how works applications which blocks web sites?

Question

I know only one low-level way of blocking websites - hosts file. However, it is obvious that main stream programs has some other way of achieving this.

I have an idea for new model of this kind of program, but without possibility of blocking sites it is useless :(

Blocking is one problem, another is filtering and replacing content in the webbrowser. Any clues?

Edit:

I discovered, that many filtering programs uses open Source library WinPcap. It seems be great for checking which sites user try to open. But of course I need to have some possibility of blocking sites, by for example replacing requested sites for sites with information about blocking. Is this possible to achieve with WinPcap?

Answer 1

You can always write a browser add-on, but an add-on can easily be disabled by the user. I'm not sure if you can block sites with an add-on, but you sure can block what's loaded and displayed on a page (think Adblock Plus).

If you want to make it more bulletproof, then you'll have to make a program that taps into the data stream before it enters the browser. This probably requires a good understanding of the platform you're targeting with your software.

Answer 2

Depending on the environment in question, you could consider banning various DNS entries if you were in a corporate environment where everyone shares the same DNS servers. This cover browsers and other utilities,e.g. AIR applications that may also make web requests. WebSense is what my employer uses for monitoring internet traffic though this may be overkill for what you are thinking.

Answer 3

WinPcap is used for two things: Sniffing packets and sending packets. It can't prevent packets from arriving or being sent.

You can use WinPcap to interfere with some connections to break them or to change them.

Examples:

1. Send RST (reset) packets in TCP to break a TCP connection.
2. Send response packets on HTTP GET packets with your information to get a different result and ignore the actual result.

It won't prevent packets from being sent or arrive, but it can make the client or server ignore other packets and use yours.