基于HTTP文件下载欺骗系统的设计与实现  

Design of File Download Spoofing System Based on HTTP

作　　者：王永刚[1] 

机构地区：[1]福建信息职业技术学院,福建福州350003

出　　处：《常州工学院学报》2012年第2期37-42,共6页Journal of Changzhou Institute of Technology

摘　　要：文章提出了一种基于HTTP文件下载欺骗技术的设计方案,能监视局域网用户行为。当目标主机开始执行文件下载时,利用TCP/IP协议没有对源IP地址执行合法性认证的缺陷,创建源IP地址为Web服务器IP地址的HTTP 302重定向数据包。通过重定向目标主机下载的资源文件,和目标主机完成文件下载通信。重定向后的数据文件是后门程序,攻击主机能通过它得到目标主机的管理权限,进而控制目标主机的网络动作。该方案具有很好的隐蔽性。最后进行了测试,测试结果表明该系统的研究思路是正确的。This paper proposes a file download spoofing technology based on HTTP,which can monitor the behavior of users in the local area network. When the target host computer begins the implementation of file download, it creates a source IP address of the Web server IP address HTTP 302 redirect data packets, owing to the lack of authentication mechanisms of the Authenticity of the source IP address. By redirecting the download resource file of the target host computer, it completes the communication of the file download with the target host computer. Data file of redirected is a backdoor program, the attacking host computer can get the authority of the target host computer by it, and then controls its network action. This design successfully spoofs the target host computer in the circumstance of user unknown. The test results indicate the thesis research ideas are correct.

关 键 词：HTTP 欺骗系统 文件下载 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]