1

I want to send a HTTPrequest to a specific web address, but with different IP address. For example, if a webserver detect IP address, then add it to a database. If another request come from a IP, which is in the DB server, ignore it.

What I'm asking is, how can I send HTTPrequest, but without server identifying me as a same person? I heard about proxies, but I think even if I use a proxy, proxy also have an IP address, so I can send only one valid request through the proxy, am I correct?

If so, how can I send HTTPrequest without server knowing it is me?

Note: I don't want server response. I only want to send the request. I am running Windows 8.1.

Rory Alsop
  • 61,367
  • 12
  • 115
  • 320
while true
  • 167
  • 1
  • 1
  • 7
  • 7
    You could use Tor – RoraΖ Aug 10 '15 at 11:26
  • @raz can you provide small description about tor ? and how i implement it ?i searched but i know only it's a browser – while true Aug 10 '15 at 13:14
  • 1
    Tor is a anonymous network that routes your traffic through 3+ nodes before it reaches the end destination. You can learn more about it at [torproject.org](https://www.torproject.org/projects/torbrowser.html.en). The Tor Browser is an easy download with automatic Tor configuration. You can be up and running in minutes. – RoraΖ Aug 10 '15 at 13:18
  • I don't think it's possible to send an HTTP request with no IP address, only a fake (aka spoofed) one. It wouldn't be the internet if you're not using an IP address. For more info [read here](https://en.wikipedia.org/wiki/Internet_protocol_suite#Internet_layer). – Celeritas Aug 11 '15 at 00:27
  • If you're not doing mischief, then just get a cloud trial account (e.g. digital ocean) and use that. – aronchick Aug 11 '15 at 16:08
  • @aronchick what it do – while true Aug 12 '15 at 09:02
  • You can get a free/trial account at many cloud providers, and they will effectively anonymize you (who cares if they track it back to the cloud provider) – aronchick Aug 13 '15 at 18:18
  • @raz i download tor .but tor doesn't show my ip to the server .but in my case i can't send another request until tor change ip again.so i have to wait until tor change my ip .how can i deal with this – – while true Aug 14 '15 at 03:17
  • @whiletrue Tor probably isn't the best solution if you're trying to flood a server with requests. – RoraΖ Aug 14 '15 at 11:13
  • Based on your comments on the various answers, it seems very unclear as to what you are actually wanting. And I'm not sure you know what you are asking. Please try and clarify. – Rory Alsop Aug 14 '15 at 11:27
  • @RoryAlsop can you say what is unclear then i can clarify – while true Aug 16 '15 at 04:41

4 Answers4

10

There's a number of ways that you could achieve this

  • As @raz says in comments use Tor. The Tor network is designed to anonymise Internet traffic so this would fit your bill quite well. Using something like Tails OS could be an easy way to get started for you in that line.
  • As @zviad-gabroshvili says use a proxy. there are a wide range of proxy services on the Internet.
  • There are various services that will contact a URL as part of their operation (e.g. search engines). If you put a link on a page that gets indexed, it's likely that the web search crawler will, in effect, send a request to your target anonymously (well in a way that wouldn't tie back to you directly)
Community
  • 1
Rory McCune
  • 60,923
  • 14
  • 136
  • 217
  • tnx for the answer..does tor just hide the ip or it send fake ip ? – while true Aug 10 '15 at 14:20
  • 3
    @whiletrue, I feel like you might be misinterpreting IP address *spoofing* with IP address anonymity techniques. The way networking works, is a two way conversation (TCP stack), and what Tor is doing is providing layers of anonymity by separating the sender from the recipient, while still being able to complete the full handshake. This is similar to a VPN or proxy as well (tor adds more). What you seem to *want* is IP spoofing, which in the context of HTTP requests will not work in the context I've interpreted you to want it to. – Michael Aug 10 '15 at 15:23
  • @Michael ok i download tor .but tor doesn't show my ip to the server .but in my case i can't send another request until tor change ip again.so i have to wait until tor change my ip .how can i deal with this – while true Aug 13 '15 at 08:47
7

I cant create a comment, so this is my two cents.

You can of course send a HTTP request under a different IP number (other than yourself, "anonymous"), using NMAP. But the one down side would be that you will never get your HTTP request back, because if the server responds it will respond to the spoofed IP address. Unless you set the IP address to some other device you have.

Of course you can use proxies, but at the end of the rainbow you are still tied to the request.

Edvinauskas
  • 103
  • 1
  • 14
    You can't spoof a HTTP request like you propose (unless you are watching the network), since HTTP runs over TCP, and as you don't see the server reply you can't complete the HTTP handshake (and thus the desired request won't reach the webserver). – Ángel Aug 10 '15 at 13:00
  • 1
    @user1587329 is this 3-way handshake cryptographically secure ? Couldn't you just send the answer blindly some seconds after the first request as if you had received SYNACK ? – Falco Aug 10 '15 at 14:03
  • @Falco, your ACK (which ends the handshake) must contain a value provided by the remote server on its SYN-ACK, otherwise it gets rejected. And the range is too much to flood the server with all possible values. – Ángel Aug 10 '15 at 14:07
  • 1
    What you might be able to do is to spoof other ips in your subnet. If you can view your full subnet in promiscuous mode (eg. you are connected to a hub, or a wireless network) and that subnet has public addressing [or directly you can change your IP without being offered it], you may be able to spoof another ip addresses in the same subnet (typically a /24) since you **are** seeing the server reply. – Ángel Aug 10 '15 at 14:11
  • @Ángel so the question is how easily predicatble this random part is... On old servers this was many times just a running number, so you could predict it in a few tries... A big range is only given if the server actually uses a random key and not some predictable pattern. – Falco Aug 10 '15 at 14:15
  • 3
    @Falco, AFAIK it's not predictable with any modern OS. They use a random starting value precisely to avoid this... (On old systems you could indeed, or guess the next connection value based on a sending a packet from your ip just before) – Ángel Aug 10 '15 at 14:19
  • 1
    @Falco: It is not "cryptographically secure": there are 2^32 different values. Yet those are nowadays (there were attacks) too pseudo-randomly chosen. I have not heard of a attack in the last decade or so. See also http://security.stackexchange.com/questions/69181/what-is-tcp-spoofing – serv-inc Aug 10 '15 at 15:25
4

I originally made a comment on some answer, but I think that the person asking the question is confusing anonymity with IP spoofing, which are different beasts altogether, so I'll go into a bit more detail.

In a typical environment, you can not spoof an IP address for an HTTP request, and this is because an HTTP request is running over the TCP stack. Pedantic stuff aside, the typical TCP stack consists of packets, with headers, and a 3-way handshake.

HTTP requires a full on TCP handshake, followed by the HTTP protocol "stuff" (the actual communication of HTTP request/response). One answer by @Edvinauskas mentioned nmap, and what they were referring to is not at all related to HTTP requests (or anything requiring a full handshake) but rather port scanning which, simplistically, can infer that if 2 parts of a handshake complete, probably that port is maybe open (SYN scan, used by other tools like zmap, masscan, etc.).

But no, that wont work in this case. The HTTP request will never go through.

In the question, it seems that what is being asked about is sequential requests, so you want it to look like basically every time you send an HTTP request to some server, it looks like you are coming from a different IP address.

This is handled typically in the following way:

Use a lot of proxy servers, not just one

There are edge cases to this, but as edge cases go, they probably do not apply to your question (e.g. if you are sending mass spam, or masquerading as something you are not).

Michael
  • 151
  • 4
2

When i read your question, TOR browser immediately came to my mind, the idea behind tor browser is "bouncing your communications around a distributed network of relays run by volunteers all around the world". this not only changes your IP address every a couple of minutes (please check specific timing in the browser), but with one click (onion button > new tor circuit) changes your IPv4 address whenever you want! download & learn more from their website https://www.torproject.org/about/overview.html.en

dave
  • 21
  • 1