scan ip from a proxy scanner site

[TimeRider]

Here is what I got from .set errorInfo

Currently: invalid command name "::http::config"
Currently: while executing
Currently: "::http::config -useragent "lynx""
Currently: (procedure "::pchecker::isvpn" line 2)
Currently: invoked from within
Currently: "::pchecker::isvpn $ip"
Currently: (procedure "::pchecker::ipcheck" line 12)
Currently: invoked from within
Currently: "::pchecker::ipcheck $_raw1 $_raw2 $_raw3"

[CrazyCat]

LOL ! I forget to include the packages

The source is now up2date

[TimeRider]

CrazyCat, I think you are still missing something; a variable I guess.

Tcl error [::pchecker::ipcheck]: can't read "ip": no such variable

Currently: can't read "ip": no such variable
Currently: while executing
Currently: "lsearch -regexp $::pchecker::whitelist $ip"
Currently: (procedure "::pchecker::ipcheck" line 4)
Currently: invoked from within
Currently: "::pchecker::ipcheck $_raw1 $_raw2 $_raw3"

And, I think the script is good to go!

[CrazyCat]

This error occures because of the regexp, it seems to not find the IP in the connexion notice.
Can you edit the script and add:

Code: Select all

putlog "STR:$text"

just under

Code: Select all

if {[string match *!*@* $frm] || ![string match -nocase "*client connecting*" $text]} { return }

And send me by PM a few examples of the logs you'll have in party-line without changing anything.
I really need the original log to check the regexp.

[PeLL]

Hello,
can you make it work for on join channel?
the bot is oper, that works by doing a whois or a userhost.
Thank you very much for your help .

[CrazyCat]

Hello,
can you make it work for on join channel?
the bot is oper, that works by doing a whois or a userhost.
Thank you very much for your help .

You want to check only users joining a particular channel ? And no more checking all network connections ?

When you say your bot is oper, do you mean @ on the channel or ircop ? Because the script can only work if eggdrop is ircop, as majority of networks cloaks the IP and only irco can have the real IP.

[PeLL]

The eggdrop bot will be ircop with @.
To use in 2 or 3 channels.
when it does whois it gets the read IP, then when it is positive with your script it can gline or zline ..
The server is inspircd, you must see IP by whois.
Thank you for your answer .

[CrazyCat]

Here is a version working on channel join. To enable it, do .chanset #channel +scanip in partyline.

Note that I don't check if user is on several watched channels, and I didn't test the script with InspIRCd, I guess the raw 378 is the same than on UnrealIRCd.

Code: Select all

package require http
package require json

namespace eval pchecker {

	# proxycheck.io api key
	variable pckey "xxxxxx-xxxxxx-xxxxxx-xxxxxxxx"

	# min score to ban
	variable score 10

	# gzline message
	variable gmsg "Sorry, VPN are not allowed"

	# List of IP not checked
	# they are regexp style
	variable whitelist {"192\.168\.0\.1" "10\.0\.0\.*"}

	# List of blacklisted IP
	# regexp too :)
	variable blacklist {}

	# To enable on a chan, think to do
	# .chanset #chan +scanip
	setudef flag scanip

	bind join - * ::pchecker::whois
	bind raw - 378 ::pchecker::ipcheck

	proc whois {nick uhost handle chan} {
		if {![channel get $chan scanip]} { return }
		if {[isbotnick $nick]} { return }
		putquick "WHOIS $nick"
	}

	proc ipcheck {frm key text} {
		set ip [lindex [split $text " "] end]
		if {[lsearch -regexp $::pchecker::whitelist $ip] ne -1} { return }
		if {[lsearch -regexp $::pchecker::blacklist $ip] ne -1} {
			putquick "GLINE *@$ip +7d :$::pchecker::gmsg"
			return
		}
		::pchecker::isvpn $ip
	}

	proc json2dict {JSONtext} {
		string range [string trim [string trimleft [string map {\t {} \n {} \r {} , { } : { } \[ \{ \] \}} $JSONtext] {\uFEFF}]] 1 end-1
	}

	proc isvpn {ip} {
		::http::config -useragent "lynx"
		set pcheck [::http::geturl http://proxycheck.io/v2/${ip}?key=$::pchecker::pckey&vpn=1&risk=1]
		set data [json2dict [::http::data $pcheck]]
		if {[dict get $data status] == "ok"} {
			set proxy [dict get [dict get $data $ip] proxy]
			set risk [dict get [dict get $data $ip] risk]
			if {[expr $risk - $::pchecker::score] >= 0 } {
				lappend $::pchecker::blacklist [string map {\. \\\.} $ip]
				putquick "GLINE *@$ip +7d :$::pchecker::gmsg"
			}
		}
		::http::cleanup $pcheck
	}
}

[PeLL]

I thank you again.
I'm testing and if it works by activating the channel without having to have @.
It is perfect for a badword, bad nick and VPN check.
Thanks for your time .

[PeLL]

Again I request your help again.
I need to modify the file above to work with isproxyip.

I have modified things but do not execute if it is proxy or not.

This line works well, read the connections:

Code: Select all

set pcheck [::http::geturl http://api.isproxyip.com/v1/check.php?key=$::pchecker::pckey&ip=${ip}&format=json]

Thank you very much and I hope you can.

[CrazyCat]

If you just change the provider without modifying the code, it can't work.

Reading IsProxyIP documentation, the answer contains only three datas: status, ip and proxy.
The code I gave previously use a risk data which doesn't exist, and the status values are not the same (ok vs success)

Here is the modification of the proc isvpn to be used with IsProxyIP:

Code: Select all

proc isvpn {ip} {
      ::http::config -useragent "lynx"
      set pcheck [::http::geturl http://api.isproxyip.com/v1/check.php?key=$::pchecker::pckey&ip=${ip}&format=json]
      set data [json2dict [::http::data $pcheck]]
      if {[dict get $data status] eq "success"} {
         set proxy [dict get [dict get $data $ip] proxy]
         if {$proxy == 1 } {
            lappend $::pchecker::blacklist [string map {\. \\\.} $ip]
            putquick "GLINE *@$ip +7d :$::pchecker::gmsg"
         }
      }
      ::http::cleanup $pcheck
   } 

[PeLL]

I am sorry to report that it generates an error that also happened to me.

In the "success":

Code: Select all

if {[dict get $data status] eq "success"} {

Tcl error [:: pchecker :: ipcheck]: key "188.170.86.229" not known in dictionary
triggering bind :: pchecker :: ipcheck
Tcl error [:: pchecker :: ipcheck]: key "198.8.94.170" not known in dictionary
triggering bind :: pchecker :: ipcheck

It is as if the success is the scanned IP.

Thank you very much again.

[CrazyCat]

My bad, did it to quick

Code: Select all

proc isvpn {ip} {
   ::http::config -useragent "lynx"
   set pcheck [::http::geturl http://api.isproxyip.com/v1/check.php?key=$::pchecker::pckey&ip=${ip}&format=json]
   set data [json2dict [::http::data $pcheck]]
   if {[dict get $data status] eq "success"} {
      set proxy [dict get $data proxy]
      if {$proxy == 1 } {
         lappend $::pchecker::blacklist [string map {\. \\\.} $ip]
         putquick "GLINE *@$ip +7d :$::pchecker::gmsg"
      }
   }
   ::http::cleanup $pcheck
}

[PeLL]

Greetings CrazyCat
Thank you very much again for your time, I just tested and it works perfect.
again I thank you friend.

[simo]

i tried this for on connect (myselve i tried with inspircd)

but it didnt seem to work not sure what i did wrong the retrieve of the IP is fine
i checked with debug msg in channel and i dont get any error neither

Code: Select all

package require http
package require json

namespace eval pchecker {

   # proxycheck.io api key
   variable pckey "xxxxxxxxxxxxxxxxxxxxxx"

   # gzline message
   variable gmsg "Sorry, VPN are not allowed"



   proc json2dict {JSONtext} {
      string range [string trim [string trimleft [string map {\t {} \n {} \r {} , { } : { } \[ \{ \] \}} $JSONtext] {\uFEFF}]] 1 end-1
   }

 

proc isvpn {ip} {
   ::http::config -useragent "lynx"
   set pcheck [::http::geturl http://api.isproxyip.com/v1/check.php?key=$::pchecker::pckey&ip=${ip}&format=json]
   set data [json2dict [::http::data $pcheck]]
   if {[dict get $data status] eq "success"} {
      set proxy [dict get $data proxy]
      if {$proxy == 1 } {
         lappend $::pchecker::blacklist [string map {\. \\\.} $ip]
         putquick "ZLINE $ip +7d :$::pchecker::gmsg"
      }
   }
   ::http::cleanup $pcheck
}


#for UnrealIRCD
#bind raw - NOTICE ::pchecker::servconnectnick1b

proc servconnectnick1b {from keyword text} {
  global outputchan

      if {[string match -nocase "*client connecting on*" $text]} {
        set nick [lindex [split $text] 9]
        set hostmask [lindex [split $text] 10]
        set connectport [lindex [split $text] 8]
 
      if {[lsearch -regexp $::pchecker::whitelist $ip] ne -1} { return }
     if {[lsearch -regexp $::pchecker::blacklist $ip] ne -1} {
        putquick "ZLINE *@$ip 7d :$::pchecker::gmsg"
        return
      }
      ::pchecker::isvpn $ip
  }

        return 0
      }

      if {[string match -nocase "*client connecting at*" $text]} {
        set nick [lindex [split $text] 8]
        set hostmask [lindex [split $text] 9]
        set at [lindex [split $text] 6]
        set servername [lindex [split $text] 7]

      if {[lsearch -regexp $::pchecker::whitelist $ip] ne -1} { return }
     if {[lsearch -regexp $::pchecker::blacklist $ip] ne -1} {
        putquick "ZLINE *@$ip 7d :$::pchecker::gmsg"
        return
      }
      ::pchecker::isvpn $ip
  }
  
        return 0
      }
}


#for InspIRCD
#bind raw - NOTICE ::pchecker::servconnectnick1a
 
proc servconnectnick1a {from key text} {
        if {[string match *!*@* $from]} { return 0 }
        if {![regexp -nocase { CONNECT: Client connecting on port (\d+) \(class (\S+)\): ([^!]+)!([^@]+)@(\S+) \(([0-9a-f.:]+)\) \[(.*)\]} $text -> port class nick ident host ip realname]} { return 0 }
      if {[lsearch -regexp $::pchecker::whitelist $ip] ne -1} { return }
     if {[lsearch -regexp $::pchecker::blacklist $ip] ne -1} {
        putquick "ZLINE $ip +7d :$::pchecker::gmsg"
        return
      }
      ::pchecker::isvpn $ip
  }
        return 0
  }
}