Proxy

From miki
Jump to navigation Jump to search

References

Bypassing proxy

The principle is to install a software on local machine that will map local port to the target server port. The desired application will then connect to this local port, and all traffic is transfered by this extra software, through the proxy. They are basically 2 methods:

  • Port Forwarding (SSL/CONNECT)- This method doesn't require a remote host server, but requires proxy to support SSL/CONNECT command for other protocols than HTTPS (which usually is not the case). Also traffic is not encrypted (and so all activity is visible in the proxy log in clear).
    Bypass software opens a port locally. When application connects to that port, the bypass sw first sends a CONNECT command to the proxy, that will establish a connection to the target host/port, and then that will simply feed all traffic from the local port through this newly opened connection.
    Note that CONNECT command does not per se imply SSL protocol, but is used by SSL to establish connection. So the target server does not need to support SSL on the target port. This is actually a mere port forwarding.
  • Remote Host - This method assumes user has an access to a remote host that will forward all traffic from the proxy to the target server/port. There are some public proxies offering this services. Alternatively user may set up his own relaying remote host with some custom server software. This method supports encryption if this intermediate host does have support for it. This method is very similar to the one using SSH.

Proxy and Tunneling Software

Software Proxy Server Port Fwding Proxy Forwarding Comments
HTTP HTTPS FTP SOCKS Caching NTLM HTTP
proxy		 SOCKS
proxy		 NTLM
auth
cntlm Y Y Y Y - - Y Y Y Y Only forward through a parent proxy.
connect - - - - - - Y Y - Y ssh proxycommand, but time-out on some proxy
nltmaps ? ? ? ? ? ? ? ? ? ? outperformed by cntlm...
privoxy Y Y - - - - - Y Y -?
proxychain ? ? ? ? - - - Y Y Y Requires an external proxy to bypass local proxy
ssh - - - Y - - Y Y - Y Using ssh-tunnel.pl
ssh-tunnel - - - - - - Y Y - Y ssh proxycommand. Send ssh client banner early to prevent time-out
socat - - - - - - Y Y Y Y
tinyproxy Y Y - - - Y - Y - - Patches to support SOCKS proxy fwding and NTLM auth

cntlm

  • Authenticating FTP, HTTP, HTTPS, SOCKS proxy server (i.e. always forward connection to a remote proxy)
  • Transparent TCP/IP port forwarding (tunneling)
  • More efficient than ntlmaps
  • Support NTLMv2, support hashed user/password, can auto-detect automatically most secure auth. mode to use with parent proxy (see -M)
  • Gateway mode
  • See also combination with tsocks

HTTHost+HTTPort

Windows only - HTTHost+HTTPort is a free HTTP Tunneling package, that supports both methods described above. HTTHost is the client software, and HTTPort is the software that can be used to setup a remote relaying server. Installation is quite straightforward.

! Privacy/confidentiality Issues! - In remote host mode, if no remote host is specified, HTTHost will then automatically try to connect to some public proxies. This means that all unencrypted data (including passwords) will be send to these public proxies. If that's an issue, then for maximum safety choose explicitly mode SSL/CONNECT, and don't use option auto.

Privoxy

Privoxy is a HTTP non-caching filtering Proxy Server. It does not support FTP.

Proxychains

Proxychains can be used to tunnel a given http traffic from some program (e.g. telnet) through a random chain of proxies.

socat

socat is a command-line utility that establishes two bidirectional byte streams and transfers data between them. It is a very powerful utility that can be used to establish connection between various type of interfaces (TCP/Serial/...). See also page on socat.

For instance, the following command can be used to tunnel a connection on local port to remote host/port using proxy SSL/CONNECT' command: 

# Using socat v2.0 BETA
/usr/local/bin/socat -ly 'TCP4-LISTEN:143,reuseaddr,fork' PROXY:imap.server:143|TCP:proxy.server:8080

Note that socat is not a proxy server in itself because the destination is always fixed. It can be used to bypass a proxy (using PROXY:), but only to pre-defined location.

SSH

There are basically two ways to bypass a proxy using SSH:

  • Port forwarding (option -L) and reverse-forwarding (option -R)
  • SOCKS proxy (option -D)

Port forwarding

The principle is to establish an SSH connection through the proxy to a remote SSH Server host, and then to tunnel all connections made on some port on the local machine to a remote host that is accessible from the SSH Server. All communications through the proxy are encrypted, and so the proxy only sees a SSH connection. This method assumes that the proxy accepts SSL/CONNECT command to an external SSH port (port 22).

Port forwarding is a standard feature in SSH (command-line option -L). For example, to connect to remote IMAP and SMTP server, using SSH port forwarding: 

ssh -f -N -L143:imap.server:143 -L25:smtp.server:25 ssh.server.org

Now, SSH must also be configured to proxy all connections to ssh.server.org through the proxy. This can be done with option ProxyCommand. See page on [[[SSH]]]. See also this page for example of reverse-forwarding.

SOCKS proxy

SSH can also be configured to act as a SOCKS5 proxy. Using option -D, SSH will open a port on local machine, and client applications may request to connect to some remote host/port through that local port. Example (this example also assumes that SSH is configured to connect through proxy using command ProxyCommand): 

ssh -f -N -D1080 hostname

Client applications must be configured to connect through the opened SOCS5 proxy. Also they must be configured to not resolve DNS locally, but through the SOCKS5 proxy. For instance, in FireFox, this can be done using the extension FoxyProxy.

Tinyproxy

Tinyproxy is an HTTP non-caching Proxy Server. It does not support FTP proxy.

Other proxy-related software

  • Frox
  • FTP-Proxy
Retrieved from "https://miki.immie.org/mediawiki/index.php?title=Proxy&oldid=1281"