IP Spoofing

advancedAdditional Vector

Masquerading as the legitimate user's IP address to bypass IP-based session validation and access controls.

Detailed Overview

IP spoofing involves forging the source IP address in network packets to impersonate another device. In session hijacking contexts, attackers spoof the victim's IP to maintain session validity when servers implement IP-based session binding. The technique requires detailed knowledge of network protocols and routing. While challenging to execute, it can be effective against systems that rely solely on IP addresses for session validation.

Prevention Strategies

01Implement multi-factor authentication
02Use ingress and egress filtering on routers
03Deploy anti-spoofing technologies
04Combine multiple session binding factors
05Monitor for impossible travel scenarios

Tools

Common software used to explore or defend against this technique.

hping3
Scapy
tcpdump
iptables / nftables

BYO — Build your code

Programmatic approaches that recreate what tools do — for learning, detection, and hardening on systems you are authorized to test.

Detect impossible travel (defense)

python

Flag session reuse from distant geos within an impossible time window.

from dataclasses import dataclass
from datetime import datetime

@dataclass
class Login:
    user: str
    city: str
    lat: float
    lon: float
    at: datetime

def haversine_km(a: Login, b: Login) -> float:
    # stub: plug in a real haversine if needed
    return abs(a.lat - b.lat) * 111 + abs(a.lon - b.lon) * 85

def impossible_travel(prev: Login, curr: Login, max_kmh: float = 900) -> bool:
    hours = (curr.at - prev.at).total_seconds() / 3600
    if hours <= 0:
        return True
    return haversine_km(prev, curr) / hours > max_kmh

Log source IP binding checks

typescript

Middleware sketch that compares session-bound IP to request IP.

type Session = { id: string; boundIp: string };

export function ipMatchesSession(
  session: Session,
  requestIp: string,
): boolean {
  return session.boundIp === requestIp;
}

// Prefer MFA + device binding over IP-only trust.