Hacker News new | ask | show | jobs
by digitalPhonix 49 days ago
Did you read the things you're linking?

> https://owasp.org/www-community/pages/attacks/ip_spoofing_vi...

Isn't an actual technique, it's describing the observed result if the server were to blindly trust some HTTP headers which is just the application payload in a TCP stream. It's not spoofing the IP at any network layer.

> https://github.com/ParsaKSH/spoof-tunnel

Requires mutually agreed spoofing on both sides... at which point it's not really spoofing and also clearly not applicable because Wikipedia will not agree to it. (It is useful in the context that they're using it, just not at all what you're talking about)

Without controling a router that's on the path or being able to publish a route that contains the IP address you're trying to spoof, there is no way to spoof an IP address in bidirectional communication.
1 comments
rolph 49 days ago
"blindly trust some HTTP headers" "Without controling a router" "Requires mutually agreed spoofing on both sides"

you understand the concepts, and the requirements for POC, but you are not the only one.

and for those who want a working weapon,they will have to identify ALL the requirements and implement it themselves. im not about to leave the weapon loaded and fully assembled in a public place.

it sounds like you are fully capable of manufacturing that weapon if you really wanted to.

also people really are soft, it starts with soc eng, and goes from there.

link
cowboylowrez 48 days ago
>it sounds like you are fully capable of manufacturing that weapon if you really wanted to.

A significant portion of the HN population could probably jury rig something up, it just has no value in the wikipedia case when you can simply hop on a compromised internet device, no spoofing needed. In the context of "foreign country posts lies with bogus ip", ip spoofing just can't compete when you can get the real deal full on two way functional tcp/ip connection from any acquired proxy device legal or not.

Look you're trying to make believe you have a secret weapon on a website where most folks know how computers work lol quit trying to make secret weapon happen when you don't actually have one.

link