URL Obfuscation

[JakBeNymble]

Hi "Proxo-Users",
                I had a couple of ideas, but no sucess, . . . "Yet".
I know it would take a lot of time, but You could Obscure the URLs in Your Favorite Book-marks and replace them.
There is also a filter and list that I saw once in a default config. for "Aliases" I thought that might be examined, but again You would have to enter the URLs one at a time in the list. But the idea would be something that would work "on-the-fly" without having to do that.

I have to think of things in blocks and then in the details of how to accomplish it. [I don't know if Proxo could be set-up to change the URL to Hex & convert the IP to dword or octal]. But that would be the Trick!

So I tried to do something more simple.
First to match the URL(Which is no problem), then recombine it with a fake URLs or usless character in between the Http:// and the @ with the real one trailing,( still not a problem), but how to make Proxo reload the Replacement string back into the address line of the browser without "looping" I don't know, I was just trying to get something simple working to build on. Maybe, . . .

http://!$%^&^%*@www.someweb-site.com.,
or
http://www.1fakeWeb-site.com%www.2FakeWeb-site%www.3FakeWeb-site.com@www.REALWeb-Site.com.

Maybe someone whose more Up on this could take a look and see.

KEY=URL:"Obcure Urls"(Out)
Match="u"
REPLACEMENT="$JUMP(ManyManyUslessCharactersORFakeWeb-Sites.com@h)"

Well at least I was trying, . . .LOL!
Have a Great and Wonderful Day, My Friends!
'jak'







Edited by - JakBeNymble on 19 Jun 2002  04:00:20

[hpguru]

The approach I will take is to insert a modification of Arne's hex conversion script into the pages I visit and onclick event handlers into the links of the page. The idea which I have yet to work out is that it should be possible to capture the click event and convert the href value on the fly.

Another approach (which is probably more feasable) would be to insert a script at the end of the page that will cycle through the links array replacing their href values with the hex converted values.

A couple of things I've noted about Arne's script:

The protocol field (e.g. "http://") must be removed and added back in after the conversion.

Opera won't support this at all since it is kind enough to unescape the hex url. I don't know if this behavior can be disabled or not.

As for converting bookmarks or favorites, yes it's a good idea but I have thousands of them. So it would be really too tedious an undertaking and if I changed my mind, well I don't want to create a lot of work for myself. As a solution we could create a header filter to redir unencoded urls to a local page that will convert the url and redirect the browser using the converted url.

Well, all I lack is the time to work on it but if anyone else want's to have at it then like Arne said, it's a good project.

Facing each other,
a thousand miles apart.

Edited by - hpguru on 18 Jun 2002  20:43:10

[Jor]

quote:Opera won't support this at all since it is kind enough to unescape the hex url. I don't know if this behavior can be disabled or not.

To disable, unselect 'Encode all addresses with UTF-8' under 'Network' in the preferences.

 

[hpguru]

Thanks Jor!

Facing each other,
a thousand miles apart.

[JakBeNymble]

Hi "Friends",
            I've been thinking, . . .(A dangerous 'pass-time' I know), but what if You could set-up a couple of James Marshall's CGI Proxy scripts that can obscures Urls or possibly "encrypt" them as well, and then chain it together with Proxo like a Remote Proxy. James Marshal has a "pack-up and carry with You" proxy. It's only two Scripts, but You need perl 5.5 or higher to run the scripts. Out of my league all together! I think I'm flying if I can get the"Url match" to work in Proxo!

Here's the link and an excerpt from the download site:
http://www.jmarshall.com/tools/cgiproxy/

[(Requires minor programming.) You can customize the encoding of destination URLs by modifying these routines. The default is a simple unobscured URL, but sample obscuring code is included in the comments.]

Anyway it was a thought I wanted to share with You, just in case someone else might want to "pick-up-the-ball" and run with it. I'm real interested in this Url obscuring, or encryption. Maybe someone else might know of some other program that might be a good canidate instead of James's Proxy.

Have a Great & Wonderful Day, My Friends!
'jak'

 

[TEggHead]

Ok, got intrigued by the idea and tried some of this...what I did was to tag a scriptcall at the end of a page that loops thru all links and replaced their href's with the chose combination of obfuscating (hexing, prepending bogus, or both)

here's what I ran into

when using the Hexer routines I ran into troubles with the Host: header also including the path to the requested document (it did not recognize where the hostname ended, so I had to exclude all / from getting hexed)

During all this I noticed that the Prox logwindow would never indicate at all any sign of a hexed URL, just as if it does its own UESC ...? That's how I noticed tha path not getting stripped from the host header

I also played with the insertion of a bogus website address like
www.many-many-many-many-wonderful-places-to-goto-today-but-I-Am-Not-Going-There-Now.com@
between the http:// and hostname, nice as it looks in my addressbar I also did not see any sign of using this return in the logwindow, as if the browser did something else with it...

Mind you, during this the address bar always nicely showed a hexed or gobledygook inserted URL, but not once did I ever saw anything of it back in the Prox logwindow...

Since I have no way of verifying that it actually is sent through as intended, other than the errorpages I get from a site if it did not understand the request it got (some got mighty confused from partly hexed URLs) I gave up and think that the encountered problems are such that it would only be possible with a function in a header filter or something sitting between prox and the net (oh no, not another layer...)

hopefully maybe someone else is more lucky or capable...

JarC

 

[Scott Lemmon]

It kind of depends on the URL obfuscation trick you're using, your browser and any proxies. Take hex escapes for example - some browsers (like IE I think) will remove (or even add) escapes before sending the request on - others won't. Browsers might also not be consistent with how they deal with things like the host header. It's actually not valid to include escapes in anything other than the path portion of a URL. Browsers that don't remove them can send a malformed URL to the server. Hex escapes in the path are always legal since the destination web server will convert them.  In fact things like unescaped spaces are not legal in a path, but again some browsers escape any spaces and others don't.

Tricks like IP obfuscation depend on the program doing the DNS.  This will be your browser, or a proxy, but in the end usually comes down to how the system's  name resolver library works.  In general though you can't depend on them working through a proxy.

Really these are all just tricks - they're generally non standard and browser dependant. Also they don't do much to hide your real destination. Mainly they seem to be used to fool the end user - not any eavesdroppers. That's why spammers seem to love them - it can make it more difficult to figure out what URL they're hosting themselves at by looking at the HTML, but the browser decodes the stuff before making the actual request.

For real security it would be better to have two proxies convert everything to HTTPS and back again. HTTPS encrypts the URL and all headers so nothing would be left visible - all an intermediary could see is that you're connecting to the second (decrypting) proxy. Of course the second proxy would still have to make the final leg in the clear.  Really, you might as well just set up a VPN to do the same thing for all traffic.


Edited by - Scott Lemmon on 27 Jun 2002  17:49:17

[JakBeNymble]

Hi "Friends",

            Thankx for the responses TEggHead & Scott! I'm glad for the information, and being able to understand alittle more about the "ends & the Outs" of it. The only thing is that when You do run through "https://", it makes me slower than Christmas. LOL!

I'm like ARNE though I'd like to give My Good Friend over at the ISP something to do with his spare time. *Smile* I can't complain about Them though, after they gave up trying to access my machine and give me open access, we get along quite well. [Just as long as I pay my bill every month and I'm not "bothering" anybody.]

It's very good to have Friends like you, Scott & TEgghead, that will do all they can to help when they can. I appreciate You and ALL of Your Talents and efforts. As I do with ALL MY TALENTED FRIENDS on THE FORUM!

I hope that All Have a Great & Wonderful Day,
"Jak"
--------
PS: "Oh, and Scott I'd just like to say that I haven't had one Problem with Your Latest version of PROXO, it seems to work just fine unless I try make adustments while a page is loading, and that's just every once in a great while"


Edited by - JakBeNymble on 27 Jun 2002  19:23:28