+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: [TUT]How to Spoofing IP Addresses: Learn how to create custom IP packets Using tool Rafale[TUT] (/showthread.php?tid=358605)
[TUT]How to Spoofing IP Addresses: Learn how to create custom IP packets Using tool Rafale[TUT] - Tooth Fairy - Apr 9, 2010
How to Spoofing IP Addresses: Learn how to create custom IP packets Using tool RafaleX and Engage Packet Builder
The RafaleX application allows for the creation of custom IP packets. The packet is very customizable and allows for the spoofing of the IP, setting the flags, number of packets, and so forth. RafaleX is becoming hard to locate on the Internet as it appears it is now called Engage Packet Builder.
The RafaleX application is an excellent way to “spoof” custom packets. Attackers can place a valid IP address as the source of the packet and the target will have to attempt to respond to the spoofed address. By sending hundreds of thousands of packets in this manner, an attacker can create a Denial of Service attack against a target.
[img]http://4.bp.blogspot.com/_1Rgvx77sTm4/S5TLsuG3uxI/AAAAAAAAC1M/odyzZtMuy44/s400/1.JPG[/img]
In this example, the Source IP of the packets to be sent is set to 10.10.10.10 with the source address of port 123. According to Internet etiquette, this should never be able to route on the Internet as the 10.x.x.x range is reserved for Private addressing. Set the destination IP to the target address. In this example it is 172.16.1.40. Set the Destination
port to port 21. The SYN and ACK flags were set for each packet.
*Note: The Ethernet communications process requires a three-way handshake:
SYN: Synchronize
SYN-ACK: Synchronize-Acknowledge
ACK: Acknowledge
When a computer receives an uninitiated SYN-ACK packet its response is to send a RST (Reset) packet.
[img]http://1.bp.blogspot.com/_1Rgvx77sTm4/S5TLsMpyRMI/AAAAAAAAC1E/VxO7ptcp5gE/s400/2.JPG[/img]
The number of packets was set to 100. Click the Send button to send the packets to the target. The Status area at the bottom left of the application will tell you that the packets were sent.
[img]http://3.bp.blogspot.com/_1Rgvx77sTm4/S5TLrn9GAiI/AAAAAAAAC08/blrt05CozLw/s400/3.JPG[/img]
The proof is below screen shot captured from packet capturing tool:
[img]http://2.bp.blogspot.com/_1Rgvx77sTm4/S5TLq7gM-iI/AAAAAAAAC00/GzgfuOM4YMk/s400/4.JPG[/img]
[img]http://1.bp.blogspot.com/_1Rgvx77sTm4/S5TLqvQ414I/AAAAAAAAC0s/PCg_2eVdprU/s400/5.JPG[/img]
Please reply ,to make it even better 👍 ✌
* - Jack. - Apr 9, 2010
Very intresting guide thanks!
* - Tooth Fairy - Apr 9, 2010
Loved to help you :)
* - catlover - Apr 9, 2010
seems good. is it better than proxies??
* - Tooth Fairy - Apr 10, 2010
Yes it is better than proxies :)
* - MindAway - Apr 10, 2010
I have a question please
now suppose you have a ip address which is 12.34.56.78
and I have another ip address which is xx.xx.xx.xx
by this tut
can i make xx.xx.xx.xx=12.34.56.78 ?!
if not, please correct me :)
* - Leg4cy - Apr 10, 2010
Cool Tut imma try this much thanks
* - vrysleepy - Apr 10, 2010
noob question, but what exactly does this do? give a false ipaddress to sites,games,connections, etc?
* - Tooth Fairy - Apr 10, 2010
Yes you are right .
* - D0ggyD0gg - Apr 10, 2010
This looks good ill try it out.
* - -mothered- - Apr 10, 2010
Great work with your tut there mate. Very well Introduced, documented, Illustrated and elaborated. I've bookmarked this and shall analytically delve Into It, within the next few days (time Is not on my side at the moment!).
Appreciate the effort you put Into this :)
* - DexHacker - Apr 10, 2010
Thanks for the tut, but one big problem your spoofing your IP, but the problem is the handshake will send the response to the spoof IP, so you will not get them and you need to return the rand number +1.
But there is a use for such programs, for example i got banned from OS Dev forum, so i decided to ban the mods, first i got all the mods IPs, this was simple just sent them to a fake site, that i said was a OS Dev fake site i found, this just saved there ip's to a text file (simple php).
Once i had all the mods IP's, i test there forum and found that if you port scan the forum, it would block your IP.
Now it was a simple case of spoofing my IP with the mods IP's as if they were port scanning them and the mods IP'S where block, i did this in a loop, from a old 486 pc.
* - Tooth Fairy - Apr 10, 2010
(Apr 10, 2010 06:16 PM)mothered Wrote: Great work with your tut there mate. Very well Introduced, documented, Illustrated and elaborated. I've bookmarked this and shall analytically delve Into It, within the next few days (time Is not on my side at the moment!).
Appreciate the effort you put Into this :)
Thanks man.
Hope you like it 👍
* - -mothered- - Apr 10, 2010
(Apr 10, 2010 10:13 PM)۩ρђєσภٱx ♠™ Wrote: Thanks man.
Hope you like it 👍
You're welcome mate. Looking forward to giving It a crack soon.
Cheers :)
* - R16H713 - Apr 11, 2010
This is epic! In theory, you can employ an amplification attack by flooding a company, that has large bandwidth, and spoofing the source as the person who's computer you want to take down. I can't wait to try this out. Thanks for the share!
(Link: http://www.engagesecurity.com/downloads/#engagepacketbuilder)