Home page logo

basics logo Security Basics mailing list archives

RE: HTTP tunneling to bypass proxy filter
From: "Brandon Louder" <Brandon.Louder () mckennan org>
Date: Mon, 21 Apr 2008 13:05:17 -0500

I am interested in hearing comments about this as well. I believe there
are some newer web security appliances that do deep inspection at the
application layer that would catch this, hopefully someone else can

Another scenario in relation to your custom http tunnel client is a
socks based proxy to an SSH server. If you have an internet facing SSH
server and set it to listen on port 443 you should be able to tunnel
your web traffic over HTTPS. For instance with putty you can do:
putty -D 8080 -P 443 -ssh "ip address"

And then set your web browser to use socks proxy of localhost on port

All of the web traffic would then show up as https to the remote IP. If
you have a web security appliance that does HTTPS decryption and deep
inspection it may not work, similar as with the HTTP tunnel client.  

-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com]
On Behalf Of uglyhunK
Sent: Saturday, April 19, 2008 8:39 AM
To: security-basics
Subject: HTTP tunneling to bypass proxy filter

Recently I was challenged by network admin to bypass corporate HTTP
filter. Easier option would have been to download one of many HTTP
clients but that is ruled out as all the sites are blocked. I didn't
want to
email the installation file as there is a strict monitoring policy to
email and "leaving no traces" is one of the primary conditions.

Only option left was to write my own HTTP tunneling client and being a
developer I have access to JDK. Server component is written in PHP and
works like a charm; all the communication is encoded in base64 (though
the best way to obfuscate data). It took me just 10 days to successfully
bypass the proxy filter and access literally all the websites except
ones. Just for the info, this is @ one of the largest American banks.
So, I
won the first round and now I threw a challenge @ him to identify this
of tunneled data and block it successfully.

I'm not sure if he can do this, but, would like to know from you guys if
there is any way for the admin to block me from using custom tunnel


Confidentiality Notice: This e-mail message, including any
attachments, is for the sole use of the intended recipient(s) and
may contain confidential and privileged information. Any
unauthorized review, use, disclosure, or distribution is
prohibited. If you are not the intended recipient, please contact
the sender by reply e-mail and destroy all copies of the original

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]