Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 9 down vote favorite
2

Reverse proxies and NAT would seem to obscure a network behind such technologies to the point where it would be hard if not impossible to identify ports open and services running.

Given that many networks use these technologies I assume it is possible to bypass them in some capacity.

I am just wondering how that may be possible, and it if would be astonishingly simple or extremely difficult.

share|improve this question
Are you talking of bypassing the RP/NAT by attacking the RP/NAT solution or the by attacking the applications in the internal network (which would result in a bypass)? – Vineet Reynolds Jun 1 '11 at 8:39
1  
What is possible is quite an open question and depends on the network being attacked. Can you rephrase your question to elicit a more specific answer? – Marc Wickenden Jun 1 '11 at 12:50
@wicky, no, I want a general answer. If you have to be less specific or give different scenarios I am OK with that, just trying to get a feel for the technology and attacks against it. – Sonny Ordell Jun 2 '11 at 9:02

2 Answers

up vote 6 down vote accepted

A number of ways, but none of them easy

A Browser compromise served from an external site where you can ask a user to view a web page from the inside of the network.

Compromising the Router/Firewall/Reverse Proxy box that re-directs the content to the actual internal/dmz web server.

Compromising the internal/dmz web server or db server through injection attacks.

Compromising the dns of the upstream provider can do it.

Man in the Middleing all their traffic if you can.

I might have just made a simple question into a much more general one ... my bad.

share|improve this answer
How would compromising the DNS provider help? I get that there are attacks like that where you can affect any machine directly....but as far as doing something outside the network, e.g. portscanning, there is no way right? – Sonny Ordell Jun 1 '11 at 6:17
You can redirect their google.com query to your website and try to compromise their browser with the content you feed to them. – Andrew Russell Jun 1 '11 at 6:27
up vote 4 down vote

Identify reverse proxies using tools like lft, osstmm-afd, or w3af.

Perform packet creation activities from the nodes past the proxies/NATs using techniques such the ones in nsping, ntp monlist, or 0trace.

If an encrypted service is available on the far-end, such as SSL/TLS or IPSec -- use it to tunnel your traffic. Try to create your own tunneling service if one does not already exist. If no encrypted services exist and you can't create them, then utilize a tool such as sniffjoke or find a hole with FWTester, Pytbull, or Scapy.

NAT also allows UDP and TCP hole punching to occur, which is how Skype gets around NAT. A multitude of other ways exist, such as NAT Pinning, DNS Pinning, and client-side attacks such as the ones available in SET (with or without browser_autopwn from the Metasploit Framework), BeEF, XSSer, XSSF, Yokoso, et al.

Most of the above depend on your entry points and capabilities to pivot from them.

share|improve this answer
I should clarify I did not mean how to bypass a reverse proxy or NAT from inside a network to reach the outside world, bur rather how attackers may bypass them to scan the actual servers for example. – Sonny Ordell Jun 2 '11 at 9:04
@Sonny: Please read my answer more carefully. Perhaps you are confusing what I'm saying? – atdre Jun 2 '11 at 21:10
I am confused by what you are saying...I don't understand how tunneling to a host would help me scan that host? – Sonny Ordell Jun 2 '11 at 22:56
@ Sonny: No, not tunneling. Not scanning. You just change from using HTTP to SSL. It may be a different infrastructure. It may not be traffic inspected. Sometimes you can force certain SSL parameters such as Ephemeral DH key exchange, which will break IDS, IPS, and even WAF that typically would be able to inspect SSL because they were configured for it. – atdre Jun 3 '11 at 0:59
@ Sonny: Thus "bypassing" reverse proxies, NATs, etc in order to do whatever you want to do (scanning included). – atdre Jun 3 '11 at 1:00
show 4 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.