Detecting whether a user is behind a proxy - php

Question

I'm trying to figure out how I could detect whether people logging into my site are behind a proxy or not. I've read that you can detect a person's real IP address through embeddable objects (Flash and Java). However, I haven't been able to actually find any examples or source for this.
I'm using PHP and I've read that looking for $_SERVER['HTTP_X_FORWARDED_FOR'], $_SERVER['HTTP_CLIENT_IP'], etc. would detect most proxies but so far I haven't been able to by testing with TOR (maybe TOR doesn't flag those, but I've read that anonymous proxies still show HTTP_X_FORWARDED). I'd like to try doing it with a java servlet, if possible. Could anyone point me in the right direction (preferably with examples?) I saw some code on ha.ckers.org but they only showed the client side and not the server side.

Answer 1

TOR does not supply any server headers such as X_FORWARDED_FOR, so your best bet is to use a list of all known exit nodes. A list can be found at https://torstat.xenobite.eu/.
For other proxies, you can look at server headers. Possible server headers of interest include:
HTTP_VIA
HTTP_X_FORWARDED_FOR
HTTP_FORWARDED_FOR
HTTP_X_FORWARDED
HTTP_FORWARDED
HTTP_CLIENT_IP
HTTP_FORWARDED_FOR_IP
VIA
X_FORWARDED_FOR
FORWARDED_FOR
X_FORWARDED FORWARDED
CLIENT_IP
FORWARDED_FOR_IP
HTTP_PROXY_CONNECTION
In PHP, you can get the value of these fields in the $_SERVER[] superglobal.

Answer 2

If your want to check weather the user is using proxy or not you can go with the port scan and checking the headers when request is made. These method will reveal public IP if the proxy is non-transparent (By the way there are two types of IP address public and private IP address). But this will not work if it is transparent proxy.
function detectProxy() {
$sockport = false;
$proxyports=array(80,8080,6588,8000,3128,3127,3124,1080,553,554);
for ($i = 0; $i <= count($proxyports); $i++) {
if(#fsockopen($ipaddress,$proxyports[$i],$errstr,$errno,0.5)){
$sockport=true;
}
}
if(
isset($_SERVER['HTTP_VIA'])
|| isset($_SERVER['HTTP_X_FORWARDED_FOR'])
|| isset($_SERVER['HTTP_FORWARDED_FOR'])
|| isset($_SERVER['HTTP_X_FORWARDED'])
|| isset($_SERVER['HTTP_FORWARDED'])
|| isset($_SERVER['HTTP_CLIENT_IP'])
|| isset($_SERVER['HTTP_FORWARDED_FOR_IP'])
|| isset($_SERVER['VIA'])
|| isset($_SERVER['X_FORWARDED_FOR'])
|| isset($_SERVER['FORWARDED_FOR'])
|| isset($_SERVER['X_FORWARDED'])
|| isset($_SERVER['FORWARDED'])
|| isset($_SERVER['CLIENT_IP'])
|| isset($_SERVER['FORWARDED_FOR_IP'])
|| isset($_SERVER['HTTP_PROXY_CONNECTION'])
|| $sockport === true
) {
echo 'User is using proxy';
}
else{
echo ''user is not using proxy';
}
}
Second method is by using DNS server by allocating sub domain to each user.
You can also check this site proxy checker which will show public and private IP address even when you are using proxy.

Answer 3

Neither Java Applets or Flash is supposed to leak the client IP. I know that older versions of Flash had a security flaw that made it possible. Most probably that is patched by now.
I've never used TOR but from what I read it seems to be implemented as a kind of VPN and thus the browser will not be aware of it at all.
Why do you need to know if the user is behind a proxy?

Answer 4

If it's an option you can try using https. The user IP then should be visible to you. However don't know about office users behind SSL proxies.

Answer 5

By looking for the following header fields you should some proxys.
VIA
FORWARDED
USERAGENT_VIA
X_FORWARDED_FOR
PROXY_CONNECTION
XPROXY_CONNECTION
HTTP_PC_REMOTE_ADDR
HTTP_CLIENT_IP
As for blocking TOR you are best of blocking the TOR exit nodes with iptables.
And if you really must be sure you could try some "semi-malicious" things like embedding some flash or java in your page which sends you back the real client ip. But that has only limited scope as you might just get the local ip if he is in e.g. a LAN you get something like 192.168.1.x

Answer 6

Once you have the client IP address, the simplest is to pass it to a service that maintains an up-to-date list of TOR exit nodes. You can for instance use Ipregistry (disclaimer: I run the service):
https://api.ipregistry.co/89.187.143.81?key=tryout
where 89.187.143.81 must be replaced by your client IP and tryout by your API key.
In the output, look at the field security -> is_tor_exit. If the boolean is true, then your client is using Tor.