Bypassing Firewalls and HTTP Proxies Part 3

Sometimes you will be behind a HTTP proxy.

This is likely when you're at places like work school, university, private networks.

If you look in the browser settings for the machine that you are forced to use, when you're on that network.

You can potentially tell whether or not you're using a proxy on that network.

So you will see something in here, maybe here HTTP proxy.

And if you do, you need to note down the IP address and the port number.

If you're on windows and you look at internet Explorer.

That will show you if there are any system proxy settings, again, note down the IP and the port number.

You can also be using a transparent proxy, which means they will be no settings in here.

You will just automatically go through the transparent proxy.

And also you can be on auto-detect proxy settings where you'll be using some form of proxy auto config or PAC or PAC file.

Which look, something like this.

So you will have to try and locate the PAC file.

And then if you do, you might be able to find the proxy's IP address and port note down the IP address and port of any proxy servers that are in here this far is likely to be on the proxy server as a file.

You can download via a web link, or it could even be a local file.

There are two main types of http proxies that you are likely to encounter now many http proxies don't actually proxy https.

They only proxy http.

And that is because HTTPS requires. More administrative efforts.

They have to make more changes.

They have to add encryption certificates and other sorts of things.

So instead of proxying what they do is they forward the HTTPS traffic on to the final destination.

As long as of course the final destinations domain or IP is allowed and they do this using something called the http connect command.

That essentially opens a private tunnel for the browser to use.

Proxies that do do this generally should be easier to bypass as there is no content inspection of the https and you can create a good tunnel with http connect, which I'll show you how to do now.

So that's the first time, second time does do full proxying of the https protocol, meaning that they, when it gets to.

It breaks the encryption.

There is no end to end encryption between here and here with these second types of proxies.

And because they're broke the encryption, they're able to filter here based on the contents of the traffic.

So how do they do this breaking well on a private network? This is normally done by placing.

A certificate on the browser, the browser, them, wherever it connects to, where they https connection, or sometimes all connections.

It creates an SSL connection to the proxy here, and that's where it ends.

And that's where it has broken the proxy then examines the traffic here and if it's okay, it then forms a second.

SSL tunnel here, SSL TLS connection to the final destination.

And it does that on behalf of the client.

Now, of course it does require a certificate on here.

If there is no certificate on here, there's no certificate installed in the browser.

Then you will get warnings saying that there's a certificate security error, and that the certificate is valid.

But this is actually a very, very common technique in businesses that want to proxy https you use their device.

They put that cert on there and they break the encryption at the proxy and are able to see all the traffic still.

It is potentially possible to get through this second type of proxy as well.

So let's look at some ways of doing that.

So the first tool to try to get through a http proxy is corkscrew.

Corkscrew is a tool for hot tunneling, SSH through http proxies, as it says, and it supports a multitude of operating systems, including Mac OS X.

You can even get it on win32 with Cygwin and also Linux of course, and it is available in repository.

On debian. And for example, on Kali Sudo app, get install and then corkscrew, and you will be able to get a fully working version from the repository.

So, what we're going to do now is we're going to open up a dynamic Sox port proxy on our local machine that sends traffic through the http proxy, and then on to the SSH server to open the connection to the SSH server.

We will first try to use the http connect method, which allows a client to connect to a server through an HTTP proxy by sending.

A http connect request to the proxy.

And this is how corkscrew works.

So that's what we're going to use.

So let me explain this command here.

So we're SSH ING, where SSH on port 22.

Now this you would need to change.

This is likely to be. Be port 80 or port 4, 4, 3, this needs to be whatever your firewall happens to allow out.

And then we're going to run additional commands, which we're going to do through the proxy command.

And we're going to run corkscrew.

We're going to run the program corkscrew.

And the first thing is, is going to connect that.

Is the IP address of the proxy server. That's why we needed to know it.

And then this here 8 1, 1 8 is the port. Of the proxy server.

And then we're going to open up a dynamic socks proxy locally on 80 80 that connects through to demo dot station x.net.

Once we have done that, we can put in 127.0.0.1. Port 80, 80 into a browser.

And that browser will go via the http proxy and then SSH onto demo dot station x.net.

So let's give that a try, see if it works.

So there we are. We're on the SSH server, so that has got us through the http proxy.

So I'm enabling my browser to go through that proxy.

So one two seven.zero. Zero.one. 80, 80 socks, proxy, remote VPN.

And there we go.

I'm coming from the Amazon data center in Dublin, where the demo server is.

So there you go, able to get through http proxy, not too painful.

Remember you need to change this to a port that the firewall allows, and of course you need corkscrew and you need to know the IP address and port of the proxy.

If the http connect method is not available or corkscrew just isn't working for whatever reason, then you can try another tool.

We have proxy tunnel here. I just scroll down.

You can see it is available for windows open BSD, net BSD.

So it should work on Mac.

It is available for Devean and Keli, and is available in the repository under proxy tunnel.

So you can just simply get it there and app get installed. Proxy tunnel.

And this is the command you would use.

If we look here, we can see this is very similar structure as to what we previously did, but we're just using proxy tunnel here instead.

Now, see, we've got port 22.

Again, that needs to change to whatever port is allowed out of your firewall.

Port 80 port 4 43. So here's the actual command proxy tunnel -P.

This is the IP address of the proxy server than 8 1, 1 8 is the port.

And then again, we are creating a local dynamic socks proxy, and we're connecting to demo dot station x.net in order to create that socks proxy.

So let's give this a try.

This one gives a little bit more information here.

It shows us that we're going through this http proxy, and we're going through to this SSH server here and there we go.

And there we are. We're coming from Ireland again.

So we're successfully getting through that proxy.

And you can see they're connected to the local socks proxy on 8080.

Now not all proxies are going to play ball.

I'm afraid. There are many things that they can use to try and stop you getting through.

First one is authentication.

So it may be that you need to authenticate to that server.

And here you can see the command here.

So I've added - P with proxy tunnel and you enter your username.

Colon password, and you can pass your username and password to the proxy server.

If you don't want to put your username and password in the actual command, because it will show up in the process list, then you can use -F and just put the username and password in a file like, so, and this is where the proxy turnal.

And with corkscrew, you can do a same sort of thing.

You can do it from a file. So there you go.

Put the username and password in a file and it will send that to the proxy server.

Some proxies may even want more information like your browsers use agent and your referrer.

Now you can still provide this using proxy tunnel.

If you notice this command is the same as what we've just been using. Um, but the difference is here.

We've got this -H, and then here, we're adding the agent in quote.

If you're not sure what your agent string is and just do a search for user agent and paste something in there for your user agent.

And it's got the host here with a -H, taking the variable here from here, and then we also have referred.

And again, we're taking the variable H here and then -P username and password, and then creating the local tunnel.

Now that's getting a little bit large, isn't it now as a command.

So there is an alternative because the command is long.

What we can do is we can set up a default command to run. Per host.

And we do that by editing the conflict file, which will be in the dot SSH folder for the user that you want to run this command.

So let's edit this file and I've actually pre-populated it here.

And this is what you're going to need.

So host is a nickname for the server that you're going to connect to user is a user you're going to connect as host name is the IP address or URL to your server or domain name for your server?

The port you're connecting to this is what will be 80 or 4 43.

The dynamic port that is going to create the socks five proxy that it's going to create locally, that you're going to connect to.

And then this is the proxy command.

This is the same that as I've just shown you, and you could put any of the previous proxy commands just in here and you can see it goes on and on.

So now, so if I save that,

if I do SSA demo is going to do the full proxy command proxy tunnel, because I have that configuration in my conflict file and it will create that local socks proxy with just this command, because demo is the host.

And there we go.

We can see it's connecting through the http server to the SSH server.

And there we are going here, refresh and there we are a tunnel through the HTTP server using SSH is working.

And there are some other options, but I can't go through every one, but the good ones are http tunnel.

This is some software that you put both on a server and on a client and you create connections between the two.

So instead of using SSH, you're using this instead, this is available for.

Windows and Linux, and it is available in the Debian tales repository.

And then windows wise, you've http tunnel, which looks like this.

Whereas you can try out there's Barba tunnel.

You can try there's super networks tunnel, but that is a pay for solution, which it looks like this.

And then if you're in a windows environment and you need to do NTLM type authentication, this is a authentication proxy that might enable you to get through a http proxy, which may help you out if you need to do NTLM authentication.

So that's getting through, http, proxy.

In most cases with one of these tools or techniques, there's a good chance that you will be able to get through.

But of course always remember about consequences.

If the consequences are high, all of these techniques could be discovered by a ken administrator.