82

You can change your IP to whatever you want; that's trivial. But that will not work the way you want to. Let's say the store's ISP is Apple Networks, and their IP range is 1.2.3.0 to 1.2.3.255. You note that and get home. Your home network is from Avocado Networks, and their IP range is 2.3.4.5. You change your IP to 1.2.3.123 and wait. Nothing happens. You ...


54

You don't have to worry about spoofing the IP from a different connection, because returned TCP packets would not make it to the attacker in that scenario. So all you have to worry about is how easy it is for the attacker to make use of that IP: Is that IP shared between multiple computers in the office? Can that IP be used on WiFi? How well is the ...


48

IP Spoofing is NOT IP Hijacking which is causing confusion for anyone reading this. IP Spoofing at its minimum / bare bones explanation is also called impersonation. Let's have an ASCII look at what it does, and how it happens: You (1.2.3.4) --> connect to your bank --> Bank (2.2.2.2) In spoofing, I can pretend to be anyone I want, if I am on your ...


31

TOR, VPN, bots, proxies, you name it.. The source IP is not "spoofed" per se... it's the real deal. If someone really spoofed a source IP, they couldn't establish a TCP connection or receive any replies. The source IP spoofing method is more useful over UDP when launching an amplification attack to a victim/spoofed IP.


23

Yes (with your assumptions of neglecting the client being able to intercept the return of the handshake at a spoofed IP) if you do things correctly. HTTP requests are done over TCP; until the handshake is completed the web server doesn't start processing the HTTP request. Granted a random user could attempt to spoof the end of a handshake; but as they have ...


20

Short answer: no. Longer answer: yes, if you control a router device close to the target device (it has to be on the path between the the real source IP address and the target, and on the path between the faked IP address and the target) or if the target network/host accepts source-routed packets.


19

When you send a request to the server, the server need to know where to answer, it's with your ip address. This is directly based on the TCP/IP protocol and in a lower level than web servers. For the reason why Firebug doesn't show your IP address, it's like when you receive mail (paper), you have your address written in front, and the sender in the back. ...


19

Set up a web server and send them a link to something on it. Once they click the link, their IP address will be logged in your web server's access logs. You could also host an image on said web server and trick a user into loading it through a third party's website. Some social networking sites allow you to upload snippets of HTML including image tags. ...


18

While I am sure there are, in fact, firewalls that may do that, I am not off-hand aware of any that operate this way. There are packet spoofing detection mechanisms, although they tend to act a little different. Bogon Filters A bogon is defined as bogus IP address. Specifically, it is the list of all IP addresses that have not been allocated by IANA, by a ...


17

Full IP spoofing is hard for the commoners. Everything in IP is made of packets. Each packet has a source address and a destination address. IP spoofing is about sending packets with a wrong source address. Sending such a packet is simple enough with a few lines of code (it tends to require local Administrator / root rights; on Linux, this is a matter of a ...


17

Short answer: Yes, but not as possible as it used to be, and dependent upon how literally one takes your question. Long answer: I notice that you did not ask "Is it possible to carry on a TCP conversation with a spoofed IP address" - that question was ably answered by @symcbean. You specifically asked "Is it possible to pass TCP handshake with spoofed IP ...


17

As others pointed out, IP spoofing alone is not a problem here since the threeway handshake for TCP will not complete. BGP hijacking combined with IP spoofing could result into a somewhat theoretical attack here if you're using public addresses in your access-list. In that case the attacker would spoof the IP-address in the access-list so traffic is coming ...


16

IP spoofing means creating IP packets with a source address which is not yours and sending those to some destination. To be able to do so, routers on the path have to allow traffic coming from an incorrect source. BCP38 describes a number of techniques (filtering, uRPF) which ISP's can use to prevent spoofed IP traffic originating from their network. Since ...


15

If the victim is using an open wireless network, spoofing DNS is easy. It is easy for the attacker to mount a man-in-the-middle attack and send forged DNS responses. Therefore, if you are using an open wireless network, you should not trust DNS at all: it is trivial to spoof. Similarly, if the attacker is on the same subnet as you, spoofing DNS is easy: ...


14

An important point must be made, which is that IP spoofing is limitative. When an attacker uses a fake IP for the packets he sends, he will usually not be able to receive the answer, unless he has some extensive power over the overall network: that's because the response will be sent to the fake IP, not the attacker's actual IP address. In particular, this ...


14

Is it possible to spoof the IP once a TCP handshake was performed successfully? No. A TCP session is defined by four items: Source IP address Source IP port Destination IP address Destination port This comes from RFC 793: To provide for unique addresses within each TCP, we concatenate an internet address identifying the TCP with a port identifier to ...


13

Let's suppose that someone (Mario) wants to send an email to someone else (let's call him Nicolas). Nicolas' mailbox is filled by a unique server, let's say smtp.gouv.fr (that's a fictitious example). So, whatever Mario does, the email will have to go through that server, transmitted with the SMTP protocol (the one with the 'RCPT' command). Mario would like ...


13

If the connection uses proxies which are correctly implemented, discovering the ip through http or tcp can be difficult. You may have some luck in getting closer to the ip using DNS instead. for If you generate the page dynamically to contain an image located at a domain that you control, e.g. <img src="http://123123.deanonymize.mydomain.com"/> the ...


13

Your question seems to indicates you do not understand how IP works, how IP routing works and how TCP is implemented on top of it (and incidentally, what IP address spoofing really means) Routing IP implements a routed datagram protocol: each datagram (packet) has (among other things) a source address, a destination address and a payload (there are many ...


13

You can spoof your IP to whatever you want it to be. Pick a number, any number! However, you can't use it to trick a HTTP server into believing your are someone you are not. The TCP handshake protects against IP spoofing. So no luck there. Anyways, my guess is that the webpage that is shown on the devices isn't discriminating based on IP. Sounds more ...


12

In general yes, there is ways of doing this, as a quick google search would've been able to tell you. When ever you call, write or send a file to a person on skype you make direct contact with the persons IP/ISP IP, and that you are of course able to track. A simple way to do it in windows is using netstat -n while in a call, and look for the port you know ...


12

Yes, it works. it's often called a reflection DDoS attack. Variants include sending DNS queries off with the (spoofed) address of the target in them. That's a DNS reflection or DNS amplification attack. Vern Paxson wrote a paper about reflection attacks and possible defenses in 2001. UPDATE Cloudflare blog entry about DNS Amplification DDoS, and follow-up ...


12

Defining a spoofed packet First off, there's the concept of ownership of an IP range. I'll say anything that isn't coming from the registered owner or delegate of an IP block from IANA (and the subsidiaries, and the delegating ISPs) is a spoof. It's all about routing There are a few things to consider when talking about spoofing. The first is that you can ...


11

Essentially it depends on the attacker and what resources they have available. Ordinary home-users or attackers who aren't very dedicated might be deterred by source IP address blocking, but more advanced/determined attackers have a number of ways to get round this. The obvious one is to use one of the wide range of proxy services available on the Internet....


11

A spoofed packet is a packet with a fake source IP address. To detect an incoming packet as spoofed, firewalls try to apply "local rules": they reject the packet if its coming from a link which is nominally incompatible with the alleged source address. For instance, if a firewall is between an internal network, with a known IP range, and the wide Internet, ...


11

Short Answer Assuming a TCP connection, it is nearly impossible to spoof a source IP address without control of the network. Longer Answer Assuming you are not using any proxies (which can cause issues if you're getting their IP address from a X-FORWARDED-FOR header), and running a service on TCP, it's extremely difficult to spoof a source IP address ...


11

TL;DR: proxy support is limited right now but there are also theoretical limits of what you could do when using a proxy. nmap can do only CONNECT and SOCKS4 and these protocols can do only TCP. Apart from that using any kind of proxy means that nmap communicates with the IP stack of the proxy and not of the target. This means: ICMP ping can not be done to ...


10

The thing about a DDoS is that you use other people's IPs, not your own. It's relatively simple to become untraceable on the Internet -- just route your traffic though a host that is not keeping traffic logs. As someone who frequently has to try to track these people down, I can tell you what an impossible nightmare it is. Here's the pattern I frequently see:...


10

1) There doesn't appear to be a usual policy. Many ISP's do now drop packets with spoofed addresses, but there are still loads that do not. 2) When NAT'ing, a correctly configured router will have a small list of rules which define the IP address which will be attached, so the usual attack is to send from a location where this doesn't happen. 3) One of the ...


10

This code allows an attacker who knows the victim's X-Forwarded-For: header and the victim's session ID to login as that user. If the victim doesn't have an X-Forwarded-For: header, the attacker can put the victim's IP address in his header and the code will use that value as his legitimate IP address instead of his actual IP address. This is the ...


Only top voted, non community-wiki answers of a minimum length are eligible