1

My questions refer detecting fake User-Agent, in sense of spoofing user OS, web-browser and other info sent in headers from users browsing resources on my server.

Is there a way to detect if user is using some tools to fake his fingerprint, e.g. by setting a fake User-Agent? Is it possible to detect if a user changes it's headers by browser developer tools or some other more sophisticated anonymization software?

4
  • For the second part, you can with a technique called 'browser finger printing" but it is not fool-proof.
    – schroeder
    Feb 6, 2017 at 22:33
  • 1
    Why do you want to detect spoofed UAs?
    – Arminius
    Feb 6, 2017 at 22:35
  • @schroeder Sorry for off-topic, thought if I would know the tools and best practices for user tracking I would get to know if detecting fakes is possible. Can you say something more on "browser finger printing"? You mean some tools or speaking in general?
    – deevee
    Feb 6, 2017 at 22:47
  • @Arminius For some survey purposes (IP is not enough in my case), I would like to collect data on uniqe visitors and detect if people are trying to multiple their visits and requests to my resources
    – deevee
    Feb 6, 2017 at 22:52

2 Answers 2

0

User Agent is always sent to you by the client, and you have no control over what the client sends to you. However, the bot/crawler/scraper (whatever the script is) that queries your website content, may be written such that they only spoof User-Agent for your website. Let them load a picture from an external domain which you control, and you might gather their real User Agent information there. This all depends on how the script that accesses your website is written, in some cases it will work.

1
  • That sounds like a good idea to give it a try, thanks!
    – deevee
    Feb 7, 2017 at 9:27
0

This may not be possible directly from Apache however analysis of the network HTTP packets themselves may reveal details such as TTL and TCP Window Sizes that would indicate that they don't match up with the platform/browser. I am sure some Intrusion Protection Systems (IPS) offer this capability out of the box.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.