Port Scanner for Open Proxies on Registration
 

Anyone with a good sized board knows what a nuisance proxies can be in the hands of disgruntled users and revolutionary wannabes. The only hacks to deal with this use http forwarding, which doesn't detect anonymous proxies, so they're very limited in value. Just about anyone that's going to go through the trouble of using a proxy to evade a ban is going to use an anonymous one.

The only way I can think of to deal with it is to do port scanning at registration, similar to what is done on IRC servers. I know it's server intensive, but I'm wondering if it would be that bad if it were only used to scan registration applications?

The features/options I'd like to see:

1) port scan: ports 80, 81, 3128, 8000, and 8080. I think these are the most common, someone can correct me on that if I'm wrong. Chances are one of these will be open even if the user is connected to a less common one.

2) automatically reject the registration: with a message for the user. It could be integrated into email verification. I assume anyone that has need for a proxy scanner is already doing email verification.

3) automatically ban the IP using vBulletin's IP ban to the 2nd depth: example- if the IP is 219.202.64.47 the hack would write 219.202.64. to your IP ban list. Eventually with all those open proxies being auto-banned, the malcontents would give up. This way would also easily allow you to manually remove a ban as there's bound to be glitches and special circumstances. Ideally this would be an option that could be turned on and off, but I know I'm asking for too much already.
:nervous:

4) Create a log of rejected registrations due to open open proxies. vBulletin owners could share these and speed up the process.

This looks like it would be a major hack, so anyone with the ambition to do it is bound to become famous. :)

wow that would be awesome

I have written a similar unpublished hack to this for VB2. There are a list of about 40 common ports used by proxies. I have discovered that using the HTTP_FORWARDED family of variables is not a very effective way of proxy detection because it actually tends to mistake certain ISP addresses as proxies. The port scan itself is not completely fool proof either. But it is able to catch a good number of proxies. I have set up my board to redirect all unregistered people who are using a proxy to register.com. There is no need to IP ban proxies since almost all of them have a very short lifetime.

You should be able to create something with a few hours worth of effort. ;)

Speak for yourself. It probably takes me longer to install stuff than it takes people to make it. lol

http://www.borlascornertap.com/forum...lies/laugh.gif
http://www.borlascornertap.com/forum.../peepwallA.gif

There's a great hack for this for phpBB.
http://www.phpbb.com/phpBB/viewtopic.php?t=248252
You can download the zip file there.

It's actually 2 hacks, one references the Distributed Server Boycott List (DSBL) and compares IP's, while the other does an actual scan for open proxies.

The author has given permission for it to be ported to vBulletin as long as you mention him in the credits. :)

That made me laugh. Thanks.

Looks like a good time for a bump. :D Maybe someone will take this up for vB 3.5.

Detecting those ports is not conclusive evidence that the person is using a proxy server at all, even less so that it is some annonymous proxy and they are a 'troublemaker'.

And just to repeat - in case you missed it in other threads - millions of people (esp in the uk) have to connect via proxy servers because they have no choice (their company or ISP force them via one).

The scanning I'm referring to is for open (unsecured) proxy ports. This would not affect UK hosts, AOL, or any other host that uses proxies with secured ports.

I wouldn't mind seeing something like this happen.