spoof-tunnel

Did you read the things you're linking? > https://owasp.org/www-community/pages/attacks/ip_spoofing_vi... Isn't an actual technique, it's describing the observed result if the server were to blindly trust some HTTP headers which is just the application payload in a TCP stream. It's not spoofing the IP at any network layer. > https://github.com/ParsaKSH/spoof-tunnel Requires mutually agreed spoofing on both sides... at which point it's not really spoofing and also clearly not applicable because Wikipedia will not agree to it. (It is useful in the context that they're using it, just not at all what you're talking about) Without controling a router that's on the path or being able to publish a route that contains the IP address you're trying to spoof, there is no way to spoof an IP address in bidirectional communication.

its a dated article, but the concept of IP spoof works, and has been modified to fit the state of tech, its more than just forging the return address in an IP header. https://owasp.org/www-community/pages/attacks/ip_spoofing_vi... https://github.com/ParsaKSH/spoof-tunnel