Reverse proxies and NAT would seem to obscure a network behind such technologies to the point where it would be hard if not impossible to identify ports open and services running.

Given that many networks use these technologies I assume it is possible to bypass them in some capacity.

I am just wondering how that may be possible, and it if would be astonishingly simple or extremely difficult.

  • Are you talking of bypassing the RP/NAT by attacking the RP/NAT solution or the by attacking the applications in the internal network (which would result in a bypass)? Commented Jun 1, 2011 at 8:39
  • 1
    What is possible is quite an open question and depends on the network being attacked. Can you rephrase your question to elicit a more specific answer? Commented Jun 1, 2011 at 12:50
  • @wicky, no, I want a general answer. If you have to be less specific or give different scenarios I am OK with that, just trying to get a feel for the technology and attacks against it. Commented Jun 2, 2011 at 9:02

2 Answers 2


A number of ways, but none of them easy

A Browser compromise served from an external site where you can ask a user to view a web page from the inside of the network.

Compromising the Router/Firewall/Reverse Proxy box that re-directs the content to the actual internal/dmz web server.

Compromising the internal/dmz web server or db server through injection attacks.

Compromising the dns of the upstream provider can do it.

Man in the Middleing all their traffic if you can.

I might have just made a simple question into a much more general one ... my bad.

  • How would compromising the DNS provider help? I get that there are attacks like that where you can affect any machine directly....but as far as doing something outside the network, e.g. portscanning, there is no way right? Commented Jun 1, 2011 at 6:17
  • 1
    You can redirect their google.com query to your website and try to compromise their browser with the content you feed to them. Commented Jun 1, 2011 at 6:27

Identify reverse proxies using tools like lft, osstmm-afd, or w3af. Nmap has a few NSE scripts for detecting reverse proxies, but some have mixed reliability, such as http-traceroute.

Perform packet creation activities from the nodes past the proxies/NATs using techniques such the ones in nsping, ntp monlist, or 0trace.

If an encrypted service is available on the far-end, such as SSL/TLS or IPSec -- use it to tunnel your traffic. Try to create your own tunneling service if one does not already exist. If no encrypted services exist and you can't create them, then utilize a tool such as sniffjoke or find a hole with FWTester, Pytbull, or Scapy.

NAT also allows UDP and TCP hole punching to occur, which is how Skype gets around NAT. A multitude of other ways exist, such as NAT Pinning, DNS Pinning, and client-side attacks such as the ones available in SET (with or without browser_autopwn from the Metasploit Framework), BeEF, XSSer, XSSF, Yokoso, et al.

Most of the above depend on your entry points and capabilities to pivot from them.

  • I should clarify I did not mean how to bypass a reverse proxy or NAT from inside a network to reach the outside world, bur rather how attackers may bypass them to scan the actual servers for example. Commented Jun 2, 2011 at 9:04
  • @Sonny: Please read my answer more carefully. Perhaps you are confusing what I'm saying?
    – atdre
    Commented Jun 2, 2011 at 21:10
  • I am confused by what you are saying...I don't understand how tunneling to a host would help me scan that host? Commented Jun 2, 2011 at 22:56
  • @ Sonny: No, not tunneling. Not scanning. You just change from using HTTP to SSL. It may be a different infrastructure. It may not be traffic inspected. Sometimes you can force certain SSL parameters such as Ephemeral DH key exchange, which will break IDS, IPS, and even WAF that typically would be able to inspect SSL because they were configured for it.
    – atdre
    Commented Jun 3, 2011 at 0:59
  • @ Sonny: Thus "bypassing" reverse proxies, NATs, etc in order to do whatever you want to do (scanning included).
    – atdre
    Commented Jun 3, 2011 at 1:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .