Login Register






ProxyPeeper v0.02a (w/ Database Support) filter_list
Author
Message
ProxyPeeper v0.02a (w/ Database Support) #1
So this is version 0.02 haha Not much input on my last version, but ill post this here any ways

Its had very simple testing. Every thing *appears* to function for me. Thanks for checking it out.

pp.schema.sql
PHP Code:
CREATE TABLE pp_ipaddr (id int(6) NOT NULL auto_increment,ipaddr VARCHAR(45) NOT NULL,status TINYINT NOT NULL,PRIMARY KEY (id),UNIQUE id (id),KEY id_2 (id))

proxypeeper.php
PHP Code:
<?php # # ProxyPeeper # Version 0.02a # Dec. 31 / 2012 # # Written by Geoff Ellis # geoff[@]undergroundsystems.co # # Check to see if user is accessing site # through an open proxy and check/record # data to a database # @include 'pp.mysql.function.php'; @include 'pp.isproxy.function.php'; $ip = $_SERVER['REMOTE_ADDR']; if(pp_checkip($ip) == 2) { if(pp_isproxy() == 1) { pp_addip($ip, 1); die("Banned"); } elseif(pp_isproxy == 0) { pp_addip($ip, 0); } } elseif(pp_checkip($ip) == 1) { die("Banned"); } ?>

pp.isproxy.function.php
PHP Code:
<?php # # ProxyPeeper # Version 0.02a # Dec. 31 / 2012 # # Written by Geoff Ellis # geoff[@]undergroundsystems.co # # pp.isproxy.function.php # Check to see if user is accessing site # through an open proxy. # function pp_isproxy() { # Specify ports here you would like to check # Do not add too many otherwise it will # significantly decrease page loading times $ports = array(80, 1080, 3128, 8080); $ip = $_SERVER['REMOTE_ADDR']; $success = 0; foreach ($ports as $port) { $attempt = @fsockopen($ip, $port,$errno,$errstr,$timeout=5); if (is_resource($attempt)) { $success = $success + 1; if ($success >= 0) { # Return: Is Proxy return 1; fclose($attempt); } else { # Return: Is NOT Proxy return 0; fclose($attempt); } } else { # Return: Is NOT Proxy return 0; fclose($attempt); } } } ?>

pp.mysql.function.php
PHP Code:
<?php # # ProxyPeeper # Version 0.02a # Dec. 31 / 2012 # # Written by Geoff Ellis # geoff[@]undergroundsystems.co # # pp.mysql.function.php # Check database to determine if users IP exists # And or if it is banned/allowed # Add IP if users IP does not exist # function pp_sqlconnect() { # Specify database connection data here $db_username = ""; $db_password = ""; $db_database = ""; $db_server = "localhost"; @mysql_connect($db_server, $db_username, $db_password); @mysql_select_db($db_database); } function pp_addip($ip, $status) { pp_sqlconnect(); $query = "INSERT INTO pp_ipaddr VALUES ('','$ip','$status')"; @mysql_query($query); @mysql_close(); } function pp_checkip($ip) { pp_sqlconnect(); $query="SELECT * FROM pp_ipaddr WHERE ipaddr='$ip'"; $result=@mysql_query($query); if(@mysql_num_rows($result) != 0) { $data=@mysql_fetch_row($result); if($data[2] == 1) { return 1; } elseif($data[2] == 0) { return 0; } } else { return 2; } @mysql_close(); } ?>

Reply

RE: ProxyPeeper v0.02a (w/ Database Support) #2
I'd made something similar here :
http://www.hackcommunity.com/Thread-Bann...-and-mySQL

Would you like to share how would you get the list of proxies to add to the database?
[Image: 2YpkRjy.png]
PM me if you need help.
My pastebin HERE. My URL Shortener HERE.

Reply

RE: ProxyPeeper v0.02a (w/ Database Support) #3
(12-31-2012, 08:33 AM)The Alchemist Wrote: I'd made something similar here :
http://www.hackcommunity.com/Thread-Bann...-and-mySQL

Would you like to share how would you get the list of proxies to add to the database?

Mmm i think youve missed the point of this script. Perhaps i should have put a better explanation.

This script is actually active in testing a users ip address to see if the connection is being made from an open proxy server. The only IP's that are added to the database ive created are ones that have directly accessed the script and have been tested for an open proxy. Its not merely a simple ban list.

As such, I dont find it necessary to go out and actually search for data to populate the database with, as this will populate itself with current data as users approach it.

Reply

RE: ProxyPeeper v0.02a (w/ Database Support) #4
Stopped on the include function..You have used '@' before include.No good programmer should use it.Every error needs to be debugged.Using it will not help anyone and will hide the error even when file can not be included.I suggest you remove it

Reply

RE: ProxyPeeper v0.02a (w/ Database Support) #5
(01-24-2013, 10:54 AM)hackarchives Wrote: Stopped on the include function..You have used '@' before include.No good programmer should use it.Every error needs to be debugged.Using it will not help anyone and will hide the error even when file can not be included.I suggest you remove it

i respectfully disagree. on a production system errors are a great way to lead to explotation. its information leak. it gives potential attackers more information than they should have.

Reply

RE: ProxyPeeper v0.02a (w/ Database Support) #6
Do you think include errors find a place on a production system.I done some work for IBM too and believe me no one should use it.Even the developers won't recognize their mistake because this won't get logged

Reply

RE: ProxyPeeper v0.02a (w/ Database Support) #7
Considering ive just posted it online, and i dont know who is going to run it on what system with what error reporting, id rather errors didnt show up by default. I could use more advanced error checking/handling, but even if i /had/ used better error checking, I would still used the error suppression.

But i dont consider you having done some work for IBM a reason to just take what you say at face value. So if youd like to present some well written support. Say from a book, or even the PHP manual perhaps, I might consider your point of view. But as it stands right now its just your opinion, and i disagree.

Reply

RE: ProxyPeeper v0.02a (w/ Database Support) #8
Agreed.You should not believe everyone on forums and i tend not to support my point further.Just consider that as an opinion and feel free to take it if u wish[i know you won't].

Just remembers even the developers won't see the error

Reply

RE: ProxyPeeper v0.02a (w/ Database Support) #9
(01-24-2013, 11:26 AM)hackarchives Wrote: Agreed.You should not believe everyone on forums and i tend not to support my point further.Just consider that as an opinion and feel free to take it if u wish[i know you won't].

Just remembers even the developers won't see the error

At this point your right, i wont accept your opinion as-is. But thats not cause i was unwilling to consider it. I did to some, albeit brief (~5 results), research after your first response and i found no conclusive argument that it should never be used.

Reply

RE: ProxyPeeper v0.02a (w/ Database Support) #10
Sorry if i said never.I read about it more during this discussion[thanks to you] and found out that it can be used in some cases.So i must say you are not wrong but here is something you can help other developers who use your program.

PHP Code:
$my_file = @file ('non_existent_file') or die ("Failed opening file");
It's right from php.net

Reply