Asked  7 Months ago    Answers:  5   Viewed   34 times

Is it possible to fake or hijack a content of $_SERVER['REMOTE_ADDR'] variable?

I would like to fake a request with:

$_SERVER['REMOTE_ADDR']='127.0.0.1';

How could I do that with PHP? Can CURL do that somehow?

 Answers

87

I assume that you mean faking it remotely. The short answer is yes you can. The long answer about how easy it is depends on how you want to fake it.

If you don't care about receiving a response, it's as trivial as opening a raw socket to the destination and forging the source IP address. I'm not sure if it's really easy to do in PHP since all of PHP's socket implementations are at or above the TCP level. But I'm sure it's possible. Now, since you're not in control of the network, the response will not go back to you. So that means that you cannot (reliably anyway) create a TCP connection via a trivial forged TCP header (since the syn-ack does prevent this by requiring two-way communication).

However, if you can compromise the gateway the IP is off of, you can do whatever you'd like. So if you compromise the wifi router a computer is connected to, you can pretend to be that computer, and the server won't tell the difference. If you compromise the ISP's outbound router, you can (in theory at least) pretend to be the computer and the server won't tell the difference.

For some more info, see these following links:

  • ServerFault Question
  • Symantec Article
  • Linux Security Article

However, you will only be able to forge the 127.0.0.1 loopback address under TCP if you actually compromise the local machine/server. And at that point does it really matter?

Important

If you're using a framework to access this information, be absolutely sure that it does not check the X-HTTP-FORWARDED-FOR header! Otherwise it's trivial to fake the IP address. For example, if you're using Zend Framework's Zend_Controller_Request_Http::getClientIp method, be absolutely sure that you pass false as the parameter! Otherwise someone just needs to send an HTTP header: X-Http-Forwarded-For: 127.0.0.1 and they now appear to be local! This is one case where using a framework without understanding how it works in the backend can really be bad...

Edit: Relevant

I wrote a blog post recently about how I stumbled across a vulnerability in StackOverflow's application. It's very relevant here, since it exploits a very similar mechanism to what this question is looking for (although the circumstances around it are somewhat narrow):

How I Hacked StackOverflow

Wednesday, March 31, 2021
 
Lloydworth
answered 7 Months ago
94

Ajax can do this. Google it, and check out api.jquery.com and look at the ajax functions, .ajax(), .post(), .get(), .load(), etc.

As for your specific question, here is what you would do:

//Javascript file
$("input[type=checkbox]").click(function () {
   $.post('my_ajax_receiver.php', 'val=' + $(this).val(), function (response) {
      alert(response);
   });
});

//PHP file my_ajax_receiver.php
<?php
   $value = $_POST['val'];
   echo "I got your value! $value";
?>
Wednesday, March 31, 2021
 
Skipper
answered 7 Months ago
95

No, you can use you first method and not fill the memory with duplicate data. The only concern here is to validate it before using, and if you copy it to another variable, you need to do same on it also.

Wednesday, March 31, 2021
 
Shibbir
answered 7 Months ago
68

It's just a warning to show that there is no password for the default user root. If you want to set password for root:

  1. Open phpmyadmin interface
  2. Click "Users" tab
  3. Select user "root"
  4. Edit Privileges
  5. Change password
Saturday, May 29, 2021
 
Lance
answered 5 Months ago
73

Here is a way to do it with plyr :

R> ddply(IN, .(DATE,TRAP), transform, RESULT=ifelse(length(ID)>1,"y","n"))
  ID       DATE TRAP RESULT
1  1 2013-01-01    1      y
2  2 2013-01-01    1      y
3  3 2013-01-01    1      y
4  2 2013-01-01    2      n
5  1 2013-01-02    3      y
6  3 2013-01-02    3      y
7  2 2013-01-03    1      n
8  1 2013-01-03    2      n
9  3 2013-01-03    3      n

Note that the rows have been reordered.


Another solution with data.table :

R> DT <- data.table(IN)
R> DT[,RESULT:=ifelse(.N>1,"y","n"), by=list(DATE,TRAP)]
R> DT
   ID       DATE TRAP RESULT
1:  1 2013-01-01    1      y
2:  2 2013-01-01    1      y
3:  3 2013-01-01    1      y
4:  1 2013-01-02    3      y
5:  2 2013-01-01    2      n
6:  3 2013-01-02    3      y
7:  1 2013-01-03    2      n
8:  2 2013-01-03    1      n
9:  3 2013-01-03    3      n

There is no reordering here.


Or using base ave:

IN <- within(IN, { RESULT <- ave(TRAP, list(DATE, TRAP), 
               FUN= function(x) ifelse(length(x) > 1, "y", "n"))})
#   ID       DATE TRAP RESULT
# 1  1 2013-01-01    1      y
# 2  2 2013-01-01    1      y
# 3  3 2013-01-01    1      y
# 4  1 2013-01-02    3      y
# 5  2 2013-01-01    2      n
# 6  3 2013-01-02    3      y
# 7  1 2013-01-03    2      n
# 8  2 2013-01-03    1      n
# 9  3 2013-01-03    3      n
Saturday, August 28, 2021
 
Robottinosino
answered 2 Months ago
Only authorized users can answer the question. Please sign in first, or register a free account.
Not the answer you're looking for? Browse other questions tagged :