GET request with different IPs

Question

I need to check vulnerability in my polling system. So I need to send GET requests but every time with different IPs. Can anyone suggest something?

Answer 1

How are you sending your GET requests?

Regardless of how you do it you'll need to change your IP somehow. If it is a program it'd be easier to change proxies on the fly, but if not you could just switch proxies every time in your browser.

You could also disconnect/reconnect your internet if you had a dynamic IP obviously, but that'd just be a hassle.

OR, if you are doing internal testing it'd be quite easy as you'd just need to change your statically set LAN IP each time.

Answer 2

Running as root with raw sockets will let you set whatever IP address you wish on your outgoing packets. Tools like hping3 include this functionality. You could write the binary GET request and feed it as an option to hping3, then specify the source address (or even --rand-source). That won't get you all the way, though.

Since we're talking about completing the full TCP connection, you'll need to take those lessons of raw sockets and write them into your own application (or find one that does this already). To be functional, your source machine's network card will need to be listening in promiscuous mode. You will also need to have your target's (the webserver) network route pumping all traffic directly to the network. The easiest way to to do that would be to make your source machine the default gateway.

Sockstress is one tool that sounds like it might fit the bill, but I'm not familiar with it.

Answer 3

Could you connect through Tor or a proxy?

Answer 4

Spoofing IP addresses over different subnets is not trivial as you have to establish a 3 way TCP handshake in order to make the HTTP connection.

If you have control of a machine on the same subnet you can probably make this work a lot easier. You simply script changing your IP, replay the HTTP request and repeat.

Other than that you could probably do one of the following:

• Install Tor (Comes with portable Firefox, easy to set up)
• Use public open proxy (Just google it)
• Get someone to help you test from different IP's

Answer 5

IP addresses can't be spoofed with TCP unless you're in a position to intercept the return traffic.

But if you're using all IP addresses that are assigned to your computer, you can call bind() on the outbound socket using the desired outbound address before calling connect() to make the request.

If instead you're on a router or other network choke-point, then your best bet is probably intercepting and re-writing your own traffic using either a virtual interface or through something like libipq. That allows you to offload the real heavy-lifting to the kernel instead of having to re-write your own TCP implementation.

If this sounds confusing, then you may be in a bit over your head, and perhaps this isn't the direction you should go.