IP Spoof technology Introduction (IP Spoofing) _ Vulnerability Research

First part
1. What is IP spoof?
IP Spoof IP Spoofing, we can say is a host device posing as another host IP address, and other devices to communicate, so as to achieve a certain purpose of technology.
Can 2.IP spoof be implemented?
Can be achieved, back in 1985, an engineer at Bell Labs Robbert Morris in his article a weakness in the 4.2BSD
The concept of IP spoof is presented in UNIX TCP/IP software, and interested readers can see the original text:
Http://www.coast.net/~emv/tubed/archives/Morris_weakness_in_TCPIP.txt
However, it is important to note that simply relying on IP spoof technology is not a good way to complete a complete attack, because the existing IP
Spoof technology is a "blind" type of intrusion, the following will explain the concept of "blind".
Realization principle of 3.IP spoof
We know that IP is a network layer is not a connection-oriented protocol, the main content of IP packets by the source IP address, the target IP address, the data is composed,
The task of IP is to transmit the message from source address to destination address according to the destination of each data message. As to whether the message is missing or wrong in the course of transmission,
IP is not considered. In terms of IP, the source device has nothing to do with the target device, they are independent of each other. IP packets are sent only according to the destination address in the data message, so it is easy to use the high-level protocol to spoof the IP address.
At the same time, TCP as a guarantee of the data between the two communications equipment in the sequential transmission of the protocol, is oriented to the connection, it needs to connect the two sides of the quot, agreed to the communication. Each byte transmitted by the TCP transmission is accompanied by a sequence number (SEQ), which expects the other to generate a reply (ACK) after receiving it.
An answer notifies the other party that the data is received successfully, on the other hand, the next byte you want to receive. At the same time, to establish a TCP connection between any two devices requires a two-party confirmation of the starting process, called three times handshake, can be broken down to represent the following:

The first step: request the direction of the service side sent Syn, indicating that they want to initiate a TCP connection. Let's assume that this time the serial number is a value x
Trust->target
Syn
Seq:x
The second step: the service party generates Syn,ack response and sends an ACK to the requesting party,
The value of the ACK is x+1, indicating that the data was received successfully, and that the next time you want to receive the bytes of SEQ is x+1. Meanwhile, the service direction of the requesting party sends its own SEQ,
We assume that its serial number is a value of Y.
Target-> Trust
Syn,ack
Seq:y
Ack:x+1
Step three: Request the direction of the service to send an ACK to receive the response of the service side. This time its SEQ value is x+1, and its ACK value is y+1, the principle is the same.
Trust->target
Ack
Seq:x+1
Ack:y+1
After this step, the connection between the requester and the service is open and the data can be transmitted.