Privoxy is a pretty good proxy tool. I’ve used it on a couple internal network servers, and it does it’s job effectively.

Posted at 10:03 am on Aug 31st, 2005 by will

nice

Posted at 10:03 am on Aug 31st, 2005 by Question Answerer

The CGIProxy links posted last week were pretty helpful, but I’d like to find something like it that allows me to use any protocol through our corporate firewall (which only allows port 80 & 443 connections). I’ve looked at a couple of packages, but none seem to support ssl connections. I tried using http://www.http-tunnel.com, and their product works nice, but I’d rather not have to spend money, even though $4.99/month is not too shabby. :)

Posted at 10:16 am on Aug 31st, 2005 by Spoonman

I used a similar setup all through highschool to bypass my school’s censors. I even wrote a small script package that would allow anyone who downloaded it to get on AIM… the administrators hated me, but never caught me.

Posted at 10:24 am on Aug 31st, 2005 by alex

if you don’t need the features of privoxy, you can get this same functionality by setting up the SSH tunnel and setting up socks4 port forwarding (i.e. dynamic) from your SSH client, and in your browser.

You could use this at work for firefox and trillian, while IE goes out through the normal “work” firewall.

Posted at 10:43 am on Aug 31st, 2005 by adam

This will be great for getting around schools firewalls.

The only problem I have is that when i load up putty to connect through my external IP on port 80 (forwarded) it does load, yet localhost does.

Posted at 11:06 am on Aug 31st, 2005 by PENGUIN

4: a socks proxy will offer more flexibility, but remember that it will leak DNS requests. this may not be a problem if you’re just trying to get to a blocked site, but if you’re trying to conceal which sites you’re visiting, it’s worth using privoxy.

5: not sure I understand your problem. You *are* outside your home network when trying to connect using your external IP, right? if not, you probably won’t be able to connect properly.

Posted at 11:17 am on Aug 31st, 2005 by tom

so……..would you have to dl the program to each machine you want to use or could you run it from a thumbdrive a la portable firefox? running from a thumbdrive would be highly desireable, as the admins at my school are…well, id call them nazis but thatd be blasphemous (theyre jesuits). anyway, could someone could give me a step by step on how to use this to stick it to the man and bypass their retarded filters? thatd be REALLY useful…..thanks

Posted at 11:40 am on Aug 31st, 2005 by hankasaurus

How secure is this set up to by pass the proxy from a company’s network to the uncensored internet? Is there a chance of being caught by a system administrator if they are monotoring the network? Would love to use this set up but don’t want to risk it if they can trace my activities.
Thanks

Posted at 11:55 am on Aug 31st, 2005 by Max

I made up a linux version a while back – check my link if you’re interested.

Posted at 12:07 pm on Aug 31st, 2005 by stephendl

To no. 8:

The encryption is pretty secure. Most versions of SSH and the most current version of Putty can force the highest levels of encryption for the traffic that goes back and forth. As was stated before, the biggest concern here is using your work or school’s network’s DNS, they can see where you are going, but they can’t see what you are doing when you are there. With Privoxy, this becomes kinda moot, but you need to be a local administrator to install Privoxy properly, otherwise you will be leaking DNS requests to the local network.

Trillian and Portable Firefox work fine off of a thumbdrive, Putty does as well but does leave a small registry entry on the local machine…not a big deal because it doesnt save a password in that or anything (unless you specifically tell it to.)

An administrator can *see* what you are trying to accomplish, a well trained administrator knows that you are using SSH if you leave Putty set to a default port, if you change it he/she might be able to tell because they see the DNS request in their logs and then a bunch of encrypted traffic. Worst they could do is lock down a bunch of ports, but worst comes to worst you can use port 80 or 443, which most admins don’t block (unless they just don’t want you using the web of course.)

Trillian (at least version 3) has an option to forward all of it’s name requests through the proxy, so they can’t tell you are using it unless they see it on a local machine. Firefox (as of yet) doesn’t support forwarding it’s DNS through the proxy, even though the SOCKS protocol (v5) supports it. Supposedly, the Deer Park builds have an option to enable DNS lookups through the proxy (and future public full releases probably will too) but from what I can tell 1.06 does not. I searched to see if someone had written an extension that would tell Firefox to use DNS through a proxy, but I haven’t found one yet and I’m not sure if it’s technically possible.

Posted at 12:13 pm on Aug 31st, 2005 by Zipperseven

to #10
Thanks ZipperSeven! Just what I wanted to know.

Posted at 12:19 pm on Aug 31st, 2005 by Max

10: you’re slightly misinterpreting the howto. privoxy is run on the SSH server (ie the machine at the user’s home) which presumably the user has admin rights to. You don’t need to install privoxy locally on the client machine — all you need is PuTTY and a web browser.

SOCKS4 proxies (and firefox using SOCKS5, assuming you’re correct) leak DNS requests. But HTTP proxies don’t. I’ve just fired up ethereal and double checked this. Web requests from IE generate DNS requests (light blue by ethereal default). Web requests from firefox, which is currently using privoxy across the SSH tunnel, don’t leak any DNS info. So I believe users should feel secure in their web browsing. I’m no ethereal expert, though, so if someone can confirm it might be a good idea.

Finally, someone in comments at my site suggested using 443, which is usually open and typically used for encrypted SSL traffic. It’s also less likely to attract the attention of script kiddies or your ISP. It’s still pretty easy to tell SSH traffic apart from SSL traffic, but it at least won’t stick out quite as obviously.

Posted at 12:53 pm on Aug 31st, 2005 by tom

Hey tom, I just posted this on your site as well, but I used the instructions at: http://bmonday.com/articles/653.aspx for using public/private keys with Putty and OpenSSH.

I use a nonstandard port because I was getting hit by Chinese hacker-idiots whether I ran the server on port 22. I didn’t think to use 443, but for now the port I’m using isn’t blocked at our corporate firewall.

I’m sorry I misunderstood the Privoxy comment…I had been running Privoxy in combination with the Tor network when I surf from hotspots and had it in my head you were using it on the local machine. Running Privoxy locally doesn’t leak DNS, as far as I’m aware, and I’m not totally sure what the benefits are of running it on the server side?

Posted at 1:30 pm on Aug 31st, 2005 by Zipperseven

bleh…ignore my comments about why you’re running privoxy on the local machine. I totally get it now. for some reason when i was reading your howto i missed that part…i was also incorrect about the socks dns forwarding…i had always used socks5 because i was under the impression it was capable of forwarding dns requests through the proxy while 4 was not.

Posted at 1:51 pm on Aug 31st, 2005 by Zipperseven

Another handy tool… I wanted to ssh into my home box from work, but of course the firewall blocks TCP 22.

“If only I could tunnel ssh through the http proxy…”

Thirty seconds with Google, and viola:
http://www.agroman.net/corkscrew/

works like a charm.

Posted at 1:57 pm on Aug 31st, 2005 by ljp

You’re right about socks5 — it IS capable of forwarding DNS requests, based on what I’ve read. It’s just that very few apps use it properly, and instead do their DNS resolution, then pass the resolved IP to the socks5 proxy. This is why the Tor howto has you use privoxy in between your browser (which leaks DNS requests when using a socks server) and Tor (which is a socks server). Privoxy is smart enough not to leak its DNS resolution requests, and uses socks5 properly.

As you said, socks4 can only handle IP addresses, so it always leaks… however, socks4a (which is what privoxy technically is, I believe) uses domain names in the requests, so when using one of them you never leak (I think).

Anyway, the punchline is the same: this particular setup doesn’t leak DNS info.

And yeah, I see where you’re coming from on the Tor thing — I’ve used that setup before, too. It’s a good one, although there are more and more sites that block traffic from Tor nodes cause of all the abuse that comes from them. It sucks to get random permission denied messages, depending on what node your request is going through. Also, having google assume you’re in germany (because that’s where your exit node is located) can be confusing. This setup doesn’t provide anonymity from anyone but your school/boss, but it avoids many of the headaches of Tor.

Posted at 2:01 pm on Aug 31st, 2005 by tom

A friend and I have been doing this for a while to bypass our school’s proxy, its the only thing that will get past Web Sense. I’v been connecting to my Mac Mini at home.

Posted at 2:41 pm on Aug 31st, 2005 by Robert Hodgen

A better solution I have found is to use Hamachi (www.hamachi.cc) to tunnel. Its incredibly easy to setup. Requires almost no
configuration. It just friggin works.

Setup a socks proxy server at home and use Proxycap (http://proxylabs.netwu.com/) on the client computer to route all applications (or selected ones) through the proxy server.

Hamachi + Proxy + Proxycap = WoW at Work

Posted at 3:01 pm on Aug 31st, 2005 by infra172

I opens SAM but I cant find the heading names Users and groups or anything simmialr to it, I vaquely recall a run command that would open teh window… ANy one know any otherways to acces the USers and Groups options?

Posted at 4:08 pm on Aug 31st, 2005 by Jer

it’s also available through control panel (“user accounts” in XP). poke around, you should be able to find it.

Posted at 4:20 pm on Aug 31st, 2005 by tom

I have a pretty important question- I go to a university with a pretty sweet internet connection- I’ve got a couple programs I use (i2hub, etc) that run over internet2- you can’t log on from anywhere except university connections. I want to set up a proxy so I can go on @ home thru my dorm connection- is this possible?

Posted at 4:37 pm on Aug 31st, 2005 by Jfalk

If you are looking for a free ssh tunnel that sits in the systray (rather than having putty open all the time) check out “SSH Tunnel” http://download.rs4u.com/ It supports autoconnect/reconnect etc and allows you to avoid having the terminal window around all the time.

Posted at 6:26 pm on Aug 31st, 2005 by bryan

My school blocks everything except port 80. My ISP restricts inbound requests on port 80. How can I get through to my home computer? If no one else, I hope the Hack a Day crowd can help. Any comments are appreciated.

Posted at 8:36 pm on Aug 31st, 2005 by oscinis

how come i see no love for stunnel???
stunnel -c -d 80 -r my.home.pc:80

Posted at 10:51 pm on Aug 31st, 2005 by fucter

yeah, privoxy is a good freeware, I use it with tor for browsing sometimes

Posted at 11:38 pm on Aug 31st, 2005 by hall

No 19 – yours suggestions are pretty good if you have control over a machine…in my situation we aren’t able to install anything, and Putty will run from the executable, off of a thumbdrive.

Posted at 10:02 am on Sep 1st, 2005 by Zipperseven

Or instead of SSH you could use OpenVPN which will tunnel over 443 SSL even through your company’s or college’s proxy server. Most companies don’t let you have a direct connection to the internet, just give you a proxy connection.

Posted at 10:30 am on Sep 1st, 2005 by Bruce

This is cool, I am sitting at my school’s computer right now using this setup.

Posted at 3:00 pm on Sep 1st, 2005 by ryokea

Dear Sir,
I will be glad if lessons can be given to me on how to hack..since ma interest lies in doing somthing spontaneous.Thank you and hope to read from you soon.
Regards,
Immanuel

Posted at 8:04 am on Sep 2nd, 2005 by Immanuel

so… i understand the concept behind this and am using it happily. but why would someone use this over the socks proxy posted here a few days back? is there a difference?

Posted at 11:38 am on Sep 2nd, 2005 by weaszel

as mentioned, socks proxies usually leak dns requests. your messages will be secure, but snoopers are able to identify their destination.

also, the other tutorial just assumed you had access to a socks proxy. okay, so tor is there for you to use, but otherwise that’s not necessarily a good assumption. your home connection’s availability and bandwidth can be controlled by you. it’s also clearly legal to use, unlike the unsecured proxies that you’d probably end up using with the other tutorial.

28: you can run ssh tunnels over a proxy, if your company makes you use one. check the settings in PuTTY; it’s pretty straightforward.

Posted at 3:56 pm on Sep 2nd, 2005 by tom

How exactly is this a hack? Seems a straightforward thing to do. I used to do this in university when they capped port usage to http/dns/ftp

Posted at 5:05 pm on Sep 3rd, 2005 by Simon

it’s not rocket science, simon, but it’s a useful thing that a lot of people don’t know how to do. And considering that it took me 2600 (hah!) words to explain it, I’m not sure how straightforward it really is.

Posted at 12:24 pm on Sep 4th, 2005 by tom

Re 11: I downloaded the Firefox Deer Park alpha for Mac OS X and I can’t find the option. It’s not there…

I’ll try the Windows version on VPC.

Posted at 9:23 pm on Sep 6th, 2005 by t3h

Edit 2: I’m trying to see if Portable Firefox works with Deer Park…

Downloading windows deer park now.

Posted at 9:28 pm on Sep 6th, 2005 by t3h

http://www.peacefire.org has detailed and EASY instructions on setting up a circumventor. http://peacefire.org/circumventor/simple-circumventor-instructions.html

Posted at 1:51 am on Sep 12th, 2005 by Diggity dan

I have long used SSH to tunnel out over port 443 and access my home linux server. I can then tunnel all types of other services (e.g., vnc, mail, nntp, etc) over the SSH link. I use 443 since it is almost always open.

However, recently a lot of places seem to be implementing SPI firewalls which block ssh traffic on port 443.

There seem to be several workarounds mentioned here and elsewhere that allow you to set up an ssl tunnel instead, including stunnel, openvpn, and corkscrew (all mentioned above).

I am looking for the easiest way of setting up an underlying ssl tunnel over which I can then run my usual ssh tunnel. I want this to be as transparent as possible so that when there is no spi firewall I can just run ssh and when there is one I can set up an ssl layer underneath.

What is the best program to use to do this?

Thanks

Posted at 9:12 pm on Sep 20th, 2005 by jk

i dont know if i ask a question here about others stuff, but i take my chance. In my university the internet have “web sense”, i dont know if you know anything about how take down that filter. Because that filter piss me off. Tk for all

Posted at 1:45 am on Sep 21st, 2005 by red_daemon

I just wanted to add in my findings-

Firefox Deer Park (1.5 Beta1) does have the setting to allow dns requests to be forwarded to socks proxy. Type about:config, then type proxy into the filter. The setting to change is: network.proxy.socks_remote_dns

I have found that using that or privoxy, both still leak some dns requests. I haven’t been able to figure out the ryhm or reason behind why or what causes it to happen. I Noticed it while testing my config at work using ethereal.
If anyone can shed some light on that, I would be most grateful.

I also wanted to mention that I find tor a bad choice to use at work because of all the connections it opens (run netstat while tor is running). This is a quick tipoff to admins that you are using anonymizing software, unlike using ssh on port 443 which is better blended with normal traffic.

Posted at 3:42 pm on Sep 30th, 2005 by god4twenty

is it just as secure to use the client at http://download.rs4u.com/ as putty? i want my program to revert to the system tray but do not want to give up security

Posted at 3:58 pm on Oct 13th, 2005 by schoolguy

IRT # 38 – this is the still the weak link in the whole proxying issue. Running SSH over 443 will still alert (I am a network security engineer at an enterprise facility). All of this will beat WebSense, but leaking DNS queries and running unexpected proxies will eventually be found.

The real key to being truly hidden is to make a true SSL connection then tunneling the requests through that…not just porting SSH over 443. Almost as good would be to just do http through http tunneling over port 80…so long as there are no DNS leaks. The true destination of your surfing is present inside the tunneled packets, but WebSense/Cisco/etc will not pick it up, and there is too much port 80 traffic on the network to try to look over it all.

One last thing….if your network guys are really savvy, they can set up alerts for port 22/80/443/* connects that don’t have an associated DNS query to go with. To beat this, you might want to have your proxy have a legitimate URL. At my job, if I see any TCP connects going out without an attached DNS query, I get a little suspicious and usually look into it.

Posted at 2:52 pm on Nov 8th, 2005 by Grew

apologies if i miss the specifics, i am not as technical as you guys.

i work for off-site a company but own my own computer (mac OS X). I am on the road a lot (not in one fixed place). they use a cisco vpn and all my traffic has to go thru it. of course they only like IMAP and 8080 or 443. I have proxies set up in all my apps for when I’m on the VPN, but I have to hop off to do all kinds of things, so I am on and off all day, setting and unsetting http proxies. Not even to mention it’s irritating that to be ‘private’ i have to disconnect. What’s the best solution: Ideally, I could just have an app that would tell mail and one browser to go over the VPN, and everything else can go out directly…I’m not sure if that is possible with a cisco VPN (I get the impression that VPNs take over all you network connection?), but that would be ideal!! I’m not trying to get out of a firewall, rather I am trying to only connect thru the VPN for 2 apps, and concurrently do my internet and computing normally/open….sorry for the long post.

Posted at 8:43 pm on Nov 10th, 2005 by qwerty90

Our office use a proxy server that is opened port 80. I do not even know which proxy they are using. We have firewalls also. Of course,they log and analyze the traffic.

We are using IE. Is there a way that I can encrypt all my http/ftp requests so that the logs/firewalls can’t see which sites I visit. I need a detailed reply – if possible; step-by-step.

Thanks.

Posted at 12:58 am on Jan 2nd, 2006 by yeshi

Mindterm is a fully featured java based SSH client complete with working tunnels. It does however create a config directory but this can be easily deleted after. I use it from time to time to set up tunnels to my router WRT54G running dd-wrt v23. I can SSH to it then set up tunnels to the router admin page or even the VNC service running on my machine inside the LAN. Perfect for sorting out problems when my wife is working on my PC.

Posted at 2:34 am on Jan 23rd, 2006 by Duxxyuk

ver good

Posted at 4:31 am on Feb 2nd, 2006 by AAron

qwerty90: On most VPN connections it’s possible to tell it to NOT use the vpn connection as a default gateway. That way the vpn connection will only be used if you need something within the ip-range you’re connecting to.. For all other things it just uses your normal connection.
I could tell you where it is in Windows but I can’t help you with your Mac.

One more thing.. if you just want to chat or do other non-bandwidth-jerking things you could try httptunnel. It’s a small application that works as a proxy but connects to their own servers. IF you pay you can have a fast connection but it’s possible to use a free but slow connection. I can use SSH through that to work on my FreeBSD machine at home and run msn and jabber through it. It is offcourse less secure since you have to rely on their servers, but you don’t have to install stuff at home for this. And the client can be installed as a normal user without admin rights and is easily removed afterwards. Check it out: http://www.http-tunnel.com

Posted at 9:05 am on Feb 23rd, 2006 by Michele

i need to check mail from school

Posted at 4:17 pm on Feb 27th, 2006 by jordan

need to get by bess anyone know of any good proxys

Posted at 11:57 am on Mar 1st, 2006 by robert

Hello there, We have just finished making our new site that aims to help you guys access myspace and other blocked material from school, college or even work. Take a look you wont be disssapointed!

Go to Access it ( http://www.accessit.v33.org) and find out more. Tell all your friends and become an expert in beating the block. Tell me what you think.

Posted at 4:27 pm on Apr 26th, 2006 by Access It

Hello there, We have just finished making our new site that aims to help you guys access myspace and other blocked material from school, college or even work. Take a look you wont be disssapointed!

Go to Access it ( http://www.accessit.v33.org) and find out more. Tell all your friends and become an expert in beating the block. Tell me what you think.

Posted at 4:28 pm on Apr 26th, 2006 by Access It

Hi,

I was wondering if someone could help me. I’m having a problem. I live on university campus and our internet connection has proxy servers that blocks some things. I wanted to download some music from internet (leglly) but the proxy doesn’t allow my programs to access internet. I was wondering, how I could get passed that?

Posted at 5:33 pm on May 24th, 2006 by meg

I have recently discovered that Firefox 1.5 and later automatically sends dns requests through the socks server. eliminating the need for privoxy. please go to irongeek.com, look in hacking illustrated. there should be something about dynamic port fowarding over ssh. watch the video.

Posted at 2:45 am on Aug 1st, 2006 by Cory

Hey, would any of you fellows know how i could hack into a proxy server.I am really frustrated because the institution i am attending has an internet usage limit, and i was wondering if you could get past those restrictions.thanks

Posted at 4:52 am on Aug 18th, 2006 by GITS

132

Posted at 1:41 pm on Oct 2nd, 2007 by anono mouse

I’ve been battling this problem for some time now. I’m glad I stumbled across your site. I tool work for an establishment where the employees are pretty damn smart. Thanks all.. Kelly

Posted at 8:59 am on Oct 24th, 2007 by Kelly

Heyyyy Nice

Posted at 4:30 pm on Oct 29th, 2007 by Blerimi

If using Firefox through a SOCKS proxy, how do you confirm packets are actually being sent through the proxy rather than the regular no proxy internet connection?

Posted at 8:15 pm on Jan 9th, 2008 by KevDog

I need the best proxy

Posted at 3:22 pm on Apr 12th, 2008 by PATRIK

I have openssl on my home windows computer and am using putty on port 443 with my router set up to forward 443 to port 22. I am using firefox portable 2.0.0.14 set to SOCKS5 proxy. In mozilla config:about I have set network.proxy.socks_remote_dns to true. This all seems to work fine. Is it safe to assume my DNS requests will not be getting leaked with this setting or should I be using PRIVOXY and http proxy in firefox?

Posted at 4:43 pm on May 2nd, 2008 by bilbo

Does anyone know a mirror or very similar tutorial to this??? The read button doesn’t work!!!! I really need this tutorial.

Posted at 3:23 pm on Jul 15th, 2008 by helpme0k

Hello friends,
I am Ranjeet from Nepal. I am searching for a trick to bypass my local mobile companies proxy to get access to internet.
See what i want is to surf internet for free because if i pay for internet usage i will not be able to afford it and thats because they charge really high for internet usage.they charge on per kb. when I opened yahoo.com,only loading the yahoo page and around $0.25 was deducted from my account this may feel very little ammount to u but its too much for me.So please help me.

They have two access points
1. Access Point Name:”mero” for internet(also called GPRS)
2. Access Point Name:”mms.mero” for mms

both using the same ip address 192.168.19.15:8080

i can connect to both of the access points but webpages only load when i use the acess point name: mero
and this way i get charged, if pages can be made to load by using the access point “mms.mero” then i think i’ll not be charged. and that is what i want.

can u please help me doing this.
is this possible.
i’ld be very thankful if u can help me connect to internet with loosing money.
thanks a lot for taking out time to read this.
reply me at ramromail@gmail.com
thanks,
Ranjeet

Posted at 8:54 am on Nov 2nd, 2008 by Ranjeet

mmnmc

Posted at 5:52 pm on Dec 17th, 2008 by elfis

university using 443 port encrypted proxy

I need explaination , list or contact about student/teachers in university using encrypted proxy that use 443 port
(example : proxy.univ.edu:443).
my friend (post doctor) in asian university tells me connection in related countries are
free to use in port 443 only

Thx in advance to give me related
explainations
AHA

Posted at 8:08 am on Feb 3rd, 2009 by hadjhaissa

I’ve found a free anonymous browsing proxy here http://www.surfshuffle.com, thought I’d share with whoever is interested before it gets blocked

Posted at 7:16 pm on May 21st, 2009 by Privacy Protection