Hot answers tagged

14

Is it possible to spoof the IP once a TCP handshake was performed successfully? No. A TCP session is defined by four items: Source IP address Source IP port Destination IP address Destination port This comes from RFC 793: To provide for unique addresses within each TCP, we concatenate an internet address identifying the TCP with a port ...


6

Yes there is some statistical data about that: http://spoofer.cmand.org/summary.php // Quoting the referenced Pages FAQ: Actually, our measurements clearly show that spoofing is still prevalent among approximately 25% of the autonomous systems and netblocks we survey. More importantly, a single entry point for spoofed traffic provides attackers a ...


4

So, how can I (the user) feed (spoof) the VPN IP address (which I have in a text file) to any JS that might run so that it all looks the same to the web server? The detection of local IP addresses you refer to depends on WebRTC. There is no way to spoof the addresses returned during the WebRTC discovery without changing either the browser code or ...


4

It relies on how far you go in spoofing. When you only spoof the ip address but not the mac address the original host will get the answer. If you did not only spoof the ip address but also the mac address it can happen that you also receive the answer. This is because the switch(es) on your LAN do map mac addresses to physical ports. This means you can "by ...


4

If you can trick them into clicking something in an email, you can send them a link to any page that you have access to the webserver logs for and find the request in the log (along with their IP). There are also a number of third party services to do this for you that are pretty easy to use (eg http://whatstheirip.com). Now, that said, some of the ...


3

This file is a configuration file for some kind of antique unsecured ancestor of ssh: rsh (Remote SHell, more info including syntax example here). This antique tool relies its security on TCP three-way handshake in order to trust that a remote host is really who it pretends to be. Due to ISN prediction, you already know this was a weak way of ...


3

What is one of the best ways to determine whether or not a user is abusing IPs? There's no good way, and it probably shouldn't be your goal. The fact that you've been "tracking actively-used IP addresses for each user" means that you already have a tracking mechanism better than IP addresses that you should use instead. As we've been tracking ...


3

Short Answer Assuming a TCP connection, it is nearly impossible to spoof a source IP address without control of the network. Longer Answer Assuming you are not using any proxies (which can cause issues if you're getting their IP address from a X-FORWARDED-FOR header), and running a service on TCP, it's extremely difficult to spoof a source IP address ...


3

As explained by the answer of gowenfawr you can not change the IP of a TCP session. However there are some options to have a TCP connection while spoofing the source IP. All that IP-spoofing does is change the Source IP address of the packet you send. This is done on the routing (IP) layer of the network stack. The server will threat this spoofed packet as ...


3

There are many ways to do it. Here are some more methods: Poll Network Interfaces (Flash, can get local information) import flash.net.NetworkInfo; public function findInterface():void { var results:Vector.<NetworkInterface> = NetworkInfo.networkInfo.findInterfaces(); for (var i:int=0; i<results.length; i++) { var ...


3

According to several of these answers: http://serverfault.com/questions/381393/can-the-ip-address-for-an-http-request-be-spoofed It is really unlikely that you could indeed spoof the IP address and send a full HTTP request to a server. TCP requires a three-way handshake, which means sending one packet back to the sender and expecting a very specific answer ...


2

The two major attack vectors that spring to mind are Non-Blind and Blind spoofing, which make use of spoofed IP's and TCP to take control of a IP/TCP session. Although the Non-Blind attack in particular may not be prevented by Source address validation. When on the same subnet as an attacker, hijacking of a legitimate TCP connection is possible by sniffing ...


2

1- What are the possible flaws on this? That depends on the exact configuration and security measures of the network because to migrate this you will need to mess around with some protocols. I can imagine some ways to migrate this but every solution relies on some protocol weaknesses and the exploitation of these might be detected by an IDS. On the ...


2

Yes you can put an RFC1918 IP address as your IP source address. You can even use a valid IP address within the targeted network you send your packet to. Correctly configured router of Internet connection should block such a packet coming from the outside with an IP address from the inside. This is what is called Ingress filtering. ISP routers don't ...


2

There is a specific IETF RFC that addresses spoofed BGP source prefixes being advertised into a network. For an ISP the default is to trust the other ISP and it is up to your peers to enforce this rigorously and some do not. https://tools.ietf.org/html/draft-jdurand-bgp-security-00#section-4.1.2.2


2

If the suspicious emails are from a consistently different IP than the trusted emails, then it seems unlikely that his computer is compromised. Instead, it sounds like someone has found a way to spoof his email address, using their own computer to send it. Without knowing more information, I can't really speculate as to why someone is doing this. However, ...


2

The IP still resolves to the MAC stored in your targets ARP table and that is the address if the local network. So yes, you don't see the replies until you poison the ARP cache of your target.


2

Here are some testing tools that offer up the capability to test your ISP for yourself -- https://web.archive.org/web/20110721053646/http://rmeijer.home.xs4all.nl/spoofaudit.html -- http://spoofer.csail.mit.edu/ -- each will provide some mechanism to detect if IP spoofing is possible, although you may need at least two nodes inside that specific ISP in order ...


2

It is easy to send a TCP packet with any IP address. On Linux you can open a raw socket and send anything you want. The problem is receiving the SYN/ACK (or any other response), which will be routed to the original IP. Routers between your client may have firewall rules to reject the request, but often they will assume that your client is just routing a ...


1

It's hard to say what your definition of "OK" is, but generally, I'd say, no, you're not ok with your current setup. I'll cover your points individually. The data being transferred is strongly encrypted. This is good. In other words, you could put the file with a download link up on a public website. If you trust the encryption, then your data is ...


1

However, enabling javascript now means that a website can run a snippet of javascript code to retrieve the user's ip address (even if they are behind a proxy or VPN). Firstly, I think it's nearly impossible to retrieve any actual useful information about IP addresses through javascript. I think it's possible via some WebRTC hackery to get the local ...


1

X-Forwarded-For header may be used to forward client's real IP in case of source NAT. But not all application use them. This header is often inserted by load-balancers or reverse-proxies, depending the architecture in place, when the application needs to know the real IP belonging to a client. When this header is inserted, the application can see 2 IPs: ...


1

The attacker can still spoof the IP address and use bank's IP address, but the response from your website will go to the spoofed IP address (bank's IP address) and not to the attacker's actual IP address. Usually a TCP handshake is required to initiate a TCP connection. HTTP uses TCP. The attacker will send a SYN packet with spoofed IP(bank's IP), your ...


1

THe Client IP address can be captured in the X-Forwarded-For field in the HTTP headers, if the box has enabled for this. In web farms it's usually configured on a server load balancer. Configuration is necessary if there is a NAT device in the path.


1

This sounds like a component of a broader targeted attack involving spear phishing. You might send a link to the victim for Banking.Example.com and begin your DNS reply spam for that domain. That way, you know which domain they are trying to resolve with DNS.


1

Yes, anybody can set a static IP on any workstation assuming they have administrative control over it, same goes for mac addresses. IP filtering should only be one of many layers as it can be easily spoofed, and I wouldn't put too much weight on static IPs for security. An attacker would spoof one of the clients IP and MACs (can happen on any modern OS), ...



Only top voted, non community-wiki answers of a minimum length are eligible