zlacker

[parent] [thread] 2 comments
1. wrboyc+(OP)[view] [source] 2020-11-28 23:15:07
How are you going from guessing TCP sequences to spoofing IP addresses on TCP connections? Did you breeze over a step or am I missing something obvious?
replies(2): >>gruez+J3 >>nitrog+W6
2. gruez+J3[view] [source] 2020-11-28 23:50:50
>>wrboyc+(OP)
TCP packets contain sequence numbers that must correspond to the ones sent by the other side. This is an issue if you're spoofing packets because you don't receive packets (containing the sequence numbers) from the other side (they will go to the spoofed address, rather than yours). Without the other side's sequence numbers, your replies will be considered invalid, which means you can't complete the handshake[1] to establish a connection. However, if you can successfully guess the sequence numbers, you can complete the handshake and also write arbitrary data to the stream. You still won't be able to receive data, but for simple protocols like irc, it can still be useful eg. connecting to a server and then sending spam to an user/channel.

[1] https://en.wikipedia.org/wiki/Transmission_Control_Protocol#...

3. nitrog+W6[view] [source] 2020-11-29 00:25:46
>>wrboyc+(OP)
The mitigations for spoofing sequence numbers might be different for each OS, and that would allow the OS to be fingerprinted. See nmap's OS fingerprinting, for example.
[go to top]