Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am using a program that I coded in C#. All it does is use HttpWebRequest to request some pages and read info from them.
I tried running it through Tor. I installed the Vidalia Bundle and Widecap.
My program is definitely run through Tor because I checked my IP from within the program.
But I get this warning in the vidalia message log:

Aug 22 10:40:42.290 [Warning] Your application (using socks5 to port 80) is giving Tor only an IP address. Applications that do DNS resolves themselves may leak information. Consider using Socks4A (e.g. via privoxy or socat) instead. For more information, please see https://wiki.torproject.org/TheOnionRouter/TorFAQ#SOCKSAndDNS.

I tried a lot of methods to stop getting this warning but I am still getting it.
I tried using Privoxy but when I start it nothing is written in the console it just doesn't seem to work.
The bundle installs Polipo by default. I tried running it and the following message appears:

DNS: couldn't open /etc/resolv.conf: No such file or directory Disabling disk cache: No such file or directory Disabling local tree: No such file or directory Established listening socket on port 8123.

If I try to connect on 8123 there doesn't seem to be anything listening there.
I checked the Tor FAQ. For windows there seem to be just TorDNS wich doesn't seem to exist.
And a virtual machine and I don't think that will help in my case.
I also tried using proxyfirewall instead of widecap but it spits out an error on startup and nothing else happens anyway.

Any ideas? Thank you.

share|improve this question
add comment

1 Answer

up vote 5 down vote accepted

I'm assuming you're using a domain name as a target in your application, e.g. google.com instead of 173.194.34.69. The DNS query is being done without the proxy.

The implementation of HttpWebRequest calls Dns.GetHostEntry, which uses the Winsock API (WSA) to perform a DNS query, outside of the proxy you specified. Unfortunately, this leaks the IP of the server you're trying to connect to. Once it has the IP address, it opens up a TCP connection to your SOCKS proxy, and tunnels through to the target.

The Tor Browser gets round this by getting the proxy to perform the DNS queries, by simply specifying a hostname instead of an IP address when sending the connect command. This is a supported feature of SOCKS4a. There's more info on it at the Tor FAQ. You'll need to write your own proxy client implementation in C# to utilise this, since the .NET framework doesn't currently provide a way to do it.

A workaround would be to replace the URL with an IP address. You'll still get the same warning, since Privoxy is just warning you that you're connecting to an IP address it hasn't seen a DNS query for, but you won't actually be doing the DNS query at all.

share|improve this answer
    
Thank you but I cannot use an ip directly in the application as in many cases this doesn't work. Meaning I have the site www.something.com if I resolve it online it gives me the ip 123.123.123.123 but if I pus 123.123.123.123 in my browser instead of www.something.com then it says "Access Denied". I am more of a programmer than a network guy. Any other ideas? –  Para Aug 22 '12 at 9:23
    
Unfortunately, the .NET framework doesn't support it. You're going to have to manually write the SOCKS client and HTTP protocol implementations yourself. I can't really help you on that here, since it's off-topic, but feel free to open up a question on StackOverflow. –  Polynomial Aug 22 '12 at 9:36
    
Hi, thank you very much for your answer. I installed Privoxy and did this TestGet.Proxy = new WebProxy("127.0.0.1:8118"); and now it works. Or at least the warning is gone. But suppose this were not my application and not an open source one. How could I solve the problem then? Thank you. –  Para Aug 22 '12 at 9:39
1  
@Para "But suppose this were not my application and not an open source one. How could I solve the problem then?" How exactly does this close-source application perform DNS lookups? –  curiousguy Aug 22 '12 at 9:58
1  
Just filter for DNS queries and look for one that's asking for the IP of the domain. Keep in mind that the OS won't always send the packet if you've already looked up the IP address before. The functionality of Wireshark is outside the scope of this question. We're going off topic. Perhaps you aught to do a little research and open a new question if you have further problems. –  Polynomial Aug 22 '12 at 10:06
show 8 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.