juxhindb / synner

A TCP SYN flood client written in Rust, powered by libpnet

Synner /'sɪnə'/

A TCP SYN flood client written in Rust, powered by libpnet

---

Prequisites

• rustc/cargo v1.27.0
• WinPcap for Windows for libpnet to work (see this)

Usage

cargo run TARGET_IP INTERFACE_NAME

In order to be able to pull the list of network interfaces, make sure that you are running in a terminal/command prompt with admin privilieges.

If you are not sure about the interface name, you can run the tool with a dummy value (e.g. \DEVICE\) and wait for it to print out the list of interfaces like so:

cargo run 192.168.33.10 \DEVICE\
   Compiling synner v0.1.0 (file:///C:/Users/juxhindb/Projects/synner)
    Finished dev [unoptimized + debuginfo] target(s) in 1.63s
     Running `target\debug\synner.exe 192.168.33.10 \DEVICE\`
List of Available Interfaces

Interface name: "\\Device\\NPF_{B1BBC7C0-C3CF-490B-A640-00ABDB86F989}"
Interface MAC: 0a:00:27:00:00:12
Interface IP: 192.168.99.1

Interface name: "\\Device\\NPF_{AD266AD1-7AE0-4360-8EE5-ED6283B43B9C}"
Interface MAC: 2a:56:5a:4f:fc:e9
Interface IP: 0.0.0.0

Interface name: "\\Device\\NPF_{2288F93F-E56C-4F71-8B8E-C385BE71421F}"
Interface MAC: 1a:56:5a:4f:fc:e9
Interface IP: 0.0.0.0

Where you can then copy the name. Be sure to unescape the \\.

Example

Running cargo run 206.189.96.237 \Device\NPF_{F94968E8-FBA0-410D-8CD3-F205AEAD4DC9} again a test DigitalOcean droplet. The GIF below is split into three panels. Bottom one running synner, top-right is an SSH connection running a TCP dump (sudo tcpdump "tcp[tcpflags] & (tcp-syn) != 0" -i eth0 -n) and the top-left is me attempting to make another SSH connection to the target machine once the target is being flooded.

synner's Issues

Usage details

Not exactly an issue, but how to do what you have mentioned in the 1st line of README?
If you want to get this to work, you need to configure the Ethernet dst and src to point to your interface's MAC address and the target interface MAC address.

panic when network adapter not use.

First of all, thank for your sharing, it's very helpful!
When I run the program, it's panicked, because my 'enp3s0' is not use, so ips is empty array.
here is my print:

NetworkInterface { name: "enp3s0", index: 2, mac: Some(MAC_ADDRESS), ips: [], flags: 4098 }

and panic message:

thread 'main' panicked at 'index out of bounds: the len is 0 but the index is 0', /checkout/src/libcore/slice/mod.rs:2085:10
note: Run with RUST_BACKTRACE=1 for a backtrace.

I added a branch to solve it, but I'm a noob to rust, look forward to your solution.

Something can be improved

I've done my project and I've discovered some way to improve the Synner maybe:

1. The random<T>() costs a lot of time. So, I think you can choose Xorshift instead of regular random algorithm. The rand library has impled the Xorshift algorithm and I wrote a fast_random<T>():

pub fn fast_random<T>() -> Result<T, rand::Error>
where
    T: PartialOrd + SampleUniform,
    Standard: Distribution<T>,
{
    let mut rng = XorShiftRng::from_rng(EntropyRng::new())?;
    Ok(rng.gen())
}

2. You can modify the Packet's source IP and source Port fields instead of creating whole new packet.
   I did this in build.rs. I created a struct and impled some methods for it.
3. In Synner, for every single sending, you will create a new (mut tx,_) pair, which is needless. I think you can just use one tx, so you can save the time of creating tx.
   I did this in sender.rs.

And I think your demo is not right maybe? I think you couldn't SSH the server because your bandwidth has been blocked. If you run the synner, can you open Google or other website normally? If not, the demo cannot prove the Synner attacked the server.