2

Question might sound impossible but I'm still serious. Downloaded a plugin for firefox called "Modify Headers" (https://addons.mozilla.org/de/firefox/addon/modify-headers/).

Set it up like that:

Select Action: Add
Header Name: X-Forwarded-For
Value: Enter any IP address here.
Add this and press start.

Now go to https://www.iplocation.net/find-ip-address or some other site and you will see that your original ip has changed without the use of proxy.

However, this doesn't work on all / many sites, but still, maybe there is a better way doing this so it works on all sites?

schroeder
  • 123,438
  • 55
  • 284
  • 319
cnmesr
  • 475
  • 1
  • 6
  • 9
  • I've got the same question here as for [your other post](https://security.stackexchange.com/questions/147166/how-can-you-fake-geolocation-in-firefox): why the no-proxy requirement? – Xiong Chiamiov Jan 04 '17 at 21:47

2 Answers2

6

No, and you're not even changing your IP address with the method you've outlined - you're effectively claiming that you're a proxy for whatever IP address you provided in that header. It might work to fool some basic analytics tools, but your IP address would still be available to whatever servers you connect to (they'd need it to know where data should be going), and it wouldn't fool any authorities who wanted to track activity back to you.

Matthew
  • 27,233
  • 7
  • 87
  • 101
2

The X-Forwarded-For HTTP header informs the website that you are making the request on behalf of the IP address you put into the X-Forwarded-For field. By faking this field, you are essentially lying that you are making the request on behalf of someone else. While the website can choose to believe this if they wish, you are still making the request with your real IP address and your real address is likely still being logged, even if it looks like you fooled them.

Though you can spoof an IP address as well, it is difficult to accomplish anything of note with a spoofed IP address other than denial-of-service attacks. This is because TCP requires two-way communication, and if you spoof your IP address, responses from the server won't make it back to you.

tlng05
  • 10,244
  • 1
  • 33
  • 36