How to expose a client's real IP address?

Question

As a forum administrator, how can I find a client's real IP address? Are there any third party tools or weakness that expose the real IP address?

Answer 1

If you run the forum software, then you implicitly know the IP of anyone who connects. Whether the forum software stores that information for you to see depends on the software, but it's always possible.

This isn't a weakness or vulnerability of the software, rather it's a necessary component of how the Internet works.

^{Note that questions on how to configure your specific forum to show you this information are not on-topic for this site.}

Answer 2

I've seen your question posed as an attack on Tor users in the past but I can't find the resource. Here goes:

1. Let the user connect through a proxy
2. Have an Ajax script or a Flash applet call home
3. You have the real IP address.

This only works when the user hasn't taken countermeasures (disable Flash, JS), but you know when they do because you don't see a "call home" connection. And just to tie it with the Tor angle, if you use the modified browser that comes with Vidalia, these plugins are disabled by default.

Answer 3

Given the pervasiveness of NAT, users have many different IP addresses between their computers and your website. But of course, what you mean by "real IP address" are their public Internet gateway addresses.

There are many ways for users to conceal their public Internet gateway addresses. There are HTTP(S) proxies, SOCKS proxies, SSH tunnels, VPN services, Tor, and various combinations thereof. HTTP(S) proxies tend to leak. SOCKS proxies are more secure. Properly configured, SSH tunnels, VPN services and Tor don't leak, and aren't vulnerable to direct external attack.

However, they're all vulnerable to attacks that either break the computer's networking setup, or leave behind malware that "phones home" when users let their guard down. But it's generally considered in poor taste (and typically illegal) to compromise other peoples computers. Unless you're the NSA, of course ;)

There are two steps that users can take to defeat such attacks. First, they can isolate networking and apps in separate compartments. Whonix and Qubes are notable examples, using VMs. Hardware isolation is even better.

Second, users can compartmentalize their activity using multiple machines and VMs. For high-risk activity, they can use LiveCDs on diskless machines.

Bottom line, you can catch the naive ones, but not many of the ones you worry most about ;)