I had somebody say that it would be possible to defeat any http proxy url blocking, "by editing the hosts file and so that some whitelisted site maps to an IP address they control, with a server set to accept any domain and would return any site specified in the query parameters."

Is this a real threat? What can I do to protect against this?

  • Hoo boy, lots more info needed for a proper answer. Is this a proxy that people have to configure their browsers to go through, or is it an invisible proxy along the network (possibly on a router or corporate firewall), or is it a reverse proxy for some specific domain(s)? Is the proxy filtering by IP or by hostname? Does the proxy filter all ports or just HTTP (80) and HTTPS (443)? Does it even filter HTTPS? Does it filter DNS requests / implement a DNS server, or is DNS just passed through / doesn't go through the proxy at all? – CBHacking Feb 12 '19 at 21:17
  • The proxy is set in the IE Settings Lan settings... If you try to browse to a page which is not on the white list page you get redirected to a 'If you really need this page make a whitelist request with the service desk folks' page – DarcyThomas Feb 12 '19 at 22:01
  • And what happens if somebody just changes that proxy setting? Or uses a program that doesn't respect the IE proxy settings? It sounds like your users probably have local Admin access - else they couldn't edit HOSTS anyhow, though they could still attempt to make HTTP(S) requests any number of other ways using other software - so you can't stop them from changing the IE proxy; even Group Policy rules can be overwritten by local admins. – CBHacking Feb 12 '19 at 22:48

I'm going to take a stab at answering this even though you haven't really provided enough information to be clear about how your proxy works and what it's intended to do.

I am assuming the following:

  • All access to the Internet is filtered through this proxy; it's either invisible on the network gateway or any program not configured to use the proxy won't be allowed through the gateway. This applies to all protocols and ports.
  • You are filtering on hostnames, not IP addresses.

If those are both true, then yes, the attack as described would work fine. It would be an inconvenient way to browse the web but it would totally work. If you want to block it you need to either:

  • Filter on IP address, not hostnames, and ensure that all IP addresses you allow are trusted sites not usable as any kind of proxy.
  • Inspect request destination IPs and hostnames, and ensure that they match (that is, the IP is assigned to that domain) and also that the hostname is whitelisted and no whitelisted hostname runs any kind of proxy.

If the latter is untrue - that is, you filter on IP addresses, not hostnames - then this won't work as described. However, it would still work if somebody with a whitelisted IP sets up an open proxy on that IP that reads the hostname and forwards the request accordingly (and relays the response), and your users edit their HOSTS files to point all the domain names they care about to this one IP.

If the former is untrue - that is, if there's any way, on some protocol or port or through changing the program configuration, to access the Internet without going through your proxy - then bypassing the filter is always going to be possible. People have built filter-bypass proxies (which they run on their own machines) that tunnel traffic through all kinds of things, like ICMP (the protocol used by ping and tracert/traceroute), DNS requests and responses, and so on. If you allow SSH traffic - even if you block the default SSH port - it's easy; most ssh implementations let you set up port tunneling to a remote system and then all the user needs to do is tell their browser to use a HTTP proxy on localhost, forward the proxy's port through SSH to an outside box, and run an actual proxy on that box.

| improve this answer | |
  • Filtering on IP address only would be a pain for the proxy admin, but it would be enough to filter on hostnames as usual, and forbid any IP address except well known ones (white list logic on IP addresses). – Serge Ballesta Feb 13 '19 at 7:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.