The squid http proxy allows an administrator to specify banned sites. Unfortunately, users can get around this by using URL hex escapes or specifying an IP address.
"Vitaly V. Fedrushkov" <willy@CSU.AC.RU> and Mauro Lacy <mauro@INTER-SOFT.COM>
Bypass some squid access restrictions.
Those relying on squid access restrictions to keep students, employees, etc. from undesireable sites.
23 February 1998
Date: Fri, 20 Feb 1998 08:04:00 +0500
From: "Vitaly V. Fedrushkov" <willy@CSU.AC.RU>
Subject: Simple way to bypass squid ACLs
-----BEGIN PGP SIGNED MESSAGE-----
Software: Squid Internet Object Cache
Version: 1.1.20 (at least)
Summary: any URL-based ACLs can be bypassed using
Impact: renders any access control based on url_regex
and/or urlpath_regex unusable
It is possible to bypass squid access control rules based on URL
regular expressions. Due to insufficient URL parsing it is possible
to rewrite URL with hex escapes so that it is no longer matched
against some rule but remains valid for replying server.
acl PornoURLs url_regex "/var/lib/squid/etc/PornoURLs.acl"
http_access deny PornoURLs
netscape http://www.aha.ru/~sands/ -> Access denied
-> 200 OK
http://www.ravage.com/plypage/html/nude.html -> Access denied
http://www.ravage.com/plypage/html/%75%6ede.html -> 404 Object Not Found
Any access restrictions based on such ACLs can be easily broken by
clients. In my case it can be used for acceptable usage policy (AUP)
1. Rewrite regexps to match any valid URL rewriting. Seems tricky
and result is unreadable by human (== easy to mistype).
2. Use some request-rewriting software at proxy port to canonify
request and forward it to squid. This breaks port- and IDENT-based
As you can see, result depends on server implementation. RFC1738 says
MAY on escaping printable characters. Also it is stated that such
escapes may change URL semantics. None the less, any other software
that uses URL matching is about to be checked.
Thanks for your time.
- - --
"No easy hope or lies | Vitaly "Willy the Pooh" Fedrushkov
Shall bring us to our goal, | Information Technology Division
But iron sacrifice | Chelyabinsk State University
Of Body, Will and Soul." | mailto:firstname.lastname@example.org +7 3512 156770
R.Kipling | http://www.csu.ac.ru/~willy VVF1-RIPE
-----BEGIN PGP SIGNATURE-----
-----END PGP SIGNATURE-----
Date: Mon, 23 Feb 1998 13:08:41 -0300
From: Mauro Lacy <mauro@INTER-SOFT.COM>
Subject: Re: Simple way to bypass squid ACLs
Vitaly V. Fedrushkov wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Good $daytime,
> Software: Squid Internet Object Cache
> Version: 1.1.20 (at least)
> Summary: any URL-based ACLs can be bypassed using
> simple rewriting
> Impact: renders any access control based on url_regex
> and/or urlpath_regex unusable
> It is possible to bypass squid access control rules based on URL
> regular expressions. Due to insufficient URL parsing it is possible
> to rewrite URL with hex escapes so that it is no longer matched
> against some rule but remains valid for replying server.
You can also replace the URL by its numerical IP address(at least this
works for the proxy of my company) eg.:
netscape http://www.playboy.com -> Access denied
Addresses: 184.108.40.206, 220.127.116.11
Aliases: www.playboy.com, www.express.playboy.com
netscape http://18.104.22.168 -> OK!
netscape http://22.214.171.124 -> OK!
> 1. Rewrite regexps to match any valid URL rewriting. Seems tricky
> and result is unreadable by human (== easy to mistype).
> 2. Use some request-rewriting software at proxy port to canonify
> request and forward it to squid. This breaks port- and IDENT-based
I suppose that in this case you have to add the numerical IP of the URL
in the ACL.
Everybody: please don't tell my company sysadmin. :-))
> - - --
> "No easy hope or lies | Vitaly "Willy the Pooh" Fedrushkov
> Shall bring us to our goal, | Information Technology Division
> But iron sacrifice | Chelyabinsk State University
> Of Body, Will and Soul." | mailto:email@example.com +7 3512 156770
> R.Kipling | http://www.csu.ac.ru/~willy VVF1-RIPE
Mauro Lacy - firstname.lastname@example.org
Intersoft Argentina - http://www.inter-soft.com
The master index of all exploits is available
here (Very large file)
Or you can pick your favorite operating system:
This page is part of Fyodor's exploit
For a free program to automate scanning your network for vulnerable
hosts and services, check out my network mapping tool, nmap. Or try these Insecure.Org resouces: