0

Is it possible to spoof the IP once a TCP handshake was performed successfully?

For example:

  1. Perform the handshake

  2. Use the session with the same IP which performed handshake but on different machine and network then send a request e.g POST HTTP request

  3. The response is delivered to the spoofed IP and processed by server

Improve this question
1
  • A lot depends on the size of the request, whether the original client host is online, and whether the original client is actively complicit in the attack (not just providing information to the attacker but actually modifying its own TCP behavior). As the victim begins to ACK parts of the request, an ordinary original client that never sent the ranges being ACKed will send a RST to shut down the connection.
    – Ben Voigt
    Dec 2, 2022 at 21:47

1 Answer 1

Reset to default
1

Certainly! If you're able to spoof valid sequence numbers this is in possible. This is essentially the TCP Sequence Number prediction attack:

The attacker hopes to correctly guess the sequence number to be used by the sending host. If they can do this, they will be able to send counterfeit packets to the receiving host which will seem to originate from the sending host, even though the counterfeit packets may in fact originate from some third host controlled by the attacker.

That's also why there's been a push to ensure that sequence numbers are hard to determine for an outsider.

Improve this answer
2
  • I have established TCP handshake and im trying to send POST request from my "spoofed client" who is in different country, during operation im getting TCP retransmission and my request doesn't go to server/ is not sent. Is it possible that my router blocks spoofed packet ? How to avoid it then ?
    – saguaro_water
    Mar 12, 2021 at 10:16
  • 1
    Your ISP probably drops packets with source set to a net not controlled by them.
    – vidarlo
    Mar 12, 2021 at 10:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .