cache mapping table of the MAC addresses and IP addresses of all devices in the intranet, so as to lay a foundation for subsequent convenient traffic interception attacks on a specific intranet device. Through ARP full network segment scanning and sniffing, the key information of all devices in the intranet private network can be understood, and the necessary information of key devices such as routers and DHCP servers can be further grasped.

[0049] In this embodiment, after executing step S20, NetBIOS scanning and port monitoring are performed. According to the ARP scanning and sniffing results of step S20, the attacker has mastered the key information of the mapping between the MAC addresses and IP addresses of all devices in the intranet. Further NetBIOS scanning detection and port monitoring are implemented. The purpose is to more fully and detailedly grasp the intranet device information, such as device name, workgroup, network status, port usage and other key information, so as to provide a decision-making basis for the subsequent precise implementation of traffic interception attacks.

[0050] S30, analyzing and selecting the attack target. Through the above steps, the attacker has mastered the necessary key information of the intranet device and established the necessary cache mapping table inside the attacker's device. The attack device is analyzed and selected according to the ARP scan results.

[0051] Specifically, in this embodiment, it is assumed that the attacker selects the industrial controller device in the intranet as the attack target for traffic interception. The MAC address and IP parameters of the industrial controller are as follows:

[0052] MAC address: 3C-90-F7-02-16-CC, local IPV4: 192.168.1.20, subnet mask: 255.255.255.0, IPV4 gateway: 192.168.1.1, DHCP server: 192.168.1.1, DHCP lease time: 12h (time to obtain the lease ~ time when the lease expires).

[0053] S40, the attacker implements a DHCPDecline spoofing attack on the DHCP server (most intranets have routers that act as DHCP servers), impersonating the attacked device, that is, sending a DHCPDecline spoofing message to the DHCP server as the attacked device;

[0054] Specifically, in this embodiment, the technical features of the spoofed message sent are as follows:

[0055] TCP / IP protocol type: UDP, message type: DHCP Decline spoofing message, source MAC address: 3C-90-F7-02-16-CC (forged as the MAC address of the industrial controller), source IP address: 192.168.1.20 (forged as the IP address of the industrial controller), source port number: 68 (DHCP client port number), destination MAC address: 9C-10-3C-67-2A-8F (DHCP server MAC address), destination IP address: 192.168.1.1 (DHCP server IP address), destination port number: 67 (DHCP server port number).

[0056] In this embodiment, the DHCP server is deceived, forcing the DHCP server to mistakenly believe that the local IP address currently used by the industrial controller (attacked device) has an IP conflict in the intranet, thereby forcing the internal program of the DHCP server to change the mapping relationship and characteristic attributes of the IP address and MAC address. When the DHCP lease of the industrial controller (attacked device) expires or is about to expire, the industrial controller (attacked device) will automatically continue to send a normal DHCPRequest request message to the DHCP server in the form of a unicast message, hoping to renew the IP address, but because the attacker has previously sent a DHCPDecline spoof message to the DHCP server, the DHCP server will not respond normally to the DHCP Request of the industrial controller, resulting in the failure of the DHCP Request unicast request of the industrial controller (attacked device), further forcing the industrial controller (attacked device) to re-initiate the DHCP application in a broadcast manner, that is, the application process of sending a DHCP Discovery packet through a broadcast packet.

[0057] S50. The attacker monitors the DHCP Discover broadcast packets in the intranet in real time and identifies the identity of the other party's device through the MAC address. If the identity of the other party's device is the attacked device, based on the concept of preemptive attack, the attacker implements a DHCP server spoofing attack on the industrial controller (attacked device) before the DHCP server responds normally. That is, the attacker pretends to be a DHCP server and sends a DHCP Offer spoofing message to the industrial controller (attacked device) to obtain priority configuration rights.

[0058] Specifically, in this embodiment, the technical features of the message sent by the attacker are described as follows:

[0059] TCP / IP protocol type: UDP, message type: DHCP Offer spoof message, source MAC address: 89-67-9A-3D-6F-1C (the attacker's own MAC address, or the DHCP server MAC address can be forged based on actual conditions), source IP address: 192.168.1.5 (the attacker's own IP address, or the DHCP server IP address can be forged based on actual conditions), source port number: 67 (DHCP server port number), destination MAC address: 3C-90-F7-02-16-CC (the MAC address of the industrial controller), destination IP address: 192.168.1.20 (the IP address of the industrial controller), destination port number: 68 (DHCP client port number).

[0060] S60. After receiving the spoofed DHCP Offer message, the industrial controller (attacked device) will mistakenly believe that the attacker is the intranet DHCP server. Then the industrial controller (attacked device) will send a DHCP Request unicast message to the attacker. After receiving the DHCP Request unicast message from the industrial controller (attacked device), the attacker will send a specific DHCP ACK configuration message to the industrial controller (attacked device). At this point, the DHCP-related attack is initially terminated.

[0061] Specifically, in this embodiment, the parameters related to the IP configuration of the industrial controller (attacked device) in the DHCP ACK message sent by the attacker are described as follows:

[0062] Set the local IP address of the industrial controller (the attacked device) to the original 192.168.1.20 (the same as the original local IP address);

[0063] Set the gateway address of the industrial controller (attacked device) to the attacker's IP address: 192.168.1.5. When the industrial controller (attacked device) determines that the destination address of the data packet to be sent is an external network address, it will actively send the data packet to the attacker's device, that is, the external network communication traffic of the industrial controller (attacked device) is successfully intercepted;

[0064] Set the subnet mask address of the industrial controller (attacked device) to: 255.255.255.254 (it can also be changed to other values, but the following conditions must be ensured: the bitwise AND operation of each bit of the subnet mask and each bit of its own IP address is performed to obtain a 4-byte length V1, and the bitwise AND operation of the subnet mask and other valid destination IP addresses in the intranet is performed to obtain a 4-byte length V2, and ensure that V1 is not equal to V2). When the destination address of the data packet to be sent by the industrial controller (attacked device) is an IP address in the intranet, because its subnet mask has been tampered with and set to 255.255.255.254, even if the destination address IP sent is an intranet address, the industrial controller (attacked device) itself is mistakenly judged as an external network IP address after the subnet mask bitwise AND algorithm, so it also sends the data packet to the attacker's device, that is, the intranet communication traffic of the industrial controller (attacked device) is successfully intercepted.

[0065] S70. After the traffic is successfully intercepted, in order to ensure that the business continuity of the industrial controller (attacked device) is not affected, the attacker needs to transparently forward the intercepted traffic to the real receiver. Similarly, when receiving the data stream sent by the third party, it is analyzed and judged whether to transparently forward it to the industrial controller (attacked device). At this point, while ensuring the interception of the traffic, it can also ensure the normal sending and receiving of the upstream and downstream traffic of the industrial controller, thereby ensuring its business continuity and not being easily discovered by the other party.

[0066] An embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, any method in the embodiment is implemented.

[0067] An embodiment of the present invention further provides an electronic terminal, comprising: a processor and a memory; the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory, so that the terminal executes any one of the methods in this embodiment.

[0068] The computer-readable storage medium in this embodiment can be understood by ordinary technicians in this field: all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to the computer program. The aforementioned computer program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other media that can store program codes.

[0069] The electronic terminal provided in this embodiment includes a processor, a memory, a transceiver and a communication interface. The memory and the communication interface are connected to the processor and the transceiver and complete communication with each other. The memory is used to store computer programs, the communication interface is used to communicate, and the processor and the transceiver are used to run computer programs so that the electronic terminal executes each step of the above method.

[0070] Compared with the prior art, the intranet traffic interception method, medium and terminal described in the above embodiments have certain limitations in intercepting and monitoring intranet traffic. It is necessary to install professional traffic monitoring equipment or system in advance, or to physically contact the attacked device, or to ensure that there are high-risk security vulnerabilities in the intranet infrastructure equipment in order to meet the purpose of traffic interception and monitoring. While the attack conditions are relatively high, the concealment is also relatively low, which affects the efficiency of intranet traffic interception. The present invention uses the principle of promoting defense by attack, and can be carried out under the premise of remote non-physical contact with the attacked device, without relying on the high-risk vulnerabilities of the attacked device, the intranet switch, the intranet router's own system or application and the third-party professional traffic monitoring system. The attacker only needs to access the intranet and attack based on the TCP / IP underlying network combination concept. The attack methods include but are not limited to ARP attack, MAC address attack, IP attack, DHCP attack, redirection attack, subnet mask attack and other forms, so as to achieve the purpose of intercepting the attacked device traffic, greatly reducing the conditions for launching attacks on the intranet, and can truly achieve the attack purpose of intercepting and monitoring the intranet traffic based on the "black box" status quo; the present invention has a wide scope of application and covers a wide range of attack objects, including but not limited to servers, PCs, laptops, industrial control equipment, Internet of Things terminals and other intranet networking devices. At the same time, the present invention is also concealed. After the attack is successful, it will not affect the existing business operation of the attacked device, and its traffic will be normally sent and received. At the same time, it is also difficult for the attacked device to be discovered that its own traffic has been intercepted and monitored. The entire invention has high efficiency in intercepting intranet traffic, promotes defense by attack, and better maintains the bottom layer security of the network.

[0071] Obviously, the embodiments described above are only preferred embodiments of the present invention, rather than all embodiments. The preferred embodiments of the present invention are shown in the accompanying drawings, but they do not limit the patent scope of the present invention. The present invention can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present invention more thorough and comprehensive. Although the present invention has been described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions recorded in the aforementioned specific embodiments, or to perform equivalent replacements for some of the technical features therein. Any equivalent structure made using the contents of the specification and drawings of the present invention, directly or indirectly used in other related technical fields, is also within the scope of patent protection of the present invention.

Claims

1. A method for intercepting intranet traffic, characterized in that: The following steps are involved: S10, the attacker's device is normally connected to the intranet environment, and the DHCP client dynamic IP application service is enabled; S20, initiate an ARP full-network dynamic scan and sniffing for the intranet, calculate the valid IP address range of the intranet, and after the ARP scan and sniffing is completed, cache the ARP scan result inside the attacker's device; S30, analyzing and selecting an attack device according to the ARP scanning result; S40: The attacker pretends to be the attacked device and sends a DHCP Decline spoof message to the DHCP server as the attacked device. S50, the attacker monitors the DHCP Discover broadcast packets in the intranet in real time and identifies the identity of the other party's device through the MAC address. If the identity of the other party's device is the attacked device, the attacker will preemptively implement a DHCP server spoofing attack on the attacked device before the DHCP server responds normally; S60, after receiving the spoofed DHCP Offer message, the attacked device sends a DHCP Request unicast message to the attacker. After receiving the DHCP Request unicast message from the attacked device, the attacker sends a specific DHCP ACK configuration message to the attacked device. S70: After the traffic is successfully intercepted, the attacker transparently forwards the intercepted traffic to the real receiver. When receiving the data stream sent by the third-party device, it is analyzed to determine whether to transparently forward it to the attacked device.

2. According to claim 1, a method for intercepting intranet traffic is characterized in that: In step S20, the attacker's device IP parameters include: MAC address 89-67-9A-3D-6F-1C, local IPv4 192.168.1.5, subnet mask 255.255.255.0, IPv4 gateway 192.168.1.1, DHCP server 192.168.1.1, DHCP lease time 12h; The DHCP server IP and MAC address information includes: local IPv4 is 192.168.1.1, and MAC address is 9C-10-3C-67-2A-8F.

3. The method for intercepting intranet traffic according to claim 1, characterized in that: In step S20, the valid IP address range of the intranet is 192.168.1.1 to 192.168.1.254, and caching the ARP scan result inside the attacker's device is to establish a cache mapping table of the MAC addresses and IP addresses of all devices in the intranet.

4. The method for intercepting intranet traffic according to claim 1, characterized in that: In step S30, the MAC address and IP parameters of the attacked device are as follows: The MAC address is 3C-90-F7-02-16-CC, the local IPV4 is 192.168.1.20, the subnet mask is 255.255.255.0, the IPV4 gateway is 192.168.1.1, the DHCP server is 192.168.1.1, and the DHCP lease time is 12h.

5. A method for intercepting intranet traffic according to claim 4, characterized in that: In step S40, the characteristics of the spoofed message sent include: the TCP / IP protocol type is UDP, the message type is a DHCP Decline spoofed message, the source MAC address is 3C-90-F7-02-16-CC, the source IP address is 192.168.1.20, the source port number is 68, the destination MAC address is 9C-10-3C-67-2A-8F, the destination IP address is 192.168.1.1, and the destination port number is 67.

6. A method for intercepting intranet traffic according to claim 5, characterized in that: In step S60, the characteristics of the message sent by the attacker include: the TCP / IP protocol type is UDP, the message type is a DHCP Offer spoofing message, the source MAC address is 89-67-9A-3D-6F-1C, the source IP address is 192.168.1.5, the source port number is 67, the destination MAC address is 3C-90-F7-02-16-CC, the destination IP address is 192.168.1.20, and the destination port number is 68.

7. A method for intercepting intranet traffic according to claim 6, characterized in that: In step S60, the parameters related to the IP configuration of the attacked device in the DHCP ACK message sent by the attacker are described as follows: Set the local IP address of the attacked device to 192.168.1.20; The gateway address of the attacked device is set to the attacker's IP address 192.168.1.

5. When the attacked device determines that the destination address of the data packet to be sent is an external network address, it will actively send the data packet to the attacker's device, that is, the external network communication traffic of the attacked device is successfully intercepted; The subnet mask address of the attacked device is set to 255.255.255.

254. When the destination address of the data packet to be sent by the attacked device is an IP address in the intranet, the attacked device itself is mistakenly judged as an external IP address after passing through the subnet mask bit and algorithm, and the data packet is sent to the attacker's device, that is, the intranet communication traffic of the attacked device is successfully intercepted.

8. The method for intercepting intranet traffic according to claim 1, characterized in that: According to the ARP scanning and sniffing result of step S20, NetBIOS scanning detection and port monitoring are implemented to grasp the device name, workgroup, network status, and port usage of the intranet.

9. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

10. An electronic terminal, characterized in that: include: Processor and memory; The memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory, so that the terminal executes the method according to any one of claims 1 to 8.

Images