1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

You are NOT safe behind proxies and VPN -> WebRTC is now used widely

Discussion in 'Black Hat SEO' started by SEO20, Mar 23, 2016.

  1. SEO20

    SEO20 Elite Member

    Joined:
    Mar 25, 2009
    Messages:
    2,016
    Likes Received:
    2,260
    Hi all

    As some of you know webrtc is now used widely to detect real IP even if you are behind VPN etc.

    "WebRTC is a free, open project that provides browsers and mobile applications with Real-Time Communications (RTC) capabilities via simple APIs. The WebRTC components have been optimized to best serve this purpose."

    "Firefox and Chrome have implemented WebRTC that allow requests to STUN servers be made that will return the local and public IP addresses for the user. These request results are available to javascript, so you can now obtain a users local and public IP addresses in javascript. This demo is an example implementation of that.

    Additionally, these STUN requests are made outside of the normal XMLHttpRequest procedure, so they are not visible in the developer console or able to be blocked by plugins such as AdBlockPlus or Ghostery. This makes these types of requests available for online tracking if an advertiser sets up a STUN server with a wildcard domain."


    Bottom line: watch out if you are doing stuff outside of the box ;-)

    Check this url to see it in action:
    Code:
    https://diafygi.github.io/webrtc-ips/
    
    There are plugins to prevent and turn off WebRTC
     
    • Thanks Thanks x 8
  2. SEO20

    SEO20 Elite Member

    Joined:
    Mar 25, 2009
    Messages:
    2,016
    Likes Received:
    2,260
    And if you want the code how this is done:

    Code:
    [COLOR=#969896]//get the IP addresses associated with an account[/COLOR]
    [COLOR=#A71D5D]function[/COLOR] [COLOR=#795DA3]getIPs[/COLOR](callback){
        [COLOR=#A71D5D]var[/COLOR] ip_dups [COLOR=#A71D5D]=[/COLOR] {};
    
        [COLOR=#969896]//compatibility for firefox and chrome[/COLOR]
        [COLOR=#A71D5D]var[/COLOR] RTCPeerConnection [COLOR=#A71D5D]=[/COLOR] [COLOR=#0086B3]window[/COLOR].RTCPeerConnection
            [COLOR=#A71D5D]||[/COLOR] [COLOR=#0086B3]window[/COLOR].mozRTCPeerConnection
            [COLOR=#A71D5D]||[/COLOR] [COLOR=#0086B3]window[/COLOR].webkitRTCPeerConnection;
        [COLOR=#A71D5D]var[/COLOR] useWebKit [COLOR=#A71D5D]=[/COLOR] [COLOR=#A71D5D]!![/COLOR][COLOR=#0086B3]window[/COLOR].webkitRTCPeerConnection;
    
        [COLOR=#969896]//bypass naive webrtc blocking using an iframe[/COLOR]
        [COLOR=#A71D5D]if[/COLOR]([COLOR=#A71D5D]![/COLOR]RTCPeerConnection){
            [COLOR=#969896]//NOTE: you need to have an iframe in the page right above the script tag[/COLOR]
            [COLOR=#969896]//[/COLOR]
            [COLOR=#969896]//<iframe id="iframe" sandbox="allow-same-origin" style="display: none"></iframe>[/COLOR]
            [COLOR=#969896]//<script>...getIPs called in here...[/COLOR]
            [COLOR=#969896]//[/COLOR]
            [COLOR=#A71D5D]var[/COLOR] win [COLOR=#A71D5D]=[/COLOR] iframe.contentWindow;
            RTCPeerConnection [COLOR=#A71D5D]=[/COLOR] win.RTCPeerConnection
                [COLOR=#A71D5D]||[/COLOR] win.mozRTCPeerConnection
                [COLOR=#A71D5D]||[/COLOR] win.webkitRTCPeerConnection;
            useWebKit [COLOR=#A71D5D]=[/COLOR] [COLOR=#A71D5D]!![/COLOR]win.webkitRTCPeerConnection;
        }
    
        [COLOR=#969896]//minimal requirements for data connection[/COLOR]
        [COLOR=#A71D5D]var[/COLOR] mediaConstraints [COLOR=#A71D5D]=[/COLOR] {
            optional[COLOR=#A71D5D]:[/COLOR] [{RtpDataChannels[COLOR=#A71D5D]:[/COLOR] [COLOR=#0086B3]true[/COLOR]}]
        };
    
        [COLOR=#A71D5D]var[/COLOR] servers [COLOR=#A71D5D]=[/COLOR] {iceServers[COLOR=#A71D5D]:[/COLOR] [{urls[COLOR=#A71D5D]:[/COLOR] [COLOR=#183691]"stun:stun.services.mozilla.com"[/COLOR]}]};
    
        [COLOR=#969896]//construct a new RTCPeerConnection[/COLOR]
        [COLOR=#A71D5D]var[/COLOR] pc [COLOR=#A71D5D]=[/COLOR] [COLOR=#A71D5D]new[/COLOR] [COLOR=#795DA3]RTCPeerConnection[/COLOR](servers, mediaConstraints);
    
        [COLOR=#A71D5D]function[/COLOR] [COLOR=#795DA3]handleCandidate[/COLOR](candidate){
            [COLOR=#969896]//match just the IP address[/COLOR]
            [COLOR=#A71D5D]var[/COLOR] ip_regex [COLOR=#A71D5D]=[/COLOR][COLOR=#183691] /([COLOR=#0086B3][0-9][/COLOR][COLOR=#A71D5D]{1,3}[/COLOR]([COLOR=#63A35C][B]\.[/B][/COLOR][COLOR=#0086B3][0-9][/COLOR][COLOR=#A71D5D]{1,3}[/COLOR])[COLOR=#A71D5D]{3}[/COLOR][COLOR=#A71D5D]|[/COLOR][COLOR=#0086B3][a-f0-9][/COLOR][COLOR=#A71D5D]{1,4}[/COLOR](:[COLOR=#0086B3][a-f0-9][/COLOR][COLOR=#A71D5D]{1,4}[/COLOR])[COLOR=#A71D5D]{7}[/COLOR])/[/COLOR]
            [COLOR=#A71D5D]var[/COLOR] ip_addr [COLOR=#A71D5D]=[/COLOR] ip_regex.[COLOR=#0086B3]exec[/COLOR](candidate)[[COLOR=#0086B3]1[/COLOR]];
    
            [COLOR=#969896]//remove duplicates[/COLOR]
            [COLOR=#A71D5D]if[/COLOR](ip_dups[ip_addr] [COLOR=#A71D5D]===[/COLOR] [COLOR=#0086B3]undefined[/COLOR])
                [COLOR=#795DA3]callback[/COLOR](ip_addr);
    
            ip_dups[ip_addr] [COLOR=#A71D5D]=[/COLOR] [COLOR=#0086B3]true[/COLOR];
        }
    
        [COLOR=#969896]//listen for candidate events[/COLOR]
        pc.[COLOR=#795DA3]onicecandidate[/COLOR] [COLOR=#A71D5D]=[/COLOR] [COLOR=#A71D5D]function[/COLOR](ice){
    
            [COLOR=#969896]//skip non-candidate events[/COLOR]
            [COLOR=#A71D5D]if[/COLOR](ice.candidate)
                [COLOR=#795DA3]handleCandidate[/COLOR](ice.candidate.candidate);
        };
    
        [COLOR=#969896]//create a bogus data channel[/COLOR]
        pc.[COLOR=#795DA3]createDataChannel[/COLOR]([COLOR=#183691]""[/COLOR]);
    
        [COLOR=#969896]//create an offer sdp[/COLOR]
        pc.[COLOR=#795DA3]createOffer[/COLOR]([COLOR=#A71D5D]function[/COLOR](result){
    
            [COLOR=#969896]//trigger the stun server request[/COLOR]
            pc.[COLOR=#795DA3]setLocalDescription[/COLOR](result, [COLOR=#A71D5D]function[/COLOR](){}, [COLOR=#A71D5D]function[/COLOR](){});
    
        }, [COLOR=#A71D5D]function[/COLOR](){});
    
        [COLOR=#969896]//wait for a while to let everything done[/COLOR]
        [COLOR=#0086B3]setTimeout[/COLOR]([COLOR=#A71D5D]function[/COLOR](){
            [COLOR=#969896]//read candidate info from local description[/COLOR]
            [COLOR=#A71D5D]var[/COLOR] lines [COLOR=#A71D5D]=[/COLOR] pc.localDescription.sdp.[COLOR=#0086B3]split[/COLOR]([COLOR=#183691]'\n'[/COLOR]);
    
            lines.[COLOR=#795DA3]forEach[/COLOR]([COLOR=#A71D5D]function[/COLOR](line){
                [COLOR=#A71D5D]if[/COLOR](line.[COLOR=#0086B3]indexOf[/COLOR]([COLOR=#183691]'a=candidate:'[/COLOR]) [COLOR=#A71D5D]===[/COLOR] [COLOR=#0086B3]0[/COLOR])
                    [COLOR=#795DA3]handleCandidate[/COLOR](line);
            });
        }, [COLOR=#0086B3]1000[/COLOR]);
    }
    
    [COLOR=#969896]//Test: Print the IP addresses into the console[/COLOR]
    [COLOR=#795DA3]getIPs[/COLOR]([COLOR=#A71D5D]function[/COLOR](ip){[COLOR=#795DA3]console[/COLOR].[COLOR=#0086B3]log[/COLOR](ip);});
     
    • Thanks Thanks x 5
  3. abhi007

    abhi007 Jr. VIP Jr. VIP

    Joined:
    Aug 31, 2010
    Messages:
    5,867
    Likes Received:
    3,947
    Location:
    Theatre of dreams :)
    Don't know about this webRTC but will give it a read.
     
  4. kbklash

    kbklash Senior Member

    Joined:
    Jun 2, 2012
    Messages:
    1,140
    Likes Received:
    449
    Location:
    in my BMW to my BHW
    Home Page:
    Good to know these.But if there are plugins to stop or turn off WebRTC,then what's the deal !
     
    • Thanks Thanks x 1
  5. SEO20

    SEO20 Elite Member

    Joined:
    Mar 25, 2009
    Messages:
    2,016
    Likes Received:
    2,260
    Most don't know that you have to do it - guess you did not either :)

     
  6. W9go

    W9go Elite Member

    Joined:
    May 16, 2011
    Messages:
    5,205
    Likes Received:
    1,089
    Gender:
    Male
    Occupation:
    chasing girls
    Location:
    chasing girls
    interesting information .. thanks.
    is there any problem running bots or only via the browsers ?
     
  7. seowolve

    seowolve Regular Member

    Joined:
    Feb 6, 2016
    Messages:
    229
    Likes Received:
    19
    Will sure read about it. but if it's true Google will implement it? or already implemented.?
     
  8. NobelNerd

    NobelNerd Power Member

    Joined:
    Feb 21, 2013
    Messages:
    782
    Likes Received:
    343
    Occupation:
    Digital Marketing
    Location:
    India
    Google might have better tracker then this behind the scenes....my main concern is hiding from google...hiding the footprints
     
  9. collegeguys4

    collegeguys4 Junior Member

    Joined:
    Feb 25, 2016
    Messages:
    124
    Likes Received:
    15
    Occupation:
    computer engineer
    Location:
    New York
    Home Page:
    Another way to counter would be to spin up a vps that can run MS, run a remote desktop
    then launch browser from the vps.
     
  10. immaletyoufinish

    immaletyoufinish Regular Member

    Joined:
    Mar 3, 2016
    Messages:
    219
    Likes Received:
    113
    The deal is like anything its an arms race, OP is putting out a warning to say - new threat you need to combat, so take up the new arms that are available.

    Much appreciated OP. Will investigate this.
     
  11. BloodyNinja

    BloodyNinja Power Member

    Joined:
    Oct 28, 2013
    Messages:
    605
    Likes Received:
    586
    Location:
    Deeptown
    • Thanks Thanks x 1
  12. Asif WILSON Khan

    Asif WILSON Khan Executive VIP Jr. VIP

    Joined:
    Nov 10, 2012
    Messages:
    12,599
    Likes Received:
    34,737
    Gender:
    Male
    Occupation:
    Fun Lovin' Criminal
    Location:
    London
    Home Page:
    • Thanks Thanks x 6
  13. mnunes532

    mnunes532 Supreme Member

    Joined:
    Jan 21, 2014
    Messages:
    1,439
    Likes Received:
    468
    Gender:
    Male
    Location:
    Portugal
    Well I tried it for fun and downloaded/turned on a vpn connection. Result: I saw the vpn ip, so I guess this don't work sometimes?
     
  14. Lauriat

    Lauriat Power Member

    Joined:
    Oct 23, 2011
    Messages:
    706
    Likes Received:
    217
    Are all other browsers safe?
     
  15. SEO20

    SEO20 Elite Member

    Joined:
    Mar 25, 2009
    Messages:
    2,016
    Likes Received:
    2,260
  16. SEO20

    SEO20 Elite Member

    Joined:
    Mar 25, 2009
    Messages:
    2,016
    Likes Received:
    2,260
    And now that we are at it - remember to disable flash - mostly disabled by default now.

    But you could easily do this

    Code:
    [COLOR=#00008B]import[/COLOR][COLOR=black] flash[/COLOR][COLOR=black].[/COLOR][COLOR=black]net[/COLOR][COLOR=black].[/COLOR][COLOR=#2B91AF]InterfaceAddress[/COLOR][COLOR=black];[/COLOR][COLOR=black]
    [/COLOR][COLOR=#00008B]import[/COLOR][COLOR=black] flash[/COLOR][COLOR=black].[/COLOR][COLOR=black]net[/COLOR][COLOR=black].[/COLOR][COLOR=#2B91AF]NetworkInfo[/COLOR][COLOR=black];[/COLOR][COLOR=black]
    [/COLOR][COLOR=#00008B]import[/COLOR][COLOR=black] flash[/COLOR][COLOR=black].[/COLOR][COLOR=black]net[/COLOR][COLOR=black].[/COLOR][COLOR=#2B91AF]NetworkInterface[/COLOR][COLOR=black];[/COLOR][COLOR=black]
    
    [/COLOR][COLOR=#00008B]function[/COLOR][COLOR=black] findIPAddress[/COLOR][COLOR=black]():[/COLOR][COLOR=#00008B]void[/COLOR][COLOR=black]
    [/COLOR][COLOR=black]{[/COLOR][COLOR=black]
        [/COLOR][COLOR=#00008B]var[/COLOR][COLOR=black] networkInfo [/COLOR][COLOR=black]=[/COLOR][COLOR=#2B91AF]NetworkInfo[/COLOR][COLOR=black].[/COLOR][COLOR=black]networkInfo[/COLOR][COLOR=black];[/COLOR][COLOR=black]
        [/COLOR][COLOR=#00008B]var[/COLOR][COLOR=black] interfaces [/COLOR][COLOR=black]=[/COLOR][COLOR=black] networkInfo[/COLOR][COLOR=black].[/COLOR][COLOR=black]findInterfaces[/COLOR][COLOR=black]();[/COLOR][COLOR=black]
        [/COLOR][COLOR=#00008B]var[/COLOR][COLOR=black] interfaceObj[/COLOR][COLOR=black];[/COLOR][COLOR=black]
        [/COLOR][COLOR=#00008B]var[/COLOR][COLOR=black] address[/COLOR][COLOR=black];[/COLOR][COLOR=black]
    
        [/COLOR][COLOR=gray]//Get available interfaces[/COLOR][COLOR=black]
        [/COLOR][COLOR=#00008B]for[/COLOR][COLOR=black]([/COLOR][COLOR=#00008B]var[/COLOR][COLOR=black] i [/COLOR][COLOR=black]=[/COLOR][COLOR=maroon]0[/COLOR][COLOR=black];[/COLOR][COLOR=black] i [/COLOR][COLOR=black]<[/COLOR][COLOR=black] interfaces[/COLOR][COLOR=black].[/COLOR][COLOR=black]length[/COLOR][COLOR=black];[/COLOR][COLOR=black] i[/COLOR][COLOR=black]++)[/COLOR][COLOR=black]
        [/COLOR][COLOR=black]{[/COLOR][COLOR=black]
            interfaceObj [/COLOR][COLOR=black]=[/COLOR][COLOR=black] interfaces[/COLOR][COLOR=black][[/COLOR][COLOR=black]i[/COLOR][COLOR=black]];[/COLOR][COLOR=black]
    
            [/COLOR][COLOR=#00008B]for[/COLOR][COLOR=black]([/COLOR][COLOR=#00008B]var[/COLOR][COLOR=black] j [/COLOR][COLOR=black]=[/COLOR][COLOR=maroon]0[/COLOR][COLOR=black];[/COLOR][COLOR=black] j [/COLOR][COLOR=black]<[/COLOR][COLOR=black] interfaceObj[/COLOR][COLOR=black].[/COLOR][COLOR=black]addresses[/COLOR][COLOR=black].[/COLOR][COLOR=black]length[/COLOR][COLOR=black];[/COLOR][COLOR=black] j[/COLOR][COLOR=black]++)[/COLOR][COLOR=black]
            [/COLOR][COLOR=black]{[/COLOR][COLOR=black]
                address [/COLOR][COLOR=black]=[/COLOR][COLOR=black] interfaceObj[/COLOR][COLOR=black].[/COLOR][COLOR=black]addresses[/COLOR][COLOR=black][[/COLOR][COLOR=black]j[/COLOR][COLOR=black]];[/COLOR][COLOR=black]
    
                trace[/COLOR][COLOR=black]([/COLOR][COLOR=black]address[/COLOR][COLOR=black].[/COLOR][COLOR=black]address [/COLOR][COLOR=black]+[/COLOR][COLOR=maroon]"\n"[/COLOR][COLOR=black]);[/COLOR][COLOR=black]
            [/COLOR][COLOR=black]}[/COLOR][COLOR=black]
        [/COLOR][COLOR=black]}[/COLOR][COLOR=black]
    [/COLOR][COLOR=black]}[/COLOR][COLOR=black]
    
    findIPAddress[/COLOR][COLOR=black]();[/COLOR]
    And so on:
    http://help.adobe.com/en_US/as3/dev...ml#WSb2ba3b1aad8a27b04a6701d612482d399e5-8000

    It's basic stuff - but a lot still don't know how to protect yourself. Did this post only to help a bit :)
     
    • Thanks Thanks x 4
    Last edited: Mar 23, 2016
  17. Justkulboi

    Justkulboi Regular Member

    Joined:
    Dec 30, 2015
    Messages:
    358
    Likes Received:
    73
    Occupation:
    Businessman 100%
    Location:
    Mars
    I will investigate it, heard about it but never thought it was a big deal thing!!
     
  18. kbklash

    kbklash Senior Member

    Joined:
    Jun 2, 2012
    Messages:
    1,140
    Likes Received:
    449
    Location:
    in my BMW to my BHW
    Home Page:
    Well,personally i am not doing anything out of the box yet !.Still what you have shared here, is gems of information.It'l come handy when i go for that wildcard surf.
     
  19. NobelNerd

    NobelNerd Power Member

    Joined:
    Feb 21, 2013
    Messages:
    782
    Likes Received:
    343
    Occupation:
    Digital Marketing
    Location:
    India
    Here Experimented on what Asif WILSON Khan suggested in another thread and plugins work great I used HMA Pro to change my IP
    Screenshot_3.jpg Screenshot_4.jpg Screenshot_5.jpg
     
  20. SEMWORLD

    SEMWORLD BANNED BANNED

    Joined:
    Nov 21, 2015
    Messages:
    1,235
    Likes Received:
    219
    Mate, Thanks for your informative post.
    I didn't know details about webRTC. Why are you emphasis on that? I can't understand these issue.
    Is it your own product?