1

I'm new PT.

In a test I was required to do, I was given a port in the segment of 172.13.x.x. I was asked to test if I'm able to reach a server at 172.16.x.x. I was wondering (considering there's either a router/ layer-3 switch / firewall !), if it is possible to inject packets using IP Spoofing to other networks.

For example, if I spoof the "source" IP to an IP of the segment 172.16.x.x, will spoofing work? Will injected packets reach to 172.16.x.x? Will I receive packets back?

WhiteWinterWolf
  • 19,082
  • 4
  • 58
  • 104

1 Answers1

2

There are actually 3-4 questions in your post, and they can mostly be answered with just networking answers.

if I spoof the "source" IP to an IP of the segment 172.16.x.x, will spoofing work?

It depends what you mean by "work", but the principle of spoofing is to fake packet and see what happens. You can fake what you want, the idea will be then to properly analyze how the network reacts and if there is any possible weakness in this reaction.

Will injected packets reach to 172.16.x.x?

Possibly.

Normally, if properly configured when receiving a packet the layer-3 device connecting the two LANs should check if the source IP address is expected on this incoming interface.

Normally, and depending on the exact topology, it should detect that no packets with source IP 172.16.x.x should be received on the interface connected to the 172.13.0.0/16 network and react accordingly (drop the packet for instance).

However, this layer-3 device may be wrongly configured and could therefore allow such packets.

Will I receive packets back?

By doing only what you describe, this one is a no for sure: the layer-3 device will have strictly no reason to route a packet with a destination IP 172.16.x.x to its 172.13.0.0/16 interface.

If you are required to be on the 172.16.0.0/16 network to reach the server, this would either mostly restrict you to UDP attacks (if the layer-3 device does not correctly check source IPs) or find a way to convince the device that you are a legitimate route toward other hosts belonging to the 172.16.0.0/16 network (which would very heavily depend on the exact network devices and configuration, but for instance facing poorly managed switches you can try to exploit some layer-2 attack and jump onto the VLAN associated to the 172.16.0.0/16 network).

WhiteWinterWolf
  • 19,082
  • 4
  • 58
  • 104