Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to spoof my IP address with the PHP curl function. I'm sending requests to a server with PHP curl, my IP address is $ip2, but I want the server to believe that the request is coming from $ip1. How can I do this?

share|improve this question

closed as off topic by Lucas Kauffman, AviD Jan 2 '13 at 12:28

Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

While doing this would have security implications, how to do so is not a security question. Besides, this is a very poor question. – AviD Jan 2 '13 at 12:28
up vote 3 down vote accepted

When the server receives a request, it needs to be able to send a reply back to the client. It knows where to send that reply back because it knows the IP address of the client. You cannot establish an HTTP (or, more generally, TCP) session with a spoofed IP address.

At the IP level, you can send an IP packet with a spoofed source address. That's not going to do much good to connect to a web server though. If the packet isn't a TCP packet sent to port 80 on the server, it's probably not even going to reach the server, it's likely to be blocked by a firewall that's between the server and the Internet.

As soon as you want to establish a TCP connection, the connection starts with the client sending a packet to establish the connection, and the server replies. Until the client has obtained a reply from the server, the connection is not established, and if the client tried to fake subsequent packets, they would probably be blocked by the server-side firewall. With the PHP curl library, you can only make well-formed TCP connections anyway.

Since the server needs to know what IP address the requests come from in order to be able to send back replies, the only way to fake your IP address is to cause these requests to come from a different machine. That is, if you want your IP address to appear to be $ip1, you need to get the machine with the address $ip1 to relay your requests. In other words, you need $ip1 to act as a proxy.

share|improve this answer

You can spoof the sender IP of UDP packets. You can't spoof your IP with TCP, since you need to receive a response to the handshake. You can only use a proxy to hide your IP.

Since http builds on TCP, you can't spoof your IP when issuing http requests, no matter which client library you use.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.