From nobody Thu Feb 02 14:48:34 2023 X-Original-To: freebsd-security@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4P71rG0h37z3fZZS for ; Thu, 2 Feb 2023 14:48:46 +0000 (UTC) (envelope-from joey@joeykelly.net) Received: from marsh.redfishnetworks.com (redfishnetworks.com [45.56.101.157]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 4P71rD71Qjz3CT3 for ; Thu, 2 Feb 2023 14:48:44 +0000 (UTC) (envelope-from joey@joeykelly.net) Authentication-Results: mx1.freebsd.org; dkim=pass header.d=redfishnetworks.com header.s=default header.b=wIcdBkdJ; spf=pass (mx1.freebsd.org: domain of joey@joeykelly.net designates 45.56.101.157 as permitted sender) smtp.mailfrom=joey@joeykelly.net; dmarc=none Received: from marsh.redfishnetworks.com (localhost [127.0.0.1]) by marsh.redfishnetworks.com (Postfix) with ESMTP id 2722A279717 for ; Thu, 2 Feb 2023 08:48:38 -0600 (CST) Received: from marsh.redfishnetworks.com ([127.0.0.1]) by marsh.redfishnetworks.com (marsh.redfishnetworks.com [127.0.0.1]) (amavisd-new, port 10024) with LMTP id hWrFNxrEfJB2 for ; Thu, 2 Feb 2023 08:48:35 -0600 (CST) Received: from nathan.bibleheroes (ip70-171-75-85.no.no.cox.net [70.171.75.85]) by marsh.redfishnetworks.com (Postfix) with ESMTPSA id C654B27970D for ; Thu, 2 Feb 2023 08:48:35 -0600 (CST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=redfishnetworks.com; s=default; t=1675349315; bh=2qTbPj5xzlQ6gvFwLU4A5TZ0uhtdRPJHyAECBlXqQBA=; h=From:To:Subject:Date:In-Reply-To:References; b=wIcdBkdJyinDL+S25oCTK2HhSHOnjIXR+/Iy/JRYeHi9sXfDIvWLmxPQjonjbKuqW 5fedoAcEZ+awviEjzqbM6NVYpDL33zTEjvEF4kTVF+m28/6u4bTwb0qqD5jEP0e0Y2 Bt1b7i8pZUhTvXPGYftVhZFmG42HlihKr7OPSBzQ= From: Joey Kelly To: freebsd-security@freebsd.org Subject: Re: help regarding IP address spoofing (when using nmap) Date: Thu, 02 Feb 2023 08:48:34 -0600 Message-ID: <10158910.FP6jjVeTY9@nathan.bibleheroes> In-Reply-To: References: List-Id: Security issues List-Archive: https://lists.freebsd.org/archives/freebsd-security List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-security@freebsd.org X-BeenThere: freebsd-security@freebsd.org MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" X-Spamd-Result: default: False [-2.99 / 15.00]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; NEURAL_HAM_LONG(-1.00)[-1.000]; NEURAL_HAM_SHORT(-0.99)[-0.991]; CTE_CASE(0.50)[]; R_DKIM_ALLOW(-0.20)[redfishnetworks.com:s=default]; R_SPF_ALLOW(-0.20)[+mx]; MIME_GOOD(-0.10)[text/plain]; DKIM_TRACE(0.00)[redfishnetworks.com:+]; MLMMJ_DEST(0.00)[freebsd-security@freebsd.org]; RCVD_VIA_SMTP_AUTH(0.00)[]; MIME_TRACE(0.00)[0:+]; FROM_EQ_ENVFROM(0.00)[]; DMARC_NA(0.00)[joeykelly.net]; RCPT_COUNT_ONE(0.00)[1]; ASN(0.00)[asn:63949, ipnet:45.56.96.0/20, country:SG]; FROM_HAS_DN(0.00)[]; ARC_NA(0.00)[]; RCVD_COUNT_THREE(0.00)[4]; TO_MATCH_ENVRCPT_ALL(0.00)[]; PREVIOUSLY_DELIVERED(0.00)[freebsd-security@freebsd.org]; TO_DN_NONE(0.00)[]; RCVD_TLS_LAST(0.00)[] X-Rspamd-Queue-Id: 4P71rD71Qjz3CT3 X-Spamd-Bar: -- X-ThisMailContainsUnwantedMimeParts: N On Thursday, February 2, 2023 8:38:46 AM CST Sambuddho Chakravarty wrote: > It was running as root only... > > Also, no the address didn't belong to the interface, and I was spoofing > it... > > So is there no way to spoof packet IP addresses ? I don't know how nmap spoofs an IP, but in a pinch you could alias the IP you want first, run your scan, then drop the alias. --Joey Kelly > > On Thu, 2 Feb 2023, 18:59 J. Hellenthal, wrote: > > On Thu, Feb 02, 2023 at 04:19:57PM +0530, Sambuddho Chakravarty wrote: > > > Hi All > > > > > > I am a relatively newbie to FreeBSD (earlier was running > > > > > > Linux). I am running FreeBSD 13.1. > > > I am trying to run nmap with source IP address spoofing > > > (for some academic purposes). It works fine with Linux > > > but on FreeBSD I get the following error: > > > # nmap -e re0 -S 192.168.17.92 -sS 143.110.249.18 -p 8080 -Pn > > > Starting Nmap 7.93 ( https://nmap.org ) at 2023-02-02 16:04 IST > > > NSOCK ERROR [0.0170s] mksock_bind_addr(): Bind to 192.168.17.92:0 > > > > failed > > > > > (IOD #1): Can't assign requested address (49) > > > NSOCK ERROR [0.0170s] mksock_bind_addr(): Bind to 192.168.17.92:0 > > > > failed > > > > > (IOD #2): Can't assign requested address (49) > > > It works fine without the source spoofing but doesn't when I use > > > it. I can however use my own machine's source IP address with > > > the '-S' option. > > > -- > > > best, > > > sambuddho > > > > sudo(8) or su(1) ? > > > > An address should also be assigned to a interface for it to be bound to. > > > > -- > > The fact that there's a Highway to Hell but only a Stairway to Heaven says > > a lot about anticipated traffic volume. -- Joey Kelly Minister of the Gospel and Linux Consultant http://joeykelly.net 504-239-6550