#12 Encryption of target IP address
My restrictive firewall/proxy at work (ISA?) blocks even encrypted http-connections. After analysing the packets from Wireshark, i noticed that in general the initial request is done by something like that:
GET http://\[Server]/ht/tunnel.php?a=c&sw=999&s=[Target IP Address]&p=80&o=2&pk=<EncryptedData>
The data itself is encrypted, but the IP address in the PHP variable is plain readable.
So when putting the link above exactly in my browser, it will be blocked!
When i put nonsense instead of the IP address into the PHP variable, the requests passes the firewall:
http://\[Server]/ht/tunnel.php?a=c&sw=999&s=hhhhhhhhhhhh&p=80&o=2&pk=<EncryptedData>
(of course, i get an expected error of tunnel.php). So it seems that the proxy/firewall detects tunneling by scanning the http request for IP addresses.
The work-around would by just to simply encrypt the target IP on the client side respectively decode it as string on the server/php side.
