Virtual Lab Setup for Source IP Spoofing (DoS Testing)
This guide outlines how to set up a safe and isolated virtual lab to test source IP spoofing
using Scapy and hping3.
1. Tools Required
- VirtualBox or VMware Workstation
- Linux ISO (e.g., Ubuntu/Kali/Debian)
- Scapy and hping3 installed on Attacker VM
- Wireshark installed on Target VM
2. Network Configuration
Use Host-Only or Internal Network to isolate the lab:
• In VirtualBox > Settings > Network > Adapter 1: Attach to Internal Network
• Set same network name (e.g., labnet) for all VMs
3. Setup Two VMs
• VM 1: Attacker - Kali/Ubuntu with Scapy and hping3
• VM 2: Target - Ubuntu with Wireshark and netcat
4. Install Required Tools
On Attacker VM:
sudo apt update
sudo apt install hping3 python3-pip
pip3 install scapy
On Target VM:
sudo apt update
sudo apt install wireshark net-tools netcat
5. Start Wireshark on Target
Open Wireshark and apply filter: ip.src == 1.2.3.4
6. Run a Listener on Target
Use netcat to simulate a listening server:
sudo nc -l -p 80
7. Send Spoofed Packets from Attacker
With Scapy (Python):
from scapy.all import IP, TCP, send
ip = IP(src="1.2.3.4", dst="192.168.56.101")
tcp = TCP(sport=1234, dport=80, flags="S")
pkt = ip / tcp
send(pkt)
With hping3 (Command Line):
sudo hping3 -S -a 1.2.3.4 -p 80 192.168.56.101
8. Prevent OS Interference (Optional)
Block outgoing RST packets:
sudo iptables -A OUTPUT -p tcp --tcp-flags RST RST -j DROP
9. Observe in Wireshark
Look for spoofed packets with source IP like 1.2.3.4.
10. Clean Up
Remove iptables rule:
sudo iptables -D OUTPUT -p tcp --tcp-flags RST RST -j DROP