Menu
We have created a database driven website using PHP with set cookies and now need to prevent HTTP spoofing, any ideas on how to do this? we are beginners with this so any help would be greatful
943
Packet filtering can prevent an IP spoofing attack since it is able to filter out and block packets that contain conflicting source address information. Using cryptographic network protocols such as HTTP Secure (HTTPS) and Secure Shell (SSH) can add another layer of protection to your environment.
One common method of attack is called HTTPS spoofing, in which an attacker uses a domain that looks very similar to that of the target website. With this tactic, also known as “homograph attack”, the characters in the target domain are replaced with other non-ASCII characters that are very similar in appearance.
Finally, detecting IP spoofing is virtually impossible for end-users. They can minimize the risk of other types of spoofing, however, by using secure encryption protocols like HTTPS—and only surfing sites that also use them.
To help prevent IP spoofing, you should use a VPN to hide your IP address. Then, monitor your network for suspicious activity with a firewall, which uses a packet filter that inspects IP packet headers. Only visit secure sites that use HTTPS protocol, and make sure to use strong passwords everywhere possible.
You cannot "spoof" HTTP requests. You send a request to the server, and the server responds appropriately.
I think what you are trying to prevent is cookie spoofing. Considering that cookies are stored on the client-side, there is nothing you can do to prevent users from modifying theirs contents.
Do not store sensitive information in your cookies. They are not secure and easily read and modified by the client.
Use PHP sessions instead. The full explanation on how sessions work and how to keep them secure can be read in one of my previous answers.
Essentially, securing sessions is done on two fronts:
Preventing session fixation
Regenerate a new session_id every X number of requests in order to reduce the amount of time an attacker has to steal the id.
Uniquely identify the client
Use the IP and/or the User-Agent to uniquely identify the client and check that value on every page load against the ones stored in the session. This is really the only two choices you have to uniquely identify the client.
Even with that in place, no solution is fool-proof and once your session_id is compromised, you are pretty much done for.
Again, for an in-depth explanation, please see my previous answer.
131
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
