iptgen is a tool to generate network packets from scripts to play them onto your netowrk or create a pcap file.
Install in the standard way:
-
Install
npcapdriver. Visit https://nmap.org/npcap/ to download and install it. -
Extract
iptgen.win32.zip.
- Choose the archive file appropriate for your platform,
iptgen.linux-x86_64.tar.gzoriptgen.linux-i686.tar.gz, and extract it.
Here are binaries:
For playing packets onto your network.
iptgen.bin --in.file <script-file> --out.eth <ifname>
e.g.
** Linux
sudo iptgen.bin --in.file ./scripts/http-upload.json --out.eth eth0
** Windows
iptgen.exe --in.file ./scripts/http-upload.json --out.eth Ethernet0
For creating a pcap file.
iptgen.bin --in.file <script-file> --out.file <filename>
e.g.
** Linux
sudo iptgen.bin --in.file ./scripts/http-upload.json --out.file http.pcap
** Windows
iptgen.exe --in.file ./scripts/http-upload.json --out.file http.pcap
To see all options that are available, run:
iptgen.bin --help
A script is text that a list of Process or String (comment) are concatenated.
Data Type: Object[String, Any] or Array[Object[String, Any]]
Details
| Key | Type | Description |
|---|---|---|
| client | String | Client IP Address (e.g. 192.168.1.2), Port numer is optional. |
| server | String | Server IP Address (e.g. 1.2.3.4:80), Port numer is optional. |
| eth.src (Optional) | String | Client MAC Address (e.g. 11:22:33:44:55:66) |
| eth.dst (Optional) | String | Server MAC Address (e.g. 11:22:33:44:55:66) |
| sequence | Sequence | Sequence of sessions |
Data Type: Array[Operation]
Data Type: Object[String, Any]
Data Type: Operation or Array[Operation]
No operation.
| Key | Type | Value |
|---|---|---|
| op | String | none |
{
"op": "none"
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | none |
["none"]
`for-loop` statement for specifying iteration.
| Key | Type | Value |
|---|---|---|
| op | String | for |
| l.begin | Number | Start value of the counter |
| l.end | Number | End value of the counter |
| l.step | Number | Specifies the amount the counter is increased (default:1) |
| l.name | String | Name of the counter |
| l.sequence | Sequence | Sequence of operations in the loop |
{
"op": "for",
"l.begin": 0,
"l.end": 10,
"l.name": "i",
"l.sequence": [
["dns.q.a", "www.domain.com", "3.3.3.3"]
]
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | for |
| [1] | Array[l.begin, l.end, l.strp] | [0]: l.begin, [1]: l.end, [2]: l.step (default:1) |
| [2] | String | l.name |
| [3] | Sequence | l.sequence |
["for", [0, 10], "i",
[
["dns.q.a", "www.domain.com", "2.2.2.2"]
]
]
Run operations in the infinite loop
| Key | Type | Value |
|---|---|---|
| op | String | loop |
| l.sequence | Sequence | Sequence of operations in the loop |
{
"op": "loop",
"l.sequence": [
["dns.q.a", "www.domain.com", "3.3.3.3"]
]
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | loop |
| [1] | Sequence | l.sequence |
["loop",
[
["dns.q.a", "www.domain.com", "2.2.2.2"]
]
]
`for-loop` statement for specifying iteration. The session is closed whenever looping back or when breaking the loop. A new port is assigned for a new session when closing the session.
| Key | Type | Value |
|---|---|---|
| op | String | for.session |
| l.begin | Number | Start value of the counter |
| l.end | Number | End value of the counter |
| l.step | Number | Specifies the amount the counter is increased |
| l.name | String | Name of the counter |
| l.sequence | Sequence | Sequence of operations in the loop |
{
"op": "for.session",
"l.begin": 0,
"l.end": 10,
"l.name": "i",
"l.sequence": [
["tcp.send", "text", "Hello"],
["tcp.recv", "text", "Hello"]
]
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | for.session |
| [1] | Array[l.begin, l.end, l.strp] | [0]: l.begin, [1]: l.end, [2]: l.step |
| [2] | String | l.name |
| [3] | Sequence | l.sequence |
["for.session", [0, 10], "i",
[
["tcp.send", "text", "Hello"],
["tcp.recv", "text", "Hello"]
]
]
Run operations in the infinite loop. The session is closed whenever looping back. A new port is assigned for a new session when closing the session.
| Key | Type | Value |
|---|---|---|
| op | String | loop.session |
| l.sequence | Sequence | Sequence of operations in the loop |
{
"op": "loop.session",
"l.sequence": [
["tcp.send", "text", "Hello"],
["tcp.recv", "text", "Hello"]
]
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | loop.session |
| [1] | Sequence | l.sequence |
["loop.session", [0, 10], "i",
[
["tcp.send", "text", "Hello"],
["tcp.recv", "text", "Hello"]
]
]
`for-loop` statement for specifying iteration. A new process separated from the session is created on each iteration. New client/server IPs can be used in the processes.
| Key | Type | Value |
|---|---|---|
| op | String | for.process |
| l.begin | Number | Start value of the counter |
| l.end | Number | End value of the counter |
| l.step | Number | Specifies the amount the counter is increased (default:1) |
| l.name | String | Name of the counter |
| l.sequence | Process | Sequence of processes in the loop |
{
"op": "for.process",
"l.begin": 0,
"l.end": 10,
"l.name": "i",
"l.sequence": {
"client": "1.1.1.1",
"server": "2.2.2.2:80",
"sequence": [
["tcp.send", "text", "Hello"],
["tcp.recv", "text", "Hello"]
]
}
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | for.process |
| [1] | Array[l.begin, l.end, l.strp] | [0]: l.begin, [1]: l.end, [2]: l.step (default:1) |
| [2] | String | l.name |
| [3] | Process | l.sequence |
["for.process", [0, 10], "i",
{
"client": "1.1.1.1",
"server": "2.2.2.2:80",
"sequence": [
["tcp.send", "text", "Hello"],
["tcp.recv", "text", "Hello"]
]
}
]
Comment statement. The statement doesn't affect the control flow.
| Key | Type | Value |
|---|---|---|
| op | String | comment or `` (empty) |
| Any | Comment |
{
"op": "comment",
"": "This is a comment."
}
{
"op": "",
"": "This is a comment."
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | comment or `` (empty) |
| [1-] | Any | Comment |
["comment", "This is a comment."]
["", "This is a comment."]
A new process separated from the session is created. New client/server IPs can be used in the process.
| Key | Type | Value |
|---|---|---|
| op | String | process |
| sequence | Process | Sequence of processes |
{
"op": "process",
"sequence": [
{
"client": "1.1.1.1",
"server": "2.2.2.2:9999",
"sequence": [
["tcp.send", "text", "Hello"]
]
},
{
"client": "3.3.3.3",
"server": "4.4.4.4:9999",
"sequence": [
["tcp.send", "text", "Hello"]
]
}
]
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | process |
| [1] | Process | sequence |
["process",
[
{
"client": "1.1.1.1",
"server": "2.2.2.2:9999",
"sequence": [
["tcp.send", "text", "Hello"]
]
},
{
"client": "3.3.3.3",
"server": "4.4.4.4:9999",
"sequence": [
["tcp.send", "text", "Hello"]
]
}
]
]
The session is closed and a new port is assigned for a new session.
| Key | Type | Value |
|---|---|---|
| op | String | session.new |
{
"op": "session.new"
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | session.new |
["session.new"]
Generate UDP packets to be generated when sending the payload to the server.
| Key | Type | Value |
|---|---|---|
| op | String | udp.send |
| p.type | String | Payload type (see Payload) |
| p.value | Any | Payload data (see Payload) |
{
"op": "udp.send",
"p.type": "text",
"p.value": "Hello"
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | udp.send |
| [1] | String | p.type |
| [2] | Any | p.value |
["udp.send", "text", "Hello"]
Generate UDP packets to be received when receiving the payload from the server.
| Key | Type | Value |
|---|---|---|
| op | String | udp.recv |
| p.type | String | Payload type (see Payload) |
| p.value | Any | Payload data (see Payload) |
{
"op": "udp.recv",
"p.type": "text",
"p.value": "Hello"
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | udp.recv |
| [1] | String | p.type |
| [2] | Any | p.value |
["udp.recv", "text", "Hello"]
Generate a TCP SYN packet to the server.
| Key | Type | Value |
|---|---|---|
| op | String | tcp.syn.stateless |
{
"op": "tcp.syn.stateless"
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | tcp.syn.stateless |
["tcp.syn.stateless"]
Generate a TCP SYN packet to the server and an ACK from the server.
| Key | Type | Value |
|---|---|---|
| op | String | tcp.syn+synack.stateless |
{
"op": "tcp.syn+synack.stateless"
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | tcp.syn+synack.stateless |
["tcp.syn+synack.stateless"]
Generate packets of TCP three-way handshaking. No packets are generated when the session has already been established.
| Key | Type | Value |
|---|---|---|
| op | String | tcp.handshake |
{
"op": "tcp.handshake"
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | tcp.handshake |
["tcp.handshake"]
Generate packets of TCP three-way handshaking no matter the session state.
| Key | Type | Value |
|---|---|---|
| op | String | tcp.handshake.stateless |
{
"op": "tcp.handshake.stateless"
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | tcp.handshake.stateless |
["tcp.handshake.stateless"]
Generate packets sent and received when sending the payload in TCP. If the TCP session has not established yet, it is done prior to sedning it.
| Key | Type | Value |
|---|---|---|
| op | String | tcp.send |
| p.type | String | Payload type (see Payload) |
| p.value | Any | Payload data (see Payload) |
{
"op": "tcp.send",
"p.type": "text",
"p.value": "Hello"
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | tcp.send |
| [1] | String | p.type |
| [2] | Any | p.value |
["tcp.send", "text", "Hello"]
Generate packets sent and received when sending the payload in TCP.
| Key | Type | Value |
|---|---|---|
| op | String | tcp.send.stateless |
| p.type | String | Payload type (see Payload) |
| p.value | Any | Payload data (see Payload) |
{
"op": "tcp.send.stateless",
"p.type": "text",
"p.value": "Hello"
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | tcp.send.stateless |
| [1] | String | p.type |
| [2] | Any | p.value |
["tcp.send.stateless", "text", "Hello"]
Generate packets sent and received when receiving the payload in TCP. If the TCP session has not established yet, it is done prior to receiving it.
| Key | Type | Value |
|---|---|---|
| op | String | tcp.recv |
| p.type | String | Payload type (see Payload) |
| p.value | Any | Payload data (see Payload) |
{
"op": "tcp.recv",
"p.type": "text",
"p.value": "Hello"
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | tcp.recv |
| [1] | String | p.type |
| [2] | Any | p.value |
["tcp.recv", "text", "Hello"]
Generate packets sent and received when receiving the payload in TCP.
| Key | Type | Value |
|---|---|---|
| op | String | tcp.recv.stateless |
| p.type | String | Payload type (see Payload) |
| p.value | Any | Payload data (see Payload) |
{
"op": "tcp.recv.stateless",
"p.type": "text",
"p.value": "Hello"
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | tcp.recv.stateless |
| [1] | String | p.type |
| [2] | Any | p.value |
["tcp.recv.stateless", "text", "Hello"]
Generate packets of a TCP shutdown handshaking initiated by the client. No packets are generated when the session is not active.
| Key | Type | Value |
|---|---|---|
| op | String | tcp.shutdown |
{
"op": "tcp.shutdown"
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | tcp.shutdown |
["tcp.shutdown"]
Generate packets of a TCP shutdown handshaking initiated by the client.
| Key | Type | Value |
|---|---|---|
| op | String | tcp.shutdown.stateless |
{
"op": "tcp.shutdown.stateless"
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | tcp.shutdown.stateless |
["tcp.shutdown.stateless"]
Generate packets of a TCP shutdown handshaking initiated by the server. No packets are generated when the session is not active.
| Key | Type | Value |
|---|---|---|
| op | String | tcp.shutdown-by-peer |
{
"op": "tcp.shutdown-by-peer"
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | tcp.shutdown-by-peer |
["tcp.shutdown-by-peer"]
Generate packets of a TCP shutdown handshaking initiated by the server.
| Key | Type | Value |
|---|---|---|
| op | String | tcp.shutdown.shutdown-by-peer.stateless |
{
"op": "tcp.shutdown.shutdown-by-peer.stateless"
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | tcp.shutdown.shutdown-by-peer.stateless |
["tcp.shutdown.shutdown-by-peer.stateless"]
Reset the internal state of the TCP session. Sending or receiving data in TCP will restart TCP handshaking prior to doing it.
| Key | Type | Value |
|---|---|---|
| op | String | tcp.clear.state |
{
"op": "tcp.clear.state"
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | tcp.clear.state |
["tcp.clear.state"]
Generate packets of SSL handshaking. No packets are generated when it is already established.
| Key | Type | Value |
|---|---|---|
| op | String | ssl.handshake |
| tls.version (Optional) | String | TLS version |
| p12.filepath (Optional) | String | The path of the PKCS#12 file |
| p12.password (Optional) | String | The password for the PKCS#12 file |
{
"op": "ssl.handshake"
}
{
"op": "ssl.handshake",
"tls.version": "1.2",
"p12.filepath": "server.p12",
"p12.password": "password"
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | ssl.handshake |
| [1] (Optional) | String | TLS version |
| [2] (Optional) | Array[String] | p12.filepath and p12.password |
["ssl.handshake"]
["ssl.handshake", "1.2", ["server.p12", "password"]]
["ssl.handshake", "", ["server.p12", "password"]]
Generate packets sent and received in sending the payload in SSL. If a SSL session has not established yet, it will be done with SSL handshaking prior to doing it.
| Key | Type | Value |
|---|---|---|
| op | String | ssl.send |
| p.type | String | Payload type (see Payload) |
| p.value | Any | Payload data (see Payload) |
{
"op": "ssl.send",
"p.type": "text",
"p.value": "Hello"
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | ssl.send |
| [1] | String | p.type |
| [2] | Any | p.value |
["ssl.send", "text", "Hello"]
Generate packets sent and received in receiving the payload in SSL. If a SSL session has not established yet, it will be done with SSL handshaking prior to doing it.
| Key | Type | Value |
|---|---|---|
| op | String | ssl.recv |
| p.type | String | Payload type (see Payload) |
| p.value | Any | Payload data (see Payload) |
{
"op": "ssl.recv",
"p.type": "text",
"p.value": "Hello"
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | ssl.recv |
| [1] | String | p.type |
| [2] | Any | p.value |
["ssl.recv", "text", "Hello"]
Generate packets sent and received in SSL shutdown sequence initiated by the client. No packets are generated when the SSL session is not ready.
| Key | Type | Value |
|---|---|---|
| op | String | ssl.shutdown |
{
"op": "ssl.shutdown"
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | ssl.shutdown |
["ssl.shutdown"]
Generate packets sent and received in SSL shutdown sequence initiated by the server. No packets are generated when the SSL session is not ready.
| Key | Type | Value |
|---|---|---|
| op | String | ssl.shutdown-by-peer |
{
"op": "ssl.shutdown-by-peer"
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | ssl.shutdown-by-peer |
["ssl.shutdown-by-peer"]
Generate packets sent and received in a DNS A record query transaction.
| Key | Type | Value / Description |
|---|---|---|
| op | String | dns.q.a |
| q.name | String | DNS query name |
| r.answers (Optional) | String or Array[String] or Array[Object[String,String] | Resolved IPv4 addresses |
{
"op": "dns.q.a",
"q.name": "www.domain.com"
}
{
"op": "dns.q.a",
"q.name": "www.domain.com",
"r.answers": {
"a": "1.1.1.1"
}
}
{
"op": "dns.q.a",
"q.name": "www.domain.com",
"r.answers": "1.1.1.1"
}
{
"op": "dns.q.a",
"q.name": "www.domain.com",
"r.answers": ["1.1.1.1", "2.2.2.2"]
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | dns.q.a |
| [1] | String | q.name |
| [2] (Optional) | String or Array[String] or Array[Object[String,String] | r.answers |
["dns.q.a", "www.domain.com"]
["dns.q.a", "www.domain.com", "1.1.1.1"]
["dns.q.a", "www.domain.com", ["1.1.1.1", "2.2.2.2"]]
Generate packets sent and received in a DNS AAAA record query transaction.
| Key | Type | Value / Description |
|---|---|---|
| op | String | dns.q.aaaa |
| q.name | String | DNS query name |
| r.answers (Optional) | String or Array[String] or Array[Object[String,String] | Resolved IPv6 addresses |
{
"op": "dns.q.aaaa",
"q.name": "www.domain.com"
}
{
"op": "dns.q.aaaa",
"q.name": "www.domain.com",
"r.answers": {
"aaaa": "2001:db8:a0b:12f0::1"
}
}
{
"op": "dns.q.aaaa",
"q.name": "www.domain.com",
"r.answers": "2001:db8:a0b:12f0::1"
}
{
"op": "dns.q.aaaa",
"q.name": "www.domain.com",
"r.answers": ["2001:db8:a0b:12f0::1", "2001:db8:a0b:12f0::2"]
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | dns.q.aaaa |
| [1] | String | q.name |
| [1] (Optional) | String or Array[String] or Array[Object[String,String] | r.answers |
["dns.q.aaaa", "www.domain.com"]
["dns.q.aaaa", "www.domain.com", "2001:db8:a0b:12f0::1"]
["dns.q.aaaa", "www.domain.com", ["2001:db8:a0b:12f0::1", "2001:db8:a0b:12f0::2"]]
Generate packets sent and received in a DNS TXT record query transaction.
| Key | Type | Value / Description |
|---|---|---|
| op | String | dns.q.txt |
| q.name | String | DNS query name |
| r.answers (Optional) | String or Array[String] or Array[Object[String,String] | Response texts |
{
"op": "dns.q.txt",
"q.name": "www.domain.com"
}
{
"op": "dns.q.txt",
"q.name": "www.domain.com",
"r.answers": {
"txt": "response-text"
}
}
{
"op": "dns.q.txt",
"q.name": "www.domain.com",
"r.answers": "response-text"
}
{
"op": "dns.q.txt",
"q.name": "www.domain.com",
"r.answers": ["response-text1", "response-text2"]
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | dns.q.txt |
| [1] | String | q.name |
| [1] (Optional) | String or Array[String] or Array[Object[String,String] | r.answers |
["dns.q.txt", "www.domain.com"]
["dns.q.txt", "www.domain.com", "response-text"]
["dns.q.txt", "www.domain.com", ["response-text1", "response-text2"]]
Suspend the execution of the current session until the time-out interval elapses.
| Key | Type | Value / Description |
|---|---|---|
| op | String | sys.time.sleep |
| time | Number | The time interval in seconds. |
{
"op": "sys.time.sleep",
"time": 10
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | sys.time.sleep |
| [1] | String | time |
["sys.time.sleep", 10]
Suspend the execution of the current session until the time-out interval elapses when playing in live. The time-out interval given is skipped only when writing pcap files.
| Key | Type | Value / Description |
|---|---|---|
| op | String | sys.time.drift |
| time | Number | The time interval in seconds. |
{
"op": "sys.time.drift",
"time": 10
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | sys.time.drift |
| [1] | String | time |
["sys.time.drift", 10]
Print a message to stdout or stderr.
| Key | Type | Value / Description |
|---|---|---|
| op | String | sys.print |
| text | String | A message to print |
| device (Optional) | String | stdout or stderr (default: stdout) |
{
"op": "sys.print",
"text": "Hello"
}
| Index | Type | Value / Description |
|---|---|---|
| [0] | String | sys.print |
| [1] | String | text |
| [2] (Optional) | String | device |
["sys.print", "Hello"]
Payload data to send or receive.
| Name | Description |
|---|---|
| text | Text. ${}-wrapped variable in the text is replaced with the value. |
| text.raw | Raw text. |
| utf16be | Use the text encoded as UTF-16BE from the UTF-8 text given. ${}-wrapped variable in the text is replaced with the value. |
| utf16be.raw | Use the text encoded as UTF-16BE from the UTF-8 text given. |
| utf16le | Use the text encoded as UTF-16LE from the UTF-8 text given. ${}-wrapped variable in the text is replaced with the value. |
| utf16le.raw | Use the text encoded as UTF-16LE from the UTF-8 text given. |
| urlenc | Use the decoded value of the text in URL encoding. ${}-wrapped variable in the payload is replaced with the value. |
| urlenc.raw | Use the decoded value of the text in URL encoding. |
| base64 | Use the decoded value of the text in base64. ${}-wrapped variable in the payload is replaced with the value. |
| base64.raw | Use the decoded value of the text in base64. |
| hex | Use the decoded value of the text in hex. ${}-wrapped variable in the payload is replaced with the value. |
| hex.raw | Use the decoded value of the text in hex. |
| file | Use the content of the file. ${}-wrapped variable in the content is replaced with the value. |
| file.raw | Use the content of the file. |
| exec | Use the data from stdout of the process executed. ${}-wrapped variable in the data is replaced with the value. |
| exec.raw | Use the data from stdout of the process executed. |
| multi | Concatenate payloads in different payload types. |
- String
Text given in the value.
In:
"text message"
Out:
text message
- Array[String]
Concatenate each element with CRLF.
In:
[
"line1",
"line2",
"line3"
]
Out:
line1[CR][LF]
line2[CR][LF]
line3[CR][LF]
- Array[String] in Array
Concatenate each element.
In:
[
"line1",
[
"text1",
"text2",
"text3"
],
"line3"
]
Out:
line1[CR][LF]
text1text2text3line3[CR][LF]
- String
Decode the text given in URL encoding.
In:
"%3A%2F%2A"
Out:
:/*
- Array[String]
Concatenate each element and decode it in URL encoding.
In:
[
"%3A",
"%2F",
"%2A"
]
Out:
:/*
- String
Decode the text given in base64.
In:
"YWJjZGU="
Out:
abcde
- Array[String]
Concatenate each element and decode it in base64.
In:
[
"YWJj",
"ZGU="
]
Out:
abcde
- String
Decode the text given in hex.
In:
"6162636465"
Out:
abcde
- Array[String]
Concatenate each element and decode it in hex.
In:
[
"61626",
"36465"
]
Out:
abcde
- String
Read the file of the name given.
In:
"file.dat"
Out:
<The content of file.dat>
- Array[String]
Concatenate each file.
In:
[
"file1.dat",
"file2.dat"
]
Out:
<The content of file1.dat><The content of file2.dat>