1

I know the theory about proxies, what they are and their purposes.

Sometimes, HTTP(s) proxies are used within a company to filter outgoing network, for example, to prevent anything but HTTP/HTTPs. I know a person inside such a company, and he can’t even use SSH, on any port. On the other side, all ports seems to be open, as long as he uses it for HTTP or HTTPs (or just TLS, I don’t know).

In theory, if I look at the OSI model, everything that comes after the session layer is encrypted. So, the only relevant things a proxy can see when a user browses a HTTPs site is IP, port and maybe domain name in certain cases, right?

It may be very dumb, but I can‘t find an answer to this question:

How it is possible for an HTTPs proxy to detect a packet as HTTPs (and not just TLS), if anything after the TLS header is encrypted?

I tried to sniff my local network, to search for a clue but I didn’t see a mention of the application protocol in session or transport layers.

| improve this question | | | | |
  • Might come from the fact that the SSH client is not aware of the proxy (happened to me). If not the structure/headers of the packets might not be the same (take with caution, i'm not sure at all) – Sidewinder94 Jul 12 '15 at 18:38
  • Yes, I don’t know what my friend tried exactly, so maybe, in this case, it’s a misconfiguration. Besides, it’s not even a problem for him, he uses a software to do SSH over HTTPs. But, it makes me wonder how a HTTPs proxy actually works. – Gui-Don Jul 12 '15 at 18:50
  • Worth reading – Moab Jul 12 '15 at 20:16
3

The first packet inside a HTTP connection (the HTTP request) or a HTTPS connection (the TLS ClientHello) are clearly distinguishable from the first packet in SSH. Encryption of HTTPS/TLS does not help here because you can detect this traffic by the initial handshake preceding the encryption.

But this is not foolproof. For instance Skype tries various methods to pass through firewalls and one is to make its traffic look similar enough to TLS that lots of firewalls let it pass, even though Skype does not speak real TLS.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.