I have never tried this in this context, but you can replay wirehshark/tcpdump capture files (pcap). tcp replay would do this. So you can capture the traffic of a production server and then replay it against the test server if you feel you must capture tests of 'wrong network packets etc'.` I don't know if this really simulates the traffic though as any sort of session traffic (web based or tcp) would need to be maintained and the packets properly altered (For example, TCP initial sequence numbers, ACK synchronization etc).
I still think a testing framework that will run scripts like jmeter makes the most sense though (You could have them inject 'hacker-like-stuff' into the fields in the webpage if you feel you must). Then at the same time you can launch your own DoS and malformed packets with a crafting tool such as scapy (scapy isn't fast, so not the ideal tool for the DoS part). A good firewall should be handling the DoS/Malformed Packets part before it gets to the server anyways, so normally I would say these are two different tests.