This is the new home of the egghelp.org community forum.
All data has been migrated (including user logins/passwords) to a new phpBB version.


For more information, see this announcement post. Click the X in the top right-corner of this box to dismiss this message.

Proxyscanner

Requests for complete scripts or modifications/fixes for scripts you didn't write. Response not guaranteed, and no thread bumping!
Post Reply
v
vako
Voice
Posts: 10
Joined: Sat Jan 12, 2008 3:12 am

Proxyscanner

Post by vako »

ive looked for all the proxyscanner tcls on the net
they seem not to work.
i need one that checks the users on channel join and verify if they are proxies and if they are since the chan is +Dm not to voice them.
i already have a Dnbsl but it doesnt CATCH all of them..

can anyone come with a good little script?
User avatar
rosc2112
Revered One
Posts: 1454
Joined: Sun Feb 19, 2006 8:36 pm
Location: Northeast Pennsylvania

Post by rosc2112 »

dnsbl does work, try adding more blacklist sites to it. Many of the older dnsbl sites are defunct, so try google searching for active ones, these are still active afaik:

spamhaus.org
njabl.org
sorbs.net

Might also need dialup blacklists and so on. Google is your friend.
v
vako
Voice
Posts: 10
Joined: Sat Jan 12, 2008 3:12 am

Post by vako »

that is nice but we must understand that new proxies arrive everyday...
so a proxyscanner can beat them if its well configured..

thats why the need. if anyone can please ill be much appreciated
User avatar
rosc2112
Revered One
Posts: 1454
Joined: Sun Feb 19, 2006 8:36 pm
Location: Northeast Pennsylvania

Post by rosc2112 »

That still implies adding them to a list, does it not?
v
vako
Voice
Posts: 10
Joined: Sat Jan 12, 2008 3:12 am

Post by vako »

if they can be added when the scanner detects them for further tries its fine with me
but the actual scanner is the difficult thing
User avatar
rosc2112
Revered One
Posts: 1454
Joined: Sun Feb 19, 2006 8:36 pm
Location: Northeast Pennsylvania

Post by rosc2112 »

How would you ever detect them, outside of having a list of known proxies? It's not like you can /whois someone and see something that identifies them as a proxy.

This should be a faq, because it's been discussed to death here.
User avatar
DragnLord
Owner
Posts: 711
Joined: Sat Jan 24, 2004 4:58 pm
Location: C'ville, Virginia, USA

Post by DragnLord »

Proxy scanners are unreliable as most "abusive" proxies use ports not normally used for proxies.
Scanning all 65536 ports on an IP for open relaying proxies that work for IRC takes a bit of time.
User avatar
strikelight
Owner
Posts: 708
Joined: Mon Oct 07, 2002 10:39 am
Contact:

Post by strikelight »

As for rosc's comments, proxy scanners work by actually attempting to connect to a suspected proxy host, as implied by DragnLord.

As for Dragn's comments about most abusive proxies being on random ports, I would have to disagree with "most" being on "random" ports, as "most" open proxies are open AND abused for that very reason of NOT being on random ports. IRC servers on many networks scan incoming connections for open proxies by connecting to select ports known for accepting connections for proxying.

That being said, once a proxied user has connected successfully to a server, and has entered a channel, the time it would take for a script to check for an open proxy on a host, would probably take longer than it would take for such a user to do their ill will, if ill will is indeed their intent.
User avatar
DragnLord
Owner
Posts: 711
Joined: Sat Jan 24, 2004 4:58 pm
Location: C'ville, Virginia, USA

Post by DragnLord »

If your going to go with the "scan ports" method it makes more sense to use a program designed to do that, instead of using eggdrop for that task. Scanning for proxies should be done by the network, not channel operators.

Bopm works well and fast with correct configuration, can be used as a chanop instead of as an ircop to ban from the channel and write to a blacklist.

My point is, use a program designed to do what you want in the most efficient way possible.
User avatar
strikelight
Owner
Posts: 708
Joined: Mon Oct 07, 2002 10:39 am
Contact:

Post by strikelight »

DragnLord wrote:If your going to go with the "scan ports" method it makes more sense to use a program designed to do that, instead of using eggdrop for that task. Scanning for proxies should be done by the network, not channel operators.

Bopm works well and fast with correct configuration, can be used as a chanop instead of as an ircop to ban from the channel and write to a blacklist.

My point is, use a program designed to do what you want in the most efficient way possible.
Assuming the user is running their own network, which is doubtful, since most IRCD's have proxy scanning add-ons.

If you still wish to do the proxy-scanning method, I think Ofloo created a non-blocking proxy scanning script. (Not really so much a proxy scanner as it is an open port scanner). A simple search in the script archive for "proxy" should yield a list of results which include his script.
User avatar
DragnLord
Owner
Posts: 711
Joined: Sat Jan 24, 2004 4:58 pm
Location: C'ville, Virginia, USA

Post by DragnLord »

strikelight wrote:Assuming the user is running their own network, which is doubtful, since most IRCD's have proxy scanning add-ons.

If you still wish to do the proxy-scanning method, I think Ofloo created a non-blocking proxy scanning script. (Not really so much a proxy scanner as it is an open port scanner). A simple search in the script archive for "proxy" should yield a list of results which include his script.
I have run bopm as a non ircop, configured to use "mode +b" instead of kline or gline, it can work that way. I have used a port scanning eggdrop along with bopm as a chanop to compare, bopm was faster and used far less system resources.

By all means, use an eggdrop to do your port scans if you wish. I'd rather use a tool designed to do the work when it's easily available.
User avatar
strikelight
Owner
Posts: 708
Joined: Mon Oct 07, 2002 10:39 am
Contact:

Post by strikelight »

Yea, not arguing the point that eggdrop may have innefficiencies compared to other tools. Regardless of any non-network tool though, I still think that any damage that such an ill-willed user wishes to perform from a proxy host, will have enough time to do so before such a tool would be able to ban him or her from the channel. (ie. spam, collect nicks, short flood, etc..)
User avatar
DragnLord
Owner
Posts: 711
Joined: Sat Jan 24, 2004 4:58 pm
Location: C'ville, Virginia, USA

Post by DragnLord »

strikelight wrote:Yea, not arguing the point that eggdrop may have innefficiencies compared to other tools. Regardless of any non-network tool though, I still think that any damage that such an ill-willed user wishes to perform from a proxy host, will have enough time to do so before such a tool would be able to ban him or her from the channel. (ie. spam, collect nicks, short flood, etc..)
That was the biggest problem I had when using eggdrop to scan ports, it took too long. The spammer/flooder was usually already gone, although the bans did keep them from making a quick repeat performance.
v
vako
Voice
Posts: 10
Joined: Sat Jan 12, 2008 3:12 am

Post by vako »

thing is i dont want to ban
i just dont want the bot to voice the user since its +Dm
and if possible write the proxy in a file so when it comes back it doesnt need to scan it again..

i searched in the tcl area and non of them worked!
m
metroid
Owner
Posts: 771
Joined: Wed Jun 16, 2004 2:46 am

Post by metroid »

You already made a topic about this and you were already answered there.

It's pointless to try again.
Post Reply