Private IP/IP Obfuscator

Post Reply

Author	Message Topic Search Topic Options Post Reply Create New Topic Printable Version Translate Topic
remy Members Profile Find Members Posts Groupie Joined: 24 March 2006 Status: Offline Points: 43	Post Options Post Reply Quote remy Report Post Thanks(0) Quote Reply Topic: Private IP/IP Obfuscator Posted: 05 February 2009 at 3:47pm
	I am seeing a fair amount of IP addresses appearing on my site from 10.x 192.168.x networks. Now my understanding is that these are private addresses and shouldn't be routable over the net. How are they being reported as in use? My guess is that there's some public proxy involved somewhere but I'm still flumoxed as to how these packets are being routed? I know this isn't a support issue per se but wondered if others had come accross this. I know I can simply block the top level address spaces to stop this occurring.

iSec Members Profile Find Members Posts Senior Member Joined: 13 February 2005 Status: Offline Points: 1140	Post Options Post Reply Quote iSec Report Post Thanks(0) Quote Reply Posted: 05 February 2009 at 6:16pm
	I have seen this appear on my forum; I have also seen the 127.0.0.1 address appear sometime. The good thing about WWF is that it now allows you to view logs... including errors that are a result of a failed SQL-Injection hacking. Here is an example of an Australia-based IP address from my forum logs: 2009-02-03 05:29:44 - 123.14.174.34 - Guest - ERROR - File: functions_filters.asp - Error Details: err_SQLServer_SqlInjectionTest() - - 2009-02-03 05:29:48 - 123.14.174.34 - Guest - ERROR - File: functions_filters.asp - Error Details: err_SQLServer_SqlInjectionTest() - - 2009-02-03 05:29:52 - 123.14.174.34 - Guest - ERROR - File: functions_filters.asp - Error Details: err_SQLServer_SqlInjectionTest() - - My point is, if you suspect those 192.168... IP's doing something on the forum, you can see exactly what they are trying to do through these logs. Edited by iSec - 05 February 2009 at 6:32pm
	"When it gets dark enough, you can see the stars" -Charles A. Beard

WebWiz-Bruce Members Profile Find Members Posts Admin Group Web Wiz Developer Joined: 03 September 2001 Location: Bournemouth Status: Offline Points: 9844	Post Options Post Reply Quote WebWiz-Bruce Report Post Thanks(0) Quote Reply Posted: 06 February 2009 at 9:48am
	The problem is that ASP reads the IP address from the header that is sent by the browser. This can be easily spoofed to hide a real IP address.
	Web Wiz Forums Hosting ASP.NET Web Hosting

Post Reply

Forum Jump

Forum Permissions View Drop Down

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot delete your posts in this forum
You cannot edit your posts in this forum
You cannot create polls in this forum
You cannot vote in polls in this forum