The Design And Implementation Of A Firewall Penetration Software System Based On Trojan Collaborative Techniques Of HTTP Tunnel And Reverse Link

Tunneling Protocol is a method of encapsulating one network protocol into another. Itcan be used to carry a payload over an incompatible delivery-network, or provide a securepath through an untrusted network. Tunneling Protocol has been widely used, suchas virtual private network (VPN). HTTP Tunneling is a technique by whichcommunications performed using various network protocols are encapsulated usingthe HTTP protocol. This technology not only can be used to transport the payload overincompatible network, but also can be used by Trojans to sneak through a firewall.Through researches on defects of firewalls, a new type of software model is designedto penetrate the firewall, based on the HTTP Tunneling and the reverse link technique.In the new model, data packets are wrapped by HTTP protocol and SOAP protocol. Theclients (including the controlled side and the control side) initiatively send requests and data tothe server on the Internet, and then the server return HTTP responses which contain the resultsor data. At the beginning of the communication, both of the controlled side and the controlside send their own registration request, and the server assigns a unique address for them.Then the server matches the controlled side and the control side according to the control side’srequest, and a logic interconnection is built between the two types of clients.After completing the design of the model, considering the requirement ofactual function, a specific design of the system is finished. The specific design improvethe details, develops a protocol for the communication between the three parts of thesystem. The protocol details the structure of the packet header and the transmissionmethods of various types of data.As the model is cross-platform, it is convenient to choose development tools according tothe demands. In the actual development process, the server is developed with C#languageand.net platform, the control side is developed with Delphi, and the controlled side isdeveloped with C++language and Windows API. After finishing the development, a softwaretest is implemented to prove the the feasibility and effectiveness of the model.