5
votes
3answers
953 views

Is it possible to pass TCP handshake with spoofed IP address?

Little time ago, me and my friends argued if TCP handshake can be passed with a spoofed IP address. Assume I have a https web server that allows only admin's IP numbers. Can anyone connect that web ...
16
votes
3answers
714 views

Vulnerable code suggested on OWASP?

Session Hijacking Prevention It is good practice to bind sessions to IP addresses, that would prevent most session hijacking scenarios (but not all), however some users might use anonymity ...
9
votes
5answers
1k views

Apache/Linux server, DoS attack from own IP

I have an unusual problem I've been trying to diagnose for a while: It's about a Debian server running a custom compile of apache 2.2 with PHP, Red5, MySQL 5.5 (standard binary), sendmail (distro ...
14
votes
6answers
4k views

How does a server obtain the IP Address of a user?

How does a server obtain the IP Address of a user? Is it possible to fool the server by spoofing the IP Address?
9
votes
3answers
5k views

Can I trust the source IP of an HTTP request?

As far as I've understood, if you try to issue a HTTP request with a spoofed IP address, then the TCP handshake fails, so it's not possible to complete the HTTP request, because the SYN/ACK from the ...
2
votes
2answers
635 views

Reveal the True IP of a User

Is there any best practice method (and preferably documented) way of revealing the True IP of a user using a HTTP(S) connection? I.e.: To be able to uncover the true IP from transparent as well as ...