auditmypc.com

Hi,

If I go with my windows PC (any browser) to the URL

it shows my private internal IP. If I do so with Linux/konqueror it also appears, with Windows Mozilla it doen's appear!

How do they get my internal IP?

Is it a bug in my iptables-Firewall, or ist it a trick of them to sell firewall software?

thanks in advance

Markus

ok, I found it, the page called a page named "/adt.asp". this page calls a java applet named "auditmypc.class" and the Class get the IP on clientside. Mozilla does't shows the Internal IP, because the adblock of my mozilla blocks the first Iframe.

Here the "(de)coded" javascript code:

##### inside scanoptions.asp: ###### document.write('\\u003c\\u0069\\u0066\\u0072\\u0061\\u006d\\u0065\\u0020\\u0073\\u0072\\u0063\\u003d\\u0022\\u002f\\u0061\\u0064\\u0074\\u002e\\u0061\\u0073\\u0070\\u0022\\u0020\\u0077\\u0069\\u0064\\u0074\\u0068\\u003d\\u0022\\u0032\\u0030\\u0030\\u0022\\u0020\\u0068\\u0065\\u0069\\u0067\\u0068\\u0074\\u003d\\u0022\\u0038\\u0030\\u0022\\u0020\\u006d\\u0061\\u0072\\u0067\\u0069\\u006e\\u0077\\u0069\\u0064\\u0074\\u0068\\u003d\\u0022\\u0031\\u0022\\u0020\\u006d\\u0061\\u0072\\u0067\\u0069\\u006e\\u0068\\u0065\\u0069\\u0067\\u0068\\u0074\\u003d\\u0022\\u0031\\u0022\\u0020\\u0061\\u006c\\u0069\\u0067\\u006e\\u003d\\u0022\\u0074\\u006f\\u0070\\u0022\\u0020\\u0073\\u0063\\u0072\\u006f\\u006c\\u006c\\u0069\\u006e\\u0067\\u003d\\u0022\\u006e\\u006f\\u0022\\u0020\\u0066\\u0072\\u0061\\u006d\\u0065\\u0062\\u006f\\u0072\\u0064\\u0065\\u0072\\u003d\\u0022\\u0030\\u0022\\u003e\\u003c\\u002f\\u0069\\u0066\\u0072\\u0061\\u006d\\u0065\\u003e')

##### "decoded": #####

##### adt.asp: #####

document.write('\\u003c\\u0061\\u0070\\u0070\\u006c\\u0065\\u0074\\u0020\\u0077\\u0069\\u0064\\u0074\\u0068\\u003d\\u0022\\u0031\\u0022\\u0020\\u0068\\u0065\\u0069\\u0067\\u0068\\u0074\\u003d\\u0022\\u0031\\u0022\\u0020\\u0063\\u006f\\u0064\\u0065\\u003d\\u0022\\u0061\\u0075\\u0064\\u0069\\u0074\\u006d\\u0079\\u0070\\u0063\\u002e\\u0063\\u006c\\u0061\\u0073\\u0073\\u0022\\u003e\\u000d\\u000a\\u003c\\u002f\\u0061\\u0070\\u0070\\u006c\\u0065\\u0074\\u003e')

##### "decoded": #####

Thanks,

Markus

Yup...It's a dirty little java trick to get you to buy there security software. I wonder how their software fixes it? Must be some "magic disable java script"!! lol

Give Portsense.com a try; it's not as fancy but works good.

SANman