3

I want to know if it's possible to reveal the real IP address of a user with JS:ScriptIP-inf [trj] or by other means, who is browsing a webpage which doesn't contain any Java Applet and the user uses Elite Proxy and VPN.

  • 1
    What do you call the real IP? 127.0.0.1 if the browser uses a local proxy? 192.168.1.x is the computer is connected do an ISP router? – Serge Ballesta Mar 28 '17 at 15:13
  • By real IP I mean the IP that can show your physical location. – student Mar 28 '17 at 15:18
  • 1
    Give a precise definition of it. When at work, my machine has an IP address in the 172.16.0.0 - 172.31.255.255 private range. It can be connected to Internet through 2 corporate proxies one at 200 km from my actual location, the second at 500 km. I do not know what is the IP that you want to hide. – Serge Ballesta Mar 28 '17 at 15:30
  • The IP I get from my Internet Provider. – student Mar 28 '17 at 16:09
  • 1
    The FBI uses web pages that do drive-by installs of a program that gets installed on your computer and sends that information back to the mothership. That's how they busted all those kiddie porn people even though they were using Tor. – SDsolar Mar 29 '17 at 5:26
3

The whole point of a VPN is to ensure that you can't do this. For most cases, you should just consider this to be impossible, and look at other ways to force the user's hand like:

  1. Blacklist all well known edit nodes and VPN server exit IPs. Then tell the user to turn off their protection to use your site - imgur does this.

  2. If it's because of a legal issue, you may want to get your lawyer to contact the provider and ask for the user's IP. This is a remedial measure, and you may not always get lucky - especially if the provider is in another jurisdiction.

If you have other information like the user's screen resolution, device, make, browser etc . - you can use them along with the other two options to narrow down your list of possible users.

1

You could see if abusing WebRTC might help.

Google's vulnerability report in chrome gives a few pointers on this.

You can also test your own browsers, by visiting PrivacyTools - which may also yield some useful code.

That, however, covers technical means only - I would definitely keep @thel3l's words in mind in the real world.

0

This is sometimes possible, but not through the method you are trying. When it comes to VPN's there is little that you can do to control it, but there are a few ways to detect VPN use, and one well known way to get an original DNS IP.

To answer your question first, the closest way you could get the VPN user's original IP address is in the event of a DNS leak.

Unfortunately, sometimes your browser will just ignore that you have a VPN set up and will send the DNS request straight to your ISP. That’s called a DNS leak. This can lead to you think that you’ve stayed anonymous and that you’re safe from online surveillance, but you won’t be protected. -MakeUseOf

However, to be able to detect this information, you are going to need to host your website using your own DNS server. Not the ones provided by your hosting company or registrar. From there you would need to monitor queries of the server. However, this will not get the user's actual IP, but rather the IP address of the DNS server that they are using. Assuming that the website visitor is just the everyday average Joe who doesn't specify their DNS server, this collected IP will be that of their ISP's DNS server. This concept is shown here.

There are a couple schools of thought for detecting the use of a proxy on a website.

1) Easiest Method: You can find caches of known VPN IP addresses on the internet if you do some research. Simply compare IPs to see if the user is using a VPN. However this list would need to be continually updated, as that information changes.

2) You could compare the latency of a packet being sent to the web server versus pinging the displayed IP address (which would be the proxy server). Since the client needs to encrypt (and most likely fragment) the packet before sending it off the the VPN server where its pieced together and decrypted before being forwarded to the web server, packets should be taking longer to get to the web server than to ping back. This option won't be very useful for openVPN (explained below).

3) OpenVPN doesn't like to fragment packets upon encryption, so instead it will actually remove parts of the packet to make room for the encryption. This method makes openVPN faster since there is less time spent messing with packet fragmentation. However, when the decrypted packet reaches it's destination, the packet will be noticeable modified (if you inspect the packet).

All in all, getting an original IP will not be something you can feasibly do unless you have a backdoor with the VPN company or get a court order for the VPN provider to provide logs. However, since you probably aren't a government agency, those aren't options.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.