绕过代理获取访客真实IP

90_

FROM:http://zone.wooyun.org/content/18274

from:https://github.com/diafygi/webrtc-ips

Firefox 跟 Chrome支持WebRTC可以向STUN服务器请求，返回内外网IP，不同于XMLHttpRequest请求，STUN请求开发者工具当中看不到网络请求的。

演示链接

[AppleScript] 纯文本查看 复制代码

//get the IP addresses associated with an account
function getIPs(callback){
    var ip_dups = {};
 
    //compatibility for firefox and chrome
    var RTCPeerConnection = window.RTCPeerConnection
        || window.mozRTCPeerConnection
        || window.webkitRTCPeerConnection;
    var mediaConstraints = {
        optional: [{RtpDataChannels: true}]
    };
 
    //firefox already has a default stun server in about:config
    //    media.peerconnection.default_iceservers =
    //    [{"url": "stun:stun.services.mozilla.com"}]
    var servers = undefined;
 
    //add same stun server for chrome
    if(window.webkitRTCPeerConnection)
        servers = {iceServers: [{urls: "stun:stun.services.mozilla.com"}]};
 
    //construct a new RTCPeerConnection
    var pc = new RTCPeerConnection(servers, mediaConstraints);
 
    //listen for candidate events
    pc.onicecandidate = function(ice){
 
        //skip non-candidate events
        if(ice.candidate){
 
            //match just the IP address
            var ip_regex = /([0-9]{1,3}(\.[0-9]{1,3}){3})/
            var ip_addr = ip_regex.exec(ice.candidate.candidate)[1];
 
            //remove duplicates
            if(ip_dups[ip_addr] === undefined)
                callback(ip_addr);
 
            ip_dups[ip_addr] = true;
        }
    };
 
    //create a bogus data channel
    pc.createDataChannel("");
 
    //create an offer sdp
    pc.createOffer(function(result){
 
        //trigger the stun server request
        pc.setLocalDescription(result, function(){});
 
    }, function(){});
}
 
//Test: Print the IP addresses into the console
getIPs(function(ip){console.log(ip);});

丨丶钟情

感谢分享

蟹老板

哇哦，是之前鸡鸡说的 开了http代理跟没开一样。原来是这样， 虽然没怎么看懂，收藏 以后慢慢看，。

小龙

borall

perble

支持中国红客联盟(ihonker.org)

r00tc4

感谢楼主的分享~

cl476874045

支持中国红客联盟(ihonker.org)

54hacker

支持，看起来不错呢！

云游者

感谢楼主的分享~