[The Real Slim Shady]

So ive decided to get back into some more programming/hacking/web development... havent done much in the last couple years at all.

So for my first small simple project ive got this: ProxyPeeper. Basically it checks to see if the user is connecting to your site via common open proxies. More are also added easily.

I dont really have a use for this script myself. But it was something i havent done before nor have i seen in use... so i thought id see how efficient something like this was.

Pretty basic right now... but i was considering the possibility of adding database support, so instead of checking every single connection, it would put a list of previously checked/approved/denied ips in a database (for regular users) and check that first.

Basically it would make it much more difficult for a banned user to use an open proxy to harass you. Might even just enable it after you encounter a problem user.

PHP Code:

<?php # # ProxyPeeper # Check to see if user is accessing site # through an open proxy # # written by Geoff # freakyg@undergroundsystems.co # Dec. 29 / 2012 # Version 0.01a # function isproxy() { $ip = $_SERVER['REMOTE_ADDR']; $ports = array(80, 1080, 3128, 8080); $success = 0; foreach ($ports as $port) { $attempt = @fsockopen($ip, $port,$errno,$errstr,$timeout=5); if (is_resource($attempt)) { $success = $success + 1; if ($success >= 0) { return 1; fclose($attempt); } else { return 0; fclose($attempt); } } else { return 0; fclose($attempt); } } } ?>

And here would be an example usage

PHP Code:

<?php @include 'isproxy.function.php'; if(isproxy() == 1) { echo "Open Proxy Detected - Banned"; } else { echo "Connection Accepted"; } ?>

Let me know what you think. Got a suggestion to improve efficiency?

[sangpenguasa]

Can you DEMO it. .??

[sangpenguasa]

Can you DEMO it. .??

[sangpenguasa]

Can you DEMO it. .??

[noize]

Can you DEMO it. .??

Please, don't dig up old threads, demonstrate it yourself.

I'll exploit this gravedig to mention that this code makes no sense to me:

Code:

$success = $success + 1; if ($success >= 0) { return 1; fclose($attempt); } else { return 0; fclose($attempt); }

Am I wrong? You initialised $success to 0 earlier, than you add 1 and you check if it's greater or equal to 0. It will sure be.

Code:

$success = $success + 1; fclose($attempt); return 1;

[The Real Slim Shady]

Can you DEMO it. .??

Please, don't dig up old threads, demonstrate it yourself.

I'll exploit this gravedig to mention that this code makes no sense to me:

Code:

$success = $success + 1; if ($success >= 0) { return 1; fclose($attempt); } else { return 0; fclose($attempt); }

Am I wrong? You initialised $success to 0 earlier, than you add 1 and you check if it's greater or equal to 0. It will sure be.

Code:

$success = $success + 1; fclose($attempt); return 1;

You're correct... doesnt make much sense to me either. It does work, but theres a whole lot of unnecessary code lol. I think the following rewrite should work just as fine without all the extra useless stuff...

Code:

<?php # # ProxyPeeper # Check to see if user is accessing site # through an open proxy # # written by Geoff # freakyg@undergroundsystems.co # Dec. 29 / 2012 # Version 0.01a # function isproxy() { $ip = $_SERVER['REMOTE_ADDR']; $ports = array(80, 1080, 3128, 8080); foreach ($ports as $port) { $attempt = @fsockopen($ip, $port,$errno,$errstr,$timeout=5); if (is_resource($attempt)) { fclose($attempt); return 1; } else { return 0; fclose($attempt); } } } ?>

Thanks for the feedback @noize

[noize]

Anytime.

Would you mind explaining me how this should detect a proxy? I mean, you're basically trying to connect to the client on the ports in $ports, aren't you? I can't get how you should find out whether he's using a proxy or not.

[The Real Slim Shady]

Anytime.

Would you mind explaining me how this should detect a proxy? I mean, you're basically trying to connect to the client on the ports in $ports, aren't you? I can't get how you should find out whether he's using a proxy or not.

It will detect if he's using a public proxy. This is because in order for the public to be able to access the proxy, the ports will be open.

The average user, or even advanced users will not have such proxy ports open to the public. It can be safely assumed in most scenarios that if these ports are open, it is a public proxy. there is a higher rate of error if you include port 80, because people do run web servers, but even then its unlikely that many people would be browsing the internet from a web server.

any ways this is more of a proof of concept thing. I dont expect it to be implemented on any wide scale.

[Xcel3rated 360]

nice code . love it .

[noize]

It will detect if he's using a public proxy. This is because in order for the public to be able to access the proxy, the ports will be open.

The average user, or even advanced users will not have such proxy ports open to the public. It can be safely assumed in most scenarios that if these ports are open, it is a public proxy. there is a higher rate of error if you include port 80, because people do run web servers, but even then its unlikely that many people would be browsing the internet from a web server.

any ways this is more of a proof of concept thing. I dont expect it to be implemented on any wide scale.

Oh. Nice idea, but actually, most clients connect to the web through port 80, and so, they have it open.

This is likely to be just a ban hammer if you don't remove 80 from the array.