Proxy: Difference between revisions

From miki
Jump to navigation Jump to search
No edit summary
Line 9: Line 9:
** http://proxys4all.cgi.net/
** http://proxys4all.cgi.net/


== Bypassing proxy - HTTP ==
== Bypassing proxy ==
The principle is to install a software on local machine that will map local port to the target server port. The desired application will then connect to this local port, and all traffic is transfered by this extra software, through the proxy. They are basically 2 methods:
The principle is to install a software on local machine that will map local port to the target server port. The desired application will then connect to this local port, and all traffic is transfered by this extra software, through the proxy. They are basically 2 methods:
* '''Port Forwarding (SSL/CONNECT)'''- This method doesn't require a remote host server, but requires proxy to support SSL/CONNECT command for other protocols than HTTPS (which usually is not the case). Also traffic is not encrypted (and so all activity is visible in the proxy log in clear).<br/>Bypass software opens a port locally. When application connects to that port, the bypass sw first sends a <tt>CONNECT</tt> command to the proxy, that will establish a connection to the target host/port, and then that will simply feed all traffic from the local port through this newly opened connection.<br/>Note that CONNECT command does not ''per se'' imply SSL protocol, but is used by SSL to establish connection. So the target server does not need to support SSL on the target port. This is actually a mere ''port forwarding''.
* '''Port Forwarding (SSL/CONNECT)'''- This method doesn't require a remote host server, but requires proxy to support SSL/CONNECT command for other protocols than HTTPS (which usually is not the case). Also traffic is not encrypted (and so all activity is visible in the proxy log in clear).<br/>Bypass software opens a port locally. When application connects to that port, the bypass sw first sends a <tt>CONNECT</tt> command to the proxy, that will establish a connection to the target host/port, and then that will simply feed all traffic from the local port through this newly opened connection.<br/>Note that CONNECT command does not ''per se'' imply SSL protocol, but is used by SSL to establish connection. So the target server does not need to support SSL on the target port. This is actually a mere ''port forwarding''.
* '''Remote Host''' - This method assumes user has an access to a remote host that will forward all traffic from the proxy to the target server/port. There are some public proxies offering this services. Alternatively user may set up his own relaying remote host with some custom server software. This method supports encryption if this intermediate host does have support for it. This method is very similar to the one using ''SSH''.
* '''Remote Host''' - This method assumes user has an access to a remote host that will forward all traffic from the proxy to the target server/port. There are some public proxies offering this services. Alternatively user may set up his own relaying remote host with some custom server software. This method supports encryption if this intermediate host does have support for it. This method is very similar to the one using ''SSH''.


=== Using HTTHost + HHTPort ===
== Proxy and Tunneling Software ==

⚫
[http://www.htthost.com/ HTTHost+HTTPort] is a free HTTP Tunneling package, that supports both methods described above. ''HTTHost'' is the client software, and ''HTTPort'' is the software that can be used to setup a remote relaying server. Installation is quite straightforward.
=== [http://www.htthost.com/ HTTHost+HTTPort] ===
⚫
'''Windows only''' - '''[http://www.htthost.com/ HTTHost+HTTPort]''' is a free HTTP Tunneling package, that supports both methods described above. ''HTTHost'' is the client software, and ''HTTPort'' is the software that can be used to setup a remote relaying server. Installation is quite straightforward.


<font color="red">'''! Privacy/confidentiality Issues!'''</font> - In ''remote host'' mode, if no remote host is specified, HTTHost will then automatically try to connect to some public proxies. This means that all unencrypted data (including passwords) will be send to these public proxies. If that's an issue, then for maximum safety choose explicitly mode ''SSL/CONNECT'', and don't use option ''auto''.
<font color="red">'''! Privacy/confidentiality Issues!'''</font> - In ''remote host'' mode, if no remote host is specified, HTTHost will then automatically try to connect to some public proxies. This means that all unencrypted data (including passwords) will be send to these public proxies. If that's an issue, then for maximum safety choose explicitly mode ''SSL/CONNECT'', and don't use option ''auto''.


⚫
=== [http://www.privoxy.org/ Privoxy] ===
⚫
== Bypassing proxy - SSH ==
⚫
'''Privoxy''' is a HTTP non-caching filtering Proxy Server. It does not support FTP.
⚫
=== Port forwarding ===
If you have a connection to a remote host server on which you can connect using ''SSH'', there is good chance that this method will work for you. The principle is the same as for the method '''Remote HOst''' described above: First setup a SSH connection to that remote SSH server, and then do port forwarding through this SSH connection from a port on the local machine to another port on either the same SSH server or even another machine. Port forwarding is a standard feature in ''SSH'' (command-line option <tt>'''-L'''</tt>).


⚫
=== [http://proxychains.sourceforge.net/ Proxychains] ===
Example of command to connect to remote IMAP and SMTP server, using SSH port forwarding on a remote SSH server:
⚫
'''Proxychains''' can be used to tunnel a given http traffic from some program (e.g. telnet) through a random chain of proxies.
<source lang="bash">ssh -f -N -L143:imap.server:143 -L25:smtp.server:25 ssh.server.org</source>


⚫
=== [http://www.dest-unreach.org/socat/ socat] ===
Now, you just need to configure ''SSH'' to connect through the proxy. For this, check the excellent [http://wiki.yobi.be/wiki/Bypass_Proxy Yobi Wiki page].
⚫
'''socat''' is a command-line utility that establishes two bidirectional byte streams and transfers data between them. It is a very powerful utility that can be used to establish connection between various type of interfaces (TCP/Serial/...). See also page on [[Linux Commands#socat|socat]].


For instance, the following command can be used to tunnel a connection on local port to remote host/port using proxy ''SSL/CONNECT''' command:
=== Browser SOCKS proxy ===
⚫
<source lang="bash">
The easiest is to use '''Firefox''' along with extension '''FoxyProxy'''.
# Using socat v2.0 BETA
⚫
/usr/local/bin/socat -ly 'TCP4-LISTEN:143,reuseaddr,fork' PROXY:imap.server:143|TCP:proxy.server:8080
⚫
</source>


Note that '''socat''' is '''not a proxy server''' in itself because the destination is always fixed. It can be used to bypass a proxy (using <code>PROXY:</code>), but only to pre-defined location.
First create a SOCKS proxy on '''localhost:8080''' to remote '''hostname''' using SSH:
<source lang="bash">% ssh -f -N -D8080 hostname</source>
Then configure '''FoxyProxy''':
* ''Options'' &rarr; ''Global Settings'' &rarr; '''Use SOCKS proxy for DNS lookups'''.
⚫
* Create new proxy, eg. '''SSH''':
** Select '''Manual Proxy Configuration'''
** IP Address '''127.0.0.1''', Port '''8080'''
** Select '''SOCKS proxy?'''
* In FoxyProxy menu, select '''Use proxy "SSH" for all URLs'''


=== SSH ===
== Using <tt>'''socat'''</tt> ==
There are basically two ways to bypass a proxy using SSH:
⚫
'''socat''' is a command-line utility that establishes two bidirectional byte streams and transfers data between them. It is a very powerful utility that can be used to establish connection between various type of interfaces (TCP/Serial/...).
* Port forwarding (option '''-L''') and reverse-forwarding (option '''-R''')
⚫
* SOCKS proxy (option '''-D''')


⚫
==== Port forwarding ====
Manpages are [http://www.dest-unreach.org/socat/doc/socat.html here]. Don't forget [http://wiki.yobi.be/wiki/Bypass_Proxy#Client_side:_using_socat Yobi].
The principle is to establish an SSH connection through the proxy to a remote SSH Server host, and then to tunnel all connections made on some port on the local machine to a remote host that is accessible from the SSH Server. All communications through the proxy are encrypted, and so the proxy only sees a SSH connection. This method assumes that the proxy accepts SSL/CONNECT command to an external SSH port (port 22).


Port forwarding is a standard feature in ''SSH'' (command-line option <tt>'''-L'''</tt>). For example, to connect to remote IMAP and SMTP server, using SSH port forwarding:
For instance, the following command do the same as ''SSL/CONNECT''' method above (using HTTHost), in just one line. It opens a local port 143, that maps to a remote IMAP server through corporate proxy (requires socat v2.0):
<source lang="bash">
<source lang="bash">
/usr/local/bin/socat -ly 'TCP4-LISTEN:143,reuseaddr,fork' PROXY:imap.server:143|TCP:proxy.server:8080
ssh -f -N -L143:imap.server:143 -L25:smtp.server:25 ssh.server.org
</source>
</source>
Now, '''SSH''' must also be configured to proxy all connections to <tt>ssh.server.org</tt> through the proxy. This can be done with option <code>ProxyCommand</code>. See page on [[[SSH]]]. See also this page for example of ''reverse-forwarding''.


⚫
==== SOCKS proxy ====
Alternatively, one can also use ''socat'' as the ssh ''ProxyCommand'' in <tt>~/.ssh/config</tt>:
SSH can also be configured to act as a SOCKS5 proxy. Using option '''-D''', SSH will open a port on local machine, and client applications may request to connect to some remote host/port through that local port. Example (this example also assumes that SSH is configured to connect through proxy using command <code>ProxyCommand</code>):
<source lang="bash">
<source lang="bash">
ssh -f -N -D1080 hostname
⚫
ProxyCommand /usr/local/bin/socat -ly - 'PROXY:%h:%p|TCP:proxy.server:8080'
</source>
</source>


Client applications must be configured to connect through the opened SOCS5 proxy. Also they must be configured to '''not resolve DNS locally''', but through the SOCKS5 proxy. For instance, in '''FireFox''', this can be done using the extension '''FoxyProxy'''.
In some case, the proxy might wait for the client (ie. local pc) to send an authentication string as it is the case in the SSL protocol. A solution for this is described in [http://wiki.yobi.be/wiki/Bypass_Proxy#Client_side:_using_socat Yobi]. It consists in sending immediately the client SSH banner, and strip it when it is sent by the client. The solution described uses a custom Perl script. Let's see if we can do it with ''socat'' only.

For this we would need a small process that would output the client SSH banner in ''stdout'', and afterwards simply pipe ''stdin'' to ''stdout'', except if the piped line matches the client SSH banner. For this we could use '''sed''' as follows (assuming client banner is ''SSH-2.0-OpenSSH_5.1''):
⚫
<source lang="bash">
sed -n "1 s/^/SSH-2.0-OpenSSH_5.1\n/p; /SSH-2.0-OpenSSH_5.1/d; /SSH-2.0-OpenSSH_5.1/! p"
⚫
</source>

== Proxy Softwares ==

HTTP - On Windows:
⚫
* '''[http://www.privoxy.org/ Privoxy]'''
⚫
: ''Privoxy'' is a HTTP non-caching filtering Proxy server. It does not support FTP.


⚫
=== [https://www.banu.com/tinyproxy/ Tinyproxy] ===
HTTP - On Linux:
'''Tinyproxy''' is an HTTP non-caching Proxy Server. It does not support FTP proxy.
⚫
* '''[https://www.banu.com/tinyproxy/ Tinyproxy]'''
⚫
* '''[http://proxychains.sourceforge.net/ Proxychains]'''
⚫
: ''Proxychains'' can be used to tunnel a given http traffic from some program (e.g. telnet) through a random chain of proxies.
⚫
* '''[http://www.dest-unreach.org/socat/ socat]'''
: ''Socat'' can be used to establish connections through proxies, but it is not in itself a proxy server (because you must tell in advance what is the target host).


== Other proxy-related software ==
FTP - On Linux:
* Frox
* Frox
* FTP-Proxy
* FTP-Proxy

Revision as of 22:27, 14 November 2009

References

Bypassing proxy

The principle is to install a software on local machine that will map local port to the target server port. The desired application will then connect to this local port, and all traffic is transfered by this extra software, through the proxy. They are basically 2 methods:

  • Port Forwarding (SSL/CONNECT)- This method doesn't require a remote host server, but requires proxy to support SSL/CONNECT command for other protocols than HTTPS (which usually is not the case). Also traffic is not encrypted (and so all activity is visible in the proxy log in clear).
    Bypass software opens a port locally. When application connects to that port, the bypass sw first sends a CONNECT command to the proxy, that will establish a connection to the target host/port, and then that will simply feed all traffic from the local port through this newly opened connection.
    Note that CONNECT command does not per se imply SSL protocol, but is used by SSL to establish connection. So the target server does not need to support SSL on the target port. This is actually a mere port forwarding.
  • Remote Host - This method assumes user has an access to a remote host that will forward all traffic from the proxy to the target server/port. There are some public proxies offering this services. Alternatively user may set up his own relaying remote host with some custom server software. This method supports encryption if this intermediate host does have support for it. This method is very similar to the one using SSH.

Proxy and Tunneling Software

HTTHost+HTTPort

Windows only - HTTHost+HTTPort is a free HTTP Tunneling package, that supports both methods described above. HTTHost is the client software, and HTTPort is the software that can be used to setup a remote relaying server. Installation is quite straightforward.

! Privacy/confidentiality Issues! - In remote host mode, if no remote host is specified, HTTHost will then automatically try to connect to some public proxies. This means that all unencrypted data (including passwords) will be send to these public proxies. If that's an issue, then for maximum safety choose explicitly mode SSL/CONNECT, and don't use option auto.

Privoxy

Privoxy is a HTTP non-caching filtering Proxy Server. It does not support FTP.

Proxychains

Proxychains can be used to tunnel a given http traffic from some program (e.g. telnet) through a random chain of proxies.

socat

socat is a command-line utility that establishes two bidirectional byte streams and transfers data between them. It is a very powerful utility that can be used to establish connection between various type of interfaces (TCP/Serial/...). See also page on socat.

For instance, the following command can be used to tunnel a connection on local port to remote host/port using proxy SSL/CONNECT' command: 

# Using socat v2.0 BETA
/usr/local/bin/socat -ly 'TCP4-LISTEN:143,reuseaddr,fork' PROXY:imap.server:143|TCP:proxy.server:8080

Note that socat is not a proxy server in itself because the destination is always fixed. It can be used to bypass a proxy (using PROXY:), but only to pre-defined location.

SSH

There are basically two ways to bypass a proxy using SSH:

  • Port forwarding (option -L) and reverse-forwarding (option -R)
  • SOCKS proxy (option -D)

Port forwarding

The principle is to establish an SSH connection through the proxy to a remote SSH Server host, and then to tunnel all connections made on some port on the local machine to a remote host that is accessible from the SSH Server. All communications through the proxy are encrypted, and so the proxy only sees a SSH connection. This method assumes that the proxy accepts SSL/CONNECT command to an external SSH port (port 22).

Port forwarding is a standard feature in SSH (command-line option -L). For example, to connect to remote IMAP and SMTP server, using SSH port forwarding: 

ssh -f -N -L143:imap.server:143 -L25:smtp.server:25 ssh.server.org

Now, SSH must also be configured to proxy all connections to ssh.server.org through the proxy. This can be done with option ProxyCommand. See page on [[[SSH]]]. See also this page for example of reverse-forwarding.

SOCKS proxy

SSH can also be configured to act as a SOCKS5 proxy. Using option -D, SSH will open a port on local machine, and client applications may request to connect to some remote host/port through that local port. Example (this example also assumes that SSH is configured to connect through proxy using command ProxyCommand): 

ssh -f -N -D1080 hostname

Client applications must be configured to connect through the opened SOCS5 proxy. Also they must be configured to not resolve DNS locally, but through the SOCKS5 proxy. For instance, in FireFox, this can be done using the extension FoxyProxy.

Tinyproxy

Tinyproxy is an HTTP non-caching Proxy Server. It does not support FTP proxy.

Other proxy-related software

  • Frox
  • FTP-Proxy
Retrieved from "https://miki.immie.org/mediawiki/index.php?title=Proxy&oldid=1280"