The last weeks were quite intensive. In theorie it looked plausible and logical but while putting the plan into practise some obstacles had to be overcome, namely getting back into libpcap, ARP man in the middle and TCP stream reassembly. I’m on track and the deadline (between 15. and 18. December) is still realistic …

Here in advance some screenshots

In case you encounter problems let me know and drop a mail.

TCPReassemble, as the name says, reassembles TCP data streams. Not perfectly and only a part of the stream as that was not the requirement. But the first steps are done that allows you to add further code to control the streams.
I ignore IP fragments (has it an influence at all?), wrong checksums and the order of the packets.

You can find the source here.

The last week I dedicated my time to the ARP MITM engine and after some hours in trouble getting back control over the existing code tweaking and fixing things here and there it’s working like a charm. One of the cruxes is done on the other one i’ll start working tomorrow.
To make the tool extendible without putting permanently my fingers on the core system and let other people create their own customised plugins a central plugin system is required. I have already a prototype of such a system but have to integrate it in the current solution. Actually I have to recode the whole thing again :/

What can you expect

• Probably a pile of C# code snippets
• Maybe some C code snippets
• Eventually a nice POC tool to put theory into practice

If you have questions drop a mail …

The second project is about a network sniffing/poisoning/information gathering/highjacking tool. I’ll start working on it on October or so …

I am still working on the old projects but didn’t make bigger progress so far. Also a new web based but not security focussed project is in the forge. If i make progress I’ll let you know.

Doei