thekingofduck/burpfakeipBurp Suite extension for spoofing IP addresses in HTTP requests, enabling testing of server-side IP restrictions and bypassing IP-based access controls.
Download and use: Releases
2021/09/24
2021/05/21
Refactored in Java, added the feature mentioned in issue, added the ability to automatically add an XFF header and a random IP to every request. For details, see the right-click menu AutoXFF. By default, the automatically added xff header is X-Forwarded-For, and its value is a generated random IP. Both can be customized.
2020/04/25
Optimized the code and added 9 new request headers.
Four small features
In the Repeater module, right-click and select the fakeIp menu, then click the inputIP feature, and then enter the specified IP:
The program will automatically add all forgeable fields to the request headers.
In the Repeater module, right-click and select the fakeIp menu, then click the 127.0.0.1 feature:
In the Repeater module, right-click and select the fakeIp menu, then click the randomIP feature:
Forging random IPs for brute force is the core feature of this plugin.
Send the packet to the Intruder module, switch Attack type to Pitchfork mode in Positions, select a valid forgeable field, and the field to be brute-forced:
Following the order of the arrows, set the Payload source to Extensin-generated, set the payload to fakeIpPayloads, and then set the second variable.
Click Start attack to begin the brute force.
As shown in the figure above, each brute-force attempt uses a different fake IP to avoid being banned.
PS: The prerequisite for forging random IPs for brute force is that a forged IP can bypass server restrictions.
