See what information websites can see about you

Have you ever wondered what type of information that websites and apps can collect about you? There are various techniques that they can use to track you and tell who you are, even if you are behind a VPN. Please take a look at what information I have gathered about you. Please also try hiding behind a VPN and see what changes. If you are interested in how I implemented this, scroll to the bottom.

Detect My Info Again

Your Web Request Information

Component	Your Information
Server Info

Your DNS Information

Component	Your Information
Server Info

Your Browser Information

Component	Your Information
Browser Info

Browser Fingerprint and DNS Leak Tool

This tool helps you see information that your browser can collect about you, which IP address you are using, detects which DNS server is making your requests so that you can detect DNS leaks, and attempts to use cookies to try and keep your original IP address you used when using this tool. Try connecting to a VPN or Proxy and click the ‘Detect My Info’ to see how your information changes.

DNS Leak to identify you

What is a DNS leak and why do you care? When your browser/computer goes to make a web request it will need to get a translation to an IP address. If your DNS server doesn’t have that IP cached it will go ask some DNS authority. And the request will keep moving along until it reaches my DNS server. I basically trick your computer into forcing my server to get the request by creating a random subdomain. I then track that DNS request back to your session here. This can reveal your location if you are connected to a VPN and for some reason your DNS requests are not getting routed through your VPN. Unfortunately, I had to get a “bare metal” server where I could intercept port 53 (DNS) requests which means I had to run a separate server to get this info.

Your IP Information to identify you

Your IP address can reveal your location. I leverage a third party API to pass your IP address to and get back the information you see, such as your organization and location. If you are using a VPN you should see your VPN information there. Some of the third party API services for this are free up to a certain number of requests. This would be similar information you can glean from looking at whatismyipaddress.com

Clock drift to identify you

I came up with this idea where I will make some background requests from this web page to a third party world clock site. I then will compare the world clock time to your time on your computer, all in UTC. Additionally, I measure how long it takes to initiate and receive the results from the API request and divide it by 2 to get the one way latency of that request. This lets me better calculate the actual time received from the world clock site. If I didn’t do this then if the one way latency was 50ms, if the world clock time was 01:50:30.20 (H:M:S.ms) I would get that answer 50ms later so the actual time would have moved by 50ms in that time to 01:50:30:70 (H:M:S.ms). So, I remove the network latency from the equation. So, even if you are connecting thru a TOR connection or multiple VPN tunnels, I should be able to calculate the drift of your clock versus the world clock more accurately. Try it! Connect thru a VPN on the other part of the world; your clock drift should remain roughly the same. I also make a few requests and take the smallest latency to reduce the amount of error introduced by latency.

So why do you care about clock drift? If your drift is fairly small, it may not matter too much. However, if your drift is over 100ms then your clock is not getting updated by a world clock as frequently and it is getting more unique, when combined with other identifying info. The higher your drift, the more identifiable you are even as you try to hide other information. If you are over 1000ms (1 second) then you are becoming even more identifiable. So, even if you try to hide behind a VPN, I can still correlate your web requests with each other.

Timezone offset to identify you

I like the timezone offset in combination with your IP address location (and it’s corresponding timezone offset). For example, let’s say your IP address says you are in Los Angeles, CA, US but your time zone is Bangladesh. Chances are you live in Bangladesh but are connecting thru a VPN. Again, combining this with other identifying information makes it easy to track this user across their attempts to hide.

Toolbar Dimensions to identify you

I like this one because it tells me how big your toolbar is (where your URL bar and bookmarks are). I basically subtract inner from outer dimensions of your browser window. This will also help you identify if someone has the developer tools open. If someone has a fairly large X or Y dimension then it is likely they have developer tools open which means your user is trying to learn something about your site. You could dynamically change some contents of your page if you detect that, such as hiding your fingerprinting code.

Ad Blocker Detection

For this one, I basically simulate a google ad javascript loading and then check to see if the DOM was updated with that code. If the request failed then you are using an ad blocker. To prevent caching of the javascript so that I can detect if it is CURRENTLY being blocked, I add a random number to the web request so I won’t give you an erroneous answer about the current status of your ad blocker. By adding the random number to the request (e.g., https://www.googlesyndication.com/pagead/js/adsbygoogle.js?random=123456) it will force a new request every time you click ‘Detect My Info’ or reload the page.

Your Router IP Detection

This is a fun one. So, it turns out I can request local IP address ranges straight from the browser. However, browsers try to be smart and prevent background requests to sites that don’t let you do cross domain requests (CORS). Additionally, the browsers respond with ambiguous errors so you have no idea why it failed. However, by observing the behavior of these requests you can quickly see that requests that are valid will fail within a pretty fast timeframe and the requests that are invalid and going to an invalid IP address will timeout. So, by simply sending a bunch of well known router IP addresses for home and business networks, I can filter out the ones that error out (because of CORS errs) by simply looking at the ones that don’t timeout because the browser is trying to contact an IP address that doesn’t exist. Simple.. and now I have your router IP address.

Summary

There are many other pieces of information that your computer reveals about you that let’s advertisers pinpoint who you are. If someone wants to figure out who you are, and track your requests as you try to hide behind VPN, private browsers, TOR, etc there are lots of ways to do this. I just covered some of the ways that someone can track you. But there are others, including some of the other information I provide in the tool above.

If you want me to implement or discuss any of the other methods, be sure to contact me thru the contact form or by leaving a comment. I hope you enjoyed this.

If you are interested in the source code you can always look at the javascript by viewing the source code of this HTML page. If you are interested in the server side code, let me know!