0

I'm looking to edit / tamper / modify live UDP packets.

I've taken a look at these programs:

hexinject - injects, doesn't modify the original packet
ettercap + etterfilter - replacement doesn't work
iptables + netsed - reroutes packets to the wrong destination

I'm looking for a program similar to fiddler2 where you can write a script that will allow you to change the packet before sending.

So if the server tries to send the packet "00 00 01", another program could intercept this packet and instead send "00 00 00". The program would modify this packet (i.e drop and resend), not inject (duplicate).

I know this might fall under "suggestion of a program", but it's not really a suggestion, I can't find a single program that does this.

I'm running linux, but I can't find anything for windows either.

I've done a lot of searching, but none of these seem to work, they either inject the packet, or they only modify a pcap file, not the live traffic.

Has anyone used anything like this before?

https://stackoverflow.com/questions/13837077/how-can-i-edit-and-tamper-packets-at-will

https://serverfault.com/questions/74915/best-way-to-live-edit-packets-from-another-computer

https://ask.wireshark.org/questions/10292/editing-the-packet-live

Network packet editor for Linux?

https://stackoverflow.com/questions/32545821/tampering-with-live-network-packets

1 Answer 1

0

The BitTwist (http://bittwist.sourceforge.net) editor commandline program (bittwiste) allows you to change the destination IP address (and port number) amongst other things.

Use these steps to edit packets http://bittwist.sourceforge.net/doc.html

2
  • I've tried iptables + netsed already. Note that it's listening to live traffic, so I can't just run netsed standalone (cannot reuse ports). So I have iptables redirect the traffic to netsed, but the problem is when I redirect the traffic, netsed doesn't know the final destination of the packet. I have an application running on port 3000, but netsed can't listen on port 3000 at the same time. How can I get netsed to listen on a port that's already being used?
    – Dave Chen
    Sep 21, 2015 at 6:52
  • Bittwist works in the same way as hexinject, it only injects packets (regenerates traffic), it never edits the original packet.
    – Dave Chen
    Sep 21, 2015 at 17:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .