Re: [Bug-wget] FTP PORT command code in v1.16.3?

[Tim Ruehsen]

On Monday 10 August 2015 16:37:35 address@hidden wrote:
> In the past it could be possible for a site over http connection to
> redirect wget to FPT using FTP PORT command so the site gets the real IP
> of the computer even when wget proxy command is in use I believe:
> https://lists.torproject.org/pipermail/tor-talk/2012-April/024040.html
> 
> Is that code still present in wget v1.16.3? It was present in v1.13.4.

By default Wget is using passive FTP. This avoids PORT (resp. EPRT and LPRT).

But your system administrator could change the default behavior via 
/etc/wgetrc and/or you could change it in ~/.wgetrc.

You can prove Wget's behavior with the -d command line option.
E.g. 'wget -d ftp://ftp.example.com/xyz' (fill a real FTP server here)
A PORT command would be printed to the screen.

*BUT* if the server reject the PASV command, Wget automatically falls back to 
PORT. This is a security thread to people who try to stay anonymous, the real 
client's IP will be shown to the FTP server.
I guess this is the what you are talking about !?

Anyways, this behavior has to be changed.

Thanks for throwing this up.

Tim

signature.asc
Description: This is a digitally signed message part.