Sometimes you will be behind a HTTP proxy. 2
This is likely when you’re at places like work, school, 3
university, private networks. 4
If you look in the browser settings 5
for the machine that you are forced to use 6
when you are on that network, 7
you can potentially tell whether or not 8
you’re using a proxy on that network. 9
So you will see something in here, maybe here, HTTP proxy, 10
the IP address and the port number. 11
If you’re on Windows and you look at Internet Explorer, 12
that will show you if there are any 13
system proxy settings, 14
again, note down the IP and the port number. 15
You can also be using a transparent proxy, 16
which means there will be no settings in here. 17
You will just automatically go through 18
the transparent proxy. 19
And also, you can be on auto detect proxy settings 20
where you’ll be using some form of 21
proxy auto-config, or PAC or PAC file, 22
which look something like this. 23
So you’ll have to try and locate the PAC file, 24
and then, if you do, you might be able 25
to find the proxy’s IP address and port, 26
note down the IP address 27
and port of any proxy servers that are in here. 28
This file is likely to be on the proxy server 29
as a file you can download via a web link, 30
or it could even be a local file. 31
There are two main types of HTTP proxies 32
that you are likely to encounter. 33
Now, many HTTP proxies don't actually proxy HTTPS. 34
They only proxy HTTP. 35
And that is because HTTPS 36
requires more administrative efforts. 37
They have to make more changes, 38
they have to add encryption certificates 39
and other sorts of things. 40
So instead of proxying, 41
what they do is they forward 42
the HTTPS traffic onto the final destination, 43
as long as of course 44
the final destination’s domain or IP is allowed, 45
and they do this using something called 46
the “HTTP CONNECT command”, 47
that essentially opens a private tunnel 48
for the browser to use. 49
Proxies that do do this generally 50
should be easier to bypass 51
as there’s no content inspection of the HTTPS, 52
and you can create a good tunnel with HTTP CONNECT, 53
which I’ll show you how to do. 54
Now, so that’s the first type. 55
Second type does do full proxying of the HTTPS protocol. 56
Meaning that they, when it gets to here, 57
it breaks the encryption, 58
there is no end-to-end encryption between here and here, 59
with these second types of proxies. 60
And because they have broke the encryption, 61
they’re able to filter here 62
based on the contents of the traffic. 63
So how do they do this breaking? 64
Well, on a private network, 65
this is normally done by 66
placing a certificate on the browser. 67
The browser then, 68
wherever it connects to with a HTTPS connection, 69
or sometimes all connections, 70
it creates an SSL connection to the proxy here, 71
and that’s where it ends, and that’s where is broken. 72
The proxy then examines the traffic here, 73
and if it’s okay, 74
it then forms a second SSL tunnel here, 75
or SSL/TLS connection to the final destination. 76
And it does that on behalf of the client. 77
Now of course, it does require 78
a certificate on here, 79
If there is no certificate on here, 80
there’s no certificate installed in the browser, 81
then you will get warnings saying 82
that there’s a certificate security error 83
and that the certificate is invalid. 84
But this is actually a very, very common technique 85
in businesses that want to proxy HTTPS. 86
You use their device, they put that cert on there, 87
and they break the encryption at the proxy 88
and are able to see all the traffic. 89
Still, it is potentially possible to get through 90
this second type of proxy as well. 91
So let's look at some ways of doing this. 92
So the first tool to try to get through 93
a HTTP proxy is Corkscrew. 94
Corkscrew is a tool for hot tunneling 95
SSH through HTTP proxies, as it says. 96
And it supports a multitude of operating systems, 97
including Mac OS X, 98
you can even get it on Win32 with Cygwin, 99
and also Linux, of course. 100
And it is available in repositories. 101
On Debian, for example, on Kali, 102
a sudo apt-get install, and then Corkscrew, 103
and you’ll be able to get a fully working version 104
from the repository. 105
So what we’re going to do now, 106
is we’re going to open up 107
a dynamic SOCKS port proxy 108
on our local machine that sends traffic through 109
the HTTP proxy and then on to the SSH server. 110
To open the connection to the SSH server, 111
we will first try to use the HTTP CONNECT method, 112
which allows a client to connect to a server 113
through an HTTP proxy by sending 114
a HTTP CONNECT request to the proxy. 115
And this is how Corkscrew works, 116
so that’s what we’re going to use. 117
So let me explain this command here. 118
So we’re SSHing, 119
we're SSHing on port 22. 120
Now this, you would need to change. 121
This is likely going to be port 80 or port 443. 122
This needs to be whatever 123
your firewall happens to allow out. 124
And then, we’re going to run additional commands, 125
which we’re going to do through the proxy command, 126
and we’re going to run Corkscrew, 127
we’re going to run the program Corkscrew. 128
And the first thing is, is going to connect, 129
that is the IP address of the proxy server, 130
that’s why we needed to know it, 131
and then this here, 8118, 132
is the port of the proxy server. 133
And then we’re going to open up 134
a dynamic SOCKS proxy 135
locally on 8080 136
that connects through to demo.stationx.net. 137
Once we have done that, 138
we can put in 127.0.0.1, 139
port 8080, into a browser 140
and that browser will go via the HTTP proxy 141
and then SSH onto demo.stationx.net. 142
So let's give that a try, see if it works. 143
So there we are, we’re on the SSH server, 144
so that has got us through the HTTP proxy. 145
So I’m enabling my browser to go through that proxy, 146
so 127.0.0.1, 8080, SOCKS proxy, remote VPN. 147
And there we go, 148
I’m coming from the Amazon data center 149
in Dublin where the demo server is. 150
So there you go, 151
able to get through a HTTP proxy. 152
Not too painful. 153
Remember, you need to change this 154
to a port that the firewall allows, 155
and of course you need Corkscrew 156
and you need to know 157
the IP address and port of the proxy. 158
If the HTTP CONNECT method is not available, 159
Corkscrew just isn't working for whatever reason, 160
then you can try another tool. 161
We have Proxytunnel here. Just scroll down. 162
You can see it is available for Windows, 163
OpenBSD, NetBSD, 164
so it should work on Mac. 165
It is available for Debian and Kali, 166
and is available in the Repository under Proxytunnel, 167
so you can just simply get it there 168
and “apt-get install proxytunnel”. 169
And this is the command you would use, 170
if we look here, 171
we can see this is very similar structures 172
to what we previously did, 173
but we’re just using Proxytunnel here instead. 174
Now see, we’ve got port 22 again, 175
that needs to change to whatever port 176
is allowed out of your firewall, port 80, port 443 etc. 177
So here is the actually command: “proxytunnel –p”. 178
This is the IP address of the proxy server, 179
then 8118 is the port, and then again, 180
we are creating a local dynamic SOCKS proxy, 181
and we’re connecting to demo.stationx.net, 182
in order to create that SOCKS proxy. 183
So let's give this a try. 184
This one gives a little bit more information here. 185
It shows us that we’re going through this HTTP proxy, 186
and we’re going through to this SSH server here. 187
And there we go. 188
And there we are. 189
We’re coming from Ireland again, 190
so we’re successfully getting through that proxy, 191
and you can see there, 192
connected to the local SOCKS proxy on 8080. 193
Now, not all proxies 194
are going to play ball, I’m afraid. 195
There are many things that they can use 196
to try and stop you getting through. 197
First one is Authentication. 198
So it may be that you need to authenticate to that server. 199
And here, you can see the command here, 200
so I’ve added “-P” with proxytunnel, 201
and you enter your “username: password”, 202
and you can pass your username and password 203
to the proxy server. 204
If you don't want to put your username and password 205
in the actual command, 206
because it will show up in the process list, 207
then you can use “-F” 208
and just put the username and password 209
in a file, like so. 210
And this is with Proxytunnel. 211
And with Corkscrew, you can do the same sort of thing. 212
You can do it from a file. 213
So there you go, 214
you put the username and password in a file 215
and it will send that to the proxy server. 216
Some proxies may even want more information, 217
like your browser's user agent and your referrer. 218
Now you can still provide this using Proxytunnel. 219
If you noticed, this command is the same 220
as what we’ve just been using, 221
but the difference is here we’ve got this “-H”, 222
and then here we’re adding the agent in quotes. 223
If you’re not sure what your agents string is, 224
then just do a search for user agent 225
and paste something in there for your user agent. 226
And it’s got the Host here with the “-H”, 227
taking the variable here from here. 228
Then we also have “Referrer”, 229
and again, we’re taking the variable “h” here. 230
And then “-P”, username and password, 231
and then creating the local tunnel. 232
Now, that’s getting a little bit large, 233
isn't it, now as a command? So there is an alternative. 234
Because the command is long, what we can do is, 235
we can set up a Default Command to run per host. 236
And we do that by editing the Config file, 237
which will be in the “.ssh” folder for the user 238
that you want to run this command. 239
So let's edit this file, 240
and I’ve actually prepopulated it here, 241
and this is what you’re going to need. 242
So “Host” is the nickname for the server 243
that you’re going to connect to. 244
“User” is the user you’re going to connect as. 245
“Host name” is the IP address or URL 246
to your server or domain name for your server. 247
The port you’re connecting to, 248
this is what will be 80 or 443 for you. 249
A dynamic port that’s going to create 250
the SOCKS5 proxy 251
that it’s going to create locally, that you’re going to connect to. 252
And then, this is the proxy command, 253
this is the same as I’ve just shown you 254
and you could put 255
any of the previous proxy commands just in here. 256
And you can see it goes on and on. 257
So now, so if I save that, 258
if I do SSH demo, 259
it’s going to do the full proxy command, proxytunnel, 260
because I have that configuration in my Config file 261
and it will create that local SOCKS proxy 262
with just this command, because “Demo” is the host. 263
And there we go, 264
we can see it’s connecting 265
through the HTTP server to the SSH server. 266
And there we are. 267
Go on here, refresh, and there we are, 268
a tunnel through the HTTP server, using SSH is working. 269
And there are some other options, 270
but I can't go through everyone, 271
but the good ones are HTTPTunnel. 272
This is some software that you put 273
both on a server and on a client, 274
and you create connections between the two. 275
So instead of using SSH, 276
you’re using this instead. 277
This is available for Windows and Linux, 278
and it is available 279
in the Debian Tails repository. 280
And then, Windows wise, you’ve got HTTPtunnel, 281
which looks like this, which you can try out. 282
There’s BarbaTunnel, you can try. 283
There’s Super Network Tunnel, 284
but that is a pay for solution, 285
which looks like this. 286
And then, if you’re in a Windows environment 287
and you need to do NTLM type authentication, 288
this is a authentication proxy that might enable you 289
to get through a HTTP proxy. 290
Which may help you out, 291
if you’re needing to do NTLM authentication. 292
So that’s getting through HTTP proxies. 293
In most cases, 294
with one of these tools or techniques, 295
there’s a good chance you will be able to get through, 296
but of course, always remember about the consequences. 297
If the consequences are high, all of these techniques 298
could be discovered by a keen administrator.