Help me smash through this firewall!

mikho

@gsrdgrdghd said:
You could try setting the HTTP Host header to something like google.com while connecting to your own IP (easy way to do this: redirect google.com to one of your own servers via your hosts file). If that works you can do pretty much anything.

problem is if the connection is going via a proxy it would probably do the DNS lookup with the proxy.

Nomad

Why not try the VPN's on port 53,80 and 8080
Or you can do that for SSH.

As for dns, maybe you can try a dnscrypt enabled dns server.
And maybe you can try connecting to ssh through a socks proxy?

Whitelisted sites part is a bummer though, does this firewall work for only hand-picked web sites or what?

0xdragon

@Nomad said:
Why not try the VPN's on port 53,80 and 8080
Or you can do that for SSH.

As for dns, maybe you can try a dnscrypt enabled dns server.
And maybe you can try connecting to ssh through a socks proxy?

Whitelisted sites part is a bummer though, does this firewall work for only hand-picked web sites or what?

It seems to scan new websites when accessed and makes a permanent judgement on it. Unsure of the criteria.

bohdans

You can run an SSL proxy,
Or... thinking outside the box, HAProxy to forward connections, depends on if you want "full" web access or access to some blocked sites.

Nomad

0xdragon said: It seems to scan new websites when accessed and makes a permanent judgement on it. Unsure of the criteria.

Err, how about creating a dummy website and accessing it a few times before converting it to something better?

0xdragon

@Nomad said:
Err, how about creating a dummy website and accessing it a few times before converting it to something better?

New sites are immediately blocked as "uncategorised".

gsrdgrdghd

0xdragon said: It seems to scan new websites when accessed and makes a permanent judgement on it. Unsure of the criteria.

Put a transparent proxy on the website and have it redirected to Google or something else common? They would scan it, conclude that it's Google and whitelist it. Afterwards you could just run an HTTP tunnel

foetti

0xdragon said: Yes, it blocks SSH and port 443 unless you're going through the proxy.

What happens if you connect to ssh on port 443 via the proxy? It works for me at work.

radry

0xdragon said: It seems to scan new websites when accessed and makes a permanent judgement on it. Unsure of the criteria.

0xdragon said: New sites are immediately blocked as "uncategorised".

Which one is it now? Does it block all new website or does it judge them? Some suggestions already have been made how to abuse that.

linuxthefish

Can you run "dig lowendtalk.com TXT @8.8.8.8" and get a reply? If so DNS tunneling is the way out!

http://code.kryo.se/iodine/

TheLonely

Got a small and easy solution that works for me.

On Google Chrome on Android go to Settings > Reduce Data Usage > On

It works as a proxy, all ports are unblocked.

Or for desktop, download the extension and enable it. 'A proxy from Google!'

https://chrome.google.com/webstore/detail/data-compression-proxy/ajfiodhbiellfpcjjedhmmmpeeaebmep?hl=en

Then just use a SSH client in your browser.

Note: this worked for me.

Edit: here is my current ip from Google
http://i.gyazo.com/812331d5752bc9a178f9f0684e971520.png

jvnadr

said: Alright, so I've been tasked with getting through a firewall that does the following

Just out of curiosity: what kind of firewall is that and why do they setup something like that? As far as I know, AU is not so paranoid like China. Is it a company's or school's firewall? Home connection?

William

Sounds more like a very strict regulated company network, universities and schools do not go that far, even in AU.

netomx

There was a thing here in MExico, that you could use the MMS proxy from the cell phone services with a custom header, you may try it. I think it is called OpenVPN-OST, it has the option to send a custom header saying that you will connect to a whitelisted website, without doing it... something like that. Worth trying.

With Android, try VPNoverDNS, it has a Windows App too

Master_Bo

I wonder, whether people in charge of fulfilling those rigid restrictions do read LET and this thread, particularly?

spammy

@Master_Bo said:
I wonder, whether people in charge of fulfilling those rigid restrictions do read LET and this thread, particularly?

They do and probably take measures to close those loopholes.

Don't want to get into details but I've seen people who thought they are smart and tech-savvy get fired for breaching the corporate firewalls. Not saying it is exactly what OP wants to do but OP might want to think if it worthwhile to lose your paycheck for being cheap over a few bucks of mobile Internet data.

raindog308

spammy said: Don't want to get into details but I've seen people who thought they are smart and tech-savvy get fired for breaching the corporate firewalls. Not saying it is exactly what OP wants to do but OP might want to think if it worthwhile to lose your paycheck for being cheap over a few bucks of mobile Internet data.

He says:

said: Alright, so I've been tasked with getting through a firewall

I read that as "someone in authority has given me this assignment." Not "I want to read LET at work." Maybe the OP should clarify.

0xdragon

@raindog308 said:

Permission has been granted for audit blah blah blah.

0xdragon

@William said:
Sounds more like a very strict regulated company network, universities and schools do not go that far, even in AU.

You'd be surprised

rds100

Did you try this?

# apt-cache search corkscrew
corkscrew - tunnel TCP connections through HTTP proxies

But you will probably need sshd running on port 443

0xdragon

@rds100 said:
Did you try this?

> # apt-cache search corkscrew
> corkscrew - tunnel TCP connections through HTTP proxies
> 

Thanks, but I'm looking more for something that runs on Windows

TheLonely

@0xdragon said:

http://www.virtualbox.org

rds100

0xdragon said:

Thanks, but I'm looking more for something that runs on Windows

A linux VM inside windows then?

0xdragon

@rds100 said:

That's an idea

netomx

Did you tried what I told you?

And ultrasurf

0xdragon

@netomx said:
Did you tried what I told you?

And ultrasurf

What did you tell me?

Ultrasurf is definitely blocked, as is TOR.

trewq

spammy said: They do and probably take measures to close those loopholes.
Don't want to get into details but I've seen people who thought they are smart and tech-savvy get fired for breaching the corporate firewalls. Not saying it is exactly what OP wants to do but OP might want to think if it worthwhile to lose your paycheck for being cheap over a few bucks of mobile Internet data.

If you haven't actually changed anything within the company's systems then this would be counted as unfair dismissal. It's pretty hard to get rid of employees here unless they do something very wrong.

geekalot

I this thread for all the potential vulnerabilities and attack vectors it sheds light on .......... so that they can be closed. Also, great examples for interview questions for InfoSec gigs.

( @Pwner, remember what I said about LET being a "beautiful playground" here? Here you go.)

Cheers

TheLinuxBug

Pwner

@geekalot said:
I this thread for all the potential vulnerabilities and attack vectors it sheds light on .......... so that they can be closed. Also, great examples for interview questions for InfoSec gigs.

( Pwner, remember what I said about LET being a "beautiful playground" here? Here you go.)

Cheers

I see your point, and it really helps a lot. I joined this forum a while back hoping to learn more about technology. Needless to say, this is probably one of the best decisions I've ever made. :-)