Anevicon：一款基于UDP的负载生成器 - FreeBuf网络安全行业门户

官方公众号企业安全新浪微博

FreeBuf.COM网络安全行业门户，每日发布专业的安全资讯、技术剖析。

FreeBuf+小程序把安全装进口袋

工具

Anevicon：一款基于UDP的负载生成器

2019-06-09 15:00:47

所属地浙江省

Anevicon是一款向服务器发送大量UDP数据包，模拟黑客可能产生活动的工具。此工具还可以用作机器人来模拟UDP泛洪攻击的僵尸网络（但仅用于教育和测试目的），这是通过该程序所依赖的Anevicon核心库实现的。

特征

Linux的加速Anevicon使用特定于Linux 的sendmmsg系统调用。它只是通过单个内核调用发送大型数据集，从而减少了CPU负载。
多功能我试图实现尽可能多的东西来制作一个多功能工具并同时保持简单。支持多种测试，详细级别，IP欺骗等功能。
Rust编写意味着它利用了裸机性能和高级别的安全性。

安装

目前，该项目需要不稳定的标准库功能，因此这就是为什么必须切换到夜间通道以避免编译错误：

$ rustup override set nightly-2019-04-11

从crates.io编译

$ cargo install anevicon

源代码编译

$ git clone https://github.com/Gymmasssorla/anevicon.git
$ cd anevicon
$ cargo build --release

预编译的二进制文件

在您的系统上运行Anevicon的最简单方法是从现有版本下载预编译的二进制文件，这不需要任何外部软件（与之前的两种方法不同）。

选项

anevicon 5.1.0
Temirkhan Myrzamadi <gymmasssorla@gmail.com>
A high-performant UDP-based load generator, written in Rust.
USAGE:
    anevicon [FLAGS] [OPTIONS] --receiver <SOCKET-ADDRESS>...
FLAGS:
    -b, --allow-broadcast    Allow sockets to send packets to a broadcast
                             address
    -h, --help               Prints help information
        --select-if          Displays an interactive menu of network interfaces
                             to use. If unset, a default one will be used.
                             
                             This option conflicts with the `--sender` because
                             it will automatically bind an appropriate
                             interface's IP.
    -V, --version            Prints version information
OPTIONS:
        --date-time-format <STRING>
            A format for displaying local date and time in log messages. Type
            `man strftime` to see the format specification [default: %X]
        --ip-ttl <UNSIGNED-INTEGER>
            Specifies the IP_TTL value for all future sockets. Usually this
            value equals a number of routers that a packet can go through
    -l, --packet-length <POSITIVE-INTEGER>
            Repeatedly send a random-generated packet with a specified bytes
            length. The default is 32768
    -p, --packets-count <POSITIVE-INTEGER>
            A count of packets for sending. When this limit is reached, then the
            program will exit [default: 18446744073709551615]
        --packets-per-syscall <POSITIVE-INTEGER>
            A count of packets which the program will send using only one
            syscall. After the operation completed, a test summary will have
            been printed [default: 600]
    -r, --receiver <SOCKET-ADDRESS>...
            A receiver of generated traffic, specified as an IP-address and a
            port number, separated by a colon.
            
            This option can be specified several times to identically test
            multiple receivers in parallel mode.
    -f, --send-file <FILENAME>
            Interpret the specified file content as a single packet and
            repeatedly send it to each receiver
    -m, --send-message <STRING>
            Interpret the specified UTF-8 encoded text message as a single
            packet and repeatedly send it to each receiver
        --send-periodicity <TIME-SPAN>
            A time interval between sendmmsg syscalls. This option can be used
            to decrease test intensity [default: 0secs]
    -t, --send-timeout <TIME-SPAN>
            A timeout of sending every single packet. If a timeout is reached,
            then a packet will be sent later [default: 10secs]
    -s, --sender <SOCKET-ADDRESS>
            A sender of generated traffic, specified as an IP-address and a port
            number, separated by a colon [default: 0.0.0.0:0]
    -d, --test-duration <TIME-SPAN>
            A whole test duration. When this limit is reached, then the program
            will exit.
            
            Exit might occur a few seconds later because of long sendmmsg
            syscalls. For more precision, decrease the `--packets-per-syscall`
            value. [default: 64years 64hours 64secs]
    -v, --verbosity <LEVEL>
            Enable one of the possible verbosity levels. The zero level doesn't
            print anything, and the last level prints everything [default: 3]
            [possible values: 0, 1, 2, 3, 4, 5]
    -w, --wait <TIME-SPAN>
            A waiting time span before a test execution used to prevent a launch
            of an erroneous (unwanted) test [default: 5secs]
For more information see <https://github.com/Gymmasssorla/anevicon>.

命令

您所需要的只是提供测试服务器地址，该地址由一个IP地址和一个端口号组成，用冒号字符分隔。默认情况下，所有发送套接字都将具有您的本地地址：

＃使用您的本地地址测试example.com网站的80端口 
$ anevicon --receiver = 93.184.216.34：80

自定义消息

默认情况下，Anevicon将生成具有指定大小的随机数据包。在某些基于UDP的测试中，数据包内容是有意义的，这就是您可以使用--send-file或--send-message选项指定它的方式：

＃使用自定义文件'message.txt'测试example.com的80端口 
$ anevicon --receiver=93.184.216.34:80 --send-file="message.txt"
＃使用自定义文本消息测试example.com的80端口 
$ anevicon --receiver=93.184.216.34:80 --send-message="How do you do?"

多个接收器

Anevicon还具有以并行模式测试多个接收器的功能，从而将负载分配到处理器内核上。为此，只需--receiver多次指定该选项即可。

＃并行测试example.com的80端口和google.com的13端口 
$ anevicon --receiver=93.184.216.34:80 --receiver=216.58.207.78:13

测试强度

在某些情况下，您不需要传输最大可能数量的数据包，您可能希望降低数据包发送的强度。为此，还有一个简单的选项叫做--send-periodicity。

＃在每个sendmmsg系统调用后测试example.com等待270微秒 
$ anevicon --receiver=93.184.216.34:80 --send-periodicity=270us

结束条件

请注意，由于安全原因，上述命令可能无法在您的系统上运行。为了让你的测试确定性，有两个终止条件称为--test-duration和--packets-count（测试持续时间和包分别计数，）：

＃使用两个限制选项测试example.com站点的80端口 
$ anevicon --receiver=93.184.216.34:80 --test-duration=3min --packets-count=7000

网络接口

还可以将所有未来套接字绑定到特定网络接口。考虑--select-if标志，它在命令行中显示网络接口的交互式菜单：

＃使用自定义网络接口测试example.com，使用`--select-if` 
$ anevicon --receiver=93.184.216.34:80 --select-if

记录选项

考虑指定从0到5（包含）的自定义详细级别，该级别由--verbosity选项完成。还有一个--date-time-format选项告诉Anevicon使用您的自定义日期时间格式。

＃使用自定义日期时间格式和最后一个详细级别 
$ anevicon --receiver=64.233.165.113:80 --date-time-format="%F" --verbosity=5

库

Cargo.toml

[dependencies]
anevicon_core = "*"

SRC / main.rs

（examples/minimal.rs）

#![feature(iovec)]
use std::io::IoVec;
use std::net::UdpSocket;
use anevicon_core::{TestSummary, Tester};
fn main() {
    // Setup the socket connected to the example.com domain
    let socket = UdpSocket::bind("0.0.0.0:0").unwrap();
    socket.connect("93.184.216.34:80").unwrap();
    // Setup all the I/O vectors (messages) we want to send
    let payload = &mut [
        (0, IoVec::new(b"Generals gathered in their masses")),
        (0, IoVec::new(b"Just like witches at black masses")),
        (0, IoVec::new(b"Evil minds that plot destruction")),
        (0, IoVec::new(b"Sorcerers of death's construction")),
    ];
    // Send all the created messages using only one system call
    let mut summary = TestSummary::default();
    let mut tester = Tester::new(&socket, &mut summary);
    println!(
        "The total packets sent: {}, the total seconds passed: {}",
        tester.send_multiple(payload).unwrap().packets_sent(),
        summary.time_passed().as_secs()
    );
}

该程序只需将四个数据包发送到<http://example.com/>。现在，您可以按照官方文档了解有关anevicon_core的更多信息。