Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote -5 down vote favorite

I want to spoof my IP address with the PHP curl function. I'm sending requests to a server with PHP curl, my IP address is $ip2, but I want the server to believe that the request is coming from $ip1. How can I do this?

share|improve this question
1  
Welcome to security.stackexchange.com, please read the FaQ. Your question implies that you plan to perform an illegal attack. We will not assist you in this and would advice to remove your question. Thank you. Furthermore you do not seem to have basic understanding of what Ddos implies. – Lucas Kauffman Jan 2 at 8:14
This for educational purpose – messi fan Jan 2 at 8:45
1  
Can you specify your education purposes? Is it homework? Why would you want to do this? – Lucas Kauffman Jan 2 at 8:47
@LucasKauffman Poor as the question is, there is nothing in it that implies an illegal attack. – Gilles Jan 2 at 9:42
@Gilles While this is true, considering the nature I can't really think of legal ways to perform a Ddos. I can accept that this might be for educational purposes, to Ddos your own lab or something. Yet the OP has failed to specify his educational purposes on here and on Stackoverflow. Which makes me suspicious of his true intentions. But you are correct so any mod may change my comment to possible illegal :) – Lucas Kauffman Jan 2 at 9:48
show 1 more comment

closed as off topic by Lucas Kauffman, AviD♦ Jan 2 at 12:28

Questions on IT Security Stack Exchange are expected to relate to IT security within the scope defined in the FAQ. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about closed questions here.

2 Answers

up vote 2 down vote accepted

When the server receives a request, it needs to be able to send a reply back to the client. It knows where to send that reply back because it knows the IP address of the client. You cannot establish an HTTP (or, more generally, TCP) session with a spoofed IP address.

At the IP level, you can send an IP packet with a spoofed source address. That's not going to do much good to connect to a web server though. If the packet isn't a TCP packet sent to port 80 on the server, it's probably not even going to reach the server, it's likely to be blocked by a firewall that's between the server and the Internet.

As soon as you want to establish a TCP connection, the connection starts with the client sending a packet to establish the connection, and the server replies. Until the client has obtained a reply from the server, the connection is not established, and if the client tried to fake subsequent packets, they would probably be blocked by the server-side firewall. With the PHP curl library, you can only make well-formed TCP connections anyway.

Since the server needs to know what IP address the requests come from in order to be able to send back replies, the only way to fake your IP address is to cause these requests to come from a different machine. That is, if you want your IP address to appear to be $ip1, you need to get the machine with the address $ip1 to relay your requests. In other words, you need $ip1 to act as a proxy.

share|improve this answer
up vote 0 down vote

You can spoof the sender IP of UDP packets. You can't spoof your IP with TCP, since you need to receive a response to the handshake. You can only use a proxy to hide your IP.

Since http builds on TCP, you can't spoof your IP when issuing http requests, no matter which client library you use.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.