The tag has no usage guidance.

learn more… | top users | synonyms

5
votes
4answers
2k views

Why is this response splitting attack not working?

I'm working through OWASP's "WebGoat" (version 5.4) vulnerable web application, but I'm getting stuck on one of the earliest lessons which is to do with HTTP response splitting. I've looked in all ...
0
votes
2answers
15k views

Can you track someone using a proxy? [duplicate]

This is past experience, and is not the case anymore since I am a programmer now and have nothing to do with security anymore. However in the past I had a person constantly trying to make comments of ...
32
votes
3answers
28k views

How can a website find my real IP address while I'm behind a proxy?

I just wonder how some website like WhatIsMyIP find out what your real IP address is, even if you use proxy server. It said : Proxy Detected and then they give your real IP address. Is it ...
3
votes
2answers
2k views

How can I implement authentication in my proxy server?

I have a proxy server, it will have a captive portal page. Users will be required to sign in before gaining access to the internet. So far I am aware of IP and/or MAC address based authentication. ...
10
votes
4answers
3k views

How do proxy servers sniff data?

I live in a country which most website on the internet is blocked by government so we mostly use wide variety of proxies such Web proxies, VPN, SOCKS and most of them are free. My question is: Is ...
2
votes
1answer
563 views

How should this system be protected from ARP spoofing?

Background My university uses an authenticated (squid) HTTP proxy server for accessing the internet. There are a few reasons for this: They want to track misuse of the connection Our university ...
3
votes
2answers
468 views

Securing Java web services called by web site in DMZ using web services for communication

Suppose you have an application running Java web services in Apache Axis 2. Specifically, these are JAX-WS (Java API for XML-Based Web Services). Currently these web services are on the same Windows ...
1
vote
1answer
1k views

OpenVPN through company proxy and surfing history

Been trying to find an answer to no avail. Probably I just don't understand the terminology... So if anyone may shed some light in plain English, that would be awesome. I connect to a paid VPN ...
5
votes
3answers
950 views

Burpsuite 1.5 initiating TLS Connection on their IP to Port 443. What is it?

I recently started using a security tool (Burpsuite 1.5) which has a free licence and a professional one. Upon downloading the free one from its vendor web-site (I am using BackTrack), I noticed ...
5
votes
3answers
514 views

Does GOOD Dynamics Proxy comply with EU data legislation?

My client is excited about GOOD technology; it allows them to have controlled access to business applications & email from BYOD (bring your own devices) and will enable a more mobile workforce. ...
19
votes
3answers
19k views

Authenticating a Proxy server over HTTPS

When browsing to a website over HTTPS, the web browser typically does a lot of work in the background - negotiating a secure channel, validating the site's certificate, verifying the trust chain, etc. ...
2
votes
1answer
1k views

Open source or common implementations for reverse proxy web application security

I realize there is already a question similar to this one, but this is somewhat of a follow-up. I understand that a reverse proxy server by itself is hardly useful as a web app security measure ...
0
votes
1answer
850 views

Why do we need to use HTTP CONNECT? [closed]

If we are writing a custom http client which connects with an https server. Should the custom client when deployed on machines which are behind web proxy need to send a HTTP CONNECT Request so as to ...
3
votes
3answers
9k views

Block the HTTPS version of a website

I would like to block some websites from their HTTPS version and allow them on HTTP. The main websites involved are Youtube and Google Images/Videos. I am using K9 Web Protection on each computer, and ...
4
votes
3answers
2k views

Is a company website secure against sslstrip if it doesn't use ssl on homepage but ssl everywhere else?

Most ecommerce websites use SSL/TLS when you want to log. But most have homepage using http only. Is it enough to have SSL/TLS on login page and logged page to prevent sslstrip ?
0
votes
3answers
816 views

Proxy Server options for school administrators [closed]

I want to set up a proxy server for a school to prevent users to log-in to site like Facebook, Youtube, etc. I have no idea how to do this, so I´d really appreciate your help.