New answers tagged

44

IP Spoofing is NOT IP Hijacking which is causing confusion for anyone reading this. IP Spoofing at its minimum / bare bones explanation is also called impersonation. Let's have an ASCII look at what it does, and how it happens: You (1.2.3.4) --> connect to your bank --> Bank (2.2.2.2) In spoofing, I can pretend to be anyone I want, if I am on your ...


4

tldr: Yes, No (both: until IPSec) I understand your question as Can someone (an ISP, for example) impersonate an internet host on the IP level? If so, how and how can that be mitigated? The right term for that is not IP Spoofing, which as Teun put out in his answer, is spoofing the origin address of packets sent to a host; they are most useless with ...


15

IP spoofing means creating IP packets with a source address which is not yours and sending those to some destination. To be able to do so, routers on the path have to allow traffic coming from an incorrect source. BCP38 describes a number of techniques (filtering, uRPF) which ISP's can use to prevent spoofed IP traffic originating from their network. Since ...


1

TL;DR: proxy support is limited right now but there are also theoretical limits of what you could do when using a proxy. nmap can do only CONNECT and SOCKS4 and these protocols can do only TCP. Apart from that using any kind of proxy means that nmap communicates with the IP stack of the proxy and not of the target. This means: ICMP ping can not be done ...


3

For now, use an external tool like proxychains. The nmap documentation for --proxies states, that the feature is not fully implemented yet: Warning: this feature is still under development and has limitations. It is implemented within the nsock library and thus has no effect on the ping, port scanning and OS discovery phases of a scan. Only NSE ...


0

Even if you are only care about the kind of TLS where the certificate is required to match the hostname (like done in HTTPS, but there are use case of TLS which don't do this) then there are still differences in scope and ability of filtering by IP address vs. hostname from the TLS handshake. Advantage of hostname based filtering: There might be several ...


2

tl;dr: different things, both usefull for different szenarios, IP whitelisting in not a bad sign You are indeed comparing apples and oranges. IP-based filtering happens at the network layer of the OSI model, whereas certificate validation happens on the transport (and/or application) layer. Allowing access only to/from specific IP addresses reduces the ...


1

As the comment said: IP spoofing is not an option if you want to have a working TCP connection. And you probably need this connection because otherwise the connection attempts will fail at the kernel already and your application will not get any requests. I don't know your application setup but I see the following options: Some applications take a HTTP ...



Top 50 recent answers are included