Penetration Testing mailing list archives
Entity tags as an HTTP covert channel
From: Maarten Van Horenbeeck <maarten () daemon be>
Date: Thu, 01 Jun 2006 21:51:20 +0800
As part of a penetration test I was recently looking for a covert way of transmitting a binary out of a target network. This network did not allow DNS resolution by internal clients, only the perimeter proxies; as such DNS tunneling was not an option. While 'pur sang' HTTP tunneling would have worked, the actual data being trafficked is usually stored in the URI request string (either using a GET or POST request). This was a bit of an issue as I knew these were being logged. It would be preferred if the audit team investigating afterwards would not be able to identify the exact data that was moved out. While looking for alternatives, I decided to use the entity tag functionality in HTTP/1.1. This tag is used bidirectionally between a header called "ETag" on the server side, and "If-None-Match" (and some related ones) on the client side. By encoding data (using Base64) into this header it is possible to move data in a covert manner in and out of the network. Most other headers are used only in a single direction or have a very specific format (Basic-Authentication or Content-MD5, for example). By combining this with partial downloads using Byte-range and 206 headers, randomizing filenames in the request (using a dictionary) and actual files containing semi-random content being returned, this can be made to look very innocuous in the proxy's logs. In the end this may be a good idea if you're looking for an original and more obscure way of sending data out. While it is not a supported tool, I wrote a couple of lines of Perl code that show how, in its most basic form, this could work. It doesn't maintain protocol and has a lot of drawbacks, so please don't consider it a production tool. It did get the job done in my situation, and may give you some ideas. More information at: http://www.daemon.be/maarten/etagtunnel.html Cheers, Maarten -- Maarten Van Horenbeeck, CISSP GCIA GCIH maarten () daemon be - http://www.daemon.be/maarten ------------------------------------------------------------------------------ This List Sponsored by: Cenzic Concerned about Web Application Security? Why not go with the #1 solution - Cenzic, the only one to win the Analyst's Choice Award from eWeek. As attacks through web applications continue to rise, you need to proactively protect your applications from hackers. Cenzic has the most comprehensive solutions to meet your application security penetration testing and vulnerability management needs. You have an option to go with a managed service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm). Download FREE whitepaper on how a managed service can help you: http://www.cenzic.com/news_events/wpappsec.php And, now for a limited time we can do a FREE audit for you to confirm your results from other product. Contact us at request () cenzic com for details. ------------------------------------------------------------------------------
Current thread:
- Entity tags as an HTTP covert channel Maarten Van Horenbeeck (Jun 01)
- RE: Entity tags as an HTTP covert channel Bob Auger (Jun 02)
- Re: Entity tags as an HTTP covert channel Maarten Van Horenbeeck (Jun 02)
- RE: Entity tags as an HTTP covert channel Bob Auger (Jun 02)