The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
2answers
120 views

I'm wondering how I hide my identity online well

what are the different ways to become anonymous. Is quicksilver a good email for that? What are the different options? I know about proxies, Tor, and VPNs. Should I do all three? I like computers but ...
0
votes
2answers
910 views

Now that CloudFlare offers potentially-insecure free SSL to all users, would a new HTTP header be useful?

I'm not sure where to post this, so I figured I'd just post it here. CloudFlare is now offering free SSL to all sites. There are two different types of SSL connections, however. There's "Flexible ...
3
votes
1answer
174 views

How the whatismyip knows real ip address?

I just realize that this website knows the real ip address even if you use proxy ,i found this question, so start to test every possible way,first, this website don't have a X-Forwarded-For or ...
1
vote
2answers
177 views

How do proxy servers protect their SSL certificates?

Suppose that there is a http proxy server outside the firewall of an organization hosting a web server. All client connections to the web server happen through this proxy. The client negotiates SSL ...
0
votes
1answer
550 views

OWASP Zap proxy Fuzz XSS pentest against REST API

I am looking to PEN test my application against XSS attacks. The application is a REST API... As such when you POST some JSON to /cart/add to see the result of that attack you would need to GET ...
5
votes
1answer
217 views

What Steps Does An Anonymous Artist Need To Take to Retain Anonymity? [closed]

I read these questions which had great information: How can I keep my identity anonymous as a website owner/administrator? and How much can I trust Tor?, however I wonder if this is too extreme for my ...
1
vote
1answer
154 views

Is this a security breach?

I read in an article that if the request is authenticated or secure (i.e., HTTPS), it won’t be cached. But in https, burp has reported an issue stating http response is as follows: Cache-Control: ...
1
vote
0answers
91 views

Reverse proxy which only proxies published query strings?

I'm setting up a reverse proxy to limit access to a protected resource. The protected resource provides a status page (http://protected.local/info). That page contains a number of links with query ...
0
votes
1answer
168 views

HTTPS Proxy Everwhere?

I am configuring a HTTPS proxy, which I want to use for my laptop wherever I go. The idea is that since its encrypted, I should be safe from eavesdroppers, even on open wireless networks. Think of it ...
-1
votes
1answer
84 views

Installing a custom SSL Certificate For Local Proxy. Safe?

I've been writing some software for over a year that is a sort of browsing security/privacy application. One of the features of this software is that it uses a local HTTP proxy for some content ...
0
votes
1answer
437 views

Intercepting HTTP requests from a Java Application [duplicate]

I was wondering if anyone knew of a way of capturing and modifying the requests sent out by a Java application over HTTP. I can see them in Wireshark, but I also want to be able to modify them in ...
3
votes
1answer
2k views

Documented Best Practices for Reverse Proxy Implementation

I'm looking for some best practices documentation for implementation of a reverse proxy. We need to allow an internal database / web server incoming access to the outside world and are trying to ...
1
vote
2answers
585 views

How can I use a proxy appliance as HTTP Proxy & Reverse Proxy at the same time?

I have a BlueCoat ProxySG 810 appliance and want to use it as both an HTTP Proxy Server for clients on the Inside interface of a PIX 525 Firewall (OS Version = 8.0(4)) and a Reverse Proxy Server for ...
1
vote
1answer
98 views

Making a content injection target [closed]

I don't know much about content injection so I'm hoping to draw on the experience of the community here. I'm writing a tool that evaluates public web proxies. I want to know if the proxies are being ...
3
votes
1answer
201 views

What kind of requests are those?

I receive a lot of requests like this: ip-10-80-XXX-XXX.eu-west-1.compute.internal:80 110.249.208.XXX - - [11/Dec/2013:10:27:17 +0000] "GET ...
0
votes
1answer
264 views

Sniff HTTP(S) from PPTP VPN server

I've setup an PPTP VPN server on my Debian 7 server. I'm using this VPN in combination with my Android phone to ensure a secure connection. However, i'm getting curious of what my phone is sending ...
0
votes
1answer
147 views

SSL Auth to proxy using Certificate on Client-side

The question may need to be reworded. The server-side is set up with Squid3 acting as an Authenticating proxy by way of LDAP. I did this for testing purposes to make sure everything was working. I ...
0
votes
1answer
68 views

hijacking fedora or ubuntu or windows upgrades on the fly

is It theoretically possible to hijack (I mean substitute on the fly) the fedora or ubuntu or windows packages upgrades if a cracker has owned the company's firewall/proxy ?
3
votes
1answer
147 views

Is using a WebServer as a proxy a secure solution

There are 2 machines - both running Windows Server. Machine1 can access the internet. Machine2 cannot access the internet, but can access Machine1. Machine2 needs to continuously access one external ...
2
votes
1answer
726 views

OWASP ZAP does not properly proxy my HTTP responses?

I tried using the web proxy functionality of OWASP Zed Attack Proxy (ZAP) to edit the response JavaScript and HTML. I tried to make a button get the attribute disable="false" instead of disable="". I ...
4
votes
4answers
903 views

Why is this response splitting attack not working?

I'm working through OWASP's "WebGoat" (version 5.4) vulnerable web application, but I'm getting stuck on one of the earliest lessons which is to do with HTTP response splitting. I've looked in all ...
0
votes
2answers
6k views

Can you track someone using a proxy? [duplicate]

This is past experience, and is not the case anymore since I am a programmer now and have nothing to do with security anymore. However in the past I had a person constantly trying to make comments of ...
26
votes
3answers
12k views

How can a website find my real IP address while I'm behind a proxy?

I just wonder how some website like WhatIsMyIP find out what your real IP address is, even if you use proxy server. It said : Proxy Detected and then they give your real IP address. Is it ...
3
votes
2answers
1k views

How can I implement authentication in my proxy server?

I have a proxy server, it will have a captive portal page. Users will be required to sign in before gaining access to the internet. So far I am aware of IP and/or MAC address based authentication. ...
10
votes
4answers
2k views

How do proxy servers sniff data?

I live in a country which most website on the internet is blocked by government so we mostly use wide variety of proxies such Web proxies, VPN, SOCKS and most of them are free. My question is: Is ...
1
vote
1answer
377 views

How should this system be protected from ARP spoofing?

Background My university uses an authenticated (squid) HTTP proxy server for accessing the internet. There are a few reasons for this: They want to track misuse of the connection Our university ...
3
votes
2answers
331 views

Securing Java web services called by web site in DMZ using web services for communication

Suppose you have an application running Java web services in Apache Axis 2. Specifically, these are JAX-WS (Java API for XML-Based Web Services). Currently these web services are on the same Windows ...
1
vote
1answer
906 views

OpenVPN through company proxy and surfing history

Been trying to find an answer to no avail. Probably I just don't understand the terminology... So if anyone may shed some light in plain English, that would be awesome. I connect to a paid VPN ...
4
votes
3answers
543 views

Burpsuite 1.5 initiating TLS Connection on their IP to Port 443. What is it?

I recently started using a security tool (Burpsuite 1.5) which has a free licence and a professional one. Upon downloading the free one from its vendor web-site (I am using BackTrack), I noticed ...
4
votes
3answers
411 views

Does GOOD Dynamics Proxy comply with EU data legislation?

My client is excited about GOOD technology; it allows them to have controlled access to business applications & email from BYOD (bring your own devices) and will enable a more mobile workforce. ...
15
votes
3answers
10k views

Authenticating a Proxy server over HTTPS

When browsing to a website over HTTPS, the web browser typically does a lot of work in the background - negotiating a secure channel, validating the site's certificate, verifying the trust chain, etc. ...
2
votes
1answer
608 views

Open source or common implementations for reverse proxy web application security

I realize there is already a question similar to this one, but this is somewhat of a follow-up. I understand that a reverse proxy server by itself is hardly useful as a web app security measure ...
0
votes
1answer
602 views

Why do we need to use HTTP CONNECT? [closed]

If we are writing a custom http client which connects with an https server. Should the custom client when deployed on machines which are behind web proxy need to send a HTTP CONNECT Request so as to ...
2
votes
3answers
6k views

Block the HTTPS version of a website

I would like to block some websites from their HTTPS version and allow them on HTTP. The main websites involved are Youtube and Google Images/Videos. I am using K9 Web Protection on each computer, and ...
3
votes
3answers
1k views

Is a company website secure against sslstrip if it doesn't use ssl on homepage but ssl everywhere else?

Most ecommerce websites use SSL/TLS when you want to log. But most have homepage using http only. Is it enough to have SSL/TLS on login page and logged page to prevent sslstrip ?
0
votes
3answers
691 views

Proxy Server options for school administrators [closed]

I want to set up a proxy server for a school to prevent users to log-in to site like Facebook, Youtube, etc. I have no idea how to do this, so I´d really appreciate your help.