2

Many websites require JavaScript. However, enabling JS means that a website can run a JS snippet to retrieve the user's IP address (even if they are behind a proxy or VPN).

So, how can I (the user) feed (spoof) the VPN IP address (which I have in a text file) to any JS that might run so that it all looks the same to the web server?

Edit / Addition: after doing a little research, i came across this site http://mybrowserinfo.com/detail.asp?bhcp=1 that displays a bunch of info that my browser is sending to the web server (Browser version, local time, screen and browser dimension, connection speed, ect..). This combo of info allows a malicious authority (say, the Chinese govt) to "fingerprint" the user, even if they do not have the IP address (because the user is behind a VPN and WebRTC has been disabled). How do i disable or "clean" this information, such that the web server can't identify the user? Is this all from WebRCT?

I suspect some of this info is coming from the UserAgent string, which i suppose the user could manually change, but what about the rest? Some must be coming from javascript, no?

Improve this question
4

So, how can I (the user) feed (spoof) the VPN IP address (which I have in a text file) to any JS that might run so that it all looks the same to the web server?

The detection of local IP addresses you refer to depends on WebRTC. There is no way to spoof the addresses returned during the WebRTC discovery without changing either the browser code or configuration or the script which is used for discovery. You could

  • switch off WebRTC completely, either by using a browser which does not support it (like Tor browser bundle) or by disabling it using various methods
  • try to make a script which somehow interferes with the discovery in the Javascript code and report something different. But this script needs to be probably adapted to various sites.

Simply disabling WebRTC is probably much easier than trying to report different values to the server.

Improve this answer
2

However, enabling javascript now means that a website can run a snippet of javascript code to retrieve the user's ip address (even if they are behind a proxy or VPN).

Firstly, I think it's nearly impossible to retrieve any actual useful information about IP addresses through javascript. I think it's possible via some WebRTC hackery to get the local network address, but if javascript actually makes it to any service that would tell it your IP, it would already have exited through the VPN.

Check this question for more info: https://stackoverflow.com/questions/391979/get-client-ip-using-just-javascript

Improve this answer
1

I don't see a risk for most of the cases. The JavaScript will return the address of the machine, which is useless if it is communicating behind something like proxy, router, Wifi AP or NAT.

Improve this answer
0
-2

If one is to truly spoof then the data sent must be changed every time it is queried. Sort of like obtaining a new IP at every log in only the machine ID and all other ID must change for every web page load etc. All records within your machine/browsers must change as well or be deleted

The idea is that as long as ANY returned information is the same then a profile can be assembled. Knowing the machine ID means that one can assemble the profile from that alone.

I have no idea how to do this and am unsure that it can be done. How about it?

Improve this answer
1
  • The question is "how". And you state that you don't know how to do it... – schroeder♦ Oct 11 '20 at 15:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.