dnsleak with brave browser

[cr8351]

I have dns leak with both brave browser and chromium but not in firefox. dnsleaktest.com shows both my real ip and proxy ip for socks5 proxies

[rofl0r]

probably using wrong proxy config then, or no proxy_dns at all

[cr8351]

It uses proxy_dns and default config with tor removed and socks5 proxy added

[rofl0r]

if it uses proxy_dns, and brave is correctly hooked, then the DNS lookup is done on the proxy. of course, if your proxy runs on localhost, that won't help you not leaking your ip.

[cr8351]

The proxy doesn't have the same ip as my real ip so how did it leak if it is done on the proxy?

[rofl0r]

that's for you to find out. i'd propose to start wireshark and see what actually happens.

[cr8351]

I am not sure what to look for in wireshark to find the cause but I am pretty sure it can be reproduced easily on any computer if you open a chromium browser with proxychains

[rofl0r]

i'd look for DNS requests accompanying your website accesses. if there are none, proxychains works as expected. btw if you're using http proxies you don't control, they may add x-forwarded-for and similar privacy-defeating headers and reveal your source ip.

[cr8351]

There are DNS requests and they are socks5 proxies and also same leak with tor only. This only happens in chromium browsers and brave browser and not firefox

[rofl0r]

well if that is so then chromium (which i dont use nor have) probably crafts its own DNS UDP packets and does the lookups without involving libc, i.o.w. it can't be hooked. the only mitigation proxychains could provide is to entirely block all UDP related functionality in libc, but then the app could still circumvent it by using raw syscalls.