{"id":13775497,"url":"https://github.com/rafael-santiago/pig","last_synced_at":"2025-04-06T03:09:37.379Z","repository":{"id":31083044,"uuid":"34642062","full_name":"rafael-santiago/pig","owner":"rafael-santiago","description":"A Linux packet crafting tool.","archived":false,"fork":false,"pushed_at":"2020-11-02T16:00:02.000Z","size":3616,"stargazers_count":468,"open_issues_count":0,"forks_count":38,"subscribers_count":26,"default_branch":"master","last_synced_at":"2025-03-30T02:06:38.489Z","etag":null,"topics":["arp-spoofing","denial-of-service","forensics","hacking","hacking-tool","intrusion-prevention","network-analysis","network-protocols","network-security-monitoring","network-test","networking","packet-crafting"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/rafael-santiago.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"COPYING","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2015-04-27T02:36:22.000Z","updated_at":"2025-03-24T23:15:43.000Z","dependencies_parsed_at":"2022-08-26T09:01:15.906Z","dependency_job_id":null,"html_url":"https://github.com/rafael-santiago/pig","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rafael-santiago%2Fpig","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rafael-santiago%2Fpig/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rafael-santiago%2Fpig/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rafael-santiago%2Fpig/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rafael-santiago","download_url":"https://codeload.github.com/rafael-santiago/pig/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247427006,"owners_count":20937201,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["arp-spoofing","denial-of-service","forensics","hacking","hacking-tool","intrusion-prevention","network-analysis","network-protocols","network-security-monitoring","network-test","networking","packet-crafting"],"created_at":"2024-08-03T17:01:39.765Z","updated_at":"2025-04-06T03:09:37.350Z","avatar_url":"https://github.com/rafael-santiago.png","language":"C","funding_links":[],"categories":["Tools","Network","\u003ca id=\"64f068672e615343db9235f1973d8fba\"\u003e\u003c/a\u003e网络数据包","Network Tools","2. [↑](#-content) Pentesting","Awesome Penetration Testing (\"https://github.com/Muhammd/Awesome-Pentest\")","Networking and Internet ##","工具"],"sub_categories":["Binary files examination and editing","Scanning / Pentesting","\u003ca id=\"b239f12aca7aa942b45836032cbef99a\"\u003e\u003c/a\u003e转换","Network Traffic Replay and Editing Tools","2.6 [↑](#-content) Network","Network Tools","Tools","Physical ###","有关渗透测试和安全方面的Docker镜像","Docker Containers of Penetration Testing Distributions and Tools"],"readme":"# Pig\n\n``Pig`` (which can be understood as ``P``acket ``i``ntruder ``g``enerator) is a ``Linux`` packet crafting tool.\nYou can use ``Pig`` to test your ``IDS``/``IPS`` among other stuff.\n\n``Pig`` brings a bunch of well-known attack signatures ready to be used and you can expand this collection\nwith more specific things according to your requirements.\n\nUntil now it is possible to create ``IPv4`` signatures with transport layer based on ``TCP``, ``UDP`` and ``ICMP``.\nYou can also create signatures based on ``ARP`` protocol, besides building up the packet since its ``Ethernet`` frame.\n\nIf you arrived here by my [2600](https://www.2600.com) article from the ``SPRING 2016`` [issue](https://store.2600.com/collections/2010-2015/products/spring-2016)\nkeep reading the following documentation sections because this little ``Pig`` has been evolving since then.\n\n# How to clone this repo?\n\nIt is pretty simple:\n\n```\nsomeones@err..InTheWolf:~/src# git clone https://github.com/rafael-santiago/pig pig\nsomeones@err..InTheWolf:~/src# cd pig\nsomeones@err..InTheWolf:~/src/pig# git submodule update --init\n```\n\n# How to build it?\n\nYou need to use the [``Hefesto``](https://github.com/rafael-santiago/hefesto) to build ``pig``. After following\nthe steps to put ``Hefesto`` working on your system. Move to the ``pig`` sub-directory named as ``src`` and run\nthe following command:\n\n```\nsomeones@err..InTheWolf:~/src/pig/src# hefesto\n```\n\nAfter this command you should find the ``pig`` binary under the path ``src/bin``. You can use the binary relatively from\n``src/bin`` or [install it](#how-to-install-it).\n\nIf for some reason you are having build troubles you should try to read some remarks present in [``BUILD.md``](https://github.com/rafael-santiago/pig/blob/master/doc/BUILD.md).\n\n# How to install it?\n\nFor installing you need to be inside the ``src`` sub-directory and call:\n\n```\nsomeones@err..InTheWolf:~/src/pig/src# hefesto --install\n```\n\nFor uninstalling, being inside the ``src`` sub-directory you should call:\n\n```\nsomeones@err..InTheWolf:~/src/pig/src# hefesto --uninstall\n```\n\n# The pigsty files\n\n``Pigsty files`` are plain text files where you can define a set of packet signatures. There is a specific syntax to be\nfollowed. Look out an example of a pigsty file:\n\n```\n[ signature   =      \"Hello\",\n  ip.version  =            4,\n  ip.ihl      =            5,\n  ip.tos      =            0,\n  ip.src      = 192.30.70.10,\n  ip.dst      =  192.30.70.3,\n  ip.protocol =           17,\n  udp.dst     =         1008,\n  udp.src     =        32000,\n  udp.payload =    \"Hello!!\" ]\n```\n\nBasically, all signature data must goes between square brackets: ``[`` ... ``]``.\n\nInside this area the piece of information is supplied by the scheme ``field = data``.\n\nIf you have some experience with Computer Networks is sure that the majority of fields listed on ``Table 1``\nhave strong meaning for you. You must use these fields to create your further signatures.\n\n**Table 1**: The ``pig`` signature fields.\n\n|    **Field**    |   **Stands for**   |  **Protocol** | **Data type** |      **Sample definition**          |\n|:---------------:|:------------------:|:-------------:|:-------------:|:-----------------------------------:|\n| ``signature``   | The signature name |       -       |     string    | ``signature = \"Udp flood\"``         |\n| ``eth.hwdst``   | Ethernet Dest. MAC |   *Ethernet*  |     MAC       | ``eth.hwdst = \"00:de:ad:be:ef:00\"`` |\n| ``eth.hwsrc``   | Ethernet Source MAC|   *Ethernet*  |     MAC       | ``eth.hwsrc = \"00:de:ad:be:ef:00\"`` |\n| ``eth.type``    |     Ether type     |   *Ethernet*  |     number    |     ``eth.type = 0x0800``           |\n| ``eth.payload`` | Ethernet Payload   |   *Ethernet*  |     string    | ``eth.payload = \"f\\x00ob\\x04r\"``    |\n|``ip.version``   |    IP version      |      *IP*     |     number    |      ``ip.version = 4``             |\n|  ``ip.ihl``     | Internet Header Len|      *IP*     |     number    |         ``ip.ihl = 5``              |\n|  ``ip.tos``     |    Type of service |      *IP*     |     number    |         ``ip.tos = 0 ``             |\n| ``ip.tlen``     |     Total Length   |      *IP*     |     number    |         ``ip.tlen = 20``            |\n|  ``ip.id``      |       Packet ID    |      *IP*     |     number    |       ``ip.id = 0xbeef``            |\n| ``ip.flags``    |       IP Flags     |      *IP*     |     number    |       ``ip.flags = 4``              |\n| ``ip.offset``   |   Fragment offset  |      *IP*     |     number    |       ``ip.offset = 0``             |\n|  ``ip.ttl``     |   Time to live     |      *IP*     |     number    |          ``ip.ttl = 64``            |\n|``ip.protocol``  |       Protocol     |      *IP*     |     number    |       ``ip.protocol = 6``           |\n|``ip.checksum``  |       Checksum     |      *IP*     |     number    |       ``ip.checksum = 0``           |\n|   ``ip.src``    |   Source address   |      *IP*     |  ip address   |    ``ip.src = 192.30.70.3``         |\n|   ``ip.dst``    |   Dest. address    |      *IP*     |  ip address   |    ``ip.dst = 192.30.70.3``         |\n| ``ip.payload``  |   IP raw payload   |      *IP*     |     string    |  ``ip.payload = \"\\x01\\x02\"``        |\n|   ``tcp.src``   |    Source port     |      *TCP*    |     number    |         ``tcp.src = 80``            |\n|   ``tcp.dst``   |    Dest. port      |      *TCP*    |     number    |         ``tcp.dst = 21``            |\n| ``tcp.seqno``   |  Sequence number   |      *TCP*    |     number    |        ``tcp.seqno = 10202``        |\n| ``tcp.ackno``   | Acknowledge number |      *TCP*    |     number    |       ``tcp.ackno = 10200``         |\n|  ``tcp.size``   |     TCP Length     |      *TCP*    |     number    |       ``tcp.size = 4``              |\n|``tcp.reserv``   | TCP reserv. field  |      *TCP*    |     number    |       ``tcp.reserv = 0``            |\n|   ``tcp.urg``   |  TCP urg. flag     |      *TCP*    |       bit     |       ``tcp.urg = 0``               |\n|   ``tcp.ack``   |  TCP ack. flag     |      *TCP*    |       bit     |       ``tcp.ack = 1``               |\n|   ``tcp.psh``   |  TCP psh. flag     |      *TCP*    |       bit     |       ``tcp.psh = 0``               |\n|   ``tcp.rst``   |  TCP rst. flag     |      *TCP*    |       bit     |       ``tcp.rst = 0``               |\n|   ``tcp.syn``   |  TCP syn. flag     |      *TCP*    |       bit     |       ``tcp.syn = 0``               |\n|   ``tcp.fin``   |  TCP fin. flag     |      *TCP*    |       bit     |       ``tcp.fin = 0``               |\n|  ``tcp.wsize``  |  TCP window size   |      *TCP*    |     number    |       ``tcp.wsize = 0``             |\n|``tcp.checksum`` |    Checksum        |      *TCP*    |     number    |       ``tcp.checksum = 0``          |\n|``tcp.urgp``     |  Urgent pointer    |      *TCP*    |     number    |      ``tcp.urgp = 0``               |\n|``tcp.payload``  |      Payload       |      *TCP*    |     string    | ``tcp.payload = \"\\x01abc\"``         |\n|   ``udp.src``   |    Source port     |      *UDP*    |     number    |        ``udp.src = 53``             |\n|   ``udp.dst``   |    Dest. port      |      *UDP*    |     number    |        ``udp.dst = 7``              |\n|   ``udp.size``  |     UDP Length     |      *UDP*    |     number    |       ``udp.size = 8``              |\n|``udp.checksum`` |      Checksum      |      *UDP*    |     number    |       ``udp.checksum = 0``          |\n|``udp.payload``  |      Payload       |      *UDP*    |     number    |    ``udp.payload = \"boo!\"``         |\n| ``icmp.type``   |     ICMP type      |     *ICMP*    |     number    |       ``icmp.type = 0``             |\n| ``icmp.code``   |     ICMP code      |     *ICMP*    |     number    |        ``icmp.code = 0``            |\n|``icmp.checksum``|     Checksum       |     *ICMP*    |     number    |    ``icmp.checksum = 0``            |\n|``icmp.payload`` |     Payload        |     *ICMP*    |     string    |  ``icmp.payload = \"ping!\"``         |\n| ``arp.hwtype``  | ARP hardware type  |     *ARP*     |     number    |      ``arp.hwtype = 0x1``           |\n| ``arp.ptype``   | ARP protocol type  |     *ARP*     |     number    |      ``arp.ptype = 0x0800``         |\n| ``arp.hwlen``   |ARP hardware length |     *ARP*     |     number    |       ``arp.hwlen = 6``             |\n| ``arp.opcode``  | ARP operation code |     *ARP*     |     number    |       ``arp.opcode = 2``            |\n| ``arp.hwsrc``   | ARP src hw address |     *ARP*     |      MAC      |``arp.hwsrc = \"de:ad:be:ef:0:0\"``    |\n| ``arp.psrc``    | ARP src proto addr |     *ARP*     |   ip address  |    ``arp.psrc = 192.30.70.3``       |\n| ``arp.hwdst``   | ARP dst hw address |     *ARP*     |      MAC      |``arp.hwdst = \"de:ad:be:ef:0:0\"``    |\n| ``arp.pdst``    | ARP dst proto addr |     *ARP*     |   ip address  | ``arp.pdst = 192.30.70.3``          |\n\nWhen creating a signature you do not need specify all data. If you specify only the most relevant packet parts\nthe remaining parts will be filled up with default values. The ``checksums`` are **always** recalculated.\n\nTip: take a look in sub-directory ``pigsty``. You will find lots of signature files and you will see that is\npretty simple define new ones.\n\n## Specifying IP addresses geographically\n\nYes, it is possible. In order to use this feature you just need to specify the values listed on ``Table 2``\nin ``ip adddress`` typed fields.\n\n**Table 2**: IPs by geographic area.\n\n|   **Value to use**  |          **Stands for**         |\n|:-------------------:|:-------------------------------:|\n|``north-american-ip``| IP addresses from North America |\n|``south-american-ip``| IP addresses from South America |\n|    ``asian-ip``     | IP addresses from Asia          |\n|   ``european-ip``   | IP addresses from Europe        |\n\n## Specifying my own addresses\n\nYou should in any ``ip address`` typed field use ``user-defined-ip`` as value. Note that you need to use the\ncommand line option ``--targets`` in this case. See section [Using pig](#using-pig) for more information.\n\n# Contribute sending more packet signatures\n\nIf you create ``pigsty files`` that you judge be relevant beyond your own environment open a pull request in order\nto include these useful files here. Thank you in advance!\n\n# Using pig\n\nThe ``Pig`` usage is very straightforward being necessary to supply four basic options which are:\n\n- ``--signatures``\n- ``--gateway``\n- ``--net-mask``\n- ``--lo-iface``\n\nDo you want to know more about each option, huh?... So let's go:\n\n- The option ``--signatures`` receives a list of file paths to ``pigsty files``.\n- The option ``--gateway`` is where you specify your gateway address. Be aware that ``pig`` generates or at least try to generate the ``ethernet frames`` too. Due to it the gateway address is rather important in order to correctly compose the ``layer-1`` data.\n- The option ``--net-mask`` for routing issues must receive your network mask.\n- The option ``--lo-iface`` is the place where you should inform the name of the local network interface you will use to \"drain out\" the generated packets.\n- The option ``--no-gateway`` indicates that any packet will send outside the network.\n\nSupposing that we want to generate ``DDos`` based traffic:\n\n```\nsomeones@err..InTheWolf:~# pig --signatures=pigsty/ddos.pigsty\\\n\u003e --gateway=10.0.2.2\\\n\u003e --net-mask=255.255.255.0 --lo-iface=eth0\n```\n\nNow we want to messing up with everything:\n\n```\nsomeones@err..InTheWolf:~# pig --signatures=pigsty/ddos.pigsty,pigsty/attackresponses.pigsty,\\\n\u003e pigsty/badtraffic.pigsty,pigsty/backdoors.pigsty\\\n\u003e --gateway=10.0.2.2 --net-mask=255.255.255.0 --lo-iface=eth0\n```\n\n## Extra options\n\n### Defining timeouts between the signature sendings\n\nFor it use the option ``--timeout=\u003cmillisecs\u003e``\n\n### Echo suppressing\n\nUse the ``--no-echo`` option.\n\n### Defining targets\n\nUse the ``--targets`` option. You can specify a list based on exact IPs, IP masks and [``CIDRs``](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing).\n\nLook this:\n\n```\nsomeones@err..InTheWolf:~# pig --signatures=pigsty/local-mess.pigsty\\\n\u003e --targets=192.30.70.3,192.30.70.*,192.30.70.0/9\\\n\u003e --gateway=10.0.2.2\\\n\u003e --net-mask=255.255.255.0\\\n\u003e --lo-iface=eth0\n```\n\n### Not using the gateway\n\nThis is useful when the loaded signatures will not send data outside the current network. In order to flag it you need to use\nthe option ``--no-gateway``. When the ``--no-gateway``  option is used you do not need to specify the gateway's address\nbecause the packets will not flow outside the current segment. As a result to inform the network mask becomes irrelevant too.\n\nFor instance:\n\n```\nsomeones@err..InTheWolf:~# pig --signatures=pigsty/local_traffic.pigsty --no-gateway --lo-iface=eth2\n```\n\nIn the sample above the ethernet frame will not be a pig's responsibility anymore. For this reason ``pig`` will not complain\nabout the lack of ``--gateway`` and ``--net-mask`` option.\n\nThe ``--no-gateway`` option is rather handy in cases that you need to generate ``ARP`` traffic. Take a look in this another\ndocument explaining how to perform [ARP spoofing with pig](https://github.com/rafael-santiago/pig/blob/master/doc/arp-spoofing-with-pig.md).\n\n### Sending only one signature and going back\n\nMaybe you need to send only one signature and so return to the caller in order to check what happened after. This kind of\nrequirement is common when you use this application as support for ``system tests`` or ``unit tests``. So, if you need\nto do this you should try to use the option ``--single-test``:\n\n```\nsomeones@err..InTheWolf:~# pig --signature=pigsty/syn-scan.pigsty --targets=127.0.0.1 --single-test\\\n\u003e --gateway=10.0.2.2 --net-mask=255.255.255.0 --lo-iface=eth0\n```\n\nAfter running this command ``pig`` will select only one signature from the file ``syn-scan.pigsty`` and try to send it and then exit.\nIf some error has occurred during the process ``pig`` will exit with ``exit-code`` equals to ``1`` otherwise ``pig`` will exit\nwith ``exit-code`` equals to ``0``.\n\n### Specifying the pigsty traverse mode\n\nThe basic ``pig's`` operation mode is about an endless ``loop`` which spits tons of packets into the network respecting a\nprevious defined timeout.\n\nYou can define how ``pig`` traverses the loaded packets for sending them using the option ``--loop=\u003cmode\u003e``. Until now\nthe modes are two: ``random`` (the default) and ``sequential``.\n\nThe ``sequential`` mode will re-iterate the signatures when it hits the end of the loaded packet signatures list.\n\n### The sub-tasks\n\nSub-tasks are useful minor tasks related with packet crafting which are shipped into ``pig`` for helping you on\nyour crafting session. These task can be acessed using the option ``--sub-task=\u003ctask-name\u003e``.\n\nBy the fact of practically being sub-programs, the sub-tasks have their own idiosyncrasies and due to it\nthe details about them follows in their own manual. Take a look at the ``Table 3`` for following up to it.\n\n**Table 3**: The ``pig`` sub-tasks.\n\n|      **Sub-task**     |                **What does it perform?**               |         **Manual**                                                                                 |\n|:---------------------:|:------------------------------------------------------:|:--------------------------------------------------------------------------------------------------:|\n|     ``pcap-import``   |     Imports packet from a PCAP file into a pigsty file | [``cat doc/pcap-import.md``](https://github.com/rafael-santiago/pig/blob/master/doc/pcap-import.md)|\n|     ``shell``         |     Executes pig on interactive mode                   | [``cat doc/shell.md``](https://github.com/rafael-santiago/pig/blob/master/doc/shell.md)            |\n\n## Pig tricks\n\n### From the Ethernet frame to the topmost layer...\n\nUntil now you can build up packets based on ``IPv4`` having ``UDP`` or ``TCP`` in their transport layer. You can also build\nup ``ARP`` packets.\n\nHowever, you can still build up packets starting from the ``Ethernet`` frame. The nice thing about it is the possibility\nof virtually building up anything above the ``Ethernet's`` payload.\n\nFor instance, even ``pig`` until now, does not offering support for cooked ``IPv6`` building up, you can still build\nit up using a raw ``Ethernet`` based pigsty. Look:\n\n```\n[ eth.hwdst = \"5C:AC:4C:AA:F5:B5\",\n  eth.hwsrc = \"08:95:2A:AD:D6:4F\",\n  eth.type = 0x86DD,\n  eth.payload = \"\\x60\\x00\\x00\\x00\\x00\\x20\\x3a\\xff\\xfe\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x0a\\x95\\x2a\\xff\\xfe\\xad\\xd6\\x4f\\xfe\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x55\\x51\\x00\\xc2\\x18\\x0f\\xdb\\x46\\x88\\x00\\x32\\x01\\xe0\\x00\\x00\\x00\\xfe\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x0a\\x95\\x2a\\xff\\xfe\\xad\\xd6\\x4f\\x02\\x01\\x08\\x95\\x2a\\xad\\xd6\\x4f\",\n  signature = \"IPv6 from Sparta\" ]\n```\n\nTaking in consideration that the inclusion of the destination and source ``MAC`` addresses inside an \"Ethernet pigsty\" is\noptional we can get the job done even without using any ``plush field``.\n\nIt is nice when you have to test new protocols over your environment among other anomalous funny stuff. On this raw way,\n``pig`` can keep itself useful to you.\n\n## Testing pig from scratch\n\nSave the following data as ``\"oink.pigsty\"``:\n\n```\n[ signature   =           \"oink\",\n  ip.version  =                4,\n  ip.ihl      =                5,\n  ip.tos      =                0,\n  ip.src      =        127.0.0.1,\n  ip.dst      =  user-defined-ip,\n  ip.protocol =               17,\n  udp.dst     =             1008,\n  udp.src     =            32000,\n  udp.payload =        \"Oink!!\\n\" ]\n```\n\nOn another ``tty`` run the ``netcat`` in ``UDP mode`` listen for connections on port ``1008``:\n\n```\nsomeones@err..InTheWolf:~# nc -u -l -p 1008\n```\n\nNow run ``pig`` using the ``\"oink.pigsty\"``, informing as target the ``loopback``:\n\n```\nsomeones@err..InTheWolf:~# pig --signatures=oink.pigsty --targets=127.0.0.1\\\n\u003e --gateway=10.0.2.2 --net-mask=255.255.255.0 --lo-iface=eth0\n```\n\nThe ``netcat`` should start receiving several ``oinks`` and... yes, congrats!! ``pig`` is up and running on your system! ;)\n\nTry to sniff your Network to get more information about these ``UDP packets`` that are flowing around your interfaces...\n\nHave fun!\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frafael-santiago%2Fpig","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frafael-santiago%2Fpig","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frafael-santiago%2Fpig/lists"}