Programers: how do I distinguish a trasparent proxy hit from a... - GoFuckYourself.com

Zester · 03-19-2005, 02:05 PM

anonymous proxy hit ?

azguy · 03-19-2005, 02:06 PM

If you use the function I gave you yesterday it would always bypass transparent ones. Transparent proxies have those extra proxy headers, HTTP_VIA and the others.

swedguy · 03-19-2005, 02:08 PM

Yep, a transparent has proxy headers attached.

Zester · 03-19-2005, 02:30 PM

Quote:

Originally Posted by azguy

If you use the function I gave you yesterday it would always bypass transparent ones. Transparent proxies have those extra proxy headers, HTTP_VIA and the others.

can you hit me up plase?

azguy · 03-19-2005, 02:33 PM

Quote:

Originally Posted by Zester

can you hit me up plase?

I'm going to have lunch in a minute. I'll be online in 2 hours or so

Zester · 03-19-2005, 03:04 PM

but anonymous proxies has those headers too, only they hide the user's ip address:

Transparent Proxies
They do not hide information about your IP address:

REMOTE_ADDR = proxy IP
HTTP_VIA = proxy IP
HTTP_X_FORWARDED_FOR = your IP

The function of such proxy servers is not the improvement of your anonymity in Internet. Their purpose is information cashing, organization of joint access to Internet of several computers, etc.

Anonymous Proxies
All proxy servers, that hide a client?s IP address in any way are called anonymous proxies

Simple Anonymous Proxies

These proxy servers do not hide a fact that a proxy is used, however they replace your IP with its own:
REMOTE_ADDR = proxy IP
HTTP_VIA = proxy IP
HTTP_X_FORWARDED_FOR = proxy IP

These proxies are the most widespread among other anonymous proxy servers.

Distorting Proxies

As well as simple anonymous proxy servers these proxies do not hide the fact that a proxy server is used. However a client?s IP address (your IP address) is replaced with another (arbitrary, random) IP:

REMOTE_ADDR = proxy IP
HTTP_VIA = proxy IP
HTTP_X_FORWARDED_FOR = random IP address

High Anonymity Proxies
These proxy servers are also called "high anonymity proxy". In contrast to other types of anonymity proxy servers they hide a fact of using a proxy:

REMOTE_ADDR = proxy IP
HTTP_VIA = not determined
HTTP_X_FORWARDED_FOR = not determined

I need to be able to distinguish between 3 cases:
1 - Transparent proxy hit ( - with this kind of hit I do nothing )
2 - Anonymity proxy hit ( - this kind of hit I want to block )
3 - High anonymity proxies or No proxy hit ( - no way to tell - let it go )

swedguy · 03-19-2005, 03:28 PM

There is actually a way to tell High anonymity proxies too. I made a script back when I used to run TGP's that worked pretty well. It wasn't 100%, but it caught a majority of them.

Zester · 03-19-2005, 11:34 PM

Quote:

Originally Posted by swedguy

There is actually a way to tell High anonymity proxies too. I made a script back when I used to run TGP's that worked pretty well. It wasn't 100%, but it caught a majority of them.

what did you use in order to distinguish a trasparent proxy hit from an anonymous proxy hit?
or distinguish a non proxy hit, from a anonymous or high anonymous hit?

rowan · 03-20-2005, 01:47 AM

If this is for trading then you'll probably have to do more sophisticated long term analysis. Even if you can detect "anonymous" proxies (and many will NOT have any headers to suggest they're a proxy) there is no easy way to detect a load coming from a compromised Winbox. It's not a simple task, it cannot be done in real time with only the IP and headers of the request as parameters.

Zester · 03-20-2005, 04:18 AM

Quote:

Originally Posted by rowan

If this is for trading then you'll probably have to do more sophisticated long term analysis. Even if you can detect "anonymous" proxies (and many will NOT have any headers to suggest they're a proxy) there is no easy way to detect a load coming from a compromised Winbox. It's not a simple task, it cannot be done in real time with only the IP and headers of the request as parameters.

thanks but I don't need anything sophisticated at this point.

I really only need to be able to distinguish between 3 cases:
1 - Transparent proxy hit
2 - Anonymity proxy hit
3 - Everything else

Radiate · 03-20-2005, 07:22 AM

Quote:

Originally Posted by swedguy

There is actually a way to tell High anonymity proxies too. I made a script back when I used to run TGP's that worked pretty well. It wasn't 100%, but it caught a majority of them.

how did you do this?

Zester · 03-21-2005, 05:47 AM

---->bump

swedguy · 03-21-2005, 09:55 AM

What's the difference between a proxy and any random IP?

pimplink · 06-24-2005, 10:18 AM

Quote:

Originally Posted by Radiate

how did you do this?

very good question

pimplink · 06-24-2005, 11:14 AM

Quote:

Originally Posted by Radiate

how did you do this?

BUMP 12345678

swedguy · 06-25-2005, 10:22 AM

What's the difference between a regular proxy and any random IP?

03-19-2005, 02:05 PM	#1
Zester Confirmed User Industry Role: Join Date: Jul 2003 Posts: 5,344	Programers: how do I distinguish a trasparent proxy hit from a... anonymous proxy hit ? __________________ * Mainstream ? $65 per sale * new male contraception

03-19-2005, 02:06 PM	#2
azguy Confirmed User Join Date: Nov 2004 Location: Scottsdale, AZ Posts: 5,167	If you use the function I gave you yesterday it would always bypass transparent ones. Transparent proxies have those extra proxy headers, HTTP_VIA and the others. Last edited by azguy; 03-19-2005 at 02:09 PM..

03-19-2005, 03:04 PM	#6
Zester Confirmed User Industry Role: Join Date: Jul 2003 Posts: 5,344	but anonymous proxies has those headers too, only they hide the user's ip address: Transparent Proxies They do not hide information about your IP address: REMOTE_ADDR = proxy IP HTTP_VIA = proxy IP HTTP_X_FORWARDED_FOR = your IP The function of such proxy servers is not the improvement of your anonymity in Internet. Their purpose is information cashing, organization of joint access to Internet of several computers, etc. Anonymous Proxies All proxy servers, that hide a client?s IP address in any way are called anonymous proxies Simple Anonymous Proxies These proxy servers do not hide a fact that a proxy is used, however they replace your IP with its own: REMOTE_ADDR = proxy IP HTTP_VIA = proxy IP HTTP_X_FORWARDED_FOR = proxy IP These proxies are the most widespread among other anonymous proxy servers. Distorting Proxies As well as simple anonymous proxy servers these proxies do not hide the fact that a proxy server is used. However a client?s IP address (your IP address) is replaced with another (arbitrary, random) IP: REMOTE_ADDR = proxy IP HTTP_VIA = proxy IP HTTP_X_FORWARDED_FOR = random IP address High Anonymity Proxies These proxy servers are also called "high anonymity proxy". In contrast to other types of anonymity proxy servers they hide a fact of using a proxy: REMOTE_ADDR = proxy IP HTTP_VIA = not determined HTTP_X_FORWARDED_FOR = not determined I need to be able to distinguish between 3 cases: 1 - Transparent proxy hit ( - with this kind of hit I do nothing ) 2 - Anonymity proxy hit ( - this kind of hit I want to block ) 3 - High anonymity proxies or No proxy hit ( - no way to tell - let it go ) __________________ * Mainstream ? $65 per sale * new male contraception

03-21-2005, 05:47 AM	#12
Zester Confirmed User Industry Role: Join Date: Jul 2003 Posts: 5,344	---->bump __________________ * Mainstream ? $65 per sale * new male contraception

03-19-2005, 02:08 PM	#3
swedguy Confirmed User Industry Role: Join Date: Jan 2002 Posts: 7,981	Yep, a transparent has proxy headers attached.

03-19-2005, 03:28 PM	#7
swedguy Confirmed User Industry Role: Join Date: Jan 2002 Posts: 7,981	There is actually a way to tell High anonymity proxies too. I made a script back when I used to run TGP's that worked pretty well. It wasn't 100%, but it caught a majority of them.

03-20-2005, 01:47 AM	#9
rowan Too lazy to set a custom title Join Date: Mar 2002 Location: Australia Posts: 17,393	If this is for trading then you'll probably have to do more sophisticated long term analysis. Even if you can detect "anonymous" proxies (and many will NOT have any headers to suggest they're a proxy) there is no easy way to detect a load coming from a compromised Winbox. It's not a simple task, it cannot be done in real time with only the IP and headers of the request as parameters.

03-21-2005, 09:55 AM	#13
swedguy Confirmed User Industry Role: Join Date: Jan 2002 Posts: 7,981	What's the difference between a proxy and any random IP?

06-25-2005, 10:22 AM	#16
swedguy Confirmed User Industry Role: Join Date: Jan 2002 Posts: 7,981	What's the difference between a regular proxy and any random IP?