how to ban not only by IP address ?

[minnesøtti]

Hi there,

I am posting to a web-based forum which runs on ASP and uses
JavaScript. I post via a proxy-server which rewrites JavaScript, does
not send cookies back to the forum server, and which changes its IP
address every few minutes within the whole class A network.

The moderator says he banned my IP address (let's put the moral issues
of it aside for the sake of the technical discussion). This means he
banned the whole network of the Class A, within which the IP addresses
of my proxy-server change. It is hard to believe, but it might be
possible. The strange thing is that when I try to do posting through
the proxy-server using the Firefox browser (which I traditionally use),
the forum server returns a message saying that I was banned from
posting. However I could make a posting using the IE6 web browser !

I have a hypothesis that the moderator bans not only my IP address. The
forum might send a JavaScript code to my computer, it computes a hash
based on the computer configuration (using the information about the
installed web browser as well), and sends this hash number (which is
unique for this computer system) back to the forum server. The postings
made with this hash are banned.

However, I looked through the JavaScript code by my non-specialist eye,
and I could not see anything suspicious. Can someone comment on how
this ban was possibly done (and how to overcome it), or at least direct
me at the Internet resource where I could read more ? Thanks.

...

[shimmyshack]

flash objects are a good way to store persistent data on a client
machine. much better than javascript.

You haven't given anything like enough info though to be definite about
the method used in this case however and I'm just guessing.

I find it hard to believe that a proxy with "changing" class A IP,
would be rewriting javascript and not sending cookies, are you SURE
about that?

Anyway the solution to your woes is to use a proxy yourself, as well as
a packet sniffer. If you liek writing c# you could code a filter into
fiddlertool and proceed from there. As with all web traffic it is
entirely possible for you to stop ANY prevention mechanism he uses, you
just have to know how. However if you do so, despite his warnings, you
may well be in violation of real world law, so dont use any techniques
for bad.

When posting an ASP page, quite often the viewstate function which is a
blunt and bloated thing, can be hijacked to send more data about you,
as it is needed to browse the site, my guess is that is where the
persistent data is being wrapped up and sent, look around for the code
that plugs into that.

In order for a hash to be used, it would have to be sent from YOUR
computer through the proxy to them, so you can see and stop it, unless
it is wrapped into the viewstate, or just appended.

[Mark McGinty]

"minnesøtti " <mi********@yah oo.comwrote in message
news:11******** **************@ j44g2000cwa.goo glegroups.com.. .

Hi there,

I am posting to a web-based forum which runs on ASP and uses
JavaScript. I post via a proxy-server which rewrites JavaScript, does
not send cookies back to the forum server, and which changes its IP
address every few minutes within the whole class A network.

The moderator says he banned my IP address (let's put the moral issues
of it aside for the sake of the technical discussion). This means he
banned the whole network of the Class A, within which the IP addresses
of my proxy-server change. It is hard to believe, but it might be
possible. The strange thing is that when I try to do posting through
the proxy-server using the Firefox browser (which I traditionally use),
the forum server returns a message saying that I was banned from
posting. However I could make a posting using the IE6 web browser !

I have a hypothesis that the moderator bans not only my IP address. The
forum might send a JavaScript code to my computer, it computes a hash
based on the computer configuration (using the information about the
installed web browser as well), and sends this hash number (which is
unique for this computer system) back to the forum server. The postings
made with this hash are banned.

However, I looked through the JavaScript code by my non-specialist eye,
and I could not see anything suspicious. Can someone comment on how
this ban was possibly done (and how to overcome it), or at least direct
me at the Internet resource where I could read more ? Thanks.

Writing ASP code to block by IP or subnet is trivial, I've done it in
several projects: simply split the return from
Request.ServerV ariables("REMOT E_ADDR") at the dots into an array, coerce the
elements to a numeric typs (if you want to use masks) and efficiently
arrange a ban (or allow) list.

If it's a Windows server, your IP and/or subnet could be IPSEC'ed away too,
but then you wouldn't get a ban notice, the server just wouldn't seem to be
there?

So are you saying you have a whole class C (or substantial part thereof) of
address space for a proxy to hop around in? The addresses it uses would
have to be allocated to it persistently, unless its integrated with DHCP...
If I were the forum admin, I'd ban you too, that sort of activity looks
malevolent, what's the incentive to take a chance you don't have darker
intentions than?

Regardless, the public IP from which a client connected is always available
to a server app at some level; ASP exposes it to scripts running under it
quite readily. Aside from an anonymizer, shell accounts in eastern block
countries, or buying more address space, I doubt you'll find a way through
half-way decent code... but the larger issue might be, why would you want
to?
-Mark

[minnesøtti]

shimmyshack wrote:

flash objects are a good way to store persistent data on a client
machine. much better than javascript.

You haven't given anything like enough info though to be definite about
the method used in this case however and I'm just guessing.

I find it hard to believe that a proxy with "changing" class A IP,
would be rewriting javascript and not sending cookies, are you SURE
about that?

I am using an anonymizer. That's what it does.

>
Anyway the solution to your woes is to use a proxy yourself, as well as
a packet sniffer. If you liek writing c# you could code a filter into
fiddlertool and proceed from there. As with all web traffic it is
entirely possible for you to stop ANY prevention mechanism he uses, you
just have to know how. However if you do so, despite his warnings, you
may well be in violation of real world law, so dont use any techniques
for bad.

When posting an ASP page, quite often the viewstate function which is a
blunt and bloated thing, can be hijacked to send more data about you,
as it is needed to browse the site, my guess is that is where the
persistent data is being wrapped up and sent, look around for the code
that plugs into that.

I am not an IT person. However, I found on the Internet that if
ViewState sends anything back to the forum server, then I should find
the following piece of code in the HTML webpage code:

<input type="hidden" name="__VIEWSTA TE"
value="dDwxNDg5 OTk5MzM7Oz7DblW pxMjE3ATl4Jx621 QnCmJ2VQ==" />

In the forum's code, there is no mentioning of "ViewState" . Does that
mean that this is not the culprit ?

Any other suggestions ? (Thanks for those you gave, so far they were
the most informatve).

...

>
In order for a hash to be used, it would have to be sent from YOUR
computer through the proxy to them, so you can see and stop it, unless
it is wrapped into the viewstate, or just appended.

[Chaddy2222]

minnesøtti wrote:

Hi there,

I am posting to a web-based forum which runs on ASP and uses
JavaScript. I post via a proxy-server which rewrites JavaScript, does
not send cookies back to the forum server, and which changes its IP
address every few minutes within the whole class A network.

The moderator says he banned my IP address (let's put the moral issues
of it aside for the sake of the technical discussion). This means he
banned the whole network of the Class A, within which the IP addresses
of my proxy-server change. It is hard to believe, but it might be
possible. The strange thing is that when I try to do posting through
the proxy-server using the Firefox browser (which I traditionally use),
the forum server returns a message saying that I was banned from
posting. However I could make a posting using the IE6 web browser !

I have a hypothesis that the moderator bans not only my IP address. The
forum might send a JavaScript code to my computer, it computes a hash
based on the computer configuration (using the information about the
installed web browser as well), and sends this hash number (which is
unique for this computer system) back to the forum server. The postings
made with this hash are banned.

However, I looked through the JavaScript code by my non-specialist eye,
and I could not see anything suspicious. Can someone comment on how
this ban was possibly done (and how to overcome it), or at least direct
me at the Internet resource where I could read more ? Thanks.

..

Nah, I doubt it could be JavaScript alone that is doing it.
It's not that powerfull, try disableing JS and see what happens.
I would say it's done useing a server side script and a Cookie placed
on the clients web browser, the cookie would contain the IP addie and
the web browser, so just delete cookies and refresh the browser a few
times before posting, I bet you that it works.
--
Regards Chad. http://freewebdesign.cjb.cc

[shimmyshack]

I am afraid that in order to track down the reason you will need to be
an IT person, you will need to know not just what anon. says it does
but what it is actually doing, after all, you claim that anon. fails to
protect you when in FF, but somehow does in IE. This made me suspicious
that you were using anon. at all. I would question your info on other
grounds as well - how for instance does the forum keep track of who is
logged in, of your session - without using either javascript, headers,
a postback, hidden inputs on a form, or some other method that gets
through your anon. proxies - or you wouldnt be able to log in. And how
once you have logged in using IE can it let you post unless you use
another username - which again supports it being js. That is assuming
you log in of course, what self respecting forum owner attempts to ban
people when his forum requires no authentication!

You haven't given enough info I'm afraid, and the whole IE/FF thing
really says that it must be js, a web bug or flash. because there can
only be two other main reasons: user-agent, and different proxy IP. not
picked up by the forum for the duration of your IE session
the user-agent thing is too gross a solution,
the diff anon. IP would be a reason, but I assume youve tried it more
than once! so I discounted this.
It is probable that a decent forum owner bans many of these types of
anon. proxies. But has some he misses - after all they are all pretty
easy to track down!!

Unless you are willing to get your hands dirty and packet capture you
wont find the answer, and even if you do its possible that the stuff is
going via UDP anyway. This is a pretty easy one to solve! - but not
without there being a transference of info from you to us.

As for javascript not being advanced? There are implementations of AES
and other encryption algos, as well as a host of other things which are
capable of sending data from your browser to the server without YOU
being able to decrypt it. Of course these things are rarely implemented
CPU constraints, however javascript is a very advanced language indeed,
and is more than capable of keeping tabs on a non IT person. XSS
attacks etc.. - js!

[VK]

minnesøtti wrote:

I am posting to a web-based forum which runs on ASP and uses
JavaScript. I post via a proxy-server which rewrites JavaScript, does
not send cookies back to the forum server, and which changes its IP
address every few minutes within the whole class A network.

Hard to believe in it taking into account that class A networks (as
well as B and C) do not exist for more than 10 years by now. The ban
can be set to a particular IP, to the server cross-range IP pair or to
the entire server IP range. Respectively any anonymizer can switch IP
only withing the range of its own IP addresses; on many hight grade
solutions there are updating lists of IP ranges of known anonymizing
services (anonymizer.com , anonymouse.net etc) banned by default.

The fact that you can still use some UA for posting suggests that the
admin used "soft ban" by particular IP(s), not killing the entire
range. As suggested clean your cookies and try again.