The word "proxy" is mostly used as short for "proxy server", which is a server that acts as an intermediary between a workstation user and the Internet so that the enterprise can ensure security, administrative control, and caching service.

learn more… | top users | synonyms

3
votes
1answer
44 views

Connection not secure when using a proxy

I connect to the Internet using a proxy at my university residence and I noticed at some sites (like my bank and PayPal), the browser reports that: it's unable to check if the website certificate ...
3
votes
1answer
196 views

How do Cloud Encryption Gateways and CASB work?

Cloud Encryption Gateways (CEG) and Cloud Access Security Brokers(CASB) are becoming popular to ensure the security and confidentiality of the data leaving to Cloud Service Providers. How do they ...
2
votes
1answer
54 views

Fixing DNS leak - transparent proxy

My ISP is using a transparent proxy to intercept my DNS lookup requests when using VPN. Is there a way to prevent that? I am using Lubuntu if that makes any differance.
4
votes
2answers
140 views

Why is it dangerous to socksify a whole system?

Today, I configured my browser to use a ssh/SOCKS5 proxy setup to keep my web traffic confidential even when browsing from insecure networks (e.g. a public WLAN hotspot). I was then thinking that it ...
3
votes
2answers
103 views

Reverse Proxy or direct?

imagine I have an architecture as shown. In order to get to the internal web server, should I use a reverse proxy like as shown and redirect traffic to my web server? Is this a more secure way ...
3
votes
2answers
80 views

Reverse proxy or Public load balancer?

What would be the difference between putting in a load balancer or reverse proxy on the perimeter to send requests back to a system in our LAN? We don't want to have people NAT directly into the LAN, ...
2
votes
1answer
118 views

Proxied server requests + forwarding authentication info in a secure fashion

We are using PassportJS with a couple of Node.js servers - Passport is just a library that is popular for Node.js server authentication - but we have some questions about how to use Passport with ...
4
votes
1answer
475 views

Is it possible to log web sites that require Adobe Flash?

We would like to block the use of Flash on our internal network, but believe that several business-critical sites may still rely on that app. I'd love to be able to "watch" the traffic for several ...
1
vote
2answers
594 views

How can I see the websites visited by clients of my WLAN?

How can I view the websites that are visited by the user of my wifi? What tools are required to do this? And one more question: can I see the WhatsApp communications?
0
votes
0answers
35 views

What are the defenses against SSL Interception? [duplicate]

SSL/TLS Proxies allow traffic interception by doing a MITM. Are there any active defenses against this to protect privacy of the users ?
0
votes
1answer
78 views

Does IP Spoofing mean using a proxy?

As said in question, does ip spoofing mean that someone uses a proxy, thereby he/she appears as different ip in the internet world?
0
votes
0answers
26 views

How to configure proxy settings of cellular internet for burp

I am pen testing an android app and using tethering to connect my phone to my laptop. I configured the access point settings as proxy = ipv4 address of my laptop and port = port on which burp is ...
2
votes
1answer
185 views

How to forward HTTP/SOCKS proxy on same port to SOCKS server?

I have socks server (TOR) and can "convert" it into HTTP/HTTPS one via Polipo or something like this. But I want to use it transparently as HTTP or SOCKS on the same port. I have experience with ...
1
vote
2answers
55 views

About browsers injectors (Sonic Train)

I know that viruses use some ways to inject some ADs in the browsers web pages like : 1-Inject an extension 2-Inject some codes to the browser process 3-With a proxy server 4-Install an injected ...
0
votes
1answer
141 views

My ISP using a transparent proxy

I found that my internet service provider uses a transparent proxy on some sites and apps like Google, Whatsapp, etc. I know they use it to save bandwidth but my question here is if they are able to ...
1
vote
1answer
114 views

Using dnscrypt on a public hotspot with a captive portal

What strategy shall I take if I wanted to use a dnscrypt with a public hotspot that requires login through a captive portal? Such hotspots require DNS settings to point to their servers (via DHCP) so ...
2
votes
1answer
101 views

How does an entity on a network (e.g. sysadmin, security software) identify that a user is connecting to the internet with a proxy?

For example, the security software iBoss is able to detect if you are using a proxy. Proxy Circumvention Proxy attempts to circumvent your Internet security solution not only violate your ...
1
vote
1answer
79 views

How to configure WebScarab to intercept only POST requests?

I'm trying to make WebScarab intercept only POST requests. On the Intercept tab below Methods I've selected only POST, but it still intercepts all GET and POST requests, so it's quite hard to tamper ...
2
votes
1answer
109 views

How can an attacker redirect victims through proxy

Let's say that an attacker is behind a proxy that's using NAT or PAT. Is it possible for him to redirect victims to his machine to achieve some attacks like web phishing or opening reverse TCP ...
6
votes
1answer
2k views

How does a website detect proxy? [duplicate]

How can a specific website detect that I'm surfing via proxy? Is there a way to use proxy and not get detected? If so, how?
4
votes
2answers
116 views

Reverse-proxy not a solution to DDOS attacks when hosted on PaaS?

We run our apps on Heroku and use Cloudflare as a CDN and to protect against DOS attacks. However, we recently experienced (a relatively minor) attack that managed to easily bypass Cloudflare by ...
2
votes
2answers
134 views

Using separate HAProxy and API tiers, how can I ensure a request came from HAProxy?

I have two machines and a HAProxy machine doing SSL termination and accepting client certs successfully. How can I configure HAProxy to ensure that the messages coming into the API box are from ...
0
votes
2answers
125 views

Data exposed through campus proxy

I want to connect with Firefox to my university campus proxy, in order to access subscribed research journals, but first I need to know, which of the transmitted data through the network are visible ...
3
votes
1answer
659 views

Why use a proxy to hide OAuth client credentials in password grant calls?

In a November 2014 article by Alex Bilbie, OAuth users were advised against making the client send its credentials (client_id and client_secret) when performing Resource Owner Password grant calls. ...
2
votes
1answer
84 views

Is intercepted ssh-socks traffic revealing HTTP object count and sizes?

I read an article titled the network is hostile, in which the following is stated: Traffic analysis remains a particular problem: even knowing the size of the files requested by a TLS-protected ...
0
votes
5answers
3k views

How to send HTTPrequest anonymously [closed]

I want to send a HTTPrequest to a specific web address, but with different IP address. For example, if a webserver detect IP address, then add it to a database. If another request come from a IP, ...
1
vote
1answer
2k views

Difference between X-Forwarded-For IP, X-Real-IP, VPNs and TOR

I have this Google Chrome Privacy Preserving Extension that I am working on. Where I can spoof the header information e.g user agents and else. When I spoof X-Forwarded-For IP and go to ...
3
votes
1answer
96 views

What kind of attacks can target static resources?

Static resources and their caching interests me from the security perspective. Let's say we have an .jpg file requisted from the origin -> going through a reverse proxy with caching -> reaching the ...
4
votes
1answer
334 views

Is it possible to trace a backend through a reverse proxy?

I'm creating a reference network topology for a WebSocket chat application at work, and I'd like to have something clarified for my own understanding. The current topology involves a reverse proxy ...
3
votes
3answers
475 views

How secure is socks5 proxy over ssh?

At work we are all using Windows 7+, with full administrative privileges. Each PC has a dedicated IP and a proxy is used. It is set as a HTTP proxy and the option to use this for all types of ...
5
votes
1answer
138 views

How should certificates be shared between a proxy and a frontend?

At work, I've been asked to look into creating a reference topology for a WebSocket chat application, which includes a proxy between the web-facing frontend server and the backend. At the moment, I am ...
2
votes
4answers
178 views

SSL encryption process and its security

I know the basics of SSL encryption and how certificates work, but there are some points that are not clear to me regarding the SSL security: If there is a intercepting proxy between the web server ...
1
vote
1answer
84 views

Reverse Proxy SSL container

Technically and security wise, can a reverse proxy act as a "container" for SSL certs ? Meaning, for example currently my web server is running on ssl (https). Can I move the SSL cert to the reverse ...
1
vote
2answers
284 views

Charles Proxy can not capture message sent over SSL connection [closed]

I have setup Charles Proxy app and it can captures my https request/response sent through browser. Now instead of using the browser, i have an app that setup a SSL connection to the server, and then ...
0
votes
1answer
62 views

detecting proxy [duplicate]

say u host a website and people come and place orders with you while your away, u come back and see the orders have been placed by somebody, how will you find out if the person who placed the order ...
0
votes
2answers
87 views

Protect SSL connections from MITM for users with modified clients

I'm working on a web app that uses SSL. I'm afraid that some people might access the app via a network that uses a proxy to intersect and inspect the SSL traffic [MITM]. Some people might access the ...
2
votes
3answers
565 views

What is the simplest way for a Proxy/UTM to block HTTPS traffic using URL filtering?

I'm building a UTM using ubuntu, How can I block HTTPS traffic using URL filtering? (For example I want to block https://facebook.com) I'm using Squid as a transparent proxy server. Solutions I don't ...
3
votes
4answers
209 views

Is a reverse proxy worth it?

Is a reverse proxy worth it? There are so many unsecured sites using a reverse proxy and I feel like that doesn't protect them. After all if they have an error in their SQL that could be use for ...
1
vote
1answer
124 views

Does a TLS-connection to a proxy-server encrypt the destination url's?

If I use a browser through a proxy-server over a secure connection (i.e. the proxy is HTTPS) - does that mean that everything is encrypted, or just the page returned from the site? And who does the ...
2
votes
1answer
668 views

SSL Decryption why is the root CA certificate required on clients?

Maybe a quick question. We have Palo Alto's that perform SSL Decryption using a sub CA certificate issued by our internal Root CA. This is working for our internal windows domain computers as the root ...
2
votes
2answers
529 views

How does my browser detect my location, even via proxy?

How does my browser detect my location even via proxy? I have tried this code via VPN and got the same result as without it. According to the specification my browser should detect it from: ...
2
votes
1answer
444 views

Safety of exposing an internal web application to the internet using a reverse proxy in the DMZ

I am creating a web application which needs to make direct connections to internal resources (e.g. database servers), but will also need to be accessed from the internet. The web app exposes web ...
0
votes
1answer
745 views

configuring burp to use in proxy environment

my university internet connection runs behind proxy.its host name is 192.168.1.103 and port no is 3128.how to configure proxy in burp suite if i should enter above proxy setting in my firefox browser. ...
1
vote
0answers
257 views

Logging all traffic crossing SSH proxy

Is there a way to log SSH sessions proxied through a machine (User-> SSH Proxy -> Server (with SSH)) without modifying the SSH daemon on the proxy? I need to log all the commands as well as responses ...
1
vote
1answer
125 views

Can Web Proxy Autodiscovery leak HTTPS URLs?

The WPAD protocol can in some circumstances allow an attacker to get clients to use a malicious PAC script. It appears to be well documented, that this can be used to perform MITM-attacks on HTTP ...
7
votes
4answers
247 views

Solution to remain anonymous on a website that dismiss tor users?

I want to access to a website who recognize tor users and dismiss them. I have read that if you connect to a proxy after your tor exit node, the website wouldn't know that you are a tor user and ...
1
vote
1answer
46 views

In What Ways Can X-Foward-For Header Information Be Used In An Attack

By enabling X-Foward-For on our proxy, we would essentially be advertising our internal IP addresses externally. However, we use a private range. Everything goes through NAT. So, the best anyone would ...
1
vote
1answer
86 views

How to fully mask my computer without using tor? [closed]

I want to mask myself and therefore I configured a proxy server. I use debian and squid 2.7. It actually works fine, however, I visited the site whatismyip.com and I can still see that I'm accessing ...
1
vote
1answer
734 views

Has anyone used this ICLOAK USB device? [closed]

Does anyone know about this ICLOAK USB device? Opinions or how well they work? I'm looking for a security solution when I'm using PCs where I work. Occasionally we have to log into to web sites, ...
1
vote
1answer
203 views

ettercap use as local proxy [closed]

Hi everibody and sorry for my english, I'm looking for a way to use ettercap (or another program) to alter TCP traffic (coming from local) on the fly. I used "netsed" with iptables, but netsed is too ...