lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon Apr 24 09:51:15 2006
Subject: Detecting anomaly in client software behaviour (Re[2]:
	Proxy Detection)

Dear Georgi Guninski,

There  are multiple ways to detect proxy without x-forwarded-for header.
Just few:

Application level:

1. Changed  HTTP  protocol.  Some browsers, including IE, use HTTP 1.1
with direct connection and HTTP 1.0 for proxy.
2. Changed  request  headers  in  browser (example is Accept: header in
Internet Explorer, which is different if proxy is used).
3. Proxy-specific   headers   modification.  E.g.  squid can easily be
detected regardless of X-Forwarded-For:
4. Changed  "border  values".  For  example,  'proximitron'  in  fully
transparent  mode  can  be  detected  by  limited  maximal length of GET

Transport level:
1. Changed TCP 'PUSH' flag sequences because of different buffer layout
2. Changed  client port. By default Windows use limited range of ports for dynamic
assignment.  Client  port  with  high number in combination with Windows
browser indicates NAT or proxy.

Network level:
1. Passive  fingerprinting  techniques  (e.g. different default TTL for
Windows  and  Linux). If Windows browser request comes from Linux box it
indicates proxy (and only proxy, as NAT doesn't change TTL).

--Monday, April 24, 2006, 12:03:37 PM, you wrote to

GG> On Sun, Apr 23, 2006 at 01:48:45AM -0700, Andrew A wrote:
>> Tor does not give an x-forward-for.

GG> some isps make transparent proxying mainly via squid.
GG> probably an exit node in such an isp may give proxy headers.


Powered by blists - more mailing lists