IP spoofing, also known as IP address forgery or a host file hijack, is a hijacking technique in which a cracker masquerades as a trusted host to conceal his identity, spoof a Web site, hijack browsers, or gain access to a network.
4
votes
5answers
134 views
Why can we not block DNS Amplification attack by blocking UDP packets or DNS response packet?
I mean if the attacker tries to ask all the open DNS resolver respond to a web server. The web server can just block its UDP ports.
If the all the DNS response go to a Authoritative ...
-2
votes
1answer
114 views
Spoofed DDoS mitigation / DNS amplification mitigation [duplicate]
Recently my server has been attacked multiple times, after looking at my firewall I've come to the conclusion that the IP's are spoofed. (10,000+ IP's connect at once)
I'm running Win server 2012 x64 ...
6
votes
3answers
197 views
TCP Sequence Prediction and it's prominence in modern systems/networks
I have a question regarding your experience of TCP Sequence Prediction that I am hoping someone could help with.
I am aware of how TCP Sequence Prediction works and how the connection can be hijacked ...
15
votes
3answers
465 views
Vulnerable code suggested on OWASP?
Session Hijacking Prevention
It is good practice to bind sessions to IP addresses, that would prevent most session hijacking scenarios (but not all), however some users might use anonymity ...
2
votes
2answers
100 views
Does “loose source and record route” drop the source address?
Is the source IPv4 address lost when a person uses "loose source and record route" and the destination address is put before the end of the list of addresses through which routing should occur?
It ...
3
votes
2answers
53 views
What information should I provide to a website or organization when notifying them that their domain may be sending out spam?
Over the past few days, I've received several spam emails coming from the addresses of a school district. I don't know much about email message headers, but since they contain numerous references like ...
1
vote
1answer
85 views
Do WPA-Enterprise implementations have built-in anti-IP-spoofing?
i'd like to know if WPA-Enterprise implementations have built-in anti-IP-spoofing. here's what i mean:
it seems to me like IP spoofing should be easily detectable and handled under WPA-Enterprise. ...
10
votes
4answers
4k views
How are spoofed packets detected?
My assumption:
When a firewall is configured to drop spoofed packets, it tries to ping (not necessarily ICMP) the source IP and sees if it belongs to a real host or if it's up, and if not, it drops ...
2
votes
4answers
241 views
How can an internet contest verify unique votes with only an email as an input parameter?
For my computer security course we are brainstorming different ways to use attributes for a unique user (that are readily available over a network) to prevent various mischievous activities. We've ...
0
votes
2answers
199 views
IP forgery (theories are fine)
Is there any (practical/theoretical) way to forge your IP address?
By forging i mean feed to the WEbsite the IP you want.
let take PHP as example:
You need me to think that your IP address is ...
3
votes
5answers
247 views
Preventing online voter fraud
As part of a promotional campaign, my company wants to launch a site where users (and potential users) of our product will be required to register and vote for certain choices. Depending on how ...
8
votes
5answers
526 views
Apache/Linux server, DoS attack from own IP
I have an unusual problem I've been trying to diagnose for a while:
It's about a Debian server running a custom compile of apache 2.2 with PHP, Red5, MySQL 5.5 (standard binary), sendmail (distro ...
1
vote
2answers
262 views
Is SSH2 still vulnerable to man-in-middle attacks?
With SSH using RSA public key authentication, can an attacker spoof the server IP address and connect with client to obtain client password?
-1
votes
1answer
160 views
how to secure my login user id and passwords specially for facebook [closed]
i think they hack me with facebook cookies.
i dont get what exactly is going on with me. every time i get the login notification from another ip location.i want to secure my cookies and i wanted to ...
4
votes
1answer
390 views
Brute force login attempt from spoofed IP's
I see that many of my WordPress installs are being hit with 1000+ failed login attempts using non-existing 'admin' account name. The requests come from different IP's every time, and I see IP's such ...
0
votes
1answer
382 views
How to track down an IP spoofer?
We just installed a SonicWALL NSA 3500 and I've noticed a few times per day there will be an alert entry like this:
Time: 01/02/2013 9:00:41.000
Priority: Alert
Category: Intrusion Prevention
...
-5
votes
2answers
594 views
How can I spoof my IP address using the PHP curl function? [closed]
I want to spoof my IP address with the PHP curl function. I'm sending requests to a server with PHP curl, my IP address is $ip2, but I want the server to believe that the request is coming from $ip1. ...
1
vote
1answer
527 views
Stopping Session Hijacking
If you noticed, I put "stopping" instead "preventing" in the title because I want my PHP application to be as secure as possible. I am wondering if anyone has any better ways to prevent session ...
5
votes
1answer
160 views
Parabolic Denial Of Service — Would it work?
Would this DoS attack be effective:
Attacker determines target (10.0.0.1)
Attacker sends ack packets to a buch of web servers with a src addr of 10.0.0.1
Servers reply to 10.0.0.1 with syn packets
...
4
votes
1answer
401 views
172.16.33.197, 127.0.0.1 IP addresses in visitor logs
I have a website running Apache and PHP. I see that there are visitors with IP addresses 172.16.33.197 and 127.0.0.1. These addresses do not belong to our network. I get the visitor IP addresses with ...
1
vote
2answers
126 views
IP attack by reading/writing data?
If I remember correctly there is an ICMP attack whereby you can embed malicious code and it gets read/executed, causing the problem (similar to SQL injection).
Are there any further/more dangerous ...
2
votes
4answers
1k views
Stopping users from spoofing an IP
I have a MikroTik router (that has firewall and scripting capabilities) that is acting as a DHCP server for the 192.168.1.0/24 subnet. Is there any way I can stop it from passing traffic from a user ...
1
vote
2answers
222 views
Why wireshark source ip tab lists other ip as well
I was trying to capture some packets using Wireshark. I could find a lots of ip in the source address tab. Which ip do they represent. Which all packets are visible to wireshark when I run it in my ...
4
votes
3answers
2k views
How can I trace the IP address of person in chat?
Is it possible to trace my IP address when I am chatting with others (with gtalk or Facebook)? If so, how could someone do that?
12
votes
6answers
2k views
How does a server obtain the IP Address of a user?
How does a server obtain the IP Address of a user? Is it possible to fool the server by spoofing the IP Address?
1
vote
2answers
765 views
Tracing an IP from a mobile broadband ISP
My honeypot caught a hack attempt from an IP that was issued by Three Mobile Broadband (UK).
My immediate thought was that most probable explanation was that the user was in the UK and had his ...
-1
votes
2answers
684 views
IP Spoofing a threat?
Quick Security Question if i may.
We have an internal Intranet system which is only accessible from a few internal vlans, our main external firewall blocks all access to the internal webserver – or ...
4
votes
3answers
2k views
Can I trust the source IP of an HTTP request?
As far as I've understood, if you try to issue a HTTP request with a spoofed IP address, then the TCP handshake fails, so it's not possible to complete the HTTP request, because the SYN/ACK from the ...
-5
votes
0answers
66 views
IP Adress Spofing via ncat,nc etc [duplicate]
Possible Duplicate:
Netcat IP Spoofing
I want to ask one question to you.
My friend and i playing game together.He is using below command this computer.
ncat -u -c /bin/bash --allow ...
1
vote
4answers
4k views
Netcat IP Spoofing
I am connecting to a server
nc -v 192.168.0.1 1111
But I want to do IP spoofing because the server on 192.168.0.1 only accepting commands from 7.7.7.7. We are two friends, I am 192.168.1.1, and my ...
2
votes
3answers
440 views
How can I make it more difficult for a user to create multiple accounts?
I would like to know the best way to increase security on a website so that the a single user can't create multiple accounts.
What all of a user can be traced? I'm thinking:
IP address
Mac address
...
5
votes
1answer
260 views
Ingress RFC1918 spoofing: How to handle it?
I've seen packets originating from RFC1918 addresses from two fairly large european ISP's (ASN1257 & smaller ASN35706) coming in on eBGP transit links lately, and I'm a bit puzzled why it wouldn't ...
3
votes
3answers
751 views
How secure can IP based login be?
From several security books and sites I understand that IP-based security (with which I mean: user is verified only by IP address) is a bad idea. Our idea is not new: we want a one-time validation and ...
2
votes
2answers
427 views
Reveal the True IP of a User
Is there any best practice method (and preferably documented) way of revealing the True IP of a user using a HTTP(S) connection?
I.e.: To be able to uncover the true IP from transparent as well as ...
4
votes
5answers
1k views
Is it trivial to bypass IP blocking?
There is a site with IP blocking. When a client makes too many invalid attempts when guessing e.g. password, then their IP address becomes blocked.
I've heard about IP spoofing and similar attacks. ...
5
votes
2answers
797 views
Is IP spoofing relevant to TCP? Is it relevant for TLS or SSH?
I have read the TCP Connection Establishment on Wikipedia
In brief the packets to start are
SYN, with a (hopefully) random sequence number A from the client.
SYN-ACK, responding, with A+1 and ...
3
votes
5answers
1k views
GET request with different IPs
I need to check vulnerability in my polling system. So I need to send GET requests but every time with different IPs. Can anyone suggest something?
4
votes
2answers
4k views
Does chatting over Skype expose my IP address?
Is there a way to identify a person's IP address in Skype, when you're chatting with them? Does this depend on their Skype settings? And if you've recorded chat messages, can they lead to the actual ...
5
votes
2answers
541 views
Why would the browser present the certificate for an unknown outside site?
The first time each day that I attempt click on the 'Mail' link from the Yahoo home page, my browser (Seamonkey) throws up a dialog with the title 'Secure connection failed'.
The content in the ...
2
votes
1answer
1k views
Spoofing email From address
Providing all legal measures are taken care of, what are some of the ways someone can spoof an email "From" field address and actually get the email to the recipient without spam filters getting in ...
6
votes
1answer
436 views
Spoofed IPv4 and IPv6 addresses over the internet
I have a few questions regarding IPv4 and IPv6 spoofing. Might as well just list them to be concise:
What's the usual routing policy for ISPs' routers in regards to spoofed source addresses? i.e. if ...
6
votes
2answers
2k views
How easy/difficult is it to spoof DNS? Are some scenarios safer/more risky than others?
Practically speaking, how easy difficult is it to spoof DNS?
What scenarios are more risky than others? For example:
A phishing email or twitter link that attracts users to click a hyperlink
A ...
0
votes
0answers
78 views
Pages restricted to certain IPs, safe? [duplicate]
Possible Duplicate:
In what scenarios is relying on source IP address as a security control acceptable/unacceptable?
If a website has a page which only renders for certain IPs, is there ...
5
votes
3answers
352 views
Solaris: IP Spoofing Across Ethernet Ports
Given a Solaris machine with two network interfaces corresponding to the separate ethernet ports in the back.
0: 192.168.0.5/255.255.255.0
1: 192.168.1.5/255.255.255.0
with /etc/defaultrouter set ...
3
votes
1answer
257 views
What kind of nefarious deeds can IP address Spoofing be used for? [duplicate]
Possible Duplicate:
What security risks does IP spoofing bring?
I found this article, which seems pretty good but was written in 2003 so I'm not sure how up to date it is.
Can IP address ...
3
votes
2answers
231 views
Can ipopts be used to circumvent a pf or iptables firewall source IP based blocking?
Can one use ipopts, and in particular IP source routing, to circumvent source-based blocking in pf or iptables?
For example, with OpenBSD's pf:
block in all # default deny
block out all
pass in on ...
16
votes
2answers
421 views
In what scenarios is relying on source IP address as a security control acceptable/unacceptable?
I've noticed that there's a number of questions where relying on source IP address as a control gets mentioned and in most gets dismissed as being unreliable.
I'd be interested in hearing from anyone ...
7
votes
3answers
211 views
Verify a website user is behind corporate firewall?
We have a public ecommerce website hosted at our datacenter onsite. For people who are within the corporate firewall hitting the website I want to display profiling information about the request of ...
6
votes
3answers
330 views
IP Address spoofing?
According to:
https://secure.wikimedia.org/wikipedia/en/wiki/IP_address_spoofing
"this technique is mainly used when the attacker does not care about the response or the attacker has some way of ...
2
votes
1answer
242 views
IP Conflicts / Spoofing
Are there any products / os that behave differently when an duplicate IP address is detected. This may indicate an IP spoof ?
Can TCP stack 'shutdown' or stop in order to protect itself ?
