Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

As a forum administrator, how can I find a client's real IP address? Are there any third party tools or weakness that expose the real IP address?

share|improve this question

3 Answers 3

If you run the forum software, then you implicitly know the IP of anyone who connects. Whether the forum software stores that information for you to see depends on the software, but it's always possible.

This isn't a weakness or vulnerability of the software, rather it's a necessary component of how the Internet works.

Note that questions on how to configure your specific forum to show you this information are not on-topic for this site.

share|improve this answer

I've seen your question posed as an attack on Tor users in the past but I can't find the resource. Here goes:

  1. Let the user connect through a proxy
  2. Have an Ajax script or a Flash applet call home
  3. You have the real IP address.

This only works when the user hasn't taken countermeasures (disable Flash, JS), but you know when they do because you don't see a "call home" connection. And just to tie it with the Tor angle, if you use the modified browser that comes with Vidalia, these plugins are disabled by default.

share|improve this answer
    
In this case, what about someone using something like Whonix (whonix.org/wiki/Main_Page). If they have a separate Tor gateway then even at that point they could run Flash/JS with a possible leak in real ip, no? –  I'm A Person Aug 4 '13 at 13:07
    
An Ajax script wouldn't be able to break out of a normal proxy AFAIK (it'd be proxied just like the regular request). Likewise if all the traffic is tunneled via the proxy, then even Flash wouldn't be able to defeat the proxy (although you might defeat the proxy via tracking- i.e. super cookies). –  Kitsune Aug 4 '13 at 14:38

Given the pervasiveness of NAT, users have many different IP addresses between their computers and your website. But of course, what you mean by "real IP address" are their public Internet gateway addresses.

There are many ways for users to conceal their public Internet gateway addresses. There are HTTP(S) proxies, SOCKS proxies, SSH tunnels, VPN services, Tor, and various combinations thereof. HTTP(S) proxies tend to leak. SOCKS proxies are more secure. Properly configured, SSH tunnels, VPN services and Tor don't leak, and aren't vulnerable to direct external attack.

However, they're all vulnerable to attacks that either break the computer's networking setup, or leave behind malware that "phones home" when users let their guard down. But it's generally considered in poor taste (and typically illegal) to compromise other peoples computers. Unless you're the NSA, of course ;)

There are two steps that users can take to defeat such attacks. First, they can isolate networking and apps in separate compartments. Whonix and Qubes are notable examples, using VMs. Hardware isolation is even better.

Second, users can compartmentalize their activity using multiple machines and VMs. For high-risk activity, they can use LiveCDs on diskless machines.

Bottom line, you can catch the naive ones, but not many of the ones you worry most about ;)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.