IP spoofing, also known as IP address forgery or a host file hijack, is a hijacking technique in which a cracker masquerades as a trusted host to conceal his identity, spoof a Web site, hijack browsers, or gain access to a network.

learn more… | top users | synonyms

86
votes
13answers
25k views

Why is it difficult to catch “Anonymous” or “Lulzsec” (groups)?

I'm not security literate, and if I was, I probably wouldn't be asking this question. As a regular tech news follower, I'm really surprised by the outrage of Anonymous (hacker group), but as a ...
16
votes
6answers
2k views

What security risks does IP spoofing bring?

By manipulating the TCP packet and changing the source address one is able to spoof the IP. As I understand it, you will not be able to set up a full handshake by doing this, as you will never receive ...
16
votes
3answers
895 views

Vulnerable code suggested on OWASP?

Session Hijacking Prevention It is good practice to bind sessions to IP addresses, that would prevent most session hijacking scenarios (but not all), however some users might use anonymity ...
16
votes
2answers
845 views

In what scenarios is relying on source IP address as a security control acceptable/unacceptable?

I've noticed that there's a number of questions where relying on source IP address as a control gets mentioned and in most gets dismissed as being unreliable. I'd be interested in hearing from anyone ...
14
votes
4answers
12k views

How are spoofed packets detected?

My assumption: When a firewall is configured to drop spoofed packets, it tries to ping (not necessarily ICMP) the source IP and sees if it belongs to a real host or if it's up, and if not, it drops ...
14
votes
6answers
5k views

How does a server obtain the IP Address of a user?

How does a server obtain the IP Address of a user? Is it possible to fool the server by spoofing the IP Address?
12
votes
6answers
1k views

What tools are available to identify which country a specific IP address is located in?

In trying to identify the country a user logs in from, or to block country ranges for whatever reason (for example regulatory requirements) what tools, whether online or offline, are available?
12
votes
5answers
2k views

Apache/Linux server, DoS attack from own IP

I have an unusual problem I've been trying to diagnose for a while: It's about a Debian server running a custom compile of apache 2.2 with PHP, Red5, MySQL 5.5 (standard binary), sendmail (distro ...
11
votes
3answers
4k views

How does the hacker manage to spoof a different IP address?

For the last 2 days, +/- every 15 minutes, someone is attempting to sign-in to my online email account. When I verify recent activity, the IP address (and the corresponding country) is different for ...
11
votes
3answers
7k views

Can I trust the source IP of an HTTP request?

As far as I've understood, if you try to issue a HTTP request with a spoofed IP address, then the TCP handshake fails, so it's not possible to complete the HTTP request, because the SYN/ACK from the ...
10
votes
3answers
690 views

Are there valid reasons for spoofing an address?

This is a corollary to the question Why don't ISPs filter on source address to prevent spoofing?. Are there valid reasons to spoof an address?
10
votes
4answers
2k views

Why don't ISPs filter on source address to prevent spoofing?

I'm under the impression that if all the ISP's were required to filter on the source IP address of all outbound packets, that spoofing would be reduced considerably. Are any ISPs implementing this ...
9
votes
2answers
5k views

How easy/difficult is it to spoof DNS? Are some scenarios safer/more risky than others?

Practically speaking, how easy difficult is it to spoof DNS? What scenarios are more risky than others? For example: A phishing email or twitter link that attracts users to click a hyperlink A ...
9
votes
2answers
2k views

Is IP spoofing relevant to TCP? Is it relevant for TLS or SSH?

I have read the TCP Connection Establishment on Wikipedia In brief the packets to start are SYN, with a (hopefully) random sequence number A from the client. SYN-ACK, responding, with A+1 and ...
8
votes
3answers
310 views

Verify a website user is behind corporate firewall?

We have a public ecommerce website hosted at our datacenter onsite. For people who are within the corporate firewall hitting the website I want to display profiling information about the request of ...
8
votes
1answer
922 views

Spoofed IPv4 and IPv6 addresses over the internet

I have a few questions regarding IPv4 and IPv6 spoofing. Might as well just list them to be concise: What's the usual routing policy for ISPs' routers in regards to spoofed source addresses? i.e. if ...
7
votes
1answer
983 views

Brute force login attempt from spoofed IP's

I see that many of my WordPress installs are being hit with 1000+ failed login attempts using non-existing 'admin' account name. The requests come from different IP's every time, and I see IP's such ...
6
votes
3answers
2k views

Is it possible to pass TCP handshake with spoofed IP address?

Little time ago, me and my friends argued if TCP handshake can be passed with a spoofed IP address. Assume I have a https web server that allows only admin's IP numbers. Can anyone connect that web ...
6
votes
4answers
843 views

How can a company reduce exposure to packet spoofing? What solution should exist, but doesn't?

I'd like to understand what anti-packet-spoofing technology exists (or should exist) to verify an inbound packet. Maybe this is as simple as a Cisco ACL, Firewall Rule, implemented at the network ...
6
votes
4answers
660 views

IP Address spoofing?

According to: https://secure.wikimedia.org/wikipedia/en/wiki/IP_address_spoofing "this technique is mainly used when the attacker does not care about the response or the attacker has some way of ...
6
votes
3answers
1k views

TCP Sequence Prediction and it's prominence in modern systems/networks

I have a question regarding your experience of TCP Sequence Prediction that I am hoping someone could help with. I am aware of how TCP Sequence Prediction works and how the connection can be hijacked ...
6
votes
5answers
1k views

Preventing online voter fraud

As part of a promotional campaign, my company wants to launch a site where users (and potential users) of our product will be required to register and vote for certain choices. Depending on how ...
6
votes
1answer
185 views

Parabolic Denial Of Service — Would it work?

Would this DoS attack be effective: Attacker determines target (10.0.0.1) Attacker sends ack packets to a buch of web servers with a src addr of 10.0.0.1 Servers reply to 10.0.0.1 with syn packets ...
6
votes
1answer
441 views

Ingress RFC1918 spoofing: How to handle it?

I've seen packets originating from RFC1918 addresses from two fairly large european ISP's (ASN1257 & smaller ASN35706) coming in on eBGP transit links lately, and I'm a bit puzzled why it wouldn't ...
5
votes
5answers
5k views

Why can we not block DNS Amplification attack by blocking UDP packets or DNS response packet?

I mean if the attacker tries to ask all the open DNS resolver respond to a web server. The web server can just block its UDP ports. If the all the DNS response go to a Authoritative ...
5
votes
2answers
12k views

Does chatting over Skype expose my IP address?

Is there a way to identify a person's IP address in Skype, when you're chatting with them? Does this depend on their Skype settings? And if you've recorded chat messages, can they lead to the actual ...
5
votes
2answers
2k views

Why would the browser present the certificate for an unknown outside site?

The first time each day that I attempt click on the 'Mail' link from the Yahoo home page, my browser (Seamonkey) throws up a dialog with the title 'Secure connection failed'. The content in the ...
5
votes
3answers
472 views

Solaris: IP Spoofing Across Ethernet Ports

Given a Solaris machine with two network interfaces corresponding to the separate ethernet ports in the back. 0: 192.168.0.5/255.255.255.0 1: 192.168.1.5/255.255.255.0 with /etc/defaultrouter set ...
5
votes
5answers
3k views

GET request with different IPs

I need to check vulnerability in my polling system. So I need to send GET requests but every time with different IPs. Can anyone suggest something?
5
votes
2answers
88 views

What information should I provide to a website or organization when notifying them that their domain may be sending out spam?

Over the past few days, I've received several spam emails coming from the addresses of a school district. I don't know much about email message headers, but since they contain numerous references like ...
4
votes
3answers
12k views

How can I trace the IP address of person in chat?

Is it possible to trace my IP address when I am chatting with others (with gtalk or Facebook)? If so, how could someone do that?
4
votes
5answers
2k views

Is it trivial to bypass IP blocking?

There is a site with IP blocking. When a client makes too many invalid attempts when guessing e.g. password, then their IP address becomes blocked. I've heard about IP spoofing and similar attacks. ...
4
votes
3answers
2k views

How secure can IP based login be?

From several security books and sites I understand that IP-based security (with which I mean: user is verified only by IP address) is a bad idea. Our idea is not new: we want a one-time validation and ...
4
votes
2answers
590 views

How does IP address spoofing of a bad address work?

While reading up on iptables, I saw this article from NixCraft recommending that a server block the following bad addresses: 0.0.0.0/8 10.0.0.0/8 127.0.0.0/8 172.16.0.0/12 192.168.0.0/16 224.0.0.0/3 ...
4
votes
1answer
837 views

172.16.33.197, 127.0.0.1 IP addresses in visitor logs

I have a website running Apache and PHP. I see that there are visitors with IP addresses 172.16.33.197 and 127.0.0.1. These addresses do not belong to our network. I get the visitor IP addresses with ...
3
votes
3answers
1k views

How can I make it more difficult for a user to create multiple accounts?

I would like to know the best way to increase security on a website so that the a single user can't create multiple accounts. What all of a user can be traced? I'm thinking: IP address Mac address ...
3
votes
2answers
771 views

Reveal the True IP of a User

Is there any best practice method (and preferably documented) way of revealing the True IP of a user using a HTTP(S) connection? I.e.: To be able to uncover the true IP from transparent as well as ...
3
votes
4answers
2k views

How can an internet contest verify unique votes with only an email as an input parameter?

For my computer security course we are brainstorming different ways to use attributes for a unique user (that are readily available over a network) to prevent various mischievous activities. We've ...
3
votes
1answer
3k views

Spoofing email From address

Providing all legal measures are taken care of, what are some of the ways someone can spoof an email "From" field address and actually get the email to the recipient without spam filters getting in ...
3
votes
1answer
165 views

Side Channel Attack Query

People Generally spoof their IP address by using any other device's ip address such as printer, scanner. My question is in this kind of particular attack why we are using these devices rather than ...
3
votes
2answers
266 views

Can ipopts be used to circumvent a pf or iptables firewall source IP based blocking?

Can one use ipopts, and in particular IP source routing, to circumvent source-based blocking in pf or iptables? For example, with OpenBSD's pf: block in all # default deny block out all pass in on ...
3
votes
1answer
396 views

What kind of nefarious deeds can IP address Spoofing be used for? [duplicate]

Possible Duplicate: What security risks does IP spoofing bring? I found this article, which seems pretty good but was written in 2003 so I'm not sure how up to date it is. Can IP address ...
2
votes
2answers
1k views

IP forgery (theories are fine)

Is there any (practical/theoretical) way to forge your IP address? By forging i mean feed to the WEbsite the IP you want. let take PHP as example: You need me to think that your IP address is ...
2
votes
3answers
948 views

Is it possible to change IP after each request

I am developing a web application. I am planning to skip CAPTCHAs for the initial signup by an IP so as to improve user experience. I was wondering if I am inviting any security risks by doing this. ...
2
votes
2answers
382 views

Is it a real security benefit if a host uses static IP Addresses for authentication?

As my knowledge about information security is not THAT good and Google did not give me a satisfactory answer I would like to ask the community here: I am working for a company offering online ...
2
votes
2answers
901 views

Does “loose source and record route” drop the source address?

Is the source IPv4 address lost when a person uses "loose source and record route" and the destination address is put before the end of the list of addresses through which routing should occur? It ...
2
votes
1answer
3k views

Stopping Session Hijacking

If you noticed, I put "stopping" instead "preventing" in the title because I want my PHP application to be as secure as possible. I am wondering if anyone has any better ways to prevent session ...
2
votes
5answers
5k views

Stopping users from spoofing an IP

I have a MikroTik router (that has firewall and scripting capabilities) that is acting as a DHCP server for the 192.168.1.0/24 subnet. Is there any way I can stop it from passing traffic from a user ...
2
votes
1answer
38 views

Virtualisation: security on the host side

Virtualised environments are focused on isolating the guest OS. Using the VirtualBox model, the guest might be behind a virtual NAT and/or talk only with other VMs via internal networks, and only ...
2
votes
1answer
338 views

IP Conflicts / Spoofing

Are there any products / os that behave differently when an duplicate IP address is detected. This may indicate an IP spoof ? Can TCP stack 'shutdown' or stop in order to protect itself ?