1

Imagine you have a simple GET request going to server 123.456.111.222. Your client executable creates a winsock on the server IP (TCP) and sends the HTTP request (unencrypted) to the server. If a local program found the outgoing request and specifically the source port of the request, could that program send its own data to that port? (Hopefully winning the race condition, but it should given it's localhost)

I would get the source port by using GetExtendedTcpTable however I am not quite sure if it would be as simple as opening the port using winsock and sending the data.

0

Not on Linux.

On Linux a program must have elevated privileges for opening a raw socket to perform that type of thing. It would need elevated privileges to read the TCP Sequence Number too, to create a packet within the receiving window on the other side.

On Windows, there are some limitations:

  • TCP data cannot be sent over raw sockets.
  • UDP datagrams with an invalid source address cannot be sent over raw sockets.
  • A call to the bind function with a raw socket for the IPPROTO_TCP protocol is not allowed.
  • Well, there are ways to get around that also on Linux. Even without root privileges, if you have a malicious program running, it could change the HOSTALIASES env variable putting whatever they want in there, grabbing your request and then forwarding a modified one to the destination. Yes, it works if programs use getaddrinfo or gethostbyname, but still, it's a possibility. – ChatterOne Jan 23 at 13:31
  • 1
    grabbing your request and then forwarding a modified one to the destination: I believe OP is asking about tampering with an existing connection. – ThoriumBR Jan 23 at 13:35
  • I'm not interested in the request, it can be ANYTHING. I just want to respond with a certain value. I'm not good at networking in general, but if I sent a packet from localhost to localhost:sourceport with some data, would it not consider it a response? – Rob Gates Jan 23 at 14:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.