Beating web filters

Hoss

Make America's Team Great Again
<Gold Donor>
25,537
12,022
Sorry if this is covered somewhere already, I really don't venture into this subforum very often. Last week I was at a jobsite that had some aggressive web filtering going on that kept me away from foh. So I'm looking for tips on how to beat it next time. I won't be able to try anything anyone suggests, but I'll copy it into a text file and keep it with me for next time.

Before I go into what I tried, I want to answer the obvious question, No I'm not worried about getting fired for visiting this site from the jobsite. I might get in trouble for looking at porn, but even then probably wouldn't lose my job. In this case, the jobsite is an offshore platform, so I'm there 24 hours a day. Nobody is going to care about me wasting time when I'm off tower, as long as no one sees me looking at porn.

I did not get any screenshots of the errors. For the most part, it was going to a redirect and saying the page could not be found. A few times the redirect page came up with the company logo and said it had been blocked, and if I disagreed I could continue and my activities would be logged (oooh scary). I clicked continue and then it went to the page not found error. There was nothing on the pages that indicated why it was blocked. Next time this happens, I might use twitter or suenig's email to get help, but I didn't have either of those available at the time. Actually, I probably could have gotten suenigs email, but I didn't think of it, and I was spending all my time trying to figure the shit out myself.

First thing I tried was the obvious address corrections. I tried with and without the https and I tried rererolled. Then I tried some proxies. Problem with the proxies is that every one I tried seemed to be blocked. I found a list of about 200 and tried just pinging them and none worked. I started doubting whether you're even supposed to be able to ping a proxy, but eventually I found a site that would check if another site was a proxy, and it was able to ping proxies. I figured they might have the same list of proxies I was getting off the internet, so I reached out to some people to get some private proxies to try. I only got 2 and neither of them worked. In fairness, one might not have even been active anymore. It was a proxy for another company that I had from years ago.

After that, I started wondering if it was DNS blocking, so I tried a couple of public DNS. Google was the only one that worked, but even with that I couldn't get to this site. By 'worked', I meant that I could get to any site at all. The only way I could find to get to this site was by using google translate or google mobilizer as a proxy, but both of those strip out all the CSS and the site was unusable. I was able to ping firesofheaven.org with no problem.

I think that's all I tried. I was only out there like 4 days and a lot of the websites I was trying for help were blocked too. I should add that youtube was also blocked and a couple of guys said they had no trouble getting to youtube, but they wouldn't tell me how they did it. Just smiled when I asked. So there is a way. Anyone got any ideas about how they were blocking and/or how to get around it?
 
Last edited:

Frenzied Wombat

Potato del Grande
14,730
31,802
I take it the "page could not be found" errors were with https sites, while you got the redirect/block page with http sites, correct? This would be standard web proxy behavior. To be honest, assuming they have it properly configured, there's not much you can do to bypass it. Proxy/VPN sites are a specific category blocked by the filter, so unless you can find a new one, that isn't your ticket out. Chances are the guys that can watch Youtube haven't found a backdoor, they just have a different web policy applied to them. Imho, you're better off finding out who manages the system and politely asking him to unblock rererolled than trying to find a way to bypass it. One thing you can try is using something like teamviewer or even RDP to remote to your home computer and surf from there-- this is assuming they haven't locked down the remote access category in their web filter.
 
  • 1Like
Reactions: 1 user

TomServo

<Bronze Donator>
6,368
8,356
Hey frenzied, I had a trick a billion years ago that allowed me to use firefox running off a thumb drive to bypass the filters. still possible?
 

Breakdown

Gunnar Durden
5,807
8,019
Hey frenzied, I had a trick a billion years ago that allowed me to use firefox running off a thumb drive to bypass the filters. still possible?

That wont matter. If they are filtering at the egress point whatever workstation you are on wont matter. They are filtering traffic at the edge. Imagine a tunnel witha check point. Wont matter what kind of car you are driving, they will still stop you at the check point.

Frenzied is right, your best bet is hoping some kind of services are open that you can jump to a remote box and then use your home PC to surf. Thats what I do at work. Use my home PC as a jump box.
 
  • 1Like
Reactions: 1 user

Mist

Eeyore Enthusiast
<Gold Donor>
30,370
22,143
We have a web filter but all our lab servers are in the DMZ... dynamic ssh tunnel to any of them, set Firefox to use localhost for a proxy and out you go.

But yeah, you could probably use Cygwin on your home box and ssh to it.

Have you tried just running teamviewer or logmein on your home machine and then connecting to it?
 

Frenzied Wombat

Potato del Grande
14,730
31,802
ssh tunnel to home pc or colo, full freedom.

Yeah that's ideal, but if your network admin is allowing port 22 outbound through the firewall without at least locking it down by business relevant destination IP's he deserves to lose his job.

The best overall bet at bypassing the web filter is to either use a remote control app that can work over 443 (like teamviewer) or by tunneling another remote control app over https. 443 has to be let out, your home PC has an IP address that will be categorized as "uncategorized" by the web filter (which is typically allowed through), so the only way they can nail you is if they are doing SSL and layer 7 inspection. All the high end web filters can certainly do this, but many don't have it turned on because of the setup complexity to get it working properly.
 

Cad

<Bronze Donator>
24,487
45,378
Yeah that's ideal, but if your network admin is allowing port 22 outbound through the firewall without at least locking it down by business relevant destination IP's he deserves to lose his job.

The best overall bet at bypassing the web filter is to either use a remote control app that can work over 443 (like teamviewer) or by tunneling another remote control app over https. 443 has to be let out, your home PC has an IP address that will be categorized as "uncategorized" by the web filter (which is typically allowed through), so the only way they can nail you is if they are doing SSL and layer 7 inspection. All the high end web filters can certainly do this, but many don't have it turned on because of the setup complexity to get it working properly.

I can just run sshd on port 80 at home. This is not an issue.
 

Frenzied Wombat

Potato del Grande
14,730
31,802
I can just run sshd on port 80 at home. This is not an issue.

Sure, you can pretty much tunnel anything over 80/443 these days, but I'd like to hope the corporate firewall or IDS has tunneling inspection turned on.. 80 is easy, but tunneling over 443 is harder to detect unless they're running SSL inspection.
 

Cad

<Bronze Donator>
24,487
45,378
Sure, you can pretty much tunnel anything over 80/443 these days, but I'd like to hope the corporate firewall or IDS has tunneling inspection turned on.. 80 is easy, but tunneling over 443 is harder to detect unless they're running SSL inspection.

I guess I've never worked anyplace where they filtered to that extent. Law firms typically log and filter certain sites, but 22 is wide open for me to tunnel out on.
 

a_skeleton_03

<Banned>
29,948
29,762
What I do is run a squid proxy on my a_skeleton_03.org server and the military doesn't seem to stop it.

I also run guacamole (html5 vnc/ssh/rdp server) and have several desktops there I can access. It's a "website" so it's all port 80.
 
  • 1Like
Reactions: 1 user

Frenzied Wombat

Potato del Grande
14,730
31,802
I guess I've never worked anyplace where they filtered to that extent. Law firms typically log and filter certain sites, but 22 is wide open for me to tunnel out on.

Doesn't surprise me at a lawfirm. If there's one group of people that try and continually justify exemptions to our web surfing and firewall restrictions it's our attorneys, usually under the guise of needing access to file sharing sites or data rooms.
 

Hoss

Make America's Team Great Again
<Gold Donor>
25,537
12,022
I take it the "page could not be found" errors were with https sites, while you got the redirect/block page with http sites, correct?

I don't know. I thought it was random, but since you asked, maybe it wasn't. Most of the time when I tried foh, I was using HTTPS. But i didn't really pay attention to that with the other sites. I figured their block page was having trouble loading.

This would be standard web proxy behavior. To be honest, assuming they have it properly configured, there's not much you can do to bypass it. Proxy/VPN sites are a specific category blocked by the filter, so unless you can find a new one, that isn't your ticket out.

I was able to VPN into my office, but it didn't unblock anything.

I didn't try remote access because I don't have anything setup.

All that being said this forum is pretty well classified for the vast majority of web filters.

I know the work you put into that, which is why I was surprised when I was blocked. They didn't even block facebook. Fuckers all over the platform were on facebook while on tower and no one gave a damn. I hate everything about facebook.
 

Frenzied Wombat

Potato del Grande
14,730
31,802
I don't know. I thought it was random, but since you asked, maybe it wasn't. Most of the time when I tried foh, I was using HTTPS. But i didn't really pay attention to that with the other sites. I figured their block page was having trouble loading.



I was able to VPN into my office, but it didn't unblock anything.

I didn't try remote access because I don't have anything setup.



I know the work you put into that, which is why I was surprised when I was blocked. They didn't even block facebook. Fuckers all over the platform were on facebook while on tower and no one gave a damn. I hate everything about facebook.

If you're able to VPN to your office then you're home free. Setup a remote access tool on your PC, or simply enable RDP, and it will work. They can't see what traffic you are sending over the VPN.
 

Hoss

Make America's Team Great Again
<Gold Donor>
25,537
12,022
If you're able to VPN to your office then you're home free. Setup a remote access tool on your PC, or simply enable RDP, and it will work. They can't see what traffic you are sending over the VPN.

Are you talking about on the laptop I take out there, or do I need another PC in the office? Because i don't have another PC in the office.
 

Louis

Trakanon Raider
2,836
1,105
A trick I use with varying results is using Google Translate. I basically translate the website url from one language to another and for whatever reason most firewalls don't pick up on it. I know this method worked with sonicwall and more recently bluecoat. You may get weird formatting, but for a text based website it really never bothered me.