IP Decode
reddit / irc

----------------------------------------------------------------------
dewyjns · 2022-07-16 06:54

WOuld like to ask something quick on unmasking IP. I found certian
users being able to unmask the IP of users. I did try /whois
<Username? but some part of the IP is masked. Wondering if there's
another way that it can be done ? For example:

 webchat@rj4.q6d.185.122.IP

&#x200B;

I can see the IP is most likely 122.185. xx.xx .. Is it possible to
unmask the remaining parts?

----------------------------------------------------------------------
adamus1red · 2022-07-16 11:17

Unless you're an operator of the IRC network. No.

----------------------------------------------------------------------
skizzerz1 · 2022-07-16 12:12

Common ways an IP may get unmasked:

1. An IRC Operator can just see the real IP in /whois
2. The user clicks a link to a server you control and you grab the IP
from your server’s access log
3. You initiate a DCC transfer or CTCP CHAT with the user and they
accept it
4. The user originally joins a channel before they set the mode to
mask their IP
5. Exploits that abuse network services

Note that case 1 requires some level of trust/privilege and cases 2-4
require end user interaction in some way (4 being a client
misconfiguration).

I’m not going to go into details on case 5 and whether or not it works
depends highly on the network and its configuration. Competently-
managed networks will have worked to patch out such exploits since it
would otherwise defeat the purpose of IP masking.

The tl;dr from this post is that there shouldn’t be a way for an
unprivileged user to unmask an IP without an informed user being aware
of the attempt.

----------------------------------------------------------------------
SadieCat69 · 2022-07-16 15:07

That looks like an InspIRCd half cloak. For IPv4 cloaks its possible
to iterate the entire visible range (2^16 addresses) and then ping
them to see if they're online and narrow it down that way. We
recommend people don't use half cloaking for this exact reason.

If this is your server you should switch to full cloaking instead.  If
you're worried about breaking bans you can keep your old `<cloak>` tag
after your new one and it'll be used for checking bans but not shown
to users.

----------------------------------------------------------------------
loulan · 2022-07-16 22:27

Surely a lot of these 2^16 addresses would respond to ping?

----------------------------------------------------------------------
SadieCat69 · 2022-07-16 22:38

Yes but you can combine it with other information to narrow it down
further e.g. ISP, TCP/IP stack fingerprinting, etc.

----------------------------------------------------------------------
dewyjns · 2022-07-17 06:45

Interestring. I noticed it also depends on certain ISP as not all of
them were showing any IP octals.

----------------------------------------------------------------------
webvictim · 2022-07-17 13:25

*octets

Also, ircds generally display an IP when the forward and reverse DNS
don’t match. You’d see a hashed hostname if they did match.

----------------------------------------------------------------------
dewyjns · 2022-07-17 14:12

yea, tht was typo. so what you saying is there's no way to unmask the
2 ocets unless you're may be admin/irc operator.

----------------------------------------------------------------------
webvictim · 2022-07-17 16:14

Correct.