Page 1 of 2 12 LastLast
Results 1 to 15 of 29
  1. #1
    Zaczero's Avatar
    Join Date
    Oct 2013
    Gender
    male
    Location
    localhost
    Posts
    3,272
    Reputation
    1460
    Thanks
    12,744
    My Mood
    Sleepy

    Post Why you should be using VPN on MPGH [IP leaking Proof of Work and how to fix it]

    Hello MPGH!

    Recently I found a way to leak IP addresses of the MPGH users and here is my proof of work.
    I'm also providing a quick and easy fix for the staff members.

    Let's start with the way how MPGH handles user images and signatures.
    What it does is simply include the image in the HTML (no cdn, no proxy, just a direct connection).
    There is nothing bad in this by itself but I found a smart way of matching the request with the mpgh username.



    Every request sends the referrer header with the url where the file is loaded from.


    Knowing this you can create a bot which checks the Who's Online page (https://www.mpgh.net/forum/online.php)
    and looks for people who are viewing our XYZ thread where the image has been loaded from.

    For optimal performance you can sort the list by "Last Activity" entry by adding ?sort=time parameter.


    The last step is to include the dummy image in your signature or thread and gather data.

    Data which you can gather using this method:
    * Thread id
    * Time
    * User id
    * Username
    * IP address
    * Country
    * Browser used


    And here goes my proof of work:


    How efficient it is?
    By running the bot for 3 days I was able to dump ~2000 users multiple times (25.000 requests).

    How effective it is?
    Sometimes you get false results so in order to make them more trustworthy you should dump a user at least 3-4 times.
    Success rate is around 80%

    How to fix it (easy way)
    Add referrer-policy header on server response which will restrict data being send from the client inside the referrer.
    I suggest using strict-origin-when-cross-origin.
    Read more here: https://developer.mozilla.org/en-US/...eferrer-Policy
    * note: it still will be possible to gather data using who's online but success rate will fall to around 10%
    * note2: for full fix I'd suggest disabling who's online feature for normal users

    How to fix it (hard way)
    Create cdn server which will redirect all media requests through it.

    Final words
    Please don't ban me lmao. This data is available for everyone anyways and I'm just showing the problem so it can be fixed quickly :3
    Also I want to show that you are not safe on the internet without VPN even if you visit trusted sites only.
    Also please consider switching to Tor https://www.torproject.org/ <3

    Donate for my small research and making MPGH a safer place for all of us ?
    BTC: 1NjW3K26ZPZeveW4st4sC249MfyW2w5ZP8
    ETH: 0x56b4ED755b7bDD75A954e168EB96f4501F75342d
    . . . malsignature.com . . .



    [ global rules ] [ scam report ] [ image title ] [ name change ] [ anime force ]
    [ league of legends marketplace rules ] [ battlefield marketplace rules ]

    "because everytime you post a picture of anime in here
    your virginity's time increases by 1 month"
    ~Smoke 2/18/2018


    Former Staff 09-29-2018
    Battlefield Minion 07-21-2018
    Premium Seller 03-04-2018
    Publicist 12-10-2017
    League of Legends Minion 05-31-2017
    Premium 02-05-2017
    Member 10-13-2013

  2. The Following 21 Users Say Thank You to Zaczero For This Useful Post:

    adderal (05-04-2019),CrispyRoll (04-16-2019),Hectard (04-09-2019),Jhem (04-10-2019),jijee (04-09-2019),[MPGH]Mayion (04-09-2019),[MPGH]meme (04-09-2019),[MPGH]MikeRohsoft (04-09-2019),mrv0jta91 (04-12-2019),[MPGH]niggo (04-09-2019),Ninja (04-09-2019),OfficerX (04-09-2019),pepenator (04-10-2019),Predator (04-09-2019),Psiyix (04-12-2019),Reign (04-11-2019),Sandwich (04-10-2019),Schiphol (04-09-2019),Sean (04-09-2019),summit (04-09-2019),Xenon~ (4 Weeks Ago)

  3. #2
    lo1a's Avatar
    Join Date
    Jan 2015
    Gender
    male
    Location
    Australia
    Posts
    4,511
    Reputation
    1872
    Thanks
    7,683
    My Mood
    Bitchy
    this is old news, and I'm suppose to be working on an image proxy but have been busy. I'll get around to it next week.

    This is no longer an issue. This has temporarily been fixed until I complete the image proxy.
    Last edited by lo1a; 04-09-2019 at 09:27 PM.





     





    dd/mm/yyyy
    Member - 31/1/2015
    Premium - 12/9/2016
    Call of Duty minion - 05/11/2016
    BattleOn minion - 28/2/2017
    Battlefield minion - 30/5/2017
    Other Semi-Popular First Person Shooter Hacks minion - 21/9/2017
    Publicist - 7/11/2017 - 2/8/18
    Cock Sucker - 1/12/2017 - Unknown
    Minion+ - 6/3/18
    Fortnite minion - 8/5/2018
    Head Publicist - 8/10/18

  4. The Following 6 Users Say Thank You to lo1a For This Useful Post:

    adderal (05-04-2019),Hectard (05-10-2019),[MPGH]meme (04-09-2019),mrv0jta91 (04-12-2019),Sean (04-09-2019),Zaczero (04-09-2019)

  5. #3
    Ferris Bueller's Avatar
    Join Date
    Feb 2011
    Gender
    male
    Location
    KFC
    Posts
    6,936
    Reputation
    465
    Thanks
    901
    My Mood
    Hot
    Damn this is pretty involved good work man!

    Not sure if it's a good idea to post exactly how to leak all these ip addresses though

  6. The Following User Says Thank You to Ferris Bueller For This Useful Post:

    Zaczero (04-09-2019)

  7. #4
    Trash's Avatar
    Join Date
    Mar 2016
    Gender
    male
    Posts
    2,809
    Reputation
    441
    Thanks
    958
    Not really that concerned unless they're DDoSing me like the skids they are.
    Past Name(s):
    ImThrowingMyLifeAway

  8. #5
    Hectard's Avatar
    Join Date
    Jul 2018
    Gender
    male
    Location
    Dave’s weedfarm
    Posts
    1,790
    Reputation
    817
    Thanks
    379
    My Mood
    Hungover
    Quote Originally Posted by Trash View Post
    Not really that concerned unless they're DDoSing me like the skids they are.
    why should they ddos a trash can LMAO

    Click here to add Noxey to chat and buy!

    The Best Accounts Store on MPGH - #1
    Top Quality Accounts & Service

    ♕ Most Active Seller with Lowest Prices Ever!
    ⫸ ⫸ Netflix / Spotify / NordVPN / ExpressVPN / Brazzers / PornHub / HBO / Hulu... ⫷ ⫷
    More than 100 Products! - ✨ Noxey Store


  9. The Following User Says Thank You to Hectard For This Useful Post:

    ZZAZZ_ (04-13-2019)

  10. #6
    Lupin's Avatar
    Join Date
    Jan 2016
    Gender
    male
    Posts
    2,949
    Reputation
    591
    Thanks
    663
    My Mood
    Happy
    I know people who got banned for using VPN's on here

  11. #7
    It looks like you’re writing unsubstantiated nonsense. Would you like to turn on all caps?
    Newsforce
    Former Staff
    Premium Member
    Cursed's Avatar
    Join Date
    Dec 2013
    Gender
    male
    Location
    Shermer High School
    Posts
    5,869
    Reputation
    3101
    Thanks
    4,244
    My Mood
    Buzzed
    Quote Originally Posted by Lupin View Post
    I know people who got banned for using VPN's on here
    Who? I proposed to admins that we disallow VPNs, like lf did, to cut down on the scamming... But was rejected due to how many users use and need to use VPNs on this site. I've been on a VPN while browsing MPGH hundreds of times...


    Quote Originally Posted by congress_ man View Post
    only time im not in the sky is when im low and dry
    Quote Originally Posted by Joe View Post
    Also IM isn't buggy at all


     

    Joined: 12-14-2013
    Donator: 1-16-2014 - 12-03-2015
    News Force (Gaming News): 10-17-2015 - 12-25-2015
    News Force (Technology News): 11-15-2015 - 12-03-2015
    News Force (Headlines): 11-27-2015 - 6-16-2016
    News Force (Head Editor): 11-27-2015 - 6-16-2016
    Premium: 12-03-2015 - ∞
    Middleman: 1-11-2016 - 6-10-2016
    Minecraft Minion: 2-28-2016 - 6-10-2016
    Marketplace Minion: 3-11-2016 - 6-10-2016
    News Force (Freelancer): 7-6-16 - ∞
    News Force (WTF News): 8-7-17 - ∞

    Rep and Thanks always appreciated!!!

  12. #8
    Joe's Avatar
    Join Date
    Jun 2015
    Gender
    male
    Location
    Somewhere nice
    Posts
    8,755
    Reputation
    2233
    Thanks
    2,553
    My Mood
    Busy
    Quote Originally Posted by Lupin View Post
    I know people who got banned for using VPN's on here
    Using private VPNs is fine like Nord

  13. #9
    niggo's Avatar
    Join Date
    Sep 2012
    Gender
    male
    Location
    At home
    Posts
    8,297
    Reputation
    1673
    Thanks
    2,471
    My Mood
    Angelic
    Quote Originally Posted by Lupin View Post
    I know people who got banned for using VPN's on here
    idk if it really was due to a vpn or maybe something else








    Quote Originally Posted by Snake View Post
    you're the prime of the primes
    if shitposting was transformers you'd be optimus prime and eternity would be bumblebee
    Quote Originally Posted by Organized Chaos View Post
    acoustic retarded cum slut
    = niggo
    Quote Originally Posted by FlavderKrasse View Post
    iM SO FUCKN SAD I GO FOR SUCIDE
    Quote Originally Posted by Hectard View Post
    Am I a racist if i say Nico niggo neee
    Quote Originally Posted by Snolfy44 View Post
    help
    how works it??
    Quote Originally Posted by Demon770 View Post
    How to hack
    Quote Originally Posted by ImThrowingMyLifeAway View Post
    niggo ugly lol
    Quote Originally Posted by Dot View Post
    I cannot wait to see you replying with another stupid reply
    Quote Originally Posted by Bowie View Post
    Stop shitposting for god sakes
    Quote Originally Posted by Poseidon View Post
    You're literally dumb.
    Quote Originally Posted by 71c View Post
    You're literally dumb.
    Quote Originally Posted by 71c View Post
    Stop shitposting for god sakes, You're literally dumb.

    i have 42rep power :>



  14. #10
    Lupin's Avatar
    Join Date
    Jan 2016
    Gender
    male
    Posts
    2,949
    Reputation
    591
    Thanks
    663
    My Mood
    Happy
    Quote Originally Posted by niggo View Post


    idk if it really was due to a vpn or maybe something else
    He was told to stop using VPN's cause there were too many different IP's from different countries logging on which would make scam reports a mess

  15. #11
    niggo's Avatar
    Join Date
    Sep 2012
    Gender
    male
    Location
    At home
    Posts
    8,297
    Reputation
    1673
    Thanks
    2,471
    My Mood
    Angelic
    Quote Originally Posted by Lupin View Post
    He was told to stop using VPN's cause there were too many different IP's from different countries logging on which would make scam reports a mess
    never seen anyone being banned for that, also you can see which IPs are from vpns and which is his main IP

    i wouldnt wanna know how my account would look like cause i have to change vpn server every 10mins due to IP bans when im doing some work in giveaways or the MP itself








    Quote Originally Posted by Snake View Post
    you're the prime of the primes
    if shitposting was transformers you'd be optimus prime and eternity would be bumblebee
    Quote Originally Posted by Organized Chaos View Post
    acoustic retarded cum slut
    = niggo
    Quote Originally Posted by FlavderKrasse View Post
    iM SO FUCKN SAD I GO FOR SUCIDE
    Quote Originally Posted by Hectard View Post
    Am I a racist if i say Nico niggo neee
    Quote Originally Posted by Snolfy44 View Post
    help
    how works it??
    Quote Originally Posted by Demon770 View Post
    How to hack
    Quote Originally Posted by ImThrowingMyLifeAway View Post
    niggo ugly lol
    Quote Originally Posted by Dot View Post
    I cannot wait to see you replying with another stupid reply
    Quote Originally Posted by Bowie View Post
    Stop shitposting for god sakes
    Quote Originally Posted by Poseidon View Post
    You're literally dumb.
    Quote Originally Posted by 71c View Post
    You're literally dumb.
    Quote Originally Posted by 71c View Post
    Stop shitposting for god sakes, You're literally dumb.

    i have 42rep power :>



  16. #12
    Trash's Avatar
    Join Date
    Mar 2016
    Gender
    male
    Posts
    2,809
    Reputation
    441
    Thanks
    958
    Quote Originally Posted by Hectard View Post
    why should they ddos a trash can LMAO
    Ask my ISP. Got no answers for my blackouts for Wi-Fi specifically.
    Past Name(s):
    ImThrowingMyLifeAway

  17. #13
    Ninja's Avatar
    Join Date
    Aug 2011
    Gender
    male
    Location
    MPGH
    Posts
    15,122
    Reputation
    2714
    Thanks
    6,596
    Thanks for this, excellent breakdown on the issue and nice explanation.
    You should more of these tbh. Revive Programming section !?

  18. #14
    RespectNF's Avatar
    Join Date
    Mar 2015
    Gender
    male
    Location
    At the top
    Posts
    4,393
    Reputation
    422
    Thanks
    764
    My Mood
    Angry
    Quote Originally Posted by Lupin View Post
    I know people who got banned for using VPN's on here
    From my knowledge we don't ban people for using a vpn, even staff members use them.

    We only require you to post your marketplace threads from your real ip so we can verify you are not a ban evader, after that you can use a vpn however you like.

    Quote Originally Posted by Joe View Post


    Using private VPNs is fine like Nord
    What do you mean by private ? All IP addresses on a VPN are available to everyone who wants to use them. If you are talking about dedicated ip which is dedicated exclusively to one person(And you have to pay more for it), then they are treated the same as a regular vpn on mpgh. It will still be recognizable that it's a VPN and a person must submit the thread from his/her actual IP. People can use Dedicated ip or public VPN addresses how they like as long as they are not posting marketplace threads from those.
    Want to buy something ? Check out my SHOP [Ton of sites available!]


    Contact me on MPGH Integrated chat by clicking on this link.

  19. #15
    Joe's Avatar
    Join Date
    Jun 2015
    Gender
    male
    Location
    Somewhere nice
    Posts
    8,755
    Reputation
    2233
    Thanks
    2,553
    My Mood
    Busy
    Quote Originally Posted by RespectNF View Post
    What do you mean by private ?
    I must've been misinformed then, I remember being told using any premium VPN (not private my bad) would be fine and using a public free one would put me at risk of accidental bans which when disputed you'd be able to tell its a vpn and unban.

Page 1 of 2 12 LastLast

Similar Threads

  1. Why you should buy USED PC parts.
    By AdobeStock in forum Computer Builds & Upgrades
    Replies: 51
    Last Post: 3 Weeks Ago, 12:30 AM
  2. Do you guys use VPN on MPGH?
    By GUG85t75r64H*&& in forum Marketplace Talk
    Replies: 8
    Last Post: 12-17-2016, 02:52 AM
  3. Why you should play on Insanes MPGH server
    By GBot! in forum Minecraft Discussions
    Replies: 8
    Last Post: 11-10-2010, 01:04 PM
  4. Replies: 24
    Last Post: 08-30-2006, 08:06 PM
  5. You should of used Diet...
    By arunforce in forum Entertainment
    Replies: 8
    Last Post: 06-08-2006, 09:05 AM

Tags for this Thread