{"id":19388378,"url":"https://github.com/mk-fg/tcp-connection-hijack-reset","last_synced_at":"2025-04-23T23:31:38.258Z","repository":{"id":7902079,"uuid":"9282935","full_name":"mk-fg/tcp-connection-hijack-reset","owner":"mk-fg","description":"Simple scapy-based tool to hijack and reset existing TCP connections","archived":false,"fork":false,"pushed_at":"2013-04-12T08:02:55.000Z","size":143,"stargazers_count":23,"open_issues_count":0,"forks_count":5,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-04-02T22:23:25.232Z","etag":null,"topics":["attack","ipset","networking","nflog","python","scapy","scraps","tcp"],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"wtfpl","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mk-fg.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"COPYING","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2013-04-07T20:44:24.000Z","updated_at":"2024-04-29T13:03:46.000Z","dependencies_parsed_at":"2022-08-29T13:00:56.632Z","dependency_job_id":null,"html_url":"https://github.com/mk-fg/tcp-connection-hijack-reset","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mk-fg%2Ftcp-connection-hijack-reset","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mk-fg%2Ftcp-connection-hijack-reset/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mk-fg%2Ftcp-connection-hijack-reset/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mk-fg%2Ftcp-connection-hijack-reset/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mk-fg","download_url":"https://codeload.github.com/mk-fg/tcp-connection-hijack-reset/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":250532054,"owners_count":21446107,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["attack","ipset","networking","nflog","python","scapy","scraps","tcp"],"created_at":"2024-11-10T10:12:34.171Z","updated_at":"2025-04-23T23:31:37.989Z","avatar_url":"https://github.com/mk-fg.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"tcp-connection-hijack-reset\n--------------------\n\nSimple [scapy](http://www.secdev.org/projects/scapy/) + iptables/ipsets + nflog\ntool to hijack and reset existing TCP connections (for both ends), established\nfrom other pids.\n\nPurpose is not some malicious DoS attacks but rather kicking hung state-machines\nin otherwise nice software, while making the whole thing look like a random net\nhiccup, which most apps are designed to handle.\n\nIf NFLOG is used (to get packets that should not pass netfilter, for instance),\nrequires [scapy-nflog-capture](https://github.com/mk-fg/scapy-nflog-capture).\n\n\nUsage\n--------------------\n\n- Create \"conn_cutter\" ipset: `ipset create conn_cutter hash:ip,port`\n\n- Create \"conn_cutter\" chain (some lines wrapped):\n\n\t```\n\t-A conn_cutter ! -p tcp -j RETURN\n\t-A conn_cutter -m set ! --match-set conn_cutter src,src -j RETURN\n\t-A conn_cutter -p tcp -m recent --set --name conn_cutter --rsource\n\t-A conn_cutter -p tcp -m recent ! --rcheck --seconds 20\\\n\t\t--hitcount 2 --name conn_cutter --rsource -j NFLOG\n\t-A conn_cutter -p tcp -m recent ! --rcheck --seconds 20\\\n\t\t--hitcount 2 --name conn_cutter --rsource -j REJECT --reject-with tcp-reset\n\t```\n\n\tNote that due to one global \"recent\" netfilter tag used above, only one\n\tconnection can be cut in 20 seconds (others will pass through this chain\n\tunharmed).\n\n\tThis is done in case of rare pids which may bind() outgoing socket to a\n\tconstant port, so that packets of the reconnection attempt from the same port\n\twon't get matched and pass.\n\n- Update \"OUTPUT\" chain:\n\n\t```\n\t-I OUTPUT -j conn_cutter\n\t```\n\n\tThat should be strictly *before* rules like `--state RELATED,ESTABLISHED -j\n\tACCEPT`.\n\n- Run: `tcp-connection-hijack-reset.py conn_cutter --pid 1234 --debug`\n\n\tWill pick single TCP connection of a specified pid (or raise error if there's\n\tmore than one) and cut it, with a lots of noise about what it's doing (due to\n\t\"--debug\").\n\n- Result: both endpoints should reliably get single RST packet and connection\n\tclosed promptly.\n\nSee [this\npost](http://blog.fraggod.net/2013/04/08/tcp-hijacking-for-the-greater-good.html)\non more details about what it all means and why it's there.\n\n\nSimilar tools\n--------------------\n\n- [dsniff](http://www.monkey.org/~dugsong/dsniff/) - has \"tcpkill\" binary that\n\tdoes very similar thing.\n\n- [tcpkill](https://github.com/chartbeat/tcpkill) - standalone tcpkill tool from\n\tdsniff.\n\n- [cutter](http://www.digitage.co.uk/digitage/software/cutter) - aims to solve\n\tsimilar problem, but on a router box (seem to work with conntrack tables\n\tonly), and with some strange methods (generating noise on connection to get\n\tseq, which doesn't seem to work at all).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmk-fg%2Ftcp-connection-hijack-reset","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmk-fg%2Ftcp-connection-hijack-reset","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmk-fg%2Ftcp-connection-hijack-reset/lists"}