Digital Paint Discussion Board

Fairness Enforcement => Cheater Reports and Bans => Topic started by: jitspoe on May 19, 2006, 03:00:37 PM

Title: CrAcKaIn
Post by: jitspoe on May 19, 2006, 03:00:37 PM
Name used: CrAcKaIn
IP's: 72.81.6.71, 72.81.34.111
Servers: 207.172.49.149 - ?, 71.195.26.204 - [SR] Sonic Revolution
Dates: 2006-05-17 16:13:20 CDT, 2006-05-17 21:10:53 CDT, 2006-05-18 9:45:17 CDT
Cheat detected: Wallhack (Probably CS variant).
Title: Re: CrAcKaIn
Post by: bug on May 19, 2006, 08:20:22 PM
--AutoGBL Log--

(ADDED SERVER BAN) sv addip 72.81.6.71
(ADDED WEB BAN) |72.81.6.71
(ADDED SERVER BAN) sv addip 72.81.34.111
(ADDED WEB BAN) |72.81.34.111
Title: Re: CrAcKaIn
Post by: Smokey on May 20, 2006, 12:56:59 AM
having it added to server bans is pointless... w/e floats your boat though. the web ban is somewhat useful...besides proxy's
Title: Re: CrAcKaIn
Post by: bug on May 20, 2006, 01:56:26 AM
having it added to server bans is pointless... w/e floats your boat though. the web ban is somewhat useful...besides proxy's

I can enable/disable proxy support at will, I just don't want to block out all the AOL kiddies.
Title: Re: CrAcKaIn
Post by: Smokey on May 20, 2006, 03:28:04 AM
i can get to your site even if you ban my ip. proxy support or not.
Title: Re: CrAcKaIn
Post by: Qoo on May 20, 2006, 08:06:39 AM
AOL doesn't use an open proxy, it just routes the users through their nearest AOL network gate.  (usually in the US, no matter where you live in the world  :-\).  The only way you could ban all AOL users would be to ban the entire range.


Also, if you are using a php script or something to block proxies, it will only block ones that forward the information that they are a proxy. There is no way to tell that the IP of an elite proxy is actaully that. (unless you have a big list of open web proxies)

Then after all this you'd want to block tor exit nodes too.   ;)
Title: Re: CrAcKaIn
Post by: bug on May 20, 2006, 12:16:29 PM
Qoo,
What I was saying was that I do not want to block out AOL kiddies, which is why I don't usually use my proxy detection script.

Smokey,
The proxy script is now enabled, I would very much like to see a sshot of you getting past it. It isn't perfect, but quite effective.
Title: Re: CrAcKaIn
Post by: Smokey on May 20, 2006, 02:15:51 PM
i got to your site. didnt even ban me lmao  ::)
Title: Re: CrAcKaIn
Post by: loial21 on May 20, 2006, 02:56:46 PM
ss?
Title: Re: CrAcKaIn
Post by: Qoo on May 20, 2006, 06:13:25 PM
Yeah, and what I'm saying is that aol doesn't identify itself as a proxy.  It wouldn't forward HTTP_X_FORWARDED_FOR, HTTP_VIA and HTTP_PROXY_CONNECTION, which is what the proxy detection script looks for in non elite proxies.

A screenshot of a basic free web based proxy:

http://img81.imageshack.us/img81/8160/rock5ft.jpg
Title: Re: CrAcKaIn
Post by: TinMan on May 20, 2006, 07:45:41 PM
That is a CGI proxy, by default it only does ftp and http, I made a little list of some of them here. (http://www.neonpulse.net/lol) I use them to check my e-mail at school and play some flash games that are blocked.
Title: Re: CrAcKaIn
Post by: Qoo on May 20, 2006, 08:47:08 PM
Yes but they can still choose to forward those variables or not.  That particular one doesn't, thus me being able to still access his site through it.

Talking about his webserver not paintball, to be clear.  :D
Title: Re: CrAcKaIn
Post by: bug on May 20, 2006, 11:08:59 PM
Yes, I am aware of that Qoo. My proxy script checks for a list of proxy variables that weak proxies send, as well as using a ***SECRET*** alternate method of finding them ;)

Also, thanks for the info on those CGI proxies! I have fixed most (if not all) frame-proxy problems. You'll see something quite humorous if you try those proxies now.

A big thank you to everyone who helped with this! The more advanced the proxy blocker becomes, the more effective the entirety of the GBL system becomes!
Title: Re: CrAcKaIn
Post by: Smokey on May 21, 2006, 12:48:12 AM
np
Title: Re: CrAcKaIn
Post by: Xsv-Boy on May 21, 2006, 09:19:39 PM
pbballer12593: so u were short then mikey then crackain?
SH0RTSTACK91: no
pbballer12593: ?
pbballer12593: who were you?
pbballer12593: you were mikey, and now your crackian?
SH0RTSTACK91: no
SH0RTSTACK91: i aint mikey
SH0RTSTACK91: mi brothers mikey but i aint
pbballer12593: crackain?
SH0RTSTACK91: im crackain nd mi bros mikey

ownt^^^^^^
Title: Re: CrAcKaIn
Post by: lekky on May 21, 2006, 10:18:18 PM
banned who cares
Title: Re: CrAcKaIn
Post by: TinMan on May 21, 2006, 11:07:01 PM
bug: nice "forbidden", lol, however tor still works  =P
Title: _
Post by: IronFist on May 22, 2006, 01:03:18 AM
Post removed
Title: Re: CrAcKaIn
Post by: bug on May 22, 2006, 01:23:26 AM
bug: nice "forbidden", lol, however tor still works  =P

TinMan,
If you see FORBIDDEN in big black letters without anything else, that means that you had an invalid referrer. The referrer check has been a part of my site ever since I released it...

As for TOR, I've played with it a bit, but when I tried it, every single tunnel was blocked (I tried refreshing it about 10 times). Coincidence that 10 different proxies from TOR are blocked? I have been considering adding RBL support, but really, I'd rather not tack on a 10-20 second load time to the already not-super-fast server.

IronFist,
I've already added the proxy.org blocklist to my htaccess.
For freak's sake! That TOR query list is huge! I might add a parser for it sometime, but for now, I'm not ready to take on a such a huge challenge.
Title: Re: CrAcKaIn
Post by: Qoo on May 22, 2006, 09:10:26 AM
http://img127.imageshack.us/img127/1282/rock8fh.jpg

http://proxy.org/tor_blacklist.txt
Title: Re: CrAcKaIn
Post by: bug on May 22, 2006, 02:25:47 PM
http://img127.imageshack.us/img127/1282/rock8fh.jpg

http://proxy.org/tor_blacklist.txt

Like I said before, I've already added the proxy.org TOR blacklist. I'm still working on blocking TOR, but for now, it's too large a task.
Title: Re: CrAcKaIn
Post by: Qoo on May 22, 2006, 03:56:57 PM
Oh OK I thought you were saying the tor list was so long you didn't have the time to format it for htaccess, and had missed the c&p file.


nm