Network Ninjitsu: Bypassing Firewalls and Web Filters
Introduction
Picture yourself in the following situation.
You're at school/work minding your own business simply perusing the Internet and all it has to offer.
However when you try to visit your ninja clan's website, you are instead presented with a web page stating that this particular website is blocked. Naturally you are shocked and offended by such an action. So do something about it; sneak through like a ninja with a SSH tunnel.
A Brief Explanation
For those who have no idea what an SSH tunnel is, imagine that whenever you establish a connection to a SSH server that you are digging an underground tunnel from your location at Point A to the server's location at Point B in which a messenger carries messages back-and-forth between you and the server. The reason that the tunnel is underground is because your connection is encrypted. Because of this, people cannot see what is being sent back-and-forth through your connection (underground tunnel). Now once you have established a connection, you have an entire tunnel to send data back-and-forth through.
Now the great thing about this underground tunnel is that it is big enough so that it can fit more then one messenger. As a result, it is possible to send messengers with messages for a server at Point C through the underground tunnel, have them relayed from Point B to point C, from Point C back to Point B, and then sent through the underground tunnel back to you at Point A.
For a more detailed explanation see the Wikipedia page about Tunneling Protocols: wikipedia.org/wiki/Tunneling_protocol
The Guards
Let's assume that the network that you are currently on has a server that filters web traffic, and is guarded by a firewall that does not allow inbound connections, and only allows outbound connections on ports: 21 (FTP), 80 (HTTP), and 443 (HTTPS).
How is this information useful you ask? Well we know that we can get traffic out of three different ports, which means that you have three openings from which you can dig a tunnel.
Preparation
In order to successfully sneak through the firewall/web filter you will need two things:
A SSH server listening on one of the ports that you are allowed outbound access on. For help setting up a SSH server see:
lifehacker.com/software/home-server/geek-to-live--set-up-a-personal-home-ssh-server-205090.php
A SSH client, either PuTTY (GUI) or Plink (command line). This article covers the use of Plink. You can download both PuTTY and Plink from:
A Simple Tunnel
The command for creating a tunnel with Plink is:
For PortNumber use a port that you are outbound access on.
For SourcePort use any number between 1 and 65535, for RemoteServer use the IP address of a remote server you would like to access, and for ServicePort use the port of the service you'd like to access on the remote server.
For example to tunnel a HTTP connection to a remote server at 72.14.207.99 through a SSH server listening on port 21 and with the address 123.123.123.123 the command would look like:
Once you have entered your password, open up a web browser and enter http://127.0.0.1:1337 into the address bar and you will be looking at the Google home page.
Note 1: When using the above command syntax, after you have provided your correct password, the blinking cursor will drop a line. This means that your login was successful.
Note 2: Tunnels can be used to proxy a connection to any address on any port, however this article will focus on tunneling web pages.
Dynamic SOCKS-based Jujitsu!
While a simple tunnel may be alright for connecting to one specific server, a ninja such as yourself has many different servers to browse and it is impractical to create a tunnel for each different server that you may want to connect to.
This is where Dynamic SOCKS-based port forwarding comes into play.
Which in n0n-1337-ninj4 terms is a SSH tunnel similar to the one created in the section above, but its RemoteServer and ServicePort are dynamic, however its SourcePort remains the same.
The command for creating a dynamic tunnel is:
Creating a dynamic tunnel is a little less confusing (syntax wise) then a simple tunnel, however using it is slightly more complex.
Web Browsing Over a Dynamic Tunnel
In order to use a web browser over a dynamic tunnel, you need to be able to modify the browser's proxy settings.
In your current restricted environment you are unable to modify your school's/work's web browser (Which is Internet Explorer [boo!]) settings.
However, this isn't a problem for a ninja like yourself. All you must do is acquire a web browser that you have full control over.
However, you can't leave any trace of using another web browser, (for it is not the ninja way) so installing a new one is out of the question.
This is where Firefox Portable (a mobile install-free version of Firefox) steps in. Download Firefox Portable from portableapps.com/apps/internet/firefox_portable (this article covers using Firefox Portable 2.0) and extract it to a USB jump drive, or to your hard drive for later burning to a CD.
To use Firefox Portable over a dynamic tunnel:
First start Firefox Portable and click on "Tools" and choose "Options". In the options windows click the button at the top labeled "Advanced", then under the "Connection" section click the button labeled "Settings...".
In the connections settings window choose the third option labeled "Manual proxy configuration:". In the entry box next to the words "SOCKS Host" enter 127.0.0.1.
In the entry box to the right of the entry box for "SOCKS Host" enter the SourcePort you used when creating your dynamic tunnel.
Make sure that SOCKSv5 is selected and then click "O.K."
Firefox Portable will now send and receive all traffic over your dynamic tunnel. However, by default Firefox Portable does DNS lookups locally which can give away what you are browsing (very un-ninja-like).
To configure Firefox Portable to send DNS lookups over a dynamic tunnel:
In the address bar type about:config and hit Enter.
In the entry box next to the word "Filter" enter network.proxy.socks_remote_dns. Right-click the result and select the "Toggle" option.
Cloaking Firefox Portable to Look Like Internet Explorer
Well, now you've got a copy of Firefox Portable using a dynamic tunnel to browse the web, but Firefox Portable isn't very stealthy and any passing teacher/administrator will be all over you when they see it.
As a ninja stealth is very important, so your next priority is to configure Firefox Portable so that it looks like Internet Explorer. You will need the following in order to effectively cloak your copy of Firefox Portable:
- Neofox IE 6: addons.mozilla.org/firefox/4327/ - A theme that makes Firefox Portable look like IE 6.0.
- Firesomething: addons.mozilla.org/firefox/31/ - An extension that allows you to change the title of the web browser.
Note: You will have to modify the XPI file slightly to make it install with Firefox Portable 2.0, the steps on how to do this are in the first comment of the page.
- Internet Explorer Windows XP Icons: www.bamm.gabriana.com/cgi-bin/download.pl/package/ieiconsxp.xpi - An extension that replaces the Firefox icons with the ones used by IE. Configure Firesomething to change the browser title from "Mozilla Firefox" to "Microsoft Internet Explorer." Firefox Portable should now look at least resemble IE at a passing glance, and with some tool bar and appearance tweaking on your part, no teacher/administrator will spare it a second glance.
Final Notes and Closing
With your new skills in Network Ninjitsu, no web filter/firewall will stand a chance.
For questions and comments you can comment me at jamespenguin@gmail.com
In case anyone cares, a RAR archive that contains: the paper, Plink, and a modified version of Firefox Portable has been uploaded to the Information Leak server.
All your base are belong to James Penguin