Unusual firewall bypassing techniques, network and computer security.

It was all very well to say `Drink me,' but the wise little Alice was not going to do that in a hurry. `No, I'll look first,' she said, `and see whether it's marked "poison" or not'; for she had read several nice little histories about children who had got burnt, and eaten up by wild beasts and other unpleasant things, all because they would not remember the simple rules their friends had taught them: such as, that a red-hot poker will burn you if you hold it too long; and that if you cut your finger very deeply with a knife, it usually bleeds; and she had never forgotten that, if you drink much from a bottle marked `poison,' it is almost certain to disagree with you, sooner or later.

Lewis Carroll "Alice In Wonderland"
Chinese French Russian Spanish Polish Italian
Home | Projects | Papers | Forum | Team | Links | Contributions

Wsh, "Web Shell" - remote UNIX/WIN shell, that works via HTTP/HTTPS. The package contains two perl scripts for server and client hosts, one C source code and one Java servlet code for the server host : the client script is for console usage and the server scripts run as CGI/Servlet scripts on the target host.

The client part provides shell-like prompt, encapsulating user commands into HTTP POST requests and sending them to the server part script on the target web server directly or via HTTP proxy server. The server part extracts and executes commands from HTTP post requests and returns STDOUT and STDERR output as HTTP response messages. By default both scripts encode HTTP data with Xor.

The key Web Shell features: SSL support (*), Command line history support (*), File upload/download, Protect server part script usage with secret key inside HTTP message, Data flow Xor encoding, Can work trough HTTP proxy server.

(*) - Additional packages are required on the client host.

Alex Dyatlov, Simon Castro
Current Wsh version: 2.2.2; README , CHANGELOG
Download | md5sum: 4b7f51d186b65bd16e304b507b96613c

Index of projects

Paper : Exploitation of data streams authorized by a network access control system for arbitrary data transfers : tunneling and covert channels over the HTTP protocol.

Team member's sites:

GNU  GNU General Public License
 GNU Free Documentation License