Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite
1

Is there any best practice method (and preferably documented) way of revealing the True IP of a user using a HTTP(S) connection?

I.e.: To be able to uncover the true IP from transparent as well as anonymous proxies wherever possible.

share|improve this question
What do you mean by "the true IP"? I run a proxy in my home so if you use the earliest address in the X-Forwarded-For header, my IP address will be in the 192.168.0.0/24 range. Is that not my "true" IP address? – Ladadadada Mar 27 '12 at 8:23

2 Answers

up vote 8 down vote accepted

If the connection uses proxies which are correctly implemented, discovering the ip through http or tcp can be difficult. You may have some luck in getting closer to the ip using DNS instead. for If you generate the page dynamically to contain an image located at a domain that you control, e.g. 

<img src="http://123123.deanonymize.mydomain.com"/>

the browser will perform a lookup on 123123.deanonymize.mydomain.com. This will result in a recursive DNS-query that eventually will reach your dns for mydomain.com. The query will originate from whatever dns the victim is using, typically the ISP. So, while it will not give you the exact IP, it may point you in a general direction.

AFAIK, this method works even if the victim uses TOR in vanilla mode, see https://trac.torproject.org/projects/tor/wiki/doc/PreventingDnsLeaksInTor for more information.

Another way may be to use a java-applet to figure out the IP at the client side, but I'm not up-to-date on what limits are in place for that nowadays.

share|improve this answer
+1 for DNS deanonymizing. I remember with use of privoxy, DNS requests can be sent within the tor network. – Dog eat cat world Mar 28 '12 at 6:47
up vote 1 down vote

Hiding the IP is the point of anonymous proxies. Thus, if that machine is doing its job, it should not give it away. Although you could try running some javascript on the client side (I am not sure if this will work in your case.).

For transparent proxies, there is some information in this question. It boils down to using the X-Forwarded-For header.

share|improve this answer
note that those javascript methods (at least those on the link) essentially use the same method of IP detection. i.e. they make a call to an external server, which returns the IP address the request came from. So if using anonymity proxy would typically also return the proxy IP address. – Yoav Aner Mar 27 '12 at 8:13
@YoavAner you are right. There just is a small chance that this will bypass the proxy depending on the setup of the system (e.g. a proxy website, instead of a proxy set up in the browser). Thus, the real answer is, indeed: probably not. – Legolas Mar 27 '12 at 8:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.