- We're gonna talk
about a couple methods to scan beyond firewalls.
Now, these methods rely upon the fact that you have access
to something inside the network already.
Scanning beyond firewalls is pretty complicated.
So what we're talking about here
is using applications on the inside of firewalls
and intrusion detection systems in order to get your traffic
through those perimeter defenses.
Starting with SSH tunneling.
So SSH, the protocol itself provides methods
to tunnel network traffic.
As we see here on the screen,
we have a VNC client talking to port 5300
which is actually being tunneled through an SSH client
through an encrypted channel,
to an SSH server on the inside, which is then redirected
to the actual VNC system on the inside of the network.
So those perimeter defenses that I was talking about
just a moment ago are happening right here.
So your firewall is in here
and you happen to have an SSH session going
through that particular firewall.
Now, the arrows on this slide are interesting
because you can actually reverse proxy traffic
through an SSH tunnel as well.
So that if you initiate the SSH session
from the inside out, you could then listen
on a local port here and connect locally
and redirect the traffic through the firewall.
So it's bidirectional proxying
of traffic through an SSH session.
This command that you see on the screen
"SSH -L 5900:10.1.1.20:5900"
What this will do is it will create a local listener
on your system.
Any traffic that goes
to that port locally will be redirected
to the IP address specified in the command
and then the destination port.
So you can actually change ports as well.
So you could listen on 59000
and redirect to 5900, if you so choose.
And then this is the destination system
that you're actually going to authenticate to.
The SSH server.
Windows, you don't often hear about SSH in Windows.
There is an SSH server for Windows.
It does support this tunneling that I'm talking about.
That comes from a company called Bitvise, Bitvise.
HTTP tunneling is another method to tunnel traffic
through perimeter defenses.
And we talk about it here, because most of the time,
if you have a demilitarized zone
that is being protected by a firewall,
it's going to permit HTTP type protocols through it.
If there's a web server on the other side of it.
So with an HTTP tunnel server
that happens to be running
in that demilitarized zone behind your perimeter equipment,
if you're able to get that installed
you could tunnel traffic through the firewall,
inside HTTP packets through an HTTP tunnel server.
And this is conceptual,
not the name of a particular product.
There's several different HTTP tunneling applications
available to you.
Here is one, Super Network Tunnel.
This is a Windows application
that will allow you to tunnel HTTP.
Next up we're gonna talk about proxy servers.
So we talked about scanning beyond the firewall.
We also need to talk
about protecting yourself from identification
and that's where proxy servers can come into play.
We're talking about proxy servers
as a concept first, of course.
So we have our proxy server sitting
in the middle of a communication flow.
And you'll notice that the session is established
from source A over to the proxy server.
This is the communication flow, back and forth.
The proxy server's job is to know where it's supposed to go.
The real destination based on the initial request,
proxy the request over, destination sends a response
to the proxy server,
which will then proxy it back to source A.
So the proxy's job is to receive the connection
and broker, he's the middleman,
the broker for this particular communication flow.
What are some benefits of proxy servers?
Anonymization, if the third party,
meaning let's look at the previous slide here.
So if you control the proxy server,
destination C only knows
that the proxy server is talking to it.
It doesn't know who source A is,
which is probably also you.
Now, in one of the upcoming slides,
we're gonna talk about proxy chaining,
but if you control this proxy server,
you can protect yourself from exposure.
Let's say you turn off all logging
on that particular proxy server.
If destination C does happen to get access to the proxy
through whatever, law enforcement order.
You could have some level of protection
and anonymization by using a proxy server that you control.
Proxies can also alter data.
So because the proxy server is capturing the traffic,
I will say, capturing is the wrong word,
but is receiving the traffic and then sending it
to that destination host.
It's possible for that proxy server to actually alter data
as it's flowing through.
This reminds me of a project a long time ago,
it was like 20 years ago,
it was called the Upside-Down-Ternet.
And what someone did was they ran a squid proxy server
that would rotate every picture in every webpage upside down
before it sent it back to the original requester.
It was pretty funny.
All right, we can also filter.
Because we can see the real traffic
and the real destinations, we can block things,
stop bad things from going through.
Another common use is source address overload,
similar to network address translation or NAT,
where we have 200 hosts behind one single IP
that can be done with a proxy server.
And finally firewalling.
Back in the late 90s, proxy firewalls were all the rage
before the rise of stateful firewalls and whatnot.
These were unique systems running proxy applications
that would proxy traffic from one host to another.
What are the benefits to you, the attacker?
I mentioned that if you control that proxy server,
maybe you could turn off logging.
Proxy servers can hide the original requester.
Going back to our picture,
the only thing destination C knows
is that the proxy server made a request to it.
So you can hide behind that.
Who is the real source?
We don't know, it was behind a proxy server.
Man in the middle,
so we talked about being able to alter data.
With man in the middle,
if you control that proxy server
then you could alter data as well.
Intercept data which might have
potentially damaging information in it.
Also internal access.
If for whatever reason, let's go back to our picture.
If for whatever reason
the network perimeter existed right here,
then it could be possible
for you to gain access to resources behind the firewall.
Maybe this proxy is in a DMZ.
If you can attach to or connect to that proxy
then you could then maybe potentially,
who knows, you gotta check,
talk from the proxy to the internal network.
And finally chaining.
I have a picture of chaining here.
So in proxy chaining, what you're doing is you're connecting
to a first proxy, which connects to a second proxy,
which connects to a third and a fourth.
Until the ultimate destination over here in Brazil.
Now, why would you wanna do this?
The laws in, let's call this Spain,
versus the laws in Russia,
versus Japan versus Australia, and ultimately Brazil.
If Brazil needs to find out who did this, who's it gonna be?
It's gonna be Australia.
So they go to Australia and say,
"Hey, I need information for that particular host.
I know it came from this IP right here."
So Australia, maybe they have some liberal policies
with respect to sharing information with Brazil,
where in Japan might not.
So Japan could then say, "No, Brazil.
We take privacy matters seriously.
We're not going to share that information."
So by doing this proxy chaining,
we can anonymize even further.
Now we're gonna talk about a couple of Windows applications
that can be used to manipulate proxy settings
and Windows is, I won't call it unique,
'cause it's like one of three options for OSs,
but it uses system wide proxy settings
rather than application specific.
So Proxifier will control Windows proxy settings.
The application can take it further.
So for example,
Chrome is gonna use the Windows setting, whereas Firefox,
you can override it with a custom proxy server
if you choose.
Proxifier will manipulate proxy settings
on a Windows system.
As well, it has a list of open proxy servers
that you can connect to.
There is a paid version of this,
as well as a time limited demo.
Proxy Switcher, similar, it will manipulate Windows settings
for the proxy server.
As well, it offers a list of available proxy servers
that have been confirmed as operable.
Next up is the Onion Router.
So the purpose of Tor is to anonymize sources
and it does this by using relay routers.
And any traffic has to go
through at least three relay routers,
before it gets sent to the ultimate destination.
These relay routers are independently controlled
and volunteer based.
So no two relays,
I can't say this specifically, but the thought here
is that no two relays are operated by the same person.
If someone had access to all three relays
then they could deduce the information.
They could figure it out.
But by using distributed relays,
distributed routers on the Tor project,
the destination knows it came from Tor exit node 66,
66 knows it came from something in the middle.
The middle Tor router knows it came from the first device.
So you are separating the knowledge
of the source from the receiver, through the Onion Router.
Some other tools for messing with proxy servers
and configuring proxy servers, et cetera.
We have Burp Suite, FastProxySwitch, ProxyCap,
several examples for you to take a look at.