1

I know that by connecting to a HTTPS site by accessing its url (say, https://google.com), the network admin can see the fact that I'm connecting to google because the browser will do DNS lookups in cleartext.

However, if I connect directly to the IP (say https://11.51.24.51), no DNS lookups are preformed, right? So the URL/IP wouldn't be leaked? Or am I missing something?

2

You're still forming a direct connection to the IP address. The network admin would be able to see you're connecting to that IP even though he can't see the contents of the connection.

Using publicly available tools such as this site, in most cases they would have a decent idea about what you're trying to access.

0

There's a few flaws with your plan.

Using an IP instead of a hostname

A network admin can still perform a reverse lookup based on IP. The common tool to do this is via whois. The returned site might be exactly correct, but it will leave some clues to the admin.

HTTPS Information

The HTTPS header will prevent the content of the request from being disclosed. However, the destination IP needs to be known in order to successfully route the request. Therefore, it is impossible to mask the destination IP.

Possible Issues

If the network admin uses a Certificate stand-in, your machine establishes a TLS session with a proxy and then the proxy establishes a connection with the destination website. When this is done, all connection information will be available to the network administrator.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.