Bungee-spoofing attack - Revision history

107.115.17.107: Switch to level 2 and 3 header (== and ===)

2026-08-12T05:49:44Z

Switch to level 2 and 3 header (== and ===)

← Older revision		Revision as of 05:49, 12 August 2026
Line 2:		Line 2:
	'''Bungee spoofing''' is an attack against unfirewalled [https://www.spigotmc.org/wiki/about-bungeecord/ Bungeecord] in which a player sends falsified player [https://github.com/SpigotMC/BungeeCord/blob/2e729325be2a4486adc0819cc03779e896ca0108/proxy/src/main/java/net/md_5/bungee/ServerConnector.java#L116 forwarding data] (sent as part of the host field in the [https://minecraft.wiki/w/Java_Edition_protocol/Packets#Handshake Handshake packet]) to the backend server. Common targets for falsification are server owners, staff members and others with special permissions.		'''Bungee spoofing''' is an attack against unfirewalled [https://www.spigotmc.org/wiki/about-bungeecord/ Bungeecord] in which a player sends falsified player [https://github.com/SpigotMC/BungeeCord/blob/2e729325be2a4486adc0819cc03779e896ca0108/proxy/src/main/java/net/md_5/bungee/ServerConnector.java#L116 forwarding data] (sent as part of the host field in the [https://minecraft.wiki/w/Java_Edition_protocol/Packets#Handshake Handshake packet]) to the backend server. Common targets for falsification are server owners, staff members and others with special permissions.

	=Solutions=		==Solutions==

	While the following sections discuss possible issues with the following solutions, please note that these are entirely theoretical and have not been tested, and to the author's knowledge, have not been exploited in the wild. All of these theoretical attacks require [[Wikipedia:Sniffing_attack\|sniffing attacks]], and as such they are not practical in the majority of cases.		While the following sections discuss possible issues with the following solutions, please note that these are entirely theoretical and have not been tested, and to the author's knowledge, have not been exploited in the wild. All of these theoretical attacks require [[Wikipedia:Sniffing_attack\|sniffing attacks]], and as such they are not practical in the majority of cases.
Line 13:		Line 13:
	[[Wikipedia:Virtual_network_interface\|network interface]], or communications are done exclusively [[Wikipedia:Virtual_private_network\|virtual private network]] providing encryption.		[[Wikipedia:Virtual_network_interface\|network interface]], or communications are done exclusively [[Wikipedia:Virtual_private_network\|virtual private network]] providing encryption.

	==Velocity==		===Velocity===

	Another possible solution is to use [https://papermc.io/software/paper/ Velocity]'s modern forwarding, which uses a [[Wikipedia:HMAC\|HMAC]] to verify player data sent in a [https://minecraft.wiki/w/Java_Edition_protocol/Packets#Plugin_Message_(clientbound) Login Plugin Message].		Another possible solution is to use [https://papermc.io/software/paper/ Velocity]'s modern forwarding, which uses a [[Wikipedia:HMAC\|HMAC]] to verify player data sent in a [https://minecraft.wiki/w/Java_Edition_protocol/Packets#Plugin_Message_(clientbound) Login Plugin Message].

Opt: Some further clarification, add technical template

2026-08-05T04:29:09Z

Some further clarification, add technical template

← Older revision		Revision as of 04:29, 5 August 2026
Line 1:		Line 1:
			{{Technical}}
	'''Bungee spoofing''' is an attack against unfirewalled [https://www.spigotmc.org/wiki/about-bungeecord/ Bungeecord] in which a player sends falsified player [https://github.com/SpigotMC/BungeeCord/blob/2e729325be2a4486adc0819cc03779e896ca0108/proxy/src/main/java/net/md_5/bungee/ServerConnector.java#L116 forwarding data] (sent as part of the host field in the [https://minecraft.wiki/w/Java_Edition_protocol/Packets#Handshake Handshake packet]) to the backend server. Common targets for falsification are server owners, staff members and others with special permissions.		'''Bungee spoofing''' is an attack against unfirewalled [https://www.spigotmc.org/wiki/about-bungeecord/ Bungeecord] in which a player sends falsified player [https://github.com/SpigotMC/BungeeCord/blob/2e729325be2a4486adc0819cc03779e896ca0108/proxy/src/main/java/net/md_5/bungee/ServerConnector.java#L116 forwarding data] (sent as part of the host field in the [https://minecraft.wiki/w/Java_Edition_protocol/Packets#Handshake Handshake packet]) to the backend server. Common targets for falsification are server owners, staff members and others with special permissions.

	=Solutions=		=Solutions=

			While the following sections discuss possible issues with the following solutions, please note that these are entirely theoretical and have not been tested, and to the author's knowledge, have not been exploited in the wild. All of these theoretical attacks require [[Wikipedia:Sniffing_attack\|sniffing attacks]], and as such they are not practical in the majority of cases.

	[https://github.com/lucko/BungeeGuard BungeeGuard] is a BungeeCord, [https://spigotmc.org/ Spigot] and [https://spongepowered.org/ Sponge] plugin developed by [https://github.com/lucko/ lucko] which attempts to solve this problem by adding a secret token to the end of the player forwarding data.		[https://github.com/lucko/BungeeGuard BungeeGuard] is a BungeeCord, [https://spigotmc.org/ Spigot] and [https://spongepowered.org/ Sponge] plugin developed by [https://github.com/lucko/ lucko] which attempts to solve this problem by adding a secret token to the end of the player forwarding data.

	This works for most setups, but if the backend and frontend (the proxy) servers communicate over the [[Wikipedia:Internet\|Internet]], it can be intercepted with a ~~[[Wikipedia:Sniffing_attack\|~~sniffing attack]] as the Handshake packet is not [[Wikipedia:Encryption\|encrypted]] and the token is sent in plaintext. It may additionally be possible to perform a [[Wikipedia:Timing_attack\|timing-based side-channel attack]], as the function responsible for checking the token may not always execute in constant time.		This works for most setups, but if the backend and frontend (the proxy) servers communicate over the [[Wikipedia:Internet\|Internet]], it can be intercepted with a sniffing attack as the Handshake packet is not [[Wikipedia:Encryption\|encrypted]] and the token is sent in plaintext. It may additionally be possible to perform a [[Wikipedia:Timing_attack\|timing-based side-channel attack]], as the function responsible for checking the token may not always execute in constant time.

	As such, for backend and frontend servers which may only communicate over the Internet, it is recommended that a [[Wikipedia:Firewall_(computing)\|firewall]] is configured for every backend server that listens on a public		As such, for backend and frontend servers which may only communicate over the Internet, it is recommended that a [[Wikipedia:Firewall_(computing)\|firewall]] is configured for every backend server that listens on a public
Line 14:		Line 17:
	Another possible solution is to use [https://papermc.io/software/paper/ Velocity]'s modern forwarding, which uses a [[Wikipedia:HMAC\|HMAC]] to verify player data sent in a [https://minecraft.wiki/w/Java_Edition_protocol/Packets#Plugin_Message_(clientbound) Login Plugin Message].		Another possible solution is to use [https://papermc.io/software/paper/ Velocity]'s modern forwarding, which uses a [[Wikipedia:HMAC\|HMAC]] to verify player data sent in a [https://minecraft.wiki/w/Java_Edition_protocol/Packets#Plugin_Message_(clientbound) Login Plugin Message].

	~~On offline-mode servers communicating across the Internet, it~~ may be vulnerable to a [[Wikipedia:Replay attack\|replay attack]] as the Login Plugin Message packet is ~~only encrypted~~ on ~~online~~ mode servers. As HMACs only serve to verify the authenticity of the attached data, the data they verify is not encrypted in any way and can be inspected by a network attacker.		It may be vulnerable to a [[Wikipedia:Replay attack\|replay attack]] as the Login Plugin Message packet is unencrypted on offline-mode servers, like those behind frontends like Velocity. As HMACs only serve to verify the authenticity of the attached data, the data they verify is not encrypted in any way and can be inspected by a network attacker.

	~~Offline~~ mode ~~servers with encryption enabled are susceptible~~ to ~~having their encryption effectively disabled with a [~~[~~Wikipedia~~:~~Man-in-the~~-~~middle attack\|man~~-in-~~the~~-~~middle~~-~~attack~~]].		Proxies like Velocity and Bungeecord must have backends configured in offline-mode, otherwise they will not be able to implement features like [https://www.spigotmc.org/wiki/bukkit-bungee-plugin-messaging-channel/ backend <-> frontend plugin messages] and [https://minecraft.wiki/w/Commands commands] running on the frontend.

	It is ~~most secure to use~~ a virtual private ~~network~~ or local ~~network~~ to ~~facilitate communication between~~ frontend ~~and backend servers~~, ~~and to configure a firewall rule~~ if you ~~cannot~~ bind ~~backend servers~~ on a ~~private~~ address.		Even though Velocity's modern forwarding is a considerable improvement over both Bungeecord and Bungeeguard, virtual private networks or local networks remain the most secure solution. Additionally, configuring firewall rules to deny packets to your backend server's port from all [[Wikipedia:IP_address\|IP addresses]] that do not belong to your frontend, if you are unable to bind on a local address.

	[[Category:Exploits]]		[[Category:Exploits]]

Opt: Add some more information to the Velocity section

2026-08-04T08:42:18Z

Add some more information to the Velocity section

← Older revision		Revision as of 08:42, 4 August 2026
Line 5:		Line 5:
	[https://github.com/lucko/BungeeGuard BungeeGuard] is a BungeeCord, [https://spigotmc.org/ Spigot] and [https://spongepowered.org/ Sponge] plugin developed by [https://github.com/lucko/ lucko] which attempts to solve this problem by adding a secret token to the end of the player forwarding data.		[https://github.com/lucko/BungeeGuard BungeeGuard] is a BungeeCord, [https://spigotmc.org/ Spigot] and [https://spongepowered.org/ Sponge] plugin developed by [https://github.com/lucko/ lucko] which attempts to solve this problem by adding a secret token to the end of the player forwarding data.

	This works for most setups, but if the backend and frontend (the proxy) servers communicate over the [[Wikipedia:Internet\|Internet]], it can be intercepted ~~via~~ a [[Wikipedia:Sniffing_attack\|sniffing attack]] as the Handshake packet is not [[Wikipedia:Encryption\|encrypted]] and the token is sent in plaintext. It may additionally be possible to perform a [[Wikipedia:Timing_attack\|timing-based side-channel attack]], as the function responsible for checking the token may not always execute in constant time.		This works for most setups, but if the backend and frontend (the proxy) servers communicate over the [[Wikipedia:Internet\|Internet]], it can be intercepted with a [[Wikipedia:Sniffing_attack\|sniffing attack]] as the Handshake packet is not [[Wikipedia:Encryption\|encrypted]] and the token is sent in plaintext. It may additionally be possible to perform a [[Wikipedia:Timing_attack\|timing-based side-channel attack]], as the function responsible for checking the token may not always execute in constant time.

	As such, for backend and frontend servers which may only communicate over the Internet, it is recommended that a [[Wikipedia:Firewall_(computing)\|firewall]] is configured for every backend server that listens on a public		As such, for backend and frontend servers which may only communicate over the Internet, it is recommended that a [[Wikipedia:Firewall_(computing)\|firewall]] is configured for every backend server that listens on a public
	[[Wikipedia:Virtual_network_interface\|network interface]], or communications are done exclusively [[Wikipedia:Virtual_private_network\|virtual private network]] providing encryption.		[[Wikipedia:Virtual_network_interface\|network interface]], or communications are done exclusively [[Wikipedia:Virtual_private_network\|virtual private network]] providing encryption.

	Another possible solution is to use [https://papermc.io/software/paper/ Velocity]'s modern forwarding, ~~but~~ it is most secure to use a virtual private network or local network to facilitate communication between frontend and backend servers.		==Velocity==

			Another possible solution is to use [https://papermc.io/software/paper/ Velocity]'s modern forwarding, which uses a [[Wikipedia:HMAC\|HMAC]] to verify player data sent in a [https://minecraft.wiki/w/Java_Edition_protocol/Packets#Plugin_Message_(clientbound) Login Plugin Message].

			On offline-mode servers communicating across the Internet, it may be vulnerable to a [[Wikipedia:Replay attack\|replay attack]] as the Login Plugin Message packet is only encrypted on online mode servers. As HMACs only serve to verify the authenticity of the attached data, the data they verify is not encrypted in any way and can be inspected by a network attacker.

			Offline mode servers with encryption enabled are susceptible to having their encryption effectively disabled with a [[Wikipedia:Man-in-the-middle attack\|man-in-the-middle-attack]].

			It is most secure to use a virtual private network or local network to facilitate communication between frontend and backend servers, and to configure a firewall rule if you cannot bind backend servers on a private address.

	[[Category:Exploits]]		[[Category:Exploits]]

Opt: Opt moved page Bungee spoofing to Bungee-spoofing attack: Make more consistent with Wikipedia

2026-08-04T08:33:35Z

Opt moved page Bungee spoofing to Bungee-spoofing attack: Make more consistent with Wikipedia

← Older revision	Revision as of 08:33, 4 August 2026
(No difference)

Opt: Add page

2026-08-04T08:32:18Z

Add page

New page

'''Bungee spoofing''' is an attack against unfirewalled [https://www.spigotmc.org/wiki/about-bungeecord/ Bungeecord] in which a player sends falsified player [https://github.com/SpigotMC/BungeeCord/blob/2e729325be2a4486adc0819cc03779e896ca0108/proxy/src/main/java/net/md_5/bungee/ServerConnector.java#L116 forwarding data] (sent as part of the host field in the [https://minecraft.wiki/w/Java_Edition_protocol/Packets#Handshake Handshake packet]) to the backend server. Common targets for falsification are server owners, staff members and others with special permissions.

=Solutions=

[https://github.com/lucko/BungeeGuard BungeeGuard] is a BungeeCord, [https://spigotmc.org/ Spigot] and [https://spongepowered.org/ Sponge] plugin developed by [https://github.com/lucko/ lucko] which attempts to solve this problem by adding a secret token to the end of the player forwarding data.

This works for most setups, but if the backend and frontend (the proxy) servers communicate over the [[Wikipedia:Internet|Internet]], it can be intercepted via a [[Wikipedia:Sniffing_attack|sniffing attack]] as the Handshake packet is not [[Wikipedia:Encryption|encrypted]] and the token is sent in plaintext. It may additionally be possible to perform a [[Wikipedia:Timing_attack|timing-based side-channel attack]], as the function responsible for checking the token may not always execute in constant time.

As such, for backend and frontend servers which may only communicate over the Internet, it is recommended that a [[Wikipedia:Firewall_(computing)|firewall]] is configured for every backend server that listens on a public
[[Wikipedia:Virtual_network_interface|network interface]], or communications are done exclusively [[Wikipedia:Virtual_private_network|virtual private network]] providing encryption.

Another possible solution is to use [https://papermc.io/software/paper/ Velocity]'s modern forwarding, but it is most secure to use a virtual private network or local network to facilitate communication between frontend and backend servers.

[[Category:Exploits]]