Sometimes you will be behind a HTTP proxy.
This is likely when you’re at places like work, school,
university, private networks.
If you look in the browser settings
for the machine that you are forced to use
when you are on that network,
you can potentially tell whether or not
you’re using a proxy on that network.
So you will see something in here, maybe here, HTTP proxy,
the IP address and the port number.
If you’re on Windows and you look at Internet Explorer,
that will show you if there are any
system proxy settings,
again, note down the IP and the port number.
You can also be using a transparent proxy,
which means there will be no settings in here.
You will just automatically go through
the transparent proxy.
And also, you can be on auto detect proxy settings
where you’ll be using some form of
proxy auto-config, or PAC or PAC file,
which look something like this.
So you’ll have to try and locate the PAC file,
and then, if you do, you might be able
to find the proxy’s IP address and port,
note down the IP address
and port of any proxy servers that are in here.
This file is likely to be on the proxy server
as a file you can download via a web link,
or it could even be a local file.
There are two main types of HTTP proxies
that you are likely to encounter.
Now, many HTTP proxies don't actually proxy HTTPS.
They only proxy HTTP.
And that is because HTTPS
requires more administrative efforts.
They have to make more changes,
they have to add encryption certificates
and other sorts of things.
So instead of proxying,
what they do is they forward
the HTTPS traffic onto the final destination,
as long as of course
the final destination’s domain or IP is allowed,
and they do this using something called
the “HTTP CONNECT command”,
that essentially opens a private tunnel
for the browser to use.
Proxies that do do this generally
should be easier to bypass
as there’s no content inspection of the HTTPS,
and you can create a good tunnel with HTTP CONNECT,
which I’ll show you how to do.
Now, so that’s the first type.
Second type does do full proxying of the HTTPS protocol.
Meaning that they, when it gets to here,
it breaks the encryption,
there is no end-to-end encryption between here and here,
with these second types of proxies.
And because they have broke the encryption,
they’re able to filter here
based on the contents of the traffic.
So how do they do this breaking?
Well, on a private network,
this is normally done by
placing a certificate on the browser.
The browser then,
wherever it connects to with a HTTPS connection,
or sometimes all connections,
it creates an SSL connection to the proxy here,
and that’s where it ends, and that’s where is broken.
The proxy then examines the traffic here,
and if it’s okay,
it then forms a second SSL tunnel here,
or SSL/TLS connection to the final destination.
And it does that on behalf of the client.
Now of course, it does require
a certificate on here,
If there is no certificate on here,
there’s no certificate installed in the browser,
then you will get warnings saying
that there’s a certificate security error
and that the certificate is invalid.
But this is actually a very, very common technique
in businesses that want to proxy HTTPS.
You use their device, they put that cert on there,
and they break the encryption at the proxy
and are able to see all the traffic.
Still, it is potentially possible to get through
this second type of proxy as well.
So let's look at some ways of doing this.
So the first tool to try to get through
a HTTP proxy is Corkscrew.
Corkscrew is a tool for hot tunneling
SSH through HTTP proxies, as it says.
And it supports a multitude of operating systems,
including Mac OS X,
you can even get it on Win32 with Cygwin,
and also Linux, of course.
And it is available in repositories.
On Debian, for example, on Kali,
a sudo apt-get install, and then Corkscrew,
and you’ll be able to get a fully working version
from the repository.
So what we’re going to do now,
is we’re going to open up
a dynamic SOCKS port proxy
on our local machine that sends traffic through
the HTTP proxy and then on to the SSH server.
To open the connection to the SSH server,
we will first try to use the HTTP CONNECT method,
which allows a client to connect to a server
through an HTTP proxy by sending
a HTTP CONNECT request to the proxy.
And this is how Corkscrew works,
so that’s what we’re going to use.
So let me explain this command here.
So we’re SSHing,
we're SSHing on port 22.
Now this, you would need to change.
This is likely going to be port 80 or port 443.
This needs to be whatever
your firewall happens to allow out.
And then, we’re going to run additional commands,
which we’re going to do through the proxy command,
and we’re going to run Corkscrew,
we’re going to run the program Corkscrew.
And the first thing is, is going to connect,
that is the IP address of the proxy server,
that’s why we needed to know it,
and then this here, 8118,
is the port of the proxy server.
And then we’re going to open up
a dynamic SOCKS proxy
locally on 8080
that connects through to demo.stationx.net.
Once we have done that,
we can put in 127.0.0.1,
port 8080, into a browser
and that browser will go via the HTTP proxy
and then SSH onto demo.stationx.net.
So let's give that a try, see if it works.
So there we are, we’re on the SSH server,
so that has got us through the HTTP proxy.
So I’m enabling my browser to go through that proxy,
so 127.0.0.1, 8080, SOCKS proxy, remote VPN.
And there we go,
I’m coming from the Amazon data center
in Dublin where the demo server is.
So there you go,
able to get through a HTTP proxy.
Not too painful.
Remember, you need to change this
to a port that the firewall allows,
and of course you need Corkscrew
and you need to know
the IP address and port of the proxy.
If the HTTP CONNECT method is not available,
Corkscrew just isn't working for whatever reason,
then you can try another tool.
We have Proxytunnel here. Just scroll down.
You can see it is available for Windows,
OpenBSD, NetBSD,
so it should work on Mac.
It is available for Debian and Kali,
and is available in the Repository under Proxytunnel,
so you can just simply get it there
and “apt-get install proxytunnel”.
And this is the command you would use,
if we look here,
we can see this is very similar structures
to what we previously did,
but we’re just using Proxytunnel here instead.
Now see, we’ve got port 22 again,
that needs to change to whatever port
is allowed out of your firewall, port 80, port 443 etc.
So here is the actually command: “proxytunnel –p”.
This is the IP address of the proxy server,
then 8118 is the port, and then again,
we are creating a local dynamic SOCKS proxy,
and we’re connecting to demo.stationx.net,
in order to create that SOCKS proxy.
So let's give this a try.
This one gives a little bit more information here.
It shows us that we’re going through this HTTP proxy,
and we’re going through to this SSH server here.
And there we go.
And there we are.
We’re coming from Ireland again,
so we’re successfully getting through that proxy,
and you can see there,
connected to the local SOCKS proxy on 8080.
Now, not all proxies
are going to play ball, I’m afraid.
There are many things that they can use
to try and stop you getting through.
First one is Authentication.
So it may be that you need to authenticate to that server.
And here, you can see the command here,
so I’ve added “-P” with proxytunnel,
and you enter your “username: password”,
and you can pass your username and password
to the proxy server.
If you don't want to put your username and password
in the actual command,
because it will show up in the process list,
then you can use “-F”
and just put the username and password
in a file, like so.
And this is with Proxytunnel.
And with Corkscrew, you can do the same sort of thing.
You can do it from a file.
So there you go,
you put the username and password in a file
and it will send that to the proxy server.
Some proxies may even want more information,
like your browser's user agent and your referrer.
Now you can still provide this using Proxytunnel.
If you noticed, this command is the same
as what we’ve just been using,
but the difference is here we’ve got this “-H”,
and then here we’re adding the agent in quotes.
If you’re not sure what your agents string is,
then just do a search for user agent
and paste something in there for your user agent.
And it’s got the Host here with the “-H”,
taking the variable here from here.
Then we also have “Referrer”,
and again, we’re taking the variable “h” here.
And then “-P”, username and password,
and then creating the local tunnel.
Now, that’s getting a little bit large,
isn't it, now as a command? So there is an alternative.
Because the command is long, what we can do is,
we can set up a Default Command to run per host.
And we do that by editing the Config file,
which will be in the “.ssh” folder for the user
that you want to run this command.
So let's edit this file,
and I’ve actually prepopulated it here,
and this is what you’re going to need.
So “Host” is the nickname for the server
that you’re going to connect to.
“User” is the user you’re going to connect as.
“Host name” is the IP address or URL
to your server or domain name for your server.
The port you’re connecting to,
this is what will be 80 or 443 for you.
A dynamic port that’s going to create
the SOCKS5 proxy
that it’s going to create locally, that you’re going to connect to.
And then, this is the proxy command,
this is the same as I’ve just shown you
and you could put
any of the previous proxy commands just in here.
And you can see it goes on and on.
So now, so if I save that,
if I do SSH demo,
it’s going to do the full proxy command, proxytunnel,
because I have that configuration in my Config file
and it will create that local SOCKS proxy
with just this command, because “Demo” is the host.
And there we go,
we can see it’s connecting
through the HTTP server to the SSH server.
And there we are.
Go on here, refresh, and there we are,
a tunnel through the HTTP server, using SSH is working.
And there are some other options,
but I can't go through everyone,
but the good ones are HTTPTunnel.
This is some software that you put
both on a server and on a client,
and you create connections between the two.
So instead of using SSH,
you’re using this instead.
This is available for Windows and Linux,
and it is available
in the Debian Tails repository.
And then, Windows wise, you’ve got HTTPtunnel,
which looks like this, which you can try out.
There’s BarbaTunnel, you can try.
There’s Super Network Tunnel,
but that is a pay for solution,
which looks like this.
And then, if you’re in a Windows environment
and you need to do NTLM type authentication,
this is a authentication proxy that might enable you
to get through a HTTP proxy.
Which may help you out,
if you’re needing to do NTLM authentication.
So that’s getting through HTTP proxies.
In most cases,
with one of these tools or techniques,
there’s a good chance you will be able to get through,
but of course, always remember about the consequences.
If the consequences are high, all of these techniques
could be discovered by a keen administrator.