5 ms·

Also worth noting: don't just regex-check the URL with (localhost|127.*) or something similar. Any hostname could point to 127.0.0.1. iptables with --uid-owner

by pfg 11y ago

Also worth noting: don't just regex-check the URL with (localhost|127.*) or something similar. Any hostname could point to 127.0.0.1. iptables with --uid-owner denying traffic to local/private IP space (plus infrastructure-specific stuff like EC2's instance metadata service) would probably be the best option.

mike-cardwell 11y ago
For those who don't know about uid-owner. Here's how you would block any process running as the "mike" user from accessing anything on localhost: iptables -A OUTPUT -m owner --uid-owner mike -d 127.0.0.0/8 -j REJECT ip6tables -A OUTPUT -m owner --uid-owner mike -d ::1 -j REJECT
fidget 11y ago
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT # Create a chain for outgoing proxy traffic -N PROXY_OUT -A OUTPUT -m owner --uid-owner proxy -j PROXY_OUT # Allow replies to the requestor -A PROXY_OUT -p tcp --sport 8080 -j ACCEPT # Prevent proxy from talking to anything non HTTP{,s} (and DNS) -A PROXY_OUT -p tcp -m multiport ! --dports 80,443,53 -j DROP # Allow DNS udp -A PROXY_OUT -p udp --dport 53 -j ACCEPT # Allow the proxy to specific private ips (demos servers) -A PROXY_OUT -d xxx.xxx.xxx.xxx/32 -j ACCEPT # Prevent proxy from talking to anything private -A PROXY_OUT ! -o <%= @public_iface %> -j DROP -A PROXY_OUT -d 10.0.0.0/8 -j DROP -A PROXY_OUT -d 172.16.0.0/12 -j DROP -A PROXY_OUT -d 192.168.0.0/16 -j DROP # Prevent proxy from talking to services via public ips <% @aws_public_ips.each do |name, facts| %> # <%= name %> -A PROXY_OUT -d <%= facts['ec2_public_ipv4'] %>/32 -j DROP <% end %> Anything I missed? Blocking outgoing ports is to taste.
- pfg 11y ago
  I would add: -A PROXY_OUT -d 127.0.0.0/8 -j DROP -A PROXY_OUT -d 169.254.0.0/16 -j DROP That seems to cover everything in IPv4, but if you have IPv6 enabled, you probably want fd00::/8, fe80::/10 and ::1/128 as well (disclaimer: my knowledge of IPv6 is rather limited.)
dunham 11y ago
Also, it can be expressed without the dots. e.g. http://2130706433 http://2130706433
- knodi123 11y ago
  that is how I got around all the internet filters in our high school. nothing makes you feel more like a hacker than punching some numbers on a calculator while all your friends watch, and bam, you're browsing forbidden websites while they all say "whoaa!"
  - justinwr 11y ago
    Same thing happened to me in 1998 but in tech school. Good times. ;)
- sah2ed 11y ago
  For those who are curious how the conversion was done: http://www.aboutmyip.com/AboutMyXApp/IP2Integer.jsp http://www.aboutmyip.com/AboutMyXApp/IP2Integer.jsp
kstrauser 11y ago
Also: $ ping 2130706433 PING 2130706433 (127.0.0.1): 56 data bytes 64 bytes from 127.0.0.1: icmp_seq=0 ttl=64 time=0.043 ms 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.106 ms ^C Dotted quad is just a convenient representation of an unsigned int.
geofft 11y ago
localhost.fbi.gov is a great example. (Also a great way to exfiltrate fbi.gov cookies on a multi-user system, but that's another discussion completely.)

by pfg 11y ago

mike-cardwell 11y ago

For those who don't know about uid-owner. Here's how you would block any process running as the "mike" user from accessing anything on localhost: iptables -A OUTPUT -m owner --uid-owner mike -d 127.0.0.0/8 -j REJECT ip6tables -A OUTPUT -m owner --uid-owner mike -d ::1 -j REJECT

fidget 11y ago

-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT # Create a chain for outgoing proxy traffic -N PROXY_OUT -A OUTPUT -m owner --uid-owner proxy -j PROXY_OUT # Allow replies to the requestor -A PROXY_OUT -p tcp --sport 8080 -j ACCEPT # Prevent proxy from talking to anything non HTTP{,s} (and DNS) -A PROXY_OUT -p tcp -m multiport ! --dports 80,443,53 -j DROP # Allow DNS udp -A PROXY_OUT -p udp --dport 53 -j ACCEPT # Allow the proxy to specific private ips (demos servers) -A PROXY_OUT -d xxx.xxx.xxx.xxx/32 -j ACCEPT # Prevent proxy from talking to anything private -A PROXY_OUT ! -o <%= @public_iface %> -j DROP -A PROXY_OUT -d 10.0.0.0/8 -j DROP -A PROXY_OUT -d 172.16.0.0/12 -j DROP -A PROXY_OUT -d 192.168.0.0/16 -j DROP # Prevent proxy from talking to services via public ips <% @aws_public_ips.each do |name, facts| %> # <%= name %> -A PROXY_OUT -d <%= facts['ec2_public_ipv4'] %>/32 -j DROP <% end %> Anything I missed? Blocking outgoing ports is to taste.

pfg 11y ago
I would add: -A PROXY_OUT -d 127.0.0.0/8 -j DROP -A PROXY_OUT -d 169.254.0.0/16 -j DROP That seems to cover everything in IPv4, but if you have IPv6 enabled, you probably want fd00::/8, fe80::/10 and ::1/128 as well (disclaimer: my knowledge of IPv6 is rather limited.)

dunham 11y ago

Also, it can be expressed without the dots. e.g. http://2130706433 http://2130706433

knodi123 11y ago
that is how I got around all the internet filters in our high school. nothing makes you feel more like a hacker than punching some numbers on a calculator while all your friends watch, and bam, you're browsing forbidden websites while they all say "whoaa!"
- justinwr 11y ago
  Same thing happened to me in 1998 but in tech school. Good times. ;)
sah2ed 11y ago
For those who are curious how the conversion was done: http://www.aboutmyip.com/AboutMyXApp/IP2Integer.jsp http://www.aboutmyip.com/AboutMyXApp/IP2Integer.jsp

kstrauser 11y ago

Also: $ ping 2130706433 PING 2130706433 (127.0.0.1): 56 data bytes 64 bytes from 127.0.0.1: icmp_seq=0 ttl=64 time=0.043 ms 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.106 ms ^C Dotted quad is just a convenient representation of an unsigned int.

geofft 11y ago

localhost.fbi.gov is a great example. (Also a great way to exfiltrate fbi.gov cookies on a multi-user system, but that's another discussion completely.)