2

Consider the following scenario: There is a client behind a really strict firewall. There is nearly nothing available to 'connect to the internet'. Just DNS resolution and HTTP/HTTPS (some whitelisted sites like Google can be visited; others get redirected to the 'site was blocked' page).

So the idea was to to build some kind of proxy using only http get requests (using this service from google as proxy which works fine but lacks css/http post request support)

Do you think that's possible or are aware of software that's capable of doing this? Or maybe another way to accomplish unrestricted internet access under these cirumstances?

PS: Using DNS for tunneling all the traffic works but is of course really really slow.

  • 2
    Note: Google translate can be used as a GET proxy too. – hd. Apr 14 '15 at 12:53
  • 2
    Just a note : a site restricting traffic so much that only some whitelisted HTTP traffic is authorized shouldn't have external DNS enabled, all name resolutions shall be done at the HTTP proxy level, unless it was setup in a pretty incompetent manner, as DNS tunneling is a well known threat. – Bruno Rohée Apr 14 '15 at 12:56
  • 1
    If port 22 is open you could use SSH to tunnel all HTTP and HTTPS traffic through it. Here is a tutorial on how to do it in Windows: anapnea.net/tut_putty_tunneling.php – Amged Rustom Apr 14 '15 at 13:25
  • Thank you for the hint but unfortunatly port 22 isn't open. – Omegavirus Apr 14 '15 at 13:31
  • 1
    Are websockets allowed ? If so, you can use something like wstunnel. – r00t Aug 12 '15 at 15:20
2

Do you think that's possible or are aware of software that's capable of doing this? Or maybe another way to accomplish unrestricted internet access under these cirumstances?

If you are in control of a server reachable by the service you mentioned then you could built your own tunnel, because

  • you can send data through the tunnel to the server (via the URL of the request)
  • and you can receive data through the tunnel from the server (via the response)

Which means all you have to do is write yourself the appropriate local and remote handlers to translate between your tunnel protocol and HTTP request/response.

I'm not aware of any existing software working within your specific restrictions (httptunnel is probably outside your restrictions), but it is possible to write something like this and to help you to actually circumvent specific security policies would be outside the scope of this forum anyway.

And always remember that security policies are often there to protect something and that you might get into trouble when you try to circumvent these policies, like loosing the job or maybe even get charged for hacking attempts. And such tunnels can be detected because they show abnormal usage behavior.

1

The main problem with tunnelling IP into HTTP GET requests is that HTTP is a client-driven protocol: the client always talks first, and the server cannot send anything to the client save as a response to a request. In pure TCP/IP, both parties must be able to talk at any time they wish.

The two main methods to solve this issue are:

  1. Polling. The client sends requests at very regular intervals, say at least once or twice per second. The server responds with either a chunk of data, or a message that says "nothing to send back at that point".

  2. Stalling. The client sends a request, but the server does not respond until it has indeed some data to send to the client, or some given amount of time has elapsed. Either way, when it has received a response, the client immediately sends a new request, for the next data chunk.

The stalling mechanism is more discreet, and less resource intensive; however, it is more complex to setup and operate, notably because the client then needs two channels, for sending and for receiving encapsulated packets. The terminal-over-Web Anyterm products uses the stalling mechanism; however, it does it with XmlHttpRequest, which sends POST requests, not GET. See also the BOSH protocol, that uses the same principle, explained in more details in section 4.

The concept can be applied to HTTP GET requests; you would probably have to encode outgoing data in the target path, or as a custom header, because HTTP GET requests are not supposed to have non-empty bodies (the HTTP standard allows for it, but it is not supposed to happen in practice, and I believe that it would make the firewall very suspicious).

I don't know of any existing tool, but this is a nice programming exercise.

Of course, getting past the firewall configuration is only part of the subject. I presume that whoever puts such heavy constraints on Web requests will also install some monitoring devices to get warned about unusual network activity, and any tunnelling should trigger such a system.

  • "I believe it would make the firewall very suspicious." Maybe... or maybe it would just ignore that traffic, because everybody knows GET requests don't have bodies. Firewalls aren't intelligent; they can only look for patterns they've been programmed to look for. – CBHacking Sep 11 '15 at 18:27
1

As long as fronting capable services are not blocked (Content Delivery Networks like Google Apps Engine, Amazon CloudFront, Azure CDN; such services serving the content of a large number of sites they are usually hard to block), you can encapsulate an HTTP GET request inside an HTTP GET request to these services.

Look at the Meek transport plugin that Tor has and which implements this idea. You can also find more technical information on GitHub, and Tor also proposes other transport plugins which may be helpful.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.