NikolaiT / zardaxt

Passive TCP/IP Fingerprinting Tool. Run this on your server and find out what Operating Systems your clients are *really* using.
Other
292 stars 33 forks source link

How are the os_mismatch and is_proxy values calculated? #10

Closed codemonies closed 2 years ago

codemonies commented 2 years ago

Hi,

Over here, there is the os_mismatch and is_proxy parameters: https://bot.incolumitas.com/proxy_detect.html

However, I can't figure it out how they're calculated. Is it if user agent doesn't match the highest avgScoreOsClass, or if the top score in bestNGuesses is below a certain threshold?

Thank you!

NikolaiT commented 2 years ago

Like this:

const axios = require('axios');

// TCP/IP Fingerprint Test
function tcpipfpTest(userAgent, ip) {
  return new Promise(function (resolve, reject) {
    let result = {
      is_proxy: false,
      lookup_ip: ip,
    };
    function S(string) {
      var regex = /avg=(\d*\.\d*)/
      return parseFloat(string.match(regex)[1]);
    }
    let url = 'https://tcpip.incolumitas.com/classify?key=snip&ip=' + ip;

    axios(url)
      .then(function (response) {
        let data = response.data;
        if (!data || !data["avgScoreOsClass"]) {
          return resolve(result);
        } else {
          // get os by tcp ip fingerprint
          // Linux, macOS or Windows
          let tcpip_os = {
            'linux': Math.max(S(data["avgScoreOsClass"]['Android']), S(data["avgScoreOsClass"]['Linux'])),
            'win': S(data["avgScoreOsClass"]['Windows']),
            'mac': Math.max(S(data["avgScoreOsClass"]['iOS']), S(data["avgScoreOsClass"]['macOS'])),
          }
          // get highest OS from TCP/IP fingerprint
          let highestOS = Object.keys(tcpip_os).reduce((a, b) => obj[a] > obj[b] ? a : b);

          let userAgentOS = 'win';
          if (userAgent.indexOf('Linux') !== -1) {
            userAgentOS = 'linux';
          }
          if (userAgent.indexOf('Android') !== -1) {
            userAgentOS = 'linux';
          }
          if (userAgent.indexOf('Mac OS') !== -1) {
            userAgentOS = 'mac';
          }
          if (userAgent.indexOf('iPhone') !== -1) {
            userAgentOS = 'mac';
          }

          result.details = data;
          result.os_mismatch = highestOS !== userAgentOS;
          result.vpn_detected = data["vpn_detected"];
          result.is_proxy = highestOS !== userAgentOS;
          return resolve(result);
        }
      }).catch((err) => {
        result.error = err;
        return reject(result);
      })
  });
}

exports.tcpipfpTest = tcpipfpTest;