HTTP Tunneling Fundamentals
Let’s begin our exploration of HTTP tunneling
by introducing a simple scenario.
In this example, we have compromised CONFLUENCE01,
and can execute commands via HTTP requests.
However, once we try to pivot,
we are blocked by a considerably restrictive network configuration.
Specifically, a Deep Packet Inspection (DPI) solution
is now terminating all outbound traffic except HTTP.
In addition, all inbound ports on CONFLUENCE01 are blocked except TCP/8090.
We can’t rely on a normal reverse shell as it would not conform to the HTTP format
and would be terminated at the network perimeter by the DPI solution.
We also can’t create an SSH remote port forward for the same reason.
The only traffic that will reach our Kali machine is HTTP,
so we could, for example, make requests with Wget and cURL.
Let’s review the network configuration for this scenario:
In this case, the FIREWALL/INSPECTOR device
has replaced the previous simple firewall.
In addition, MULTISERVER03 is blocked on the WAN interface.
We have credentials for the PGDATABASE01 server,
but need to figure out how to SSH directly there through CONFLUENCE01.
We need a tunnel into the internal network,
but it must resemble an outgoing HTTP connection from CONFLUENCE01.