Re: [Full-disclosure] ByPass a BlueCoat Proxy 8100 Serie authentification
On Fri, Aug 14, 2009 at 4:17 PM, anto...@santo.franto...@santo.fr wrote: Gone beach for the Week End, more info on monday. Antoine. Lies. -Guy ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] ByPass a BlueCoat Proxy 8100 Serie authentification
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Is it working on all versions ? Le 14 août 09 à 15:10, anto...@santo.fr a écrit : Title : ByPass a BlueCoat Proxy 8100 Serie (authentification request AND eventually the 3rd party url filtering solution) Date : 14/08/2009 Author : Antoine Santo -BEGIN PGP SIGNATURE- Version: GnuPG/MacGPG2 v2.0.12 (Darwin) iEYEARECAAYFAkqFdYwACgkQbd20JnyNpPQabwCfZ4/0226HqLuMR6x9uFEvCNbi MKoAniYMMuW6KpaHq/kRPx7RXdwavyV3 =1hNq -END PGP SIGNATURE- ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] ByPass a BlueCoat Proxy 8100 Serie authentification
** Test two : i just add a spoofed http header REFERER to a whitelisted (localdatabase) site Result : W00t !! ** Can you elaborate on, to a whitelisted (localdatabase) site? None of the rules defined in the Web Authentication Layer or Web Access Layer have a whitelist attribute. In the list of available actions for the Web Authentication Layer there's: Do Not Authenticate, ForceAuthenticate1 and Deny. In the Web Access Layer list of available actions there are a couple dozen options, none of which are labeled whitelist or whitelisted. Also, I'm not sure what you mean by localdatabase. Internal http traffic shouldn't hit the proxies... Using an 8100-C with SG05 5.2.4.3. -Guy ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] ByPass a BlueCoat Proxy 8100 Serie authentification
From: Sebastien gioria s...@gioria.org Is it working on all versions ? Tested version : - Software version: SGOS 5.2.4.14 Proxy Edition ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] ByPass a BlueCoat Proxy 8100 Serie authentification
** Test two : i just add a spoofed http header REFERER to a whitelisted (localdatabase) site Result : W00t !! ** Antoine, Would you mind sharing the policy (on the bluecoat) you're referring to for www.mappy.fr? What is the Action for that host or IP set to? You mentioned whitelisted but that could mean anything from the list of options in the policy manager. Thanks, Guy ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] ByPass a BlueCoat Proxy 8100 Serie authentification
Hi, ** Test two : i just add a spoofed http header REFERER to a whitelisted (localdatabase) site Result : W00t !! ** Can you elaborate on, to a whitelisted (localdatabase) site? i think it basically means 'to a site thats been configured as allowed in the configuration of the BC' - allowed = whitelisted, int he configuration = localdatabase alan ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] ByPass a BlueCoat Proxy 8100 Serie authentification
i think it basically means 'to a site thats been configured as allowed in the configuration of the BC' - allowed = whitelisted, int he configuration = localdatabase alan Alan, The Bluecoat 8100-C I'm going through has 27 policies in the Web Access Layer. The first policy is configured to ForceContentFail for a list of destinations (a blacklist since colors seem to be in). The next 15 (2-16) policies are all DENY rules for specific hosts, IPs, regex patters, filenames, etc. The next 10 rules (17-26) are for destinations that should Bypass Caching. The final rule (27) is, Source: Any - Destination: Any - Service/Time: Any, Action: Allow. Google.com isn't listed anywhere in the first 26 policies - anyone on the LAN can access Google without authenticating. So, if I understand what you're saying, I should be able to spoof the Referer string sent from my browser to something like www.google.com, or cnn.com, whatever isn't listed in any of the DENY policies, and not only bypass authentication, but access sites explicitly defined in the deny policies? If that's the case, circumventing the auth or accessing blacklisted sites isn't happening. This is good of course; the device is working as it's supposed to, but I would like to confirm whether or not we're susceptible to this alleged bypass. So far, looks like a dud... Not even sure why this would work, it seems too simple. -Guy ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
