title: HTTP Response Spoofing by packet injection
body: <p>I am trying to send a fake web page as response using scapy in python. I have this very simple code, which sends a short html page whenever it sees a GET request from the local machine. But somehow it is not working and the actual page always shows up in the browser. </p>
  
  <pre><code>from scapy.all import *
  
  def callback(packt):
  ##    packt.show()
      if Raw in packt[TCP]:
          if packt[TCP][Raw].load.startswith('GET'):
              resp='HTTP/1.1 200 OK\r\nServer: Apache HACKER\r\nContent-Type: text/html\r\n\r\n&lt;html&gt;&lt;head&gt;&lt;title&gt; an example &lt;/title&gt; &lt;/head&gt;&lt;body&gt; Hello World, &lt;/body&gt;&lt;/html&gt;'
              spoof_packt=Ether(dst=packt[Ether].src,src=packt[Ether].dst)/IP(src=packt[IP].dst,dst=packt[IP].src,ttl=44)/TCP(sport=80,dport=packt[TCP].sport,seq=packt[TCP].ack,ack=packt[TCP].seq+len(packt[TCP][Raw]),flags='PA')/resp
              sendp(spoof_packt)
  
  interface="eth0"
  
  sniff(iface=interface,filter="tcp port 80", prn=callback)
  </code></pre>
  
  <p>I have used WireShark to capture the packet trace and I see my packet arrives before the actual response from the web server. Here is a shot of the packet trace from WireShark GUI. <img src="https://i.stack.imgur.com/sRyx0.png" alt="enter image description here"> </p>
  
  <p>The packet highlighted with orange is the spoofed packet being sent by my program which is running locally on the same machine. First Black highlighted packet is actual response from webserver. I verified, the SEQ and ACK numbers are the same in both packets.</p>
  
  <p>Let me know if more information is needed I will update the question.</p>