anonymous posting

[Negative]

Dino,

I don't get it...

JPnyc is correct BUT (don't you always hate the butts)

OK... that's not what I don't get... it's just a funny typo

If the hothead ran the physical server all bets are off. You connect to one of my servers and I know your internal IP even if you use NAT, your browser, your screen resolution hell If I wanted I could tell how much disk space you have. I'm guessing that the hothead posted A session cookie trying to look cool

I'm not sure why it matters whether or not Mr. Hothead is running the server or not. How, when I'm using NAT, would you be able to see my internal IP (other than by using a cookie - not sure how that would even work)? If you can, I would like you to explain that. And if so, I would like you to explain how it matters whether or not you're running the server (and I really mean that... the more days go by, the more I realize I don't understand this stuff...).

[JPnyc]

Why couldn't an ip be stored in a cookie? A script that could write a cookie would most likely be coded by someone who also knew how to do, at the very least, a check for the ip of the requesting computer.

I didn't say it couldn't, just that I doubted it would be. What's the purpose of it? If the guy he's concerned about is the admin of the forum, he sure doesn't need to put the IP into a cookie to know what it is.

[dinowuff]

Yo neg, it wasn't a typo ;-)

Anyway, by server I mean WEB Server. IIS, Apache, whatever have built in functions that gather tons of data. You know that IP addresses are gathered but all sorts of other data is also captured by default. To get the NAT address one only has to ask. You can use encapsulation (pretty much a pain) or script the request in a session id (easiest)

Firewalls and ad ons like noscript will prevent most of this. But the main thing to remember is that YOU initiated the connection to my server, I didn't. In essence your firewall completely trusts my server 'cause you initiated the connection. Now all I need to do is (put simply) an ARP request.