Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am connecting to a server

nc -v 192.168.0.1 1111

But I want to do IP spoofing because the server on 192.168.0.1 only accepting commands from 7.7.7.7. We are two friends, I am 192.168.1.1, and my friend is 192.168.0.1. My friend installed a daemon (on port 1111) and runs

ncat -u -c /bin/bash --allow 7.7.7.7 -l 1111

I know netcat's -s parameter, but I don't know how to use it. I tried

nc -v 192.168.0.1 1111 -s 7.7.7.7
7.7.7.7: inverse host lookup failed: Unknown server error : Connection timed out

How can I use netcat to connect with a spoofed IP address?

share|improve this question
2  
You should familiarize your self with the OSI model. This is a very introductory question about the basics of networking. –  Rook Apr 22 '12 at 16:11
1  
Full command ncat -u -c /bin/bash -k -n -v --allow 1.1.1.1 -l 443 –  Tolga Apr 23 '12 at 20:33
    
My Friend's Code is ncat -u -c /bin/bash --allow 7.7.7.7 -l 1111 –  Tolga Apr 24 '12 at 9:50
    
You need to have a lot of networking set up to make this happen. Is his internet firewall set up to accept connections on this port? Is there port redirection? –  schroeder Apr 24 '12 at 18:29
    
also remember to use UDP switch ... –  schroeder Apr 24 '12 at 19:22

4 Answers 4

Netcat does not support IP-spoofing. Also, when there is one or more routers in between, the odds that IP-spoofing will be working is zero. When using 192.168.1.x and 192.168.0.y having a router in between is very likely.

Also 7.7.7.7 is a publicly assigned address. You cannot use it for your own.

If you want to experiment with other IP-addresses, use addresses from these ranges:

  • 10.x.y.z
  • 172.24.0.0 - 172.31.255.255
  • 192.168.x.y

netcat needs to bind to an IP address that is available on your computer. You can check those by typing sudo ifconfig -a. Notice that all 127.x.y.z addresses are loopback addresses and only exist inside your own PC.

share|improve this answer
    
Thanks.Should I use to program which ip spoof and send the command? –  Tolga Apr 22 '12 at 11:05
3  
Your friend and you work from the same home or room? If the answer to that question is 'No' then IP-spoofing is not going to work at all. –  jippie Apr 22 '12 at 11:20
    
No.My friend is from other city.I am sending nc -v friend_address 1111 and no respond.I want to command execute on my friend pc from 1111 port and download secret file. –  Tolga Apr 22 '12 at 11:34
    
You won't be able to connect to his 192.168.0.1 address from your home. You need to connect to his internet-facing router's IP and set up his router to forward traffic to his computer. Has this been set up? –  schroeder Apr 24 '12 at 18:31
    
Study some TCP/IP networking material that explains you how IP-addresses are made up and how routing works. Wikipedia is a nice start: en.wikipedia.org/wiki/Internet_Protocol_Suite –  jippie Apr 24 '12 at 18:41

The netcat -s parameter is used to set the source address. This parameter is used if you have multiple interfaces, and multiple exit gateways that can be used. netcat manual

It seem to me that you are trying to set the source ip to an ip that is not routed back to you on your gateway.

The traffic flow would look something similar to this for the three-way handshake: (192.168.0.254 is your default gateway used to reach internet).

7.7.7.7 -> 192.168.0.1 (SYN)

192.168.0.1 -> 192.168.0.254 (SYN+ACK) # At this point, the packet will be routed through the gateway, destination is still 7.7.7.7

192.168.0.254(official internet ip) -> 7.7.7.7 (SYN+ACK)

7.7.7.7 -> 192.168.0.254(official internet ip) (RST) # Packet is disregarded by 7.7.7.7 is not familiar with this connection.

As you can see, you will be able to spoof the initial packet to the server, but you are unable to complete the three-way-handshake which is required to send any commands/data. The reason for this is because the response traffic will not be sent back to you, but to the real 7.7.7.7 ip.

A method to perform a successful spoofing attack is by man-in-the-middle, where you convince 192.168.0.1 that you are the gateway. When 192.168.0.1 send the SYN+ACK response towards 7.7.7.7, you will intercept the traffic and can act as 7.7.7.7.

Paper about ARP and attacks

share|improve this answer
    
he's using UDP, so a 'connection' isn't necessary –  schroeder Apr 24 '12 at 19:21

'Connection' is not possible by spoofing. When his computer responds, it will be to the address that is not you. You have to send commands 'blind'.

To prove this, send a ping request (to your machine) to your friend's netcat session (while spoofing) and capture packets to see if you get anything.

** EDIT **

It IS possible to IP spoof with netcat! Just assign the spoofed IP to your local interface and set up a gateway:

eth0 IP: 192.168.1.1
IP to spoof: 7.7.7.7
Target IP: 5.5.5.5

ifconfig eth0 7.7.7.7
route add -net 7.7.7.0 eth0
nc -nvu -s 7.7.7.7 -g 192.168.1.1 5.5.5.5 1111

The problem is that many Internet routers block this type of spoofing.

Strict Source Routing

You can set up full-connections while spoofing, but you need to set up a gateway chain to do it:

eth0 IP: 192.168.1.10
Firewall IP: 192.168.1.1
IP to spoof: 7.7.7.7
Target IP: 5.5.5.5
IPs of Internet routers to Target (up to 8): n.n.n.[1-8]

ifconfig eth0 7.7.7.7
route add -net 7.7.7.0 eth0
nc -nvu -s 7.7.7.7 -g 192.168.1.10 192.168.1.10 1111
nc -nvu -s 7.7.7.7 -g 192.168.1.10 192.168.1.1 1111
nc -nvu -s 7.7.7.7 -g 192.168.1.10 -g 192.168.1.1 n.n.n.1 1111
...
nc -nvu -s 7.7.7.7 -g 192.168.1.10 -g 192.168.1.1 -g n.n.n.8 5.5.5.5 1111
share|improve this answer
    
netcat doesn't support icmp, so it would never see a ping (icmp echo request). ICMP is a totally different protocol compared to TCP (what you probably want) or UDP. –  jippie Apr 24 '12 at 18:35
    
@jippie what I meant was to send the ping command to the remote netcat session, because the listener is bound to bash. But, I have totally changed my answer for connection-based options. –  schroeder Apr 24 '12 at 19:06
    
I give error when add route. SIOCADDRT: Invalid argument –  Tolga Apr 25 '12 at 15:06
    
Different linux kernels expect different args. Try "ip route add 7.7.7.0/24 dev eth0" or look at the "route --help" to see how to add a route to a network. –  schroeder Apr 25 '12 at 16:44
    
I did as you showed.And i controlled my packets with wireshark but not move my udp packet.So,no answer target ip. –  Tolga Apr 25 '12 at 18:54

Everything you should do is to write private IP address on the address bar on your own favourite internet browser and click enter. It usually is beneficial for you to utilize internet browser with maximum help for world wide web requirements (similar to Firefox) for the greatest end results. You're going to be taken up to precisely what is critically the computer software which drives your current networking unit. Below you may make corrections to configurations, set your account information, and set up your networking unit as you think fit.

As is also the way it is with any computer system setup, it usually is to your best benefit either to come up with a total data backup of the configuration settings before you decide to modify them or note down the defaults for each function that you choose to transform. A couple of inaccurate configuration settings when making your own computer network unit and you might eliminate your internet connection.

If anything truly does go awry when updating your network system piece of equipment via 192.168.1.1 ip, there's often a hardware reset control key on the backside of the piece of equipment that can bring back each of the controls to the manufacturer defaults.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.