For my IT security class summer project, we have to work on different ways to circumvent security measures setup on a school/company network and to explain how these hacks can be detected and avoided.
One of the topics is (please excuse my poor translation):
Albert is connected with his laptop to the school network. He only has access to the world wide web through the school filtering proxy. This proxy is configured to only allow HTTP (TCP 80) and HTTPS (443) requests and some websites (say www.forbidden-forum.com) are filtered out. ICMP echo request/replies are allowed.
What tricks could Albert use to access www.forbidden-forum.com from the school network ? How as a network & system administrator would you detect/prevent those tricks ?
Now I don't ask for answers to that exercise here (that would defeat the whole point of me joining this course and would teach me nothing).
So far I thought of the following tricks:
- Using an ICMP tunnel. Can be detected easily by monitoring an abnormally high amount of ICMP frames.
- Share the internet connection from a cellphone. Hard to detect, especially if the admin have no administrative rights over the students computers.
- Using a VPN over the 443 TCP port. May be detected by monitoring an abnormally high amount of 443 traffic to a particular host (the VPN server), but difficult because it might be legitimate traffic. The admin could try to connect to the same host using a web browser and could however detect it is not a proper web server.
- Have an external web server that acts as a remote browser that redirects everything to www.forbidden-forum.com.
My question is actually about this last point. I think it is possible to have a software that does that but it would have to:
- connect to www.forbidden-forum.com on demand
- replace all URLs in the response document/javascript code to remap to itself such that Albert's computer never actually tries to reach www.forbidden-forum.com directly.
- be able to translate the replaced URLs to their original counterparts.
I would actually love to be able to demonstrate this PoC during the project presentation on the school guest network (which has similar restrictions) but I'd really like to avoid having to "develop" something on my own.
My developer skills are actually not that good and I wonder: is there a software that does something like that ? Perhaps an apache module or configuration ?