Simulating a POST request with a spoofed IP

Jan 11, 2014 at 9:39 PM
Hello,

I'm trying to make a HTTP POST request with a spoofed ip (94.234.170.70 below).

If I make an new HttpWebRequest() and POST it to http://posttestserver.com/post.php (a server for testing POST request) it gets registered. However, using the code below, nothing gets registered.

I compared the two requests in WireShark, and the only difference seems to be that the HttpWebRequest line gets a green background, while the other once gets black and a [TCP Retransmission] prefix added to the description in the "Info"-field.

The second requests gets sent using my regular network adapter using your sample code from the "SendingASinglePacketWithSendPacket"-project.

Does anyone know what might be missing here?

Thanks in advance!

Best regards,
Johan
/// <summary>
/// This function build an HTTP over TCP over IPv4 over Ethernet packet.
/// </summary>
private static Packet BuildHttpPacket()
{
    EthernetLayer ethernetLayer = new EthernetLayer
    {
        Source = new MacAddress("01:01:01:01:01:01"),
        Destination = new MacAddress("02:02:02:02:02:02"),
        EtherType = EthernetType.None, // Will be filled automatically.
    };

    IpV4Layer ipV4Layer = new IpV4Layer
    {
        Source = new IpV4Address("94.234.170.70"),
        CurrentDestination = new IpV4Address("67.205.14.22"),
        Fragmentation = IpV4Fragmentation.None,
        HeaderChecksum = null, // Will be filled automatically.
        Identification = 123,
        Options = IpV4Options.None,
        Protocol = null, // Will be filled automatically.
        Ttl = 100,
        TypeOfService = 0,
    };

    TcpLayer tcpLayer = new TcpLayer
    {
        SourcePort = 4050,
        DestinationPort = 80,
        Checksum = null, // Will be filled automatically.
        SequenceNumber = 100,
        AcknowledgmentNumber = 50,
        ControlBits = TcpControlBits.Acknowledgment,
        Window = 100,
        UrgentPointer = 0,
        Options = TcpOptions.None,
    };

   HttpRequestLayer httpLayer = new HttpRequestLayer
   {
       Version = HttpVersion.Version11,
       Header = new HttpHeader(new HttpContentLengthField(11)),
       Body = new Datagram(Encoding.UTF8.GetBytes("&foo=1")),
       Method = new HttpRequestMethod(HttpRequestKnownMethod.Post),
       Uri = @"http://posttestserver.com/post.php"
   };

   PacketBuilder builder = new PacketBuilder(ethernetLayer, ipV4Layer, tcpLayer, httpLayer);

   return builder.Build(DateTime.Now);
}
Coordinator
Jan 18, 2014 at 5:08 PM
Hi filyr,

Are you sending a TCP SYN packet first and are you using the correct sequence and acknowledgement numbers?

If you send an HTTP request without first doing a TCP 3-way-handshake, the server will reject the packet.

I hope this helps,

Boaz.