3 ms·
Timely. I've been noticing on flights that the in-flight wifi uses a squid proxy to block you until you pay - but most of the time, you'll get whatever data fr
by RajT88 3y ago
Timely. I've been noticing on flights that the in-flight wifi uses a squid proxy to block you until you pay - but most of the time, you'll get whatever data from the DNS Forwarder even if you haven't paid yet.
I've been noodling on how to build a simple proxy off DNS to test on my next flight.
- tekknolagi 3y agoSearch for iodine
- deleted 3y ago[deleted]
- smashed 3y agoYou might be interested in iodine. https://github.com/yarrick/iodine https://github.com/yarrick/iodine
- Bender 3y agoA word of caution, don't try this in a corporate environment. Many corporate firewalls will generate security alerts on high DNS request rates. PaloAlto PAN's specifically have alerts for this. I believe Fortigate may as well. Most of the DLP appliances will detect this too. Splunk also has a module to detect this based on query logs. I don't have a horse in the race, just trying to save a few here from a paddlin'.
- xyx0826 3y agoNot a proxy but SoftEther VPN supports connection over DNS and/or ICMP. This is meant for circumventing firewalls. https://www.softether.org/1-features/1._Ultimate_Powerful_VPN_Connectivity#1.6._VPN_over_ICMP.2C_and_VPN_over_DNS_(Awesome https://www.softether.org/1-features/1._Ultimate_Powerful_VP...!)
- fruitreunion1 3y agoudp2raw also supports ICMP tunneling, as a simpler/leaner option that you could run WireGuard over. It's quite performant compared to DNS.
- andrelaszlo 3y agoA regular proxy on port 53 might work? Is it necessary to actually use DNS? Otherwise there's https://github.com/yarrick/iodine https://github.com/yarrick/iodine Edit: seems like others have recommended it already. I got it working in a hotel room once after giving up on the utterly broken ToS acceptance page for the WiFi.
- fruitreunion1 3y agoIf they do DPI on port 53 traffic to only allow DNS, then it's necessary. The neat thing about iodine is that it even works when you don't even have access to your home/whatever destination IP address due to the firewall redirecting packets to their server. It uses their resolver as a proxy to access a nameserver that you control, allowing you to exfiltrate data and get an uncensored connection.
- philipwhiuk 3y agoThis sort of escape is how Kaminsky ended up as the guy who broke DNS. (From the opener to https://www.wired.com/2008/11/ff-kaminsky/ https://www.wired.com/2008/11/ff-kaminsky/ )
- gunapologist99 3y agoRIP Dan Kaminsky