Re: [Full-disclosure] ByPass a BlueCoat Proxy 8100 Serie authentification

[Guy <full-disclosure@xxxxxxxxxxxxxx>]

> i think it basically means 'to a site thats been configured as allowed in the
> configuration of the BC' -   allowed = whitelisted, int he configuration = 
> localdatabase
>
> alan

Alan,

The Bluecoat 8100-C I'm going through has 27 policies in the "Web
Access Layer." The first policy is configured to "ForceContentFail"
for a list of destinations (a "blacklist" since colors seem to be in).
The next 15 (2-16) policies are all DENY rules for specific hosts,
IPs, regex patters, filenames, etc. The next 10 rules (17-26) are for
destinations that should Bypass Caching. The final rule (27) is,
Source: Any - Destination: Any - Service/Time: Any, Action: Allow.

Google.com isn't listed anywhere in the first 26 policies - anyone on
the LAN can access Google without authenticating. So, if I understand
what you're saying, I should be able to spoof the "Referer" string
sent from my browser to something like www.google.com, or cnn.com,
whatever isn't listed in any of the DENY policies, and not only bypass
authentication, but access sites explicitly defined in the deny
policies?

If that's the case, circumventing the auth or accessing "blacklisted"
sites isn't happening. This is good of course; the device is working
as it's supposed to, but I would like to confirm whether or not we're
susceptible to this alleged bypass. So far, looks like a dud... Not
even sure why this would work, it seems too simple.

-Guy

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/