IP Spoofing doesn't work.

Question

IP Spoofing doesn't work.

tigersoft18 opened this issue 4 years ago · comments

Running the project successfully launches packets with spoofed IP and it is verified with Wireshark on my PC. But they never reach the target on internet. I've checked it working in my LAN. What's the difference between LAN and Internet in this project?

Subangkar Karmaker Shanto · Answer 1 · Thu Oct 01 2020 18:06:50 GMT+0800 (China Standard Time)

Considering that your target machine has real ip i.e. it is not behind any NAT, spoofed ping can still be traced if via intermediate routers by detecting an invalid source ip for the domain you are using. However, in my university LAN it worked pretty well.

…

On Tue, Sep 29, 2020, 7:53 PM Wenhao Wang ***@***.***> wrote: Running the project successfully launches packets with spoofed IP and it is verified with Wireshark on my PC. But they never reach the target on internet. I've checked it working in my LAN. What's the difference between LAN and Internet in this project? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#1>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AFOFWCPDXBQ5KIAKZKQDYTDSIHRFFANCNFSM4R52SZEA> .

Wenhao Wang · Answer 2 · Thu Oct 01 2020 19:08:51 GMT+0800 (China Standard Time)

Normal packets arrive perfectly, but only spoofed packets are filtered out. It seems that intermediate routers are blocking them.
Then, is it impossible to spoof source IP address on the internet?
Are all spoofing PoCs are tested on LAN?

Wenhao Wang · Answer 3 · Thu Oct 01 2020 19:12:49 GMT+0800 (China Standard Time)

I think target machine is not the problem seeing that normal packets are working well. I wonder sender's routing structure blocks spoofing.
Would you test your project on my target machine?

Subangkar Karmaker Shanto · Answer 4 · Thu Oct 01 2020 21:22:15 GMT+0800 (China Standard Time)

Well if the intermediate router can verify whether a source ip can exist in the incoming domain or not, it can certainly reject it. I'm currently occupied with a work right now. Feel free to send the spoofed ping to your target ip following the instructions mentioned in the readme file of the repo.

…

On Thu, Oct 1, 2020, 5:13 PM Wenhao Wang ***@***.***> wrote: I think target machine is not the problem seeing that normal packets are working well. I wonder sender's routing structure blocks spoofing. Would you test your project on my target machine? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#1 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AFOFWCNU4BQHLKOP7PN42YLSIRP37ANCNFSM4R52SZEA> .

Wenhao Wang · Answer 5 · Thu Oct 01 2020 21:52:10 GMT+0800 (China Standard Time)

I opened this issue because this repo doesn't work on my sender and target machines both on the internet.
Would you just try sending spoofed ping to my target machine with your sender? I want to make it clear whether ip spoofing is still possible on the internet.

Subangkar Karmaker Shanto · Answer 6 · Fri Oct 02 2020 01:31:11 GMT+0800 (China Standard Time)

Well. it's an interesting matter to look into.
But I currently have windows environment only. Thanks for letting me know. I will inform you once it is tried outside LAN.

hacker25808674 · Answer 7 · Wed Mar 29 2023 20:02:41 GMT+0800 (China Standard Time)

Can I tunnel ssh using icmp host spoffing