6 ms·
Not the first of its kind, just look-up in Wikipedia: https://en.wikipedia.org/wiki/ICMP_tunnel https://en.wikipedia.org/wiki/ICMP_tunnel Any captive portal th
by PinguTS 11y ago
Not the first of its kind, just look-up in Wikipedia: https://en.wikipedia.org/wiki/ICMP_tunnel https://en.wikipedia.org/wiki/ICMP_tunnel
Any captive portal these days block also ICMP.
Most firewalls block ICMP these days, because the days of blacklisting are over and ICMP is not the one who is getting white listed. Why?
The only way these days is to misuse DNS. But even that works less and less reliable.
- vampire_dk 11y agoI agree that some captive portals/firewalls do block ICMP but still I've seen many in my country which don't.
- dogma1138 11y agoWell the question is then what's the point other than a personal exercise? There is plenty of ICMP / multi protocol tunnels software out there for both linux and windows much of it doesn't require administrative privileges. Also ptunnel comes standard with some linux distro's these days Ubuntu and so do probably most of it's derivatives, and as far as raw performance goes ptunnel is also the highest performing one capable of achieving about 150kbps which isn't that bad considering the sheer amount of packets and overhead you get. http://manpages.ubuntu.com/manpages/gutsy/man8/ptunnel.8.html http://manpages.ubuntu.com/manpages/gutsy/man8/ptunnel.8.htm...
- vampire_dk 11y agoI tried using some but couldn't get them to work. Probably because many were developed long time back. There have been many recent changes in the kernel.
- simoncion 11y ago> Well the question is then what's the point other than a personal exercise? What's your question? Is it "What's the point of blocking ICMP?"? Or is it the opposite question? If it's the former, then there are sysadmins out there who cargo-cult their network configuration and listen to folks like Gibson Research Corporation who've been giving really bad advice [0] for the past decade+. [0] Specifically, they strongly recommend dropping all traffic to ports that don't have listening services, along with all ICMP, rather than rejecting said traffic and allowing all non-problematic ICMP. They also have a "handy" tool [1] to make it look like doing anything else is "DANGEROUS": (The tool reports [2] if your site responds to ICMP echo requests.) [1] https://www.grc.com/shieldsup https://www.grc.com/shieldsup [2] Ping Reply: RECEIVED (FAILED) — Your system REPLIED to our Ping (ICMP Echo) requests, making it visible on the Internet. Most personal firewalls can be configured to block, drop, and ignore such ping requests in order to better hide systems from hackers. This is highly recommended since "Ping" is among the oldest and most common methods used to locate systems prior to further exploitation.
- PinguTS 11y agoAny major captive portal re-routes DNS requests to their Login-IP and block any IP leaving the local network. That essentily prohibits any ICMP request to the outside world.
- gonzo 11y agoSure, but they still need to lookup the name.
- johnsmithhenry 11y agoExactly. I've seen many captive portals that don't block ICMP.
- scurvy 11y agoWhy would you block ICMP rather than police it or only allow certain opcodes and sizes? I hope the people blocking ICMP don't ever try and run IPv6.
- cortesoft 11y agoOf course they aren't going to try IPv6. Not because of ICMP, but they won't try it.
- exelius 11y agoYeah, that was my thought. Does everyone really think that the companies building these security platforms haven't thought of this? It's not an obscure protocol or anything, and ICMP has plenty of other potential abuses that would lead network admins to block it.
- est 11y ago> The only way these days is to misuse DNS How about IP over TCP SYN.