1

If POST requests are being made to a website via a browser using an HTTP proxy from sslproxies.org, is it possible to trace the origin of those AJAX requests without having access to the proxy being used? Assume the role of the webmaster here, and assume the proxy used is either 'Anonymous or Elite Proxy' as marked on sslproxies.org

As a security project I'm looking at seeing if it's possible for me, the webmaster, to trace POST requests made through an HTTP proxy. By trace I mean identify the original senders IP or specific information about them that I can get from their browser.

  • When you say "trace", do you mean find the original IP address or simply identify if any two POST requests came from the same user/browser? – ilikebeets Feb 3 '15 at 11:56
  • Both, ideally. I mean it's probably obvious if two requests come from the same user if they show up as coming from the proxys IP. But finding the original IP is the main goal. – Edge Feb 3 '15 at 12:09
1

Unfortunately if it is a properly configured transparent proxy, getting the originating IP address is not *possible. The best you can hope for is a badly configured transparent proxy.

You might want to read this post for more info on why.

*If you act ethically. You have to consider two things here: Firstly, the ethical issue of trying to locate a user that obviously wants to remain anonymous. Secondly, the fact that an transparent proxy is designed to do exactly that, protect the identities of the users behind it, and to bypass that would mean that you would need to serve some malicious content (possibly script) to the client that can exploit a vulnerability on the client system to bypass the proxy or identify the user otherwise. This is obviously completely unethical and possibly illegal depending on the presiding laws and thus I suppose not suited for your experiment.

  • This is very interesting, and the legal component interests me greatly. Assuming that legalities weren't a problem, how would a webmaster go about it? Let's say that the anonymous user is using Firefox. Would the webmaster need to exploit a Firefox vulnrability? Furthermore, is there a non malicious javascript that would identify the user? – Edge Feb 3 '15 at 12:49
  • On another note, what if the anonymous user broke the law? Would the webmaster be able to legally coax the access logs from the owner of the proxy used? – Edge Feb 3 '15 at 12:50
  • TildalWave's answer in that link you posted said that if the webmaster put in flash objects, they might be able to find out the anonymous users real IP. Did I read that correctly? – Edge Feb 3 '15 at 12:53
  • I believe that giving detail on how to exploit a system is against the policies of this forum and thus I will not go into detail on that subject. All you need to know is that many systems have a myriad of vulnerable components (Browser/Add-ons/Extensions) running that could be exploited with something as simple as some malicious JavaScript (Flash being among the most exploited). – ilikebeets Feb 3 '15 at 12:56
  • I suppose at the end of the day, all of these methods only work 'in real time', in that they work to identify current and future users, but not past users from before the malicious code is in place. – Edge Feb 3 '15 at 12:58
1

There is currently a vulnerability in the WebRTC implementation of both Firefox on Windows and Chrome on Windows which reveals the original IP address of a client behind a proxy server or VPN.

In order to exploit this vulnerability, the client must download a javascript from the server of the attacker and execute it.

Keep in mind that this is a malicious exploit which might get the website flagged by security software and search engines as serving malware.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.