Fake Proxy Host_Name & IP Filters!

[JakBeNymble]

*Originally*, there were Only Two Filters Posted here in this Sub-Directory of the FORUM's PRIVACY Folder, The "Via: Filter & the X-Forwarded-For: Filter". But as Posts were being made and questions being asked, they resulted in Discoveries being made and the Formation of the "Client-IP Filter" and it's accompaning List. So I have edited this "First Post" and listed all three of them together below.

As You carefully read the Following Posts, You can watch it's evolution take place. Also all the Filter's Lists have been Up-dated and are available for downloading and examination from the Sub-Forum. One Discovery that was made, (it was a discovery to me at least), was that the "X-Forwarded-For: Filter's Replacement text can be altered to make it "appear" that You are Using more than One Proxy,(Proxy-Chaining), even if You are NOT Using One at ALL! This is accomplished by "adding" Fake IP numbers to the Replacement text. The more IPs that You add the more Proxies it appears that You are Using.
REPLACEMENT="1 , 000.000.000.000. , 000.000.000.000" . . .and so on.

--------
*DRAW-BACK: Adding Extra IPs to the X-Fowarded-For Filter's Replacement Text can SLOW SURFING DOWN!*

[There is Better way to add "Fake Proxy Chaining" to Your Arrangement that won't Slow You down. On the next page I have posted a "User-Agent" that can be used to add this feature without ANY slow down! Or if You use a Rotating U/A Filter & List, You can add part of the U/A to Your U/A Filter's Replacement Text and add the Extra Proxy feature to ALL your U/A's in Your List! See bottom of page 2 for details].

Thank You, "jak"
--------
"The Ancestor of Every Action, Is a THOUGHT"-Emerson

HI Proxo-Users,
              I just got though up-loading a List of Fake Proxy host_names on the sub-forum. It is to be used with the "Via" Filter. Jor created it for string-over load in hopes of hiding the Hosts_name. He posted it once on the forum and I added  rotation and a list for it. I use it along with a Rotating "X-Forwarded-For"& "Client-ip" Filters. With most sites, it can be detected if a proxy is being used. Some Proxies have "High Anonymity", which means that it can't be detected that a Proxy is being used for the connection. But even with an anonymous proxy, sites detect that you are using a Proxy! Also to go along with proxy detection, the Remote_host name is detected and if the proxy is not anonymous, then your Client IP is forwarded through to the site also, 'And Logged'! Well since Proxy use is being detected anyways, why not give the Proxy a New "Fake Name", and forward a "Fake ISP" and a "Fake Client I.P" along with it??? You can do that by using these  Filters!


The second Filter(rotating X-Forwarded-For:), ARNE taught me to make & helped me put it together. It was one of the first filters that I tried to make. So to ARNE & JOR, (THANKX GUYS! You are heros to me!)

 There are 3 lists here on the Sub-Forum that You will need. They are, (1)The"Via: Filter list, (2). The "X-Forwarded-For" Filter List. And (3). The "Client I.P." Filter List, which was just up-loaded for You.

(1). The "Via:" Filter/List will send a "Fake Host-Name" Header which looks like a Proxy.

(2). The "X-Forwared-For" Filter/List will send a "Fake ISP" Header, and

(3). the "Client I.P." Filter/List will send a "Fake IP" header .


-----Start Filter-----
KEY="Via:(Out) "Jakx-Fake Proxy Spoofer"
URL="(^$LST(Exceptions))"
MATCH="$LST(Via)"
REPLACEMENT="1 /Accept-Encoding: deflate, gzip; (version Foobar 2001 beta seven) 0303.022201424 , 3.0 , 2.0 , 1.0"
-----End FIlter----

-----Start Filter-----
KEY="X-Forwarded-For:(out)"Jakx-Fake ISP Spoofer"
URL="(^$LST(Exceptions))"
MATCH="$LST(XForward)"
REPLACEMENT="1"
-----End Filter-----

-----Start Filter-----
KEY="Client-ip:(Out) "Jakx-Fake Client-IP Spoofer"
URL="(^$LST(Exceptions))"
MATCH="$LST(ClientIP)"
REPLACEMENT="1"
-----End Filter----

You will notice that in the 'URL' Filter value I have a list called "Exceptions". That is for listing sites that You DO NOT Want to send the Fake Information to. (Be Sure to Put the FORUM's URL in the "Excecptions" List or You might have trouble loggin on to the FORUM).

Now of Course You will need a Proxy to surf though to "cloak" Your real IP. The Flow of data will be as such:(Browser--->Proxomitron--->(sending Real IP and "Fake Info")--->Remote Proxy(cloaking Real IP, but sending "Fake Info"--->to destination site)!=;-)


Here is where you can check an see if your proxy can be detected,
http://www.all-nettools.com/pr.htm
And here you can see if your real or "Fake" Client IP is being Forwarded through:
http://www.leader.ru/secure/who.html
Remember All "Jakx-SPOOFER filters" have to be enabled before the PROXO Magic can happen!
Take Care, and I hope that you have a Great & Wonderful Day!
"JaK"
--------------------------------------------------------------------------------

Dear "PROXO-USERS",
               If You remove the FORUM's URL in the URL match line in these filters and My "Fake Referer" Filter and Lists, You will have trouble getting on the FORUM! Of Course You would have to get on the FORUM before You could read this post. See http://asp.flaaten.dk/pforum/topic.asp?ARCHIVE=&TOPIC_ID=576 for the details.
Thanks for Trying out these and other Jakx.Filters/lists. Any and all comments are always Welcome.
Have a Great Day to One & All,
'jak'
----------------------------------------------------------------------------------

Hi "Proxo-Users",
                 I hope that You have been enjoying using the "spoofers' I came back to add to this Post that all the Spoofer Lists can be downloaded here:http://www.flaaten.dk/forum/

And also I am working on re-doing the Lists to slow the scanning down abit to make the 'Spoofers' "appear" more realistic to Servers. [Remember the best way to get noticed is to Stand Out in the Crowd.]

Right now I am experimenting with different speeds for different lists, to see what seems to work the best. Your Browser will make from 10 to 40 hits or connections loading a page. But as soon as I find the right combination for the "Via/X-Forwarded-For/Client-IP lists", I will up-load them for You.[The List has been Up-dated & Up-loaded on the Sub-forum.]

Have a Great & Wonderful Day, My FRIENDS!
'jak'



Edited by - JakBeNymble on 13 Jul 2002  18:43:36

[JakBeNymble]

Hi "Proxo-Users",
                 As many of You that have read my posts know that I really like using Proxo's Rotating Filters. I guess I might tend to over-do it at times. But if you have been thinking about trying some of them, let me give you an idea of what can be done with them. I will show you what a test-page shows------

 
All information sent by your web browser when requesting this web page:

Accept: text/xml, application/xml, application/xhtml+xml, text/html;q=0.9, image/png, image/jpeg, image/gif;q=0.2, text/plain;q=0.8, text/css, */*;q=0.1 Accept-Language: it Host: www.privacy.net Referer: http://www.sfu.ca/biology/faculty/breden/ User-Agent: Mozilla/3.0 (WinNT; I) Via: Proxy[1.0] Accept-Encoding: gzip, deflate, compress;q=0.9 Keep-Alive: 300 X-Forwarded-For: xxx.177.1.68 Cache-Control: max-stale=0

 Now watch when I reload the page, remember I not making Any Changes, it's the Rotating Filters------

Accept: text/xml, application/xml, application/xhtml+xml, text/html;q=0.9, image/png, image/jpeg, image/gif;q=0.2, text/plain;q=0.8, text/css, */*;q=0.1 Accept-Language: en-us Host: www.privacy.net Referer: http/members.tripod.com/florp/aardvark/social.html User-Agent: Mozilla/4.06 [en] (Win95; I) Proxy-Connection: close Via: Proxy[1.0] Accept-Encoding: gzip, deflate, compress;q=0.9 Keep-Alive: 300 X-Forwarded-For: xxx.184.22.189

And Again------

Accept: text/xml, application/xml, application/xhtml+xml, text/html;q=0.9, image/png, image/jpeg, image/gif;q=0.2, text/plain;q=0.8, text/css, */*;q=0.1 Accept-Language: he Host: www.privacy.net Referer: http/www.angelfire.com/yt/kpyehi2/images/img125.jpg User-Agent: Mozilla/3.0 (compatible; MuscatFerret/1.5.4; [email protected]) Via: Proxy[2.] /Accept-Encoding: deflate, gzip; (version Foobar 2001 beta seven) 0303.022201424 , 3.0 , 2.0 Accept-Encoding: gzip, deflate, compress;q=0.9 Keep-Alive: 300 X-Forwarded-For: xxx.197.166.198 Cache-Control: max-stale=0

One more time-----

Accept: text/xml, application/xml, application/xhtml+xml, text/html;q=0.9, image/png, image/jpeg, image/gif;q=0.2, text/plain;q=0.8, text/css, */*;q=0.1 Accept-Language: ku Host: www.privacy.net Referer: http/passporttoknowledge.com/antarctica2/main/journal/dr_jour6.html User-Agent: Mozilla/3.01-C-MACOS8 (Macintosh; I; PPC) Via: Proxy[2.] /Accept-Encoding: deflate, gzip; (version Foobar 2001 beta seven) 0303.022201424 , 3.0 , 2.0 Accept-Encoding: gzip, deflate, compress;q=0.9 Keep-Alive: 300 X-Forwarded-For: xxx.197.166.198 Cache-Control: max-stale=0

And One Last Time----

Accept: text/xml, application/xml, application/xhtml+xml, text/html;q=0.9, image/png, image/jpeg, image/gif;q=0.2, text/plain;q=0.8, text/css, */*;q=0.1 Accept-Language: mt Host: www.privacy.net Referer: http://boergoat.une.edu.au/meatmrk2.htm User-Agent: Mozilla/3.02Gold (WinNT; I) Via: Proxy[1.0] Accept-Encoding: gzip, deflate, compress;q=0.9 Keep-Alive: 300 X-Forwarded-For: xxx.177.1.68 Cache-Control: max-stale=0

Remember All of this is "Rotating Fake info". "Language, Referer, User-Agent, Via, X-Forwarded-For". All the info changes with each page, and I also use Proxo's built in Proxy rotation so my IP changes with each page also, not just the fake X-Forwarded-For I.P. Most all of the Filters are on the FORUM and most of the lists that go with them are up-loaded on the Sub-Forum. If you are needing filters or lists and can't find them let me know and I will mail them to you.

Have a Wonderful & Blessed Day, My Friends!
"jak"




Edited by - JakBeNymble on 22 May 2002  06:05:23

[JD5000]

Hiya Jak,

If I understand this.. On the first test site it should pick up the correct "remote address" & "remote host", but not the correct "via" & x-forwarded-for", is that right?



~JD

--------

"Imagination is more important than knowledge" - Einstein

[JakBeNymble]

Hi "JD5000",
           I was using the same test-page. Nothing is real in the Header Fields! The Filters call to the lists and picks at random some value. I have text file lists made for Language, Referer, User-Agent, Via, X-Forwarded-For Filters and they are designed to change values with each page. Nope, nothing that you see in the post is REAL! Well, except for this:

(Accept: text/xml, application/xml, application/xhtml+xml, text/html;q=0.9, image/png, image/jpeg, image/gif;q=0.2, text/plain;q=0.8, text/css, */*;q=0.1)

That is real, everything else is Proxo-Magic. My User-Agent List now has over 250 different kinds of User-Agent & Operating Systems Listed, and it changes to a different one automatically when you fetch a page.

Here are some "example only" I.Ps for the X-Forwarded-For Rotation Filter.

# Jak's X-Forwarded-For: "Fake I.P." Rotating 'SPOOFER' Filter
$CON(1,10)$SET(1=216.41.20.132)
$CON(2,10)$SET(1=216.41.20.136)
$CON(3,10)$SET(1=63.127.192.153)
$CON(4,10)$SET(1=216.41.20.98)
$CON(5,10)$SET(1=63.127.192.160)
$CON(6,10)$SET(1=216.41.20.99)
$CON(7,10)$SET(1=216.41.20.104)
$CON(8,10)$SET(1=216.41.20.107)
$CON(9,10)$SET(1=216.41.20.134)
$CON(10,10)$SET(1=216.41.20.132)

If you want to have a good laugh, take any of the IPs and do a reverse look-up on them and see what the Host name is!

See what is happening is, by using a Remote Proxy Sever you Hide your Actual IP & Host Name, but most Proxies have the words "Proxy" or "Cache" in the URLs so the site "knows" you are using a Proxy. So since they know it's proxy anyway, why not Forward to them a "Fake" Host name and Client IP. The site will think that you are using a Non-Anonymous or Cache Proxy and that they have your Actual Host name and IP, when in Fact all they got is the Proxo "Fake Host name and IP"! I've had a barrel of Fun using these two Filters! LOL!

 Let me Know if You want the Whole "X-Forwarded-For" List, it has 116 different entries in it! Sites will think that they are your actual ISP!

Well You Have a Wonderful & Blessed Day, My FRIEND!
"swinging-jak"


 

[Jor]

Hi Jak,

very interesting filter set!

I'll test it a bit, give you comments on it later

 

[JD5000]

Thx for clearing that up Jak.

quote:Let me Know if You want the Whole "X-Forwarded-For" List, it has 116 different entries in it! Sites will think that they are your actual ISP!

Sure! That would be great. Do ya still have my email addy?

--------

"Imagination is more important than knowledge" - Einstein

[JakBeNymble]

Hi "Friends",
            First of all I would just like to say, that I am delighted that You are considering using and examining these Filters! Coming from Men of such calibour as Your-selves! Thankx.

And JD5000 I believe that I added you to my list, but I been having trouble with the mail server. I will check and see if I can get in, and if not I will give you another account where you can send your address to and then I can get the list to You. I don't want to up-load the list to the Sub-Forum until I get all the "kinks" out of it!

Also there is something that folks need to do to the Jakx.USer-Agent List that I have already up-loaded. The message at the top of the list needs to be deleted.(All the # comments and thank you message) I know that Proxo is suppose to ignore any comments made after the # sign in a list. But for some reason, it slows the scanning of the list down. And every great once in awhile depending on the test-page, Your Real User-Agent & O/S will slip through. I didn't catch it for awhile because of all the entries in the list. But once I caught it, I deleted all the comments and # signs and the problem has apparently disappeared. I also have a separate set of Filters, that Kick in when the sites in my exceptions list are fetched. If you don't have something to kick in, when the rotation stops all the Real Stuff will be sent through. Not Very Cool!

Also any improvements, comments good or bad will be Greatly Appreciated!
Have A Great Day, MY FRIENDS!
"jak"

 

[JakBeNymble]

Hi Proxo-Users,
              The List for the X-Forwarded-For Filter has been Up-loaded. There are 120 entries in the list. http://asp.flaaten.dk/pforum/fu/users/49_37.zip

Test pages-http://www.leader.ru/secure/who.html or http://www.all-nettools.com/tools1.htm

This is a new one that I found, http://www8.big.or.jp/~000/CyberSyndrome/evc.html. Not to sure about how safe it is to use it, but it does show you alot of information. So never go outside without your "Proxy" on. Also remember the browser's cache, sometimes when you re-load the page you will get the "Cached Page" and not the actual test-page results so it might appear that the Filters are Not Rotating when in fact they are! You can pop-up Proxo's log window and tell for sure if they are rotating or not. But if you use the Proxo Built-in Proxy Rotater, most of the time you will get a fresh page as the proxies rotate.

REMEMBER, this list contains addresses of "ACTUAL SITES", however, the Site's Host-Names are FAKE NAMES! They are NOT really what they Say they ARE! However the IPs "WILL" be resolved to their Fake Host Names.
"jak"
OPPS! I had to come back and edit the Url.



Edited by - JakBeNymble on 24 May 2002  07:15:40

[hpguru]

That's cool! You should be added to the Geeks Hall Fame!

 

[JakBeNymble]

Hi "Hpguru",
           Coming from one who has "So Quickly" brought "So Much" to the floor here on THE FORUM, I most heartedly Thank You for Your Gracious Compliment!
I do so Hope that You enjoy the Filters and the Lists as much as I have had compiling them!
Have a Wonderful & Blessed Day, My Friend!
"Happy-Jak"

 

[JakBeNymble]

Hi "Proxo-Users",
                 Here is a nice variation on the "Via: Spoofer Filter" you might also want to try. You don't have to Use the "Fake IP FILTER" for this set-up. First make sure that You never go outside without Your PROXY on! Now "DISABLE" the FAKE IP FILTER and leave it turned off for this arrangement. Now Change the "Via: Proxy Spoofer Filter to look like this:

-------Start Filter------
KEY="Via:(Out)'Proxy-Spoofer'th"
URL="(^asp.flaaten.dk/w|$LST(Exceptions))"
MATCH="$LST(Via)"
REPLACEMENT="1 /Accept-Encoding: deflate, gzip; (version Foobar 2001 beta seven) 0303.022201424 , 3.0 , 2.0 , 1.0)"
-------End Filter-------
Remember the " are Not Part of the Filter Elements, they just show where the Filter elements start and stop.

Now with this Filter enabled, it will appear to sites that You are surfing through 5 or 6 Proxies Chained together! Even if You are not Using a Proxy at all!
Use this test-page to check the Results. http://www.leader.ru/secure/who.html.
And after the test page loads, look at "Proxy Servers Passed"!Here is what it should look like.

COLLECTED INFORMATION
Reported remote address
xxx.71.201.65
     Browser
Netscape v 4.06
     OS
Macintosh (PowerPC)
    Referer
http/animaldiversity.ummz...n
   Proxy used
     yes
Proxy servers passed
6 ( Type II - 6 )
Nearest proxy
     VTMDNS
Client's address we got
xxx.71.201.65
Client's hostname
someHostName.net
Preferable mail server
SomeMailServer.ne

THE SITE THINKS I WAS RUNNING THROUGH 6 PROXIES!
Please REMEMBER to 'Disable' the "X-Forwarded-For FILTER" or this arrangement WON'T work.
Have a DeLightFul & Bless Week-End, MY FRIENDS!
"jak"

 

[JD5000]

Haven't tried that one yet. Here's another test site tho..

http://www.stilllistener.addr.com/checkpoint1/

--------

"Imagination is more important than knowledge" - Einstein

[Jor]

Hi Jak,

did some testing of this filter set -- excellent work!

While I won't be using it (kinda overkill since I use Opera behind Proxo and JAP, so nothing I dislike leaks out anyway ), this is a great filterset for privact enhancing.

 

[JakBeNymble]

To My Dear "FRIENDS" Here on the FORUM,
                                       Thank You So Much "JOR"! You will never know how much I Truely "VALUE" ALL Of Your OPINIONS! My Heart has been made Glad to almost the point of tears by Your COMMENTS & KINDNESS! THANK YOU, . .THANK YOU SO MUCH, ONE & ALL!
These Filters Sometimes Work almost to well at times. If you manually Check Proxies(Load them and Surf to a Test Page), PLEASE Disable both Filters to check the Anonymity Factor of a Proxy. On the Leader test site, my IP was not showing, but on the privacy.net/analyze site it was trailing after the "Fake IP". The leader site apparently Grabbed the First IP, Which was the "FAKE" one, and ignored the second one which was the real one. But the privacy.net site showed that both where being forwarded through the Proxy I was using. So I deleted that Proxy from the list.

May GOD BLESS YOU RICHLY THIS DAY, MY FRIENDS!
"jak"


 

[JakBeNymble]

Hi "Proxo-Users",
                 I have another Filter that You might be interested in also. Have You ever Tried out a Proxy that was real fast, and on the test-page the trace-route stopped at the Proxy's IP, and You thought You had a "Keeper". But then You start doing some checking and in the Header-Fields there was the Words "Client-Ip" and right after it was Your Real IP??? Now what do You do?? YOU GOT A REAL FAST KILLER PROXY, TRACE-ROUTE OK, BUT YOUR REAL IP IS BEING FORWARDED THROUGH THE HEADER!
Here is What You NEED!

-----Start Filter-----
KEY="Client-ip:(Out) "Client-IP SPOOFER"th"
URL="*"
MATCH="$LST(ClientIP)"
REPLACMENT="1"
-----End Filter------

Now we need a list of Fake IP's. (1).I took and made a copy of the list for the X-Forwarded-For Filter and re-named it ClientIP, then I moved the last entry to the TOP of of the list. (2).Of course then You have to re-number the list so that the Now new Top number starts with a 1 instead of 120. If You don't off set the list like this, the Client-IP will be the same as the X-Forwarded-For IP. So with the list off-set by one, the X-Forwarded-For Number will always be ahead of the Client-IP Number by one. (3).With this Filter enabled, I tested it over and over again and IT KEPT MY IP out of the Header Fields!

This is still "experimental", but so far it's works without a hitch!
Have a Wonderful & Blessed Day, My Friends!
"jak"=:-)
Here is what it looks like 'WITHOUT' the Filter enabled using the htp://privacy.net/analyze test-page-----

Accept: text/xml, application/xml, application/xhtml+xml, text/html;q=0.9, image/png, image/jpeg, image/gif;q=0.2, text/plain;q=0.8, text/css, */*;q=0.1 Accept-Language: eu Host: www.privacy.net Referer: http://www.cybergoat.com/ User-Agent: Mozilla/3.0Gold (Win16; I) Via: germany-de.net /Accept-Encoding: deflate, gzip; (version Foobar 2001 beta seven) 0303.022201424 , 3.0 , 2.0 , 1.0), HTTP/1.0 someHostName[00000000] (Traffic-Server/5.1.3-50227-50963 [uScM]) Accept-Encoding: gzip, deflate, compress;q=0.9 X-Forwarded-For: 12.148.163.44 Client-ip: xxx.157.150.131 <(Actual IP being revealed)

TraceRoute to xxx.178.7.52 [HostNameOfProxy]


Now I will re-load the page with the Filter 'ENABLED':

Accept: text/xml, application/xml, application/xhtml+xml, text/html;q=0.9, image/png, image/jpeg, image/gif;q=0.2, text/plain;q=0.8, text/css, */*;q=0.1 Accept-Language: ca Host: www.privacy.net Referer: http://www.sas.upenn.edu/~nmiller0/dungphoto.html User-Agent: Mozilla/4.0 (compatible; MSIE 4.01; Mac_PowerPC) Via: Proxy1.0 /Accept-Encoding: deflate, gzip; (version Foobar 2001 beta seven) 0303.022201424 , 3.0 , 2.0 , 1.0), HTTP/1.0 SomeHostName[00000000] (Traffic-Server/5.1.3-50227-50963 [uScM]) Accept-Encoding: gzip, deflate, compress;q=0.9
Client-ip: 12.148.163.48 <(FAKE IP FROM FILTER) X-Forwarded-For: 12.148.163.142

TraceRoute to xxx.178.7.52 [HostNameOfProxy]



----------------------------------------------------------------------------------

PROXO-USERS,

           THE ABOVE FILTER IS NOT MASKING YOUR IP!

What is happening in the Filter above is, that By Adding the Fake Client IP Filter to the String, the 'STRING is being OVER-LOADED'! I happened to think of a Post that "JOR" made once, ("A Server can only see the first 60 characters or so, and then It ignores the rest of the information".)

And in the words of Proxo's Creator,"Scott", ("You can't do anything about things that are put on after your data leaves Your Machine"!) And that includes things like Your Client-Ip. So this Filter is 'NOT' very reliable in stopping Your Client-IP from being Sent Through 100% of the time! It does work most of the time if the server is not set-up to look pass 60 or So Characters. And It will SEND A Fake Client-IP through, but depending on the Server, Your Actual Client-IP May get sent through right along with it! Not Very COOL!

It works Great For Sending A Fake Client-IP through, but it is My Recommendation to NOT use it in Hopes to try to Stop Your Actual IP from being sent through! In the Words of My Good Friend ARNE, ("The Only way to Cloak Your IP and surf anonymously, is to Use an Anonymizing Proxy".)

So in conclusion, while the Client-IP Filter Works extremely WELL at sending a FAKE IP through an anonymizing Proxy, it will 'fail' if are trying to use it to stop a "Non-anonymous Proxy" From Forwarding Your IP through to sites.

------------------------------------------------------------------------------------

Dear "Proxo-Users",
                  I would just like to say on Behalf of the [Fake Client-IP Filter], that today while I was "weeding" out the slow and the dead proxies out of the Proxo Remote Proxy list, I discovered 4 or maybe 5 Proxies that I had tested over and over not to be Anonymizing Proxies! But because of the "Fake IP" Filter was working so well I thought these Proxies Where Real ANONYMIZING PROXIES! It had sent through the Proxo Fake IP and had loaded down the string to where the Servers where "Ignoring My Real IP", and I thought they where Real Anonymous Proxies! LOL!

Thank You For Your Considerations.
And I hope that You Have a Wonderful & Blessed Day, My Friends!
"jak"



Edited by - JakBeNymble on 28 May 2002  04:52:27