Go Remote_addr,http_client_ip,http_x_forwarded_for

Nap woke up suddenly want to forge IP address. A search, Mark.

SOURCE Address: http://www.cnblogs.com/lmule/archive/2010/10/15/1852020.html

--------------------------------------------------------------------------------------------------------------- --------------------------------------------

Look at the time of Ecshop's lib_base.php. the function that obtains the client real IP (real_ip), There are many cases of judgment, the main judge whether the client uses the agent, pay attention to the order of judgment, first determine whether the client uses proxy http_x_forwarded_ For

Let's just attach the Source.

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465 666768697071

/** * 获得用户的真实IP地址 * * @access  public * @return  string */functionreal_ip(){    static$realip= NULL;     if($realip!== NULL)    {        return$realip;    }    if (isset($_SERVER))    {        if(isset($_SERVER[‘HTTP_X_FORWARDED_FOR‘]))        {            $arr = explode(‘,‘, $_SERVER[‘HTTP_X_FORWARDED_FOR‘]);            /* 取X-Forwarded-For中第一个非unknown的有效IP字符串 */            foreach($arr AS $ip)            {                $ip= trim($ip);                if($ip!= ‘unknown‘)                {                    $realip= $ip;                    break;                }            }        }        elseif(isset($_SERVER[‘HTTP_CLIENT_IP‘]))        {            $realip= $_SERVER[‘HTTP_CLIENT_IP‘];        }        else        {            if(isset($_SERVER[‘REMOTE_ADDR‘]))            {                $realip = $_SERVER[‘REMOTE_ADDR‘];            }            else            {                $realip = ‘0.0.0.0‘;            }        }    }    else    {        if(getenv(‘HTTP_X_FORWARDED_FOR‘))        {            $realip= getenv(‘HTTP_X_FORWARDED_FOR‘);        }        elseif(getenv(‘HTTP_CLIENT_IP‘))        {            $realip= getenv(‘HTTP_CLIENT_IP‘);        }        else        {            $realip= getenv(‘REMOTE_ADDR‘);        }    }    preg_match("/[\d\.]{7,15}/", $realip, $onlineip);    $realip= !empty($onlineip[0]) ? $onlineip[0] : ‘0.0.0.0‘;    return$realip;}

By the way, the difference between $_server and getenv, getenv does not support the IIS ISAPI way of running PHP

one, not using the proxy server situation:

REMOTE_ADDR = Your IP
Http_via = no value or no display
Http_x_forwarded_for = no value or no display

second, the use of transparent proxy server situation: Transparent Proxies

REMOTE_ADDR = Last Proxy server IP
Http_via = Proxy Server IP
Http_x_forwarded_for = your real IP, after multiple proxy servers, This value resembles the following: 203.98.182.163, 203.98.182.163, 203.129.72.215.

This type of proxy server also forwards your information to your access object, and does not achieve the purpose of hiding the true Identity.

third, the use of ordinary anonymous proxy server situation: Anonymous Proxies

REMOTE_ADDR = Last Proxy server IP
Http_via = Proxy Server IP
Http_x_forwarded_for = proxy IP, After multiple proxies, This value resembles the following: 203.98.182.163, 203.98.182.163, 203.129.72.215.

Hides your real ip, but reveals to the Access object that you are using a proxy server to access Them.

Iv. use of deceptive proxy servers: distorting Proxies

REMOTE_ADDR = Proxy Server IP
Http_via = Proxy Server IP
Http_x_forwarded_for = Random IP, After multiple proxy servers, This value is similar to the following: 203.98.182.163, 203.98.182.163, 203.129.72.215.

Tells the Access object that you used a proxy server, but fabricated a bogus random IP to spoof it instead of your real ip.

V. Use of highly anonymous proxy servers: high anonymity Proxies (Elite Proxies)

REMOTE_ADDR = Proxy Server IP
Http_via = no value or no display
Http_x_forwarded_for = no value or not displayed, after multiple proxy servers, This value is similar to the following: 203.98.182.163, 203.98.182.163, 203.129.72.215.

Full use of Proxy server information replaces all of your information, as if you were using the proxy server directly to access the Object.

REMOTE_ADDR is the IP of your client when it "shakes hands" with your server. If you use anonymous proxy, remote_addr displays the IP of the proxy server.
HTTP_CLIENT_IP is the HTTP header sent by the proxy server. If "super anonymous proxy", the value of None is Returned. similarly, REMOTE_ADDR will be replaced with the IP of this proxy server.
$_server[' REMOTE_ADDR ']; The IP of the access side (possibly the user, possibly the Proxy)
$_server[' http_client_ip ']; Agent-side (may exist, can be forged)
$_server[' http_x_forwarded_for ']; The user is the agent in which IP is used (may exist or can be forged)

－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－

In Web Development. we may be accustomed to using the following code to obtain the IP address of the Client:
C # code

Copy the code code as Follows:
Preferential access to proxy IP
String IP = request.servervariables["http_x_forwarded_for"];
If (string. IsNullOrEmpty (IP)) {
Direct access to client IP without proxy IP
IP = request.servervariables["remote_addr"];
}

The above code appears to be Normal. unfortunately, there is a hidden danger!! Because the value of "http_x_forwarded_for" is obtained by obtaining the "x_forwarded_for" property of the HTTP header. so here is a way to provide a malicious attacker: you can forge IP address!!
Here is the test code:

Copy the code code as Follows:
HttpWebRequest request = (httpwebrequest) httpwebrequest.create ("http://localhost/ip.aspx");
Request. Headers.add ("x_forwarded_for", "0.0.0.0");
HttpWebResponse response = (httpwebresponse) Request. GetResponse ();
StreamReader stream = new StreamReader (response. GetResponseStream ());
String IP = Stream. ReadToEnd ();
Stream. Close ();
Response. Close ();
Request = null;

"ip.aspx" file Code:

Copy the code code as Follows:
Response.Clear ();
Preferential access to proxy IP
String IP = request.servervariables["http_x_forwarded_for"];
If (string. IsNullOrEmpty (IP))
{
Client IP is directly taken without proxy IP
IP = request.servervariables["remote_addr"];
}
Response.Write (IP);
Response.End ();

So. when you go to the test code to access the Ip.aspx File. " String IP = Stream. ReadToEnd (); " The IP data that this code takes is "0.0.0.0"!!!! (uh. in Real-world situations. such an IP address is definitely not the result we want. and in some voting systems to limit an IP can only vote 1 times, if it is also used similar code to obtain the other IP and then Judge.

Or if you use the above code to obtain an IP address and then no longer make data judgment, you may be able to further data destruction!!
For example, If you get an IP address in a code like the one above, you have a SQL statement:
String sql = "INSERT into (ip) VALUE ('" + IP + "')";
Then maybe the attacker can also do SQL injection for data corruption!!

So it seems that the method of using the "http_x_forwarded_for" property to obtain the client IP is no longer desirable.-_-# but if this method is not Used. then those who really use the proxy server. we can no longer obtain their real IP address (because some proxy servers "x_forwarded_for" this HTTP header plus access to the User's true IP address. oh, that's the way it is, something has to be lost ...

－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－

Look at these two posts, finally understand why the acquisition of IP after it is also verified, like I used to get the client IP directly through the remote_addr, and the idea of not to verify the alignment is very silly very naïve, must be severely hit!

Go Remote_addr,http_client_ip,http_x_forwarded_for