VPN & Proxy Detection, Browser Spoof Detection using TCP

iloveghosts · #23 05-24-2018

Quote:

Originally Posted by nate

I'm confused... with stealth, the nail that stands out gets hammered. If you hide all your TCP info you would stand out. If you spoofed it to look like a regular user. You would look like you do now.

There is no one single finger print for a PC that I know of. There are only odds of how many other PC's have the same finger print. The more PC's have the same finger print the better off you are.

If you want to kill all this, why dont you run Windows or Linux with a GUI on a VPS and remote into it with teamviewer or something similar.

Because VPS and Teamviewer can be detected by WebSockets and analyzing behavior. Your mouse will be slow at remote stuff, or sometimes you face glitches. The mouse is not smooth at all. This can be easily detected using Machine learning. You just need to send all data, then ML algorithm does the magic.

iloveghosts · #24 05-24-2018

Quote:

Originally Posted by iloveghosts

Because VPS and Teamviewer can be detected by WebSockets and analyzing behavior. Your mouse will be slow at remote stuff, or sometimes you face glitches. The mouse is not smooth at all. This can be easily detected using Machine learning. You just need to send all data, then ML algorithm does the magic.

You do not have JS knowledge based on your talk. They can fingerprint everything, from your behavior to browser. Look at Biocatch, they can detect you even you switch computers. I do not need to hide TCP, I just want to spoof it to look like a normal user.

A user with Linux TCP print looks strange to them expect an android phone.

I know PayPal also use their own Biocatch system. Look at their JS, Mouse events clearly programmed into the script.

nate · #25 05-24-2018

And the plot thickens. I feel like Im watching fight club.

iloveghosts · #26 05-24-2018

Quote:

Originally Posted by nate

And the plot thickens. I feel like Im watching fight club.

Well, no fight club. Here is some simple example :

Browser Fingerprint: Mac OS X
TCP Fingerprint: Linux
ICMP Fingerprint: Linux

This, of course, gets a red flag from PayPal system. They have millions of users with millions of TCP & ICMP fingerprints, so I believe they can analyze everything better than WITCH or any other company.

Amazon is not using TCP/ICMP as per my research. They use another kind of stuff.

iloveghosts · #27 05-24-2018

Browser Fingerprint: Android
TCP Fingerprint: Linux
ICMP Fingerprint: Linux

This is a legitimate example.

nate · #28 05-24-2018

I feel like we are getting trolled... This user joined today. Admin could run his IP and see how good he is at stealth to see what we're dealing with.

Either he has a big vocabulary as a troll or he works for someone.

iloveghosts · #29 05-24-2018

Quote:

Originally Posted by nate

I feel like we are getting trolled... This user joined today. Admin could run his IP and see how good he is at stealth to see what we're dealing with.

Either he has a big vocabulary as a troll or he works for someone.

I do not troll anyone. I ask help from Experts. I used Proxy to sign up at Aspkin. I'm good at OpSec.

I had another account here but now I cant remember username or password.

nate · #30 05-24-2018

Quote:

Originally Posted by iloveghosts

I ask help from Experts.

Sounds like your the expert... Only reason I jumped on this thread is because it actually looked like it would stimulate my mind.... Instead you blew my brains out... And that doesn't happen to me on this forum anymore.

MM78 · #31 05-24-2018

This whole thread is pointless, we aren't hacking into the NSA or trying to do anything exotic.

By the way, I went to the site http://witch.valdikss.org.ru/ with my VMWare using my Portable Browser, while connected with my Proxy....and here are the results...

Every once in a while someone comes on here with some over the top bullsh*t when it isn't needed.

nate · #32 05-24-2018

Quote:

Originally Posted by MM78

This whole thread is pointless, we aren't hacking into the NSA or trying to do anything exotic.

By the way, I went to the site http://witch.valdikss.org.ru/ with my VMWare using my Portable Browser, while connected with my Proxy....and here are the results...

Every once in a while someone comes on here with some over the top bullsh*t when it isn't needed.

That thing only knows if the MTU isn't 1500. If your MTU isnt 1500 it assumes your using OpenVPN even if you not.

Or its a phishing site...

iloveghosts · #33 05-24-2018

Quote:

Originally Posted by MM78

This whole thread is pointless, we aren't hacking into the NSA or trying to do anything exotic.

By the way, I went to the site http://witch.valdikss.org.ru/ with my VMWare using my Portable Browser, while connected with my Proxy....and here are the results...

Every once in a while someone comes on here with some over the top bullsh*t when it isn't needed.

What about your OS shows in TCP? This tool is not modified, He just made it for DEMO but other companies already use TCP. Ok, I talk bull****, I will go to do my business then. None of you care about it.

iloveghosts · #34 05-24-2018

Compare your VM OS with TCP OS then see the difference.

iloveghosts · #35 05-24-2018

Quote:

Originally Posted by MM78

This whole thread is pointless, we aren't hacking into the NSA or trying to do anything exotic.

By the way, I went to the site http://witch.valdikss.org.ru/ with my VMWare using my Portable Browser, while connected with my Proxy....and here are the results...

Every once in a while someone comes on here with some over the top bullsh*t when it isn't needed.

By the way, NSA hacked long-time ago. I hope you know about shadow brokers and Snowden.

Here an example of a company who use TCP to prevent fraud and ⊗⊗⊗⊗ accounts.

https://www.pymnts.com/assets/Upload...Network-WP.pdf

iloveghosts · #36 05-24-2018

Detection of a mismatch between the operating system information reported by the browser compared with operating system information reported by the TCP/IP operating system fingerprint.

This Pymtns paper clearly describe this on Page 11

iloveghosts · #37 05-24-2018

MM78, The fact is your proxy os shows as Linux. This proves you are using Proxy/VPN.

iloveghosts · #38 05-24-2018

There is another site which use IP latency to detect proxies. You can see it from here https://whatleaks.com/

Scroll down to PING.

MM78 · #39 05-24-2018

Jesus Christ, it's like attempting to walk across a street by levitation instead of just using your feet. Stop trying to make it more complicated than it is.

iloveghosts · #40 05-24-2018

Quote:

Originally Posted by MM78

Jesus Christ, it's like attempting to walk across a street by levitation instead of just using your feet. Stop trying to make it more complicated than it is.

Ok but scroll down in the same site, and see passive os fingerprint then send me a screenshot.

iloveghosts · #41 05-24-2018

Quote:

Originally Posted by MM78

Jesus Christ, it's like attempting to walk across a street by levitation instead of just using your feet. Stop trying to make it more complicated than it is.

............................... ............................

nate · #42 05-24-2018

Not true... It says exactly what his says or I used text editor too I suppose just to troll you right? And my home IP is on blocked list... I kind of find that hard to believe since it comes from Time Warner but WTF.

iloveghosts · #43 05-24-2018

I have Hackintosh VM, so the text different in mac then. Ok, He is honest then. Jesus will love him. It looks like you are near to IP location that's why it does not catch the PING.

What about your Passive OS fingerprint? None of your guys showed me that one.

MM78 · #44 05-24-2018

Quote:

Originally Posted by iloveghosts

What about your Passive OS fingerprint? None of your guys showed me that one.

Keep your pants on....