I was wondering what gifted's index.php script did.
The new index.php script added this code at lines 1575 - 1614:
<?php
//We do not allow proxy here
if(@fsockopen($_SERVER['REMOTE_ADDR'], 80, $errstr, $errno, 1))
die("It would apprear you're using a proxy, so please, go fuck yourself!");
function checkProxy($ip){
$contactEmail="Goldkey0070@gmail.com";
$timeout=3;
$banOnProability=0.99;
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_TIMEOUT, $timeout);
curl_setopt($ch, CURLOPT_URL, "http://check.getipintel.net/check.php?ip=$ip");
$response=curl_exec($ch);
curl_close($ch);
if ($response > $banOnProability) {
return true;
} else {
if ($response < 0 || strcmp($response, "") == 0 ) {
//There's a lot of comment here that I removed, look it up on the index.php file if you're interested in what it says
}
return false;
}
}
$ip=$_SERVER['REMOTE_ADDR'];
if (checkProxy($ip)) {
echo "It would apprear you're using a proxy, so please, go fuck yourself! <br />";
}
?>
Basically, here is what it does:
if(@fsockopen($_SERVER['REMOTE_ADDR'], 80, $errstr, $errno, 1))
die("It would apprear you're using a proxy, so please, go fuck yourself!");
If port 80 is open on the user's computer, then display the message in the
die("") and kill the rest of the script. I've explained previously why doing this can cause a lot of false positives, you can read it here:
...
This would likely work somewhat, however would throw some false-positives for anyone with Port 80 on their network open (E.G running a web server, using a public WiFi network and other things all may have Port 80 open), not to mention this port can simply be remapped if needed meaning attackers can bypass this anyway. You can even check if it is open on your network
here, if it is this script will block you.
...
OpenVPN automatically uses Port 80, however this can be remapped to a different Port as the page describes allowing it to pass. My AWS VPS currently has
Port 80 closed, meaning this script would let me pass using it.
It would probably work for some bots, however it is not completely foolproof and may stop real users accessing your faucet.
function checkProxy($ip){
$contactEmail="Goldkey0070@gmail.com";
$timeout=3;
$banOnProability=0.99;
Create a function which will be called later and create three variables inside of it. These variables are:
- Some random e-mail address, not too sure what that is for (as it is not used anywhere else in the script).
- The amount of seconds for PHP to try to access the URL. If the URL can't be found in this amount of seconds (3) then the connection will die.
- If the URL returns higher than this number, then the user is banned - This should be explained more in the next few chunks of code. (It should also be spelled probability)
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_TIMEOUT, $timeout);
curl_setopt($ch, CURLOPT_URL, "http://check.getipintel.net/check.php?ip=$ip");
$response=curl_exec($ch);
curl_close($ch);
This basically gets the content from the page
http://check.getipintel.net/check.php?ip=USERSIP with the timeout set previously.
GetIPIntel is a service that scores IP addresses on how 'bad' they are (E.G if they are a proxy or bot).
However, this API is only free for a certain amount of requests per day (500 / 15 per minute), so if your faucet gets a lot of unique users this could do very little for you.
if ($response > $banOnProability) {
return true;
} else {
if ($response < 0 || strcmp($response, "") == 0 ) {
//snip
}
return false;
}
This code checks if the return from GetIPIntel is greater than the variable
banOnProability. If it is, then the function returns
true and marks the user to be blocked. Otherwise, the function returns false and lets them pass.
The
if ($response < 0 || strcmp($response, "") == 0 ) { is used to find if the response was empty and if the server is having any problems, though the code doesn't do anything in this so it is somewhat useless (unless you want to edit it yourself).
$ip=$_SERVER['REMOTE_ADDR'];
if (checkProxy($ip)) {
echo "It would apprear you're using a proxy, so please, go fuck yourself! <br />";
}
Finally, this piece of code gets the user's IP, checks it against GetIPIntel and if the function returns true, it says the exact same is if port 80 were open.
This is a more reliable method of detecting bots and other attackers than seeing if a port is open, however (unless you're winning to pay) it is only functional for 500 users per day.
There are no other changes to
the original code as far as I can see, feel free to check it yourself using
a difference checking tool. It should also be noted that this script only works with FaucetInABox version r63, as r64 changes the code in index.php significantly I believe.
