Everyone, let's take a look at the next attack
known as IP spoofing.
As an integers is quite clear that the
attacker is trying to spoof its own IP.
This particular attack takes advantage of sorts out
at packets. So technically, an attacker is
trying to hide the source from where
the packet is being generated.
So one of the primary purpose of
doing so is that the attacker doesn't need to be in between the communication anymore
as compared to other sessions as
exacting attacks?
So one of the reasons this attack is used is
to hide the source IP in that
way, an attacker, when performing a heavier attack doesn't
need to use his own IP, but
you can always disguise from Battle
packet is being generated.
This come on attack is also seen in
oscillators just because of the purpose of hiding the
IP. So odd person was
trying to protect the asset. You would not be able to
confirm. What's actual Source IP, and
then attacker can generate multiple Source
IP addresses in that way. It is very
difficult for an organization to protect against
such attacks and one of the other purposes that
if an attacker wants to send out any
Just content, you can do so by Heidi's IP again now,
just, let's take a example.
So as you can see, I'm using my colleague box in
order to perform a simple IP spoofing attack.
So just for us
to confirm, if the packets are being spoofed.
I'm going to use y shark.
So I'm just going to record one
of the interfaces. That is my local lamb.
The Pakistani be captured now.
What I'm going to do is that you using one of the two known
as H pink tree.
So this is a syntax error amount. I what I'm
going to tell is that using this command is
using H being 3, and
practice and sing packets or the target address. That
is 10.00 96.
As was in the skin types, I'm going to use HP 3 as
a tool and the parameters are I'm going to pass is I
finessed which force in attack and
followed by the Target IP address. That is 10,
0, 0, 96, and using the I finish, which
I am going to let know
what is the spoofed IP address, or I'm going to use. I'm going
to use one dot 1.1.1 as Source.
IP that is going to be spooked and
hyphen C. Switch is going to
Use let us know the number of packages are going to set.
As you can see, we have sent three spoofed IP packets.
Now, let's go back to Wireshark and confirm that.
Using the IP dot address parameter. I am going to search
for One Dot. One dot, one dot one.
Now, as you can see, we have three same
package that are being sent based on
the command that we had used. Its - is useful sin
packets as what we see in each one of those requests and
the spoof addresses, one dot, one dot, one
dot one. That is what we see as a suicide pact.
Just to reiterate a scenario. Actually, that
article the Senate to be in between the communication Channel,
unlike other session hijacking scenarios. So
tracker is going to spoof the IP address of the victim by
doing so. Specific Network device is
going to respond back to the victim because during
the TCP handshake, using the
source header packets. That is how machine is going to
know for which so surveys. It has to respond back
with the communication.
So just a typical data scenario that occur can
keep on injecting different packets,
specifying a specific Source IP
and forth. At each one of those requests, the
server is going to respond back.
That is false video. Thank you.