Wikipedia:Open proxies noticeboard/Guide to checking open proxies: Difference between revisions

Revision as of 00:25, 12 January 2018

Revision as of 04:16, 8 February 2018

Line 4:

# Step one: You would normally first have reason to suspect that an IP is an open proxy. There may be a banned user or sockpuppets using IP addresses from different countries, or the vandal or other users might mention it directly. There might be an IP already blocked as an open proxy requesting unblock.[http://en.wikipedia.org/w/index.php?title=User_talk:89.18.180.142&oldid=318350560] The edit might malform some wikitext.[http://en.wikipedia.org/w/index.php?title=San_Jose,_California&diff=prev&oldid=320637803] Proper spambots and vandalbots will also usually use open proxies.[http://en.wikipedia.org/w/index.php?title=Santorum&diff=prev&oldid=316919186] If there are no suspects around then you might want to find a recently blocked open proxy for testing.

# Identify the access point. You are hopefully going to use it yourself. Google the IP address. Do [[rDNS]] and [[WHOIS]] lookups. Be creative if you have to, like looklooking at neighbouring IP addressaddresses. While you're there check if it looks dynamic. The first question to ask is whether it's a web proxy or an HTTP proxy.

## Does it look like a web server? Keywords to look for in search results are PHP-proxy, CGI-proxy, Glype, and NPH, as well as ___domain names. Do the rDNS and WHOIS suggest it's a dedicated server or hosting range? Open the IP address in your browser. Is there a holding page, or even a web proxy there? Find which sites are hosted on it using rDNS and Google. Nmap will almost always say that port 80 is open on webservers, but this does not necessarily mean there is an open proxy there.

## Or does it look like an [[SOCKS#Comparison_to_HTTP_proxying|HTTP/SOCKS proxy]]? Such proxy IPs are always associated with a [[TCP and UDP port|port number]]. The most usual ones are 80, 1080, 3128, 8000, 8080, 8888, but it could be any number up to 65535. These ports are usually displayed in search results following the IP address and a colon, for example 111.282.3.1:3128. They are, in so far as they obfuscate e.g. the user's original IP address and other data, sometimes [[Proxy_server#Anonymous_HTTPS_proxy|referred to]] as "Transparent" or "Elite". Use the IP address with colon and port number in your browser's address bar. If the port is open there will usually be some response, but nothing very interesting. If a normal Nmap-portscan is used the ports will said to be open, but this does not necessarily mean there is an open proxy. Nmap can, however, check via its scripts [http://nmap.org/nsedoc/scripts/http-open-proxy.html http-open-proxy] and [http://nmap.org/nsedoc/scripts/socks-open-proxy.html socks-open-proxy] if they actually operate.