Hot answers tagged

44

IP Spoofing is NOT IP Hijacking which is causing confusion for anyone reading this. IP Spoofing at its minimum / bare bones explanation is also called impersonation. Let's have an ASCII look at what it does, and how it happens: You (1.2.3.4) --> connect to your bank --> Bank (2.2.2.2) In spoofing, I can pretend to be anyone I want, if I am on your ...


15

IP spoofing means creating IP packets with a source address which is not yours and sending those to some destination. To be able to do so, routers on the path have to allow traffic coming from an incorrect source. BCP38 describes a number of techniques (filtering, uRPF) which ISP's can use to prevent spoofed IP traffic originating from their network. Since ...


14

Is it possible to spoof the IP once a TCP handshake was performed successfully? No. A TCP session is defined by four items: Source IP address Source IP port Destination IP address Destination port This comes from RFC 793: To provide for unique addresses within each TCP, we concatenate an internet address identifying the TCP with a port identifier ...


7

Yes there is some statistical data about that: http://spoofer.cmand.org/summary.php // Quoting the referenced Pages FAQ: Actually, our measurements clearly show that spoofing is still prevalent among approximately 25% of the autonomous systems and netblocks we survey. More importantly, a single entry point for spoofed traffic provides attackers a ...


4

If you can trick them into clicking something in an email, you can send them a link to any page that you have access to the webserver logs for and find the request in the log (along with their IP). There are also a number of third party services to do this for you that are pretty easy to use (eg http://whatstheirip.com). Now, that said, some of the ...


4

Short Answer Assuming a TCP connection, it is nearly impossible to spoof a source IP address without control of the network. Longer Answer Assuming you are not using any proxies (which can cause issues if you're getting their IP address from a X-FORWARDED-FOR header), and running a service on TCP, it's extremely difficult to spoof a source IP address ...


4

It relies on how far you go in spoofing. When you only spoof the ip address but not the mac address the original host will get the answer. If you did not only spoof the ip address but also the mac address it can happen that you also receive the answer. This is because the switch(es) on your LAN do map mac addresses to physical ports. This means you can "by ...


4

So, how can I (the user) feed (spoof) the VPN IP address (which I have in a text file) to any JS that might run so that it all looks the same to the web server? The detection of local IP addresses you refer to depends on WebRTC. There is no way to spoof the addresses returned during the WebRTC discovery without changing either the browser code or ...


4

tldr: Yes, No (both: until IPSec) I understand your question as Can someone (an ISP, for example) impersonate an internet host on the IP level? If so, how and how can that be mitigated? The right term for that is not IP Spoofing, which as Teun put out in his answer, is spoofing the origin address of packets sent to a host; they are most useless with ...


3

Put the zombies' IP addresses in a file (say IP.txt). And let's assume that the target machine 192.168.88.135 Then you can use a script to automate the scan process. Something like this for ip in $(cat IP.txt); do nmap -sI $ip 192.168.88.135 -p $1 >$ip.txt done After saving this script, and giving it execution privileges, you can invoke this ...


3

For now, use an external tool like proxychains. The nmap documentation for --proxies states, that the feature is not fully implemented yet: Warning: this feature is still under development and has limitations. It is implemented within the nsock library and thus has no effect on the ping, port scanning and OS discovery phases of a scan. Only NSE ...


3

According to several of these answers: http://serverfault.com/questions/381393/can-the-ip-address-for-an-http-request-be-spoofed It is really unlikely that you could indeed spoof the IP address and send a full HTTP request to a server. TCP requires a three-way handshake, which means sending one packet back to the sender and expecting a very specific answer ...


3

There are many ways to do it. Here are some more methods: Poll Network Interfaces (Flash, can get local information) import flash.net.NetworkInfo; public function findInterface():void { var results:Vector.<NetworkInterface> = NetworkInfo.networkInfo.findInterfaces(); for (var i:int=0; i<results.length; i++) { var ...


2

If the suspicious emails are from a consistently different IP than the trusted emails, then it seems unlikely that his computer is compromised. Instead, it sounds like someone has found a way to spoof his email address, using their own computer to send it. Without knowing more information, I can't really speculate as to why someone is doing this. However, ...


2

It is easy to send a TCP packet with any IP address. On Linux you can open a raw socket and send anything you want. The problem is receiving the SYN/ACK (or any other response), which will be routed to the original IP. Routers between your client may have firewall rules to reject the request, but often they will assume that your client is just routing a ...


2

As explained by the answer of gowenfawr you can not change the IP of a TCP session. However there are some options to have a TCP connection while spoofing the source IP. All that IP-spoofing does is change the Source IP address of the packet you send. This is done on the routing (IP) layer of the network stack. The server will threat this spoofed packet as ...


2

The IP still resolves to the MAC stored in your targets ARP table and that is the address if the local network. So yes, you don't see the replies until you poison the ARP cache of your target.


2

Here are some testing tools that offer up the capability to test your ISP for yourself -- https://web.archive.org/web/20110721053646/http://rmeijer.home.xs4all.nl/spoofaudit.html -- http://spoofer.csail.mit.edu/ -- each will provide some mechanism to detect if IP spoofing is possible, although you may need at least two nodes inside that specific ISP in order ...


2

When you spoof ones IP the answer will not reach you at least not for a long time. As a side effect you can cause what is called Port Stealing. This is happening when one IP is seen on two different ports of a switch. The IP is then assigned to the port the IP was last seen on which might be the port you spoofed the address from. But when the original host ...


2

The two major attack vectors that spring to mind are Non-Blind and Blind spoofing, which make use of spoofed IP's and TCP to take control of a IP/TCP session. Although the Non-Blind attack in particular may not be prevented by Source address validation. When on the same subnet as an attacker, hijacking of a legitimate TCP connection is possible by sniffing ...


2

1- What are the possible flaws on this? That depends on the exact configuration and security measures of the network because to migrate this you will need to mess around with some protocols. I can imagine some ways to migrate this but every solution relies on some protocol weaknesses and the exploitation of these might be detected by an IDS. On the other ...


2

Yes you can put an RFC1918 IP address as your IP source address. You can even use a valid IP address within the targeted network you send your packet to. Correctly configured router of Internet connection should block such a packet coming from the outside with an IP address from the inside. This is what is called Ingress filtering. ISP routers don't ...


2

tl;dr: different things, both usefull for different szenarios, IP whitelisting in not a bad sign You are indeed comparing apples and oranges. IP-based filtering happens at the network layer of the OSI model, whereas certificate validation happens on the transport (and/or application) layer. Allowing access only to/from specific IP addresses reduces the ...


2

Here's what we can tell you: Public DNS record is publicly accessible Parts of the Public DNS systems can be subverted by sufficiently advanced attacker, unless measures like DNSSEC are taken and enforced From these we can see several issues under the following scenario: You have internal service but you used public DNS to map these names to your ...


2

Is it possible to send HTTP packet via spoofed IP? No you can't. HTTP is a protocol on top of TCP and doing IP spoofing with TCP is nearly impossible due to the internals of the protocol. You would not only need to send a single spoofed packet like in UDP but you would actually need to reply the packets of the peer with the matching sequence numbers ...


2

It is not possible A spoofed http packet would have to travel over a TCP connection. TCP has a 3-way handshake that would prevent communication from a spoofed IP address from ever reaching the server's PHP code. Before application data starts getting sent, here is what would happen: YOU send TCP SYN with spoofed IP SERVER responds with SYN-ACK to that ...


1

TL;DR: proxy support is limited right now but there are also theoretical limits of what you could do when using a proxy. nmap can do only CONNECT and SOCKS4 and these protocols can do only TCP. Apart from that using any kind of proxy means that nmap communicates with the IP stack of the proxy and not of the target. This means: ICMP ping can not be done ...


1

As the comment said: IP spoofing is not an option if you want to have a working TCP connection. And you probably need this connection because otherwise the connection attempts will fail at the kernel already and your application will not get any requests. I don't know your application setup but I see the following options: Some applications take a HTTP ...


1

From What I understand, this web server will be placed outside the intranet. Have your IT department considered placing this web server in a dedicated VLAN? the above code will only allow access from one particular IP address(the Public IP of your network)and make sure that the Domain Name matches with the IP address. Typically you are turning your web ...


1

I have a similar set-up, a whitelisted linux ftp server, receiving an encrypted file in the clear, and have asked similar questions. For one, I have it set up as anonymous, since what is the point of a login in the clear? Second, it is whitelisted, so the only theoretical vulnerability is IP spoofing. I read up on IP spoofing specifically in regard to ftp, ...



Only top voted, non community-wiki answers of a minimum length are eligible