Hot answers tagged

2

Is it possible to send HTTP packet via spoofed IP? No you can't. HTTP is a protocol on top of TCP and doing IP spoofing with TCP is nearly impossible due to the internals of the protocol. You would not only need to send a single spoofed packet like in UDP but you would actually need to reply the packets of the peer with the matching sequence numbers ...


1

It is not possible A spoofed http packet would have to travel over a TCP connection. TCP has a 3-way handshake that would prevent communication from a spoofed IP address from ever reaching the server's PHP code. Before application data starts getting sent, here is what would happen: YOU send TCP SYN with spoofed IP SERVER responds with SYN-ACK to that ...


1

Spoiler: you can't. Smart pants: If you can fit the request in a single TCP packet, you can. Or if you control the routing to the spoofed IP. Or the machine with the IP that is spoofed. But: you probably won't be able to do that. The problem is: while HTTP is stateless, it uses TCP, which isn't. Especially, before any actual data is sent, a handshake is ...


1

I have a similar set-up, a whitelisted linux ftp server, receiving an encrypted file in the clear, and have asked similar questions. For one, I have it set up as anonymous, since what is the point of a login in the clear? Second, it is whitelisted, so the only theoretical vulnerability is IP spoofing. I read up on IP spoofing specifically in regard to ftp, ...



Only top voted, non community-wiki answers of a minimum length are eligible