Luigi Auriemma

Hey Luigi. I have a question about your tspeakfp tool.
I've been trying to set it up so I could flood a server and I usually do like this : tspeakfp -p **** -v 2.0.32.60 -x [IP] and it starts up.
The problem is that I always get banned for flooding on all the servers I tried...
Is there any way to fix this? Am I doing something wrong?



Thanks in advance Luigi.

well, that's enough normal since the admin or the anti-fakep_players mod see the flooding attack and bans your IP address.
the only way for bypassing the banning is changing your IP address, for example using a socks proxy but this will not avoid the banning of this other IP too

Ohhh... so using a socks proxy I can keep changing my IP in order to flood continuously? Which do you recomend ? Where to get it ? How do I use it ?


Thanks alot man.

you will not able to flood the server continuosly, you can only until you will get re-banned (not your real IP but that of the socks proxy server).

A socks proxy is just a machine which will be between you and the target, so the IP that the target will see is that of the server and not yours.

Now I will explain a bit how the things work since this is useful in future in case of other people which wants info about how using a proxy.
You need 2 things:
- a socks server to which you can connect
- a program which automatically "proxyfies" your programs

The socks servers are listed on many websites and they can be of various types, slow, fast (exist fast socks servers??? naaa), open socks created by admins with small computer knowledge, created by crackers, honeypots and so on.
Anyway you need one of these and it's enough to search "socks list" on a search engine for knowing the public lists maintained daily.
Note that a socks proxy is not the only choice with TCP connections since the HTTP proxies which allow CONNECT can be used at the same way.
Then remember that could be long to find a working proxy...

About the program to use (the "proxifier"), a good choice for Windows is SocksCap which unfortunately is no longer supported but it's simple to use and it's free.
You can still find it online somewhere but I think you must hex edit the executable, in this case I have created a patch for it.
For the moment do NOT use Freecap because it has many protocol bugs which don't make it to work correctly with some types of proxy or connections, I hope these bugs (I reported them to the author) will be fixed in the 3.19 version.

That's all

Ok m8 thanks alot for the explanation. Just another thing.. on the server that I tried to flood there is some random guy that can actually flood it like hell without getting banned. Any ideas on why he can and I can't ?

it's possible that he uses a longer delay during the attack using the -t or -T options.

A correction about Sockscap, version 2.40 no longer has the annoying "expiration" message so no hex editing is needed (except if you want to remove the annoying splash screen at 0xE888).

Well ye I thought that too but he floods really fast with a really low delay time. I've done few tests on the server and I can only maintain the fake players coming in if I put it with a delay of 6 seconds between each connection : -t 6 :S

Should SocksCap force ALL connections through a SOCKS proxy?

Sockscap redirects to the proxy all the connections made by the program you are proxyfying

Quick step-by-step to the usage of Sockscap (the latest version should be 2.40-051231):

- run sc32.exe
- go on File->Settings
- type the IP address of the SOCKS server you choosed and it's port (usually 1080)
- choose the version of the server, 4 or 5 (leave the default option)
- now select New from the main menu for adding the tool/program you want to use
- select the Command Line executable with the Browse button (for example peerchar_irc.exe) and click on OK
- now if you want to run the proxified program just double click on its icon in the main menu

Remember that you must be sure that the SOCKS proxy works so test it, for example using a proxified netcat for doing the tests (like "c:\folder\nc.exe 207.38.11.136 6667 -v -v -n", I have used directly the IP of peerchat.gamespy.com for being faster), and modify the relative setting each time you want to try a new proxy server.

in case someone is interested the second bug described here http://secunia.com/advisories/26141/ is probably referred to the command "help ..\..\..\..\boot.ini"
The current versions of Teamspeak now drops any dot and slash/backslash car.

Update for the TOR + Sockscap method, since this thread is linked in another thread too

Then with Tor there is no longer the need to find valid SOCKS servers, it's enough to:
- install the Tor/Vidalia Package http://www.torproject.org/download.html.en
- run sockscap, this tool is hard to find on the net so a ready to use copy is available on http://mirror.aluigi.org/misc/sockscap-2.40-051231.zip
- in the SOCKS settings place 127.0.0.1 and port 9050 as SOCKS server and select SOCKS Version 5 and "Resolve all names locally"
- launch Vidalia and start Tor from there
- go in SocksCap and add the program to socksify with the needed command arguments and Run it from there

It's incredible, today I was casually searching keywords like teamspeak flooder, teamspeak spammer or ts flood/spam on Youtube and ALL the videos about this argument used just my "Teamspeak Fake Players DoS" (tspeakfp) tool BUT saying that the program was written by themselves.
These morons think that creating a small launcher with a button for launching my tool gives them the right of not crediting me or doing worst things (like cancelling my references from source code and recompile it)... what idiots

I ran tor and then the socks program and it said everything was functional, I loaded firefox through it and it did infact say my IP had changed an I was located in France, but then tor started spitting warns that information could be leaking, so when I loaded gs arcade, it disconnected me immediately so it had to have gotten through, what should I do?

I did exactly what you said, and it appeared to be working, but when I load gs arcade I get this new error:

[Summary]
GameSpy Arcade experienced 'Access Violation' (0xc0000005) at address: 005F3997 01:001F2997 in module 'C:\Program Files\GameSpy Arcade 3\Aphex.exe'

depends by the method used by proxyfirewall to catch the packets of the programs, with sockscap (if I'm not in error) there is no such problem

It did the same exact thing with both programs, however the socks program works wonders at school for the lightspeed blockers!

Anywho, when I load up gs arcade tor says something like:

[WARN] This is just a change in your IP Address, anything using DNS may leak information.

except it's a lot longer.

Well I've been speaking with an admin, and last night I restored my pc, so either I talked them out of my ban or it has something to do with the registry.

About the proxy problem there is another trick you can try to bypass the crash.
Use the tool "GS Peerchat proxy decrypter 0.3a" aka peerchat_proxy available in my peerchat section:

http://aluigi.org/papers.htm#peerchat

before launching it socksify it using sockscap and then follow the instructions on the screen (if it will give you connection problems check if 127.0.0.1 is bypassed by sockscap for local addresses which if I'm not in error is by default, anyway just a note in case something doesn't work).

In short you will have the following situation:
- GSA will not connect to the GS peerchat server but to peerchat_proxy, so to your pc
- peerchat_proxy will get the connection and then will connect to the real peerchat server through the proxy set in sockscap (sockscap + tor)

seems a bit complex but in reality it's easy and will also give you the possibility of seeing the peerchat IRC protocol of GSA which is ever interesting

A little correction, Tor supports only TCP (socks5 supports both UDP and TCP but Tor allows only TCP at the moment) so the sockscap+tor thing cannot be applied to UDP games, so practically all the games.

yes I'm 100% sure, was enough to socksify netcat -u or idinfo and they quitted immediately.
Tried also quake 3 using both sockscap and the in-game socks support but doesn't work (in fact the servers guess my italian location perfectly).