Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[ncat] Ability to control hostname resolution for proxy destinations #1439

Closed
wants to merge 3 commits into from
Closed

Conversation

nnposter
Copy link

@nnposter nnposter commented Jan 22, 2019

In connect mode, currently all proxy destinations are directly passed onto the remote proxy server, without trying to resolve them locally. This behavior has raised some concerns.

This proposal implements a new ncat option that provides control over whether these hostnames are resolved by the remote proxy server or locally, by Ncat itself.

Usage:

ncat   ...   --proxy-dns local | remote | both | none
  • local - Hostnames are resolved locally on the Ncat host. Ncat exits with error if the hostname cannot be resolved.

  • remote - Hostnames are passed directly onto the remote proxy server. This is the default behavior.

  • both - Hostname resolution is first attempted on the Ncat host. Unresolvable hostnames are passed onto the remote proxy server.

  • none - Hostname resolution is completely disabled. Only an IPv4 or IPv6 address can be used as the proxy destination.

Note that this new option is complementing, not replacing, option --no-dns, which controls all existing hostname resolution, such as non-proxied targets, hops, source address, and the proxy server itself.

Copy link

@jaymzh jaymzh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From a read-through of the code, this looks like it'll solve the issue. I'm traveling the next two weeks, so I'm not sure when I'll get a chance to actually give it a shot, but I'll try to find time this this week if I can.

@@ -647,6 +659,7 @@ int main(int argc, char *argv[])
" --proxy <addr[:port]> Specify address of host to proxy through\n"
" --proxy-type <type> Specify proxy type (\"http\", \"socks4\", \"socks5\")\n"
" --proxy-auth <auth> Authenticate with HTTP or SOCKS proxy server\n"
" --proxy-dns <type> Specify where to resolve proxy destination\n"
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

probably should list the possible types here (none, local, remote, both)... and maybe what they mean...

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not enough space if we want to keep it on a single line

@jaymzh
Copy link

jaymzh commented Jan 22, 2019

I checked out your branch and tried to build, but the build fails on:

make: *** No rule to make target `nbase/nbase_addrset.h', needed by `targets.o'.  Stop.

@jaymzh
Copy link

jaymzh commented Jan 22, 2019

Nevermind I think this is #1379 I'll give the solution there a shot.

@jaymzh
Copy link

jaymzh commented Jan 22, 2019

local/remote/both all work as expected, thanks! I will note that none is not considered a valid option, despite the docs, you get:

Ncat: Invalid proxy DNS type. QUITTING.

@nnposter
Copy link
Author

Yup; my bad. Hopefully fixed.

@nnposter
Copy link
Author

Committed as r37586.

@nmap-bot nmap-bot closed this in dbed133 Feb 24, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants