1

I want to send a HTTPrequest to a specific web address, but with different IP address. For example, if a webserver detect IP address, then add it to a database. If another request come from a IP, which is in the DB server, ignore it.

What I'm asking is, how can I send HTTPrequest, but without server identifying me as a same person? I heard about proxies, but I think even if I use a proxy, proxy also have an IP address, so I can send only one valid request through the proxy, am I correct?

If so, how can I send HTTPrequest without server knowing it is me?

Note: I don't want server response. I only want to send the request. I am running Windows 8.1.

11
  • 7
    You could use Tor
    – RoraΖ
    Commented Aug 10, 2015 at 11:26
  • @raz can you provide small description about tor ? and how i implement it ?i searched but i know only it's a browser
    – while true
    Commented Aug 10, 2015 at 13:14
  • 1
    Tor is a anonymous network that routes your traffic through 3+ nodes before it reaches the end destination. You can learn more about it at torproject.org. The Tor Browser is an easy download with automatic Tor configuration. You can be up and running in minutes.
    – RoraΖ
    Commented Aug 10, 2015 at 13:18
  • I don't think it's possible to send an HTTP request with no IP address, only a fake (aka spoofed) one. It wouldn't be the internet if you're not using an IP address. For more info read here.
    – Celeritas
    Commented Aug 11, 2015 at 0:27
  • If you're not doing mischief, then just get a cloud trial account (e.g. digital ocean) and use that.
    – aronchick
    Commented Aug 11, 2015 at 16:08

4 Answers 4

10

There's a number of ways that you could achieve this

  • As @raz says in comments use Tor. The Tor network is designed to anonymise Internet traffic so this would fit your bill quite well. Using something like Tails OS could be an easy way to get started for you in that line.
  • As @zviad-gabroshvili says use a proxy. there are a wide range of proxy services on the Internet.
  • There are various services that will contact a URL as part of their operation (e.g. search engines). If you put a link on a page that gets indexed, it's likely that the web search crawler will, in effect, send a request to your target anonymously (well in a way that wouldn't tie back to you directly)
3
  • tnx for the answer..does tor just hide the ip or it send fake ip ?
    – while true
    Commented Aug 10, 2015 at 14:20
  • 3
    @whiletrue, I feel like you might be misinterpreting IP address spoofing with IP address anonymity techniques. The way networking works, is a two way conversation (TCP stack), and what Tor is doing is providing layers of anonymity by separating the sender from the recipient, while still being able to complete the full handshake. This is similar to a VPN or proxy as well (tor adds more). What you seem to want is IP spoofing, which in the context of HTTP requests will not work in the context I've interpreted you to want it to.
    – Michael
    Commented Aug 10, 2015 at 15:23
  • @Michael ok i download tor .but tor doesn't show my ip to the server .but in my case i can't send another request until tor change ip again.so i have to wait until tor change my ip .how can i deal with this
    – while true
    Commented Aug 13, 2015 at 8:47
7

I cant create a comment, so this is my two cents.

You can of course send a HTTP request under a different IP number (other than yourself, "anonymous"), using NMAP. But the one down side would be that you will never get your HTTP request back, because if the server responds it will respond to the spoofed IP address. Unless you set the IP address to some other device you have.

Of course you can use proxies, but at the end of the rainbow you are still tied to the request.

7
  • 14
    You can't spoof a HTTP request like you propose (unless you are watching the network), since HTTP runs over TCP, and as you don't see the server reply you can't complete the HTTP handshake (and thus the desired request won't reach the webserver).
    – Ángel
    Commented Aug 10, 2015 at 13:00
  • 1
    @user1587329 is this 3-way handshake cryptographically secure ? Couldn't you just send the answer blindly some seconds after the first request as if you had received SYNACK ?
    – Falco
    Commented Aug 10, 2015 at 14:03
  • 1
    What you might be able to do is to spoof other ips in your subnet. If you can view your full subnet in promiscuous mode (eg. you are connected to a hub, or a wireless network) and that subnet has public addressing [or directly you can change your IP without being offered it], you may be able to spoof another ip addresses in the same subnet (typically a /24) since you are seeing the server reply.
    – Ángel
    Commented Aug 10, 2015 at 14:11
  • 3
    @Falco, AFAIK it's not predictable with any modern OS. They use a random starting value precisely to avoid this... (On old systems you could indeed, or guess the next connection value based on a sending a packet from your ip just before)
    – Ángel
    Commented Aug 10, 2015 at 14:19
  • 1
    @Falco: It is not "cryptographically secure": there are 2^32 different values. Yet those are nowadays (there were attacks) too pseudo-randomly chosen. I have not heard of a attack in the last decade or so. See also security.stackexchange.com/questions/69181/what-is-tcp-spoofing
    – serv-inc
    Commented Aug 10, 2015 at 15:25
4

I originally made a comment on some answer, but I think that the person asking the question is confusing anonymity with IP spoofing, which are different beasts altogether, so I'll go into a bit more detail.

In a typical environment, you can not spoof an IP address for an HTTP request, and this is because an HTTP request is running over the TCP stack. Pedantic stuff aside, the typical TCP stack consists of packets, with headers, and a 3-way handshake.

HTTP requires a full on TCP handshake, followed by the HTTP protocol "stuff" (the actual communication of HTTP request/response). One answer by @Edvinauskas mentioned nmap, and what they were referring to is not at all related to HTTP requests (or anything requiring a full handshake) but rather port scanning which, simplistically, can infer that if 2 parts of a handshake complete, probably that port is maybe open (SYN scan, used by other tools like zmap, masscan, etc.).

But no, that wont work in this case. The HTTP request will never go through.

In the question, it seems that what is being asked about is sequential requests, so you want it to look like basically every time you send an HTTP request to some server, it looks like you are coming from a different IP address.

This is handled typically in the following way:

Use a lot of proxy servers, not just one

There are edge cases to this, but as edge cases go, they probably do not apply to your question (e.g. if you are sending mass spam, or masquerading as something you are not).

2

When i read your question, TOR browser immediately came to my mind, the idea behind tor browser is "bouncing your communications around a distributed network of relays run by volunteers all around the world". this not only changes your IP address every a couple of minutes (please check specific timing in the browser), but with one click (onion button > new tor circuit) changes your IPv4 address whenever you want! download & learn more from their website https://www.torproject.org/about/overview.html.en

1
  • tnx .does that mean tor use my ip address also for others ??
    – while true
    Commented Aug 10, 2015 at 15:32

Not the answer you're looking for? Browse other questions tagged .