I want to spoof my IP address with the PHP curl function. I'm sending requests to a server with PHP curl, my IP address is $ip2, but I want the server to believe that the request is coming from $ip1. How can I do this?
closed as off topic by Lucas Kauffman, AviD♦ Jan 2 at 12:28
Questions on IT Security Stack Exchange are expected to relate to IT security within the scope defined in the FAQ. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about closed questions here.
When the server receives a request, it needs to be able to send a reply back to the client. It knows where to send that reply back because it knows the IP address of the client. You cannot establish an HTTP (or, more generally, TCP) session with a spoofed IP address.
At the IP level, you can send an IP packet with a spoofed source address. That's not going to do much good to connect to a web server though. If the packet isn't a TCP packet sent to port 80 on the server, it's probably not even going to reach the server, it's likely to be blocked by a firewall that's between the server and the Internet.
As soon as you want to establish a TCP connection, the connection starts with the client sending a packet to establish the connection, and the server replies. Until the client has obtained a reply from the server, the connection is not established, and if the client tried to fake subsequent packets, they would probably be blocked by the server-side firewall. With the PHP curl library, you can only make well-formed TCP connections anyway.
Since the server needs to know what IP address the requests come from in order to be able to send back replies, the only way to fake your IP address is to cause these requests to come from a different machine. That is, if you want your IP address to appear to be $ip1, you need to get the machine with the address $ip1 to relay your requests. In other words, you need $ip1 to act as a proxy.
You can spoof the sender IP of UDP packets. You can't spoof your IP with TCP, since you need to receive a response to the handshake. You can only use a proxy to hide your IP.
Since http builds on TCP, you can't spoof your IP when issuing http requests, no matter which client library you use.