December 28, 2002
Santa Comes Late: New pxytest Released
I bet you thought I was being a lazy slug, shirking my weblog duties over the holiday week. Ha! Nothing could be further from the truth. I was doing something useful: writing code instead of generating blather.
I'm pleased to announce the second public release of pxytest, a tool for detecting unsecured proxies. This release, version 1.36, is a significant update. It fixes one bug, adds one new proxy type, and provides a whole slew of new features.
Here's a summary of what's new in this release:
- Fixed problem where pxytest sucks down infinite amounts of data when it connects up to a streaming data source ($INPUT_THRESHOLD configuration parameter).
- New proxy type added: http-post.
- Incompatibility: the http test has been renamed to http-connect, and http is now an alias to it. So you can still request an "http" test but it will display as "http-connect".
- Can now specify proxy type all, which will be expanded out to scan for all known proxy types.
- Can control output verbosity (-v option, $DEFAULT_VERBOSITY configuration parameter).
- Can specify string for matching SMTP banner (-S option, $DEFAULT_SMTP_BANNER configuration parameter).
- Multi-threaded testing (-t option, $DEFAULT_THREADS configuration parameter).
- Can force all tests to run rather than stopping as soon as a proxy is detected (-a option).
- Added help (-h option).
- Added "80/http-post" and "8080/http-post" to basic test, using the new "http-post" test mechanism.
- Added "1180/socks4" to basic test, to catch open Wingate 3.0 proxies.
- Moved "6588" from full to basic test, to better detect unsecured AnalogX proxies.
Visit the pxytest home page for further information or to download a copy.
Thanks to everybody who has submitted suggestions for pxytest. Particular thanks to Bert Driehuis, Anthony Edwards, Furio Ercolessi, Bob Poortinga, David Ritz and Michael Tokarev. If the issue you raised is not addressed in this release (and I haven't already emailed you about it) please contact me and remind me.
As always, your comments are welcomed. If you want to suggest additions to the basic or full test lists, it will help me greatly if you can provide as much information as possible about the proxy type, its prevalence on the net, and examples I can test against.
Posted by chip
at 03:58 PM
to: Software
Permalink
| Comments (2)
| Trackbacks (0)
Trackbacks have been closed on this entry.
Congratulations on the release, Chip! Keep on fighting the good fight...
Posted by: davidnunez on December 28, 2002 11:30 PMHi.
Firstly let me say thankyou for releasing this superb application.
I have been playing around with it trying to use it for a specific spam (though not email) problem I have atm.
I assist with some technical matters where I can on a web based forum but unfortunately it has been hit hard by someone posting bot generated spam through various kinds of proxies.
It has now got to the point where a specific forum has been set up for this guy and all other forums shut while the admins of the forum try to sort it out.
Is there a simple way to adapt, and are you happpy for me to use your code so that it can scan a poster's IP for proxies and ban them.
At present I am doing it in a very horrible way (though it works OK) but I am sure there must be a more elegant manner.
The forum is a PHP application and I have it check for a session variable called proxycheck.
If it exists usage carries on as normal but if it doesn't then it checks the IP against known proxies from previous scans then runs
system( pxytest -v 2 -t $ip \| grep "Connected" )
If it returns true then I add the IP to a banned list to eliminate scanning in the future otherwise I allow to set an proxycheck session variable
With all my waffle I guess what I really mean is there a more sensible way of using your app to get to the desired (although unfortunate) goal of stopping anyone using a proxy from accessing the website ?
