RE: Bypassing firewall

From: Kaptain (kaptainat_private)
Date: Wed Jan 26 2000 - 16:44:46 PST

  • Next message: Peter Harrison: "port 53 probes"

    It's article 52-16.
    
    -K
    
    
    On Tue, 25 Jan 2000, Riley, Steven wrote:
    
    > Phrack 56-16 had a good article on what you suggested. I think the article
    > was called 'Piercing a Firewall'.
    >  
    > 
    > -----Original Message-----
    > From: Mailing Lists [mailto:mlistat_private]
    > Sent: 23 January 2000 16:06
    > To: firewall-wizardsat_private
    > Subject: Bypassing firewall
    > 
    > 
    > Hi!
    > 
    > Back where I work, we are using a firewall the blocks everything coming in, 
    > and gives internal users permission to use the www, ftp, pop and mail 
    > ports.  (no icq, no aol, no nothing else).
    > 
    > But I overheard one of my users bragging that it bypassed the firewall 
    > using two linux machines doing port redirection.
    > 
    > I did a little research on this and the most plausible way I found is that 
    > he is running a linux inside the firewall which grabs everyhing on a 
    > certain port (let's say the icq server port), then forward it through port 
    > 80 to another linux box outside the firewall which make the actual call to 
    > the icq server on the right port.  Is that possible?  Is there any other 
    > alternatives he can be using?
    > 
    > btw, I don't know what the firewall used is, I'm the sysadm for my 
    > division, but we are using the corporate firewall.
    > 
    > Thanks! 
    > 
    >  
    > ===================================================
    > This communication contains information which is confidential and 
    > may also be privileged.  It is for the exclusive use of the 
    > intended recipient(s).  If you are not the intended recipient(s), 
    > please note that any distribution, copying or use of this 
    > communication or the information in it is strictly prohibited.  
    > If you have received this communication in error, please notify 
    > the sender immediately and then destroy any copies of it.
    > --
    > MCI WorldCom Year 2000 information http://www.wcom.co.uk/2000
    > 
    > 
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 13:59:30 PDT