How do websites get your real IP address when you're proxied?

Question

From a trusted computer engineer and Rapidshare, it seems that its possible to get your real IP address when you're proxied. Note that I define proxied I mean using some kind of tunneling (VPN, SSH, etc) to another computer that does not share your IP address. I do NOT mean proxy sites, since with some trivial Javascript and some server side code you can get the IP address easily.

My question though is how? The computer engineer I mentioned said that you could just ask the browser directly (presumably with JS) and it would cough up your real IP. He also mentioned using a tracking image, although I don't think that will work since thats requested by the proxy, not you directly.

Answer 1

They could be using a flash or a java object which can use sockets and get the IP not relying on the browser. However that method would not work if you are connecting through a VPN.

Non-anonymous proxies (SOCKS etc.) are not worried about hiding your IP so they might send it in the header which Rapid Share then dissects and gets your IP.

It is also quite easy to determine a proxy using some checks. One way would be maintaining a list of proxies. Non-anonymous proxies state that the person is using a proxy in the headers.

VPN is almost undetectable unless you're using a blacklist as all the traffic is routed through the tunnel, not just HTTP.

Answer 2

On HTTP proxies, they can use a header name X-Forwarded-For. the format of this header looks like it:

X-Forwarded-For: client1, proxy1, proxy2 

this header added by http proxy, so web applications could easily check it, but of course anyone can send a fake header. this is supported by major proxy servers like Squid, MS ISA Server, Cisco Cache Engine, etc.