Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Someone is proxy-mirroring my website, can I do anything?

news.ycombinator.com

Post reply on HN
Print view View original

211–220 of 310 posts

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#211

Post by mmcgaha »

ycommentator wrote: post #95

My networking knowledge isn't great, so apologies if this is wrong. But if it's not wrong, it could help. FIND THE IP FOR THE DOMAIN PS > ping sukuns.us.to Pinging sukuns.us.to [45.86.61.166] with 32 bytes of data: Reply from 45.86.61.166: bytes=32 time=319ms TTL=39 ... REVERSE DNS TO FIND HOST https://dnschecker.org/ip-whois-lookup.php?query=45.86.61.166 Apparently it's "Dedipath". And that WHOIS lookup gives an abu…

Block all of the prefixes that their AS announces too: https://bgp.tools/as/35913#prefixes

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#212

Post by someweirdperson »

spiffytech wrote: post #58
musabg wrote: post #27

1. Create fake url endpoint. And go to that endpoint in the adversary's website, when your server gets request, flag the ip. Do this nonstop with a script. 2. Create fake html elements and put unique strings inside. And you can search that string in search engines for finding similar fake sites on different domains. 3. Create fake html element and put all request details in encrypted format. Visit adversary's website…

> 5. Instead of banning them, return fake content (fake titles and fake images etc) if proxy is detected OR the ip is flagged. > 6. Don't ban the flagged ip's. She/He's gonna find another one. Make them angry and their user's angry so they give up on you. There's a popular blog that no longer gets linked on HN. The author didn't like the discussions HN had around his writing, so any visitors with HN as the referer ar…

Does anyone not have their referer header supressed or faked?

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#213

Post by SeriousM »

mkoryak wrote: post #143

> They are stripping all JS Are they now? Add a `visibility: hidden` to random elements on the page, and show them with javascript. OR Are they removing _all_ js? Have you checked whether they remove ` ` ? You can try to do script injection _into your own site_ to see if their mirroring software is smart enough to deal with all the different xss vectors. Bonus points: if they remove your ` attribute, add a style like…

Just try some of the polimorphic xss tricks hacker try in order to get JavaScript into a page. Portswigger has a wonderful page of an extensive xss list.

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#214

Post by 5350-uiop-1130 »

add some CSS to mess with their URLs

a[href*="sukuns"] { font-size: 500px!important; color: LimeGreen!important; }

pretty much destroys the page. i guess eventually they would give up in the specificity battle.

probably more stuff you could do with CSS to mess with them.

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#215

Post by krater23 »

michaelmior wrote: post #176
nuccy wrote: post #166

Earlier quoted context omitted.

Making js essential is not that hard, right? Just "display: none" on the root element, which is removed by js :) More sophisticated options can been found in other comments.

Forcing all users of your website to use JavaScript to get around a scammer is pretty heavy-handed.

Show me one website that today really works without javascript.

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#216

Post by aembleton »

tgtweak wrote: post #121
musabg wrote: post #27

1. Create fake url endpoint. And go to that endpoint in the adversary's website, when your server gets request, flag the ip. Do this nonstop with a script. 2. Create fake html elements and put unique strings inside. And you can search that string in search engines for finding similar fake sites on different domains. 3. Create fake html element and put all request details in encrypted format. Visit adversary's website…

Going defcon3 on proxies You can also write some obfuscated inline JavaScript that checks the current hostname and compares to the expected one and redirects when not aligned.

They are stripping all JS.

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#217

Post by eloff »

christophilus wrote: post #125
eloff wrote: post #90

Earlier quoted context omitted.

Seems like a good use case for a zip bomb. Return some tiny gzipped content that expands to 1gb.

Yeah. Their proxy is parsing the HTML and stripping it / modifying it, so they're obviously unzipping the responses on their servers. Create the honeypot endpoint, and if you get a request from that endpoint, reply with a zip bomb. Then, write a little script that repeatedly hits that honeypot URL. I quite like this idea.

Awesome, do post a follow-up on HN, I want to hear how this war with the proxy asshats plays out.

Re: Ask HN: Someone is proxy-mirroring my website, can I do anything?

#219

Post by rich_sasha »

musabg wrote: post #27

1. Create fake url endpoint. And go to that endpoint in the adversary's website, when your server gets request, flag the ip. Do this nonstop with a script. 2. Create fake html elements and put unique strings inside. And you can search that string in search engines for finding similar fake sites on different domains. 3. Create fake html element and put all request details in encrypted format. Visit adversary's website…

I read once a suggestion to serve gzipped requests which, gzipped, are tiny, but un-gzipped are enormous. Like GBs of 0s.

Not sure how you actually do it and if it serves your purpose but sounded neat.

Post reply on HN