Questions tagged [proxy]

The word "proxy" is mostly used as short for "proxy server", which is a server that acts as an intermediary between a workstation user and the Internet so that the enterprise can ensure security, administrative control, and caching service.

Filter by
Sorted by
Tagged with
1 vote
0 answers
508 views

SAML/oauth2/openid-connect login via proxy as another user

I manage a set of service providers (SP1, SP2, SP3, etc), and we currently have this SAML SSO flow working where the SP causes a POST submit to the SAML IDP with an XML SAML request which includes an ...
2 votes
1 answer
832 views

Detailed explanations on OWASP Zap Security scan rules

As an example, I have installed Anti-CSRF Scanning rule in ZAP proxy and scanned a POST request which does not verify the CSRF token value from the back end. Ideally, it is a CSRF vulnerability, but ...
3 votes
2 answers
19k views

How to find the real IP of website behind reverse proxy?

I've set up Nginx as a reverse proxy server that points to an Apache server remotely. Of course IPs are different and let's suppose that I'm only running an HTTP service on that server. How can an ...
11 votes
3 answers
41k views

Difference between X-Forwarded-For IP, X-Real-IP, VPNs and TOR

I have this Google Chrome Privacy Preserving Extension that I am working on. Where I can spoof the header information e.g user agents and else. When I spoof X-Forwarded-For IP and go to http://...
1 vote
1 answer
2k views

Does a http proxy (ziproxy/squid) encrypt communication between client and server

I've read a lot of similar questions, with long answer, and they are making me confused, so for a quick yes/no question. If I, access a https webpage via an http proxy (my own proxy) (like ziproxy/...
-1 votes
1 answer
180 views

IP hiding attempts are detected [closed]

So I am using Tor and I try to log into a certain web site. It gives me a message saying that my IP address was used for spamming and does not let me log in. I think ok, probably the exit node is ...
0 votes
1 answer
1k views

Javascript injection bettercap2 over HTTPS

I use bettercap2 http proxy and arp spoof to inject one-line js alert into http pages. It works fine, however what about https? I couldn’t find any working method to inject it without the browser’s ...
0 votes
1 answer
1k views

What are the risks when using proxy such as Fiddler

I would like to understand a point. When I use fiddler it creates a local proxy to analyze the traffic, so far everything is fine. However when Fiddler is launched and I browse an HTTPS site the ...
4 votes
1 answer
2k views

Highly anonymous proxies vs anonymous proxies

From this link about highly anonymous proxies: There’s another type of anonymous proxy called Highly Anonymous Proxy. The main difference with this one is the fact that aside from hiding your IP, ...
2 votes
2 answers
1k views

How do I turn off automated testing in OWASP ZAP?

I am trying to find out how to turn off the automated scanner in ZAP. I am not even sure if it is on. How and where can I tell if the scanner is on? I just want it to be a pure proxy for the time ...
0 votes
1 answer
117 views

Online platform control (proxy)

To connect to the online platform of the company I work for, I have to use a proxy. Is it possible for the person responsible for this platform to check if I am currently using other programs in ...
0 votes
1 answer
313 views

my ip address comes out from a different ISP/Country

I noticed suddenly something weird on my PC. I am currently in Italy, Google all of a sudden is displayed in Arabic, and my IP is from an ISP in Czech Republic, and it is obviously different from the ...
1 vote
2 answers
2k views

What's wrong with RSA host key mismatch when using git?

I was pushing codes to github from a repo via a proxy (socks5) proxychains git push -uv origin master Warning: the RSA host key for 'github.com' differs from the key for the IP address '224.0.0.1' ...
1 vote
0 answers
1k views

How can I proxy traffic of macOS Mojave APPS using Burp Suite?

If I do a web search for proxying macOS apps using Burp Suite, I don't get any useful info. Instead, I get dozens of results talking about how to proxy iOS or Android apps. I am talking about desktop ...
1 vote
1 answer
593 views

How to configure VPN + Tor + linux as a proxy server? [closed]

Goal To hide the IP address using Tor, which goes through a proxy server to make HTTP/FTP requests look like they came from a regular user, not one who uses Tor. Example A user requests the website. ...
1 vote
1 answer
367 views

What are the security implications of connecting to Tor through an SSH SOCKS proxy?

Suppose I have a user account on a remote server run by a friend. I create a SOCKS tunnel on my computer that forwards connections from a local port to the remote server: ssh -N -D 12345 [email protected]....
1 vote
1 answer
289 views

How reverse proxy works?

I know that forward proxy can enhance security by replacing client IP's address with proxy server IP address. So, the web server or anyone else cannot identify the client identity who's requesting a ...
0 votes
2 answers
2k views

Explicit vs transparent proxy

As far as I have understood it: An explicit proxy challenges the user/application within his session. NGFW (transparent proxy) and SSO/identity-based solutions are just letting everything pass that ...
4 votes
1 answer
16k views

Configuring burp to use in proxy environment

My university internet connection runs behind proxy. Its host name is 192.168.1.103 and port no is 3128. How do I configure proxy in burp suite if I should enter above proxy setting in my Firefox ...
1 vote
1 answer
604 views

Can a machine running a packet sniffer see what nginx is forwarding on localhost to a Flask app?

I want to serve a Flask application from my pc. Other machines in my network only should be able to consume the API. However, I wish to have the communication between the other machines and the API ...
2 votes
1 answer
201 views

Whats the point in setting up an open proxy?

Decided to have a look at a list of "open" proxies. I've noticed that a good deal of these proxies are on residential IPs. One of the IPs, 68.188.59.198, is owned by Charter Communications ...
1 vote
1 answer
250 views

Can wifi network administrators see if you are using a proxy?

A friend of mine wants to use a Proxy on his home computer because his parents have blocked many games and social media services. My question is, if he is using a Proxy, will his parents be able to ...
-1 votes
1 answer
343 views

Preventing MITM Attack with Squid

There are two options, what is the best approach? I want to either Create a squid proxy server that detects MITM attacks or Create a python UI application to detect differences between local ...
1 vote
1 answer
330 views

Is it possible to completely obfuscate proxy servers?

Stripe's fraud detection documentation claims it has Proxy Detection When I search for how it might be detecting traffic from proxies, I see this great answer, which show how to detect that traffic. ...
1 vote
0 answers
215 views

Certificate Checking for MITM w/ Squid

I have already set up a squid cache proxy server on a Raspberry Pi 4. I need to create some sort of GUI to turn on and off certificate checking for man in the middle attacks. First, how do I get squid ...
0 votes
1 answer
1k views

My ISP using a transparent proxy

I found that my internet service provider uses a transparent proxy on some sites and apps like Google, Whatsapp, etc. I know they use it to save bandwidth but my question here is if they are able to ...
1 vote
1 answer
3k views

Does IP Spoofing mean using a proxy?

As said in question, does ip spoofing mean that someone uses a proxy, thereby he/she appears as different ip in the internet world?
1 vote
1 answer
333 views

SSL Termination within corporate network

I know its is advised to encrypt the traffic within the company network. Should we also stay away from SSL termination after a reverse proxy that's proxies multiple worker nodes on the same LAN? By ...
4 votes
3 answers
1k views

Does Tor still hide all tracks?

I've seen some threads on Reddit that say true hackers, when attacking, go through a public WiFi network, use a VM, proxy through a zombie computer, use a VPN, then proxychain through Tor, use another ...
0 votes
2 answers
477 views

Hiding client IP from a VPN server

VPNs can often be useful for obscuring personably identifying information (IP, geolocation, etc.) from remote destination servers. Traffic is routed through a VPN server and forwarded to the ...
0 votes
2 answers
2k views

WPAD (badWPAD vulnerability) should I disable or not?

Hi I have read recently very bad things about WPAD vulnerability for example here nakedsecurity.sophos.com/2016/05/25/when-domain-names-attack-the-wpad-name-collision-vulnerability/ (article from ...
-1 votes
1 answer
2k views

How to prevent someone from proxying your Websites

So i think someone is mirroring my site with a proxy and hides behind cloudflare (cloudflare already notified and google also) so i cant find out the real ip of the server to block it. Is there anyway ...
2 votes
2 answers
1k views

How to route internet traffic through Google

I'm in a situation where my network provider blocks all my internet access except for Google and its branches (Drive, Gmail, etc). I'm looking for a way to route my traffic through Google (with Google ...
1 vote
2 answers
939 views

IP-whitelisting for DB access, does solution fit best practices?

All the data we have on our customers sits in our data-lake, which is hosted by one of our suppliers. Currently the security is such that a limited number of users has (limited) access to the database ...
0 votes
0 answers
346 views

Why does my IP being leaked with system-wide proxy through webTRC, but it doesn't happen when I use system-wide VPN

WebRTC manages to leak my IP when I use proxy, but when I use VPN it only shows VPN server's IP (both proxy and VPN were system-wide). What's the key difference? Google Chrome was used in both tests (...
1 vote
1 answer
166 views

Based on cookies, does a website knows that a user visited it if the user does not log in?

I, user ABC, have an account on some financial website example.com. I have logged in from my browser many times before so cookies were saved. Each time I would log off after I finish browsing that ...
1 vote
1 answer
1k views

How to make Squid Proxy undetectable by ip-check.net? [closed]

I have setup squid proxy on a CentOs server where I set forwarded_for to delete and denied request headers on the /etc/squid/squid.conf file. However, whilst connected to the proxy, if I visit http://...
3 votes
1 answer
2k views

Using mitmproxy to analyze mobile application and iOS network data

I followed a guide where the author connected Windows PC and iPhone to his home WiFi network. He installed mitmproxy and ran mitmweb.exe on PC. On iPhone he went to wifi settings and set a manual ...
0 votes
0 answers
143 views

Can I use IPSec for anonymous browsing (like in commercial proxies)?

In class, we learned how to set up a VPN between two remote sites using IPSec in tunnel mode. I have a VPS for hosting my website (with root access), but if I set up a tunnel between my PC and the VPS,...
0 votes
2 answers
287 views

Alternative to Proxy servers for limiting internet access?

My company is using on premise DMZ proxy servers to limit internet access to employees working from home. When they use company laptop, they are automatically configured to go through the proxy server ...
1 vote
1 answer
2k views

Run Hydra Through Series of Proxies?

Is there a way to run Hydra through a series of proxies so a website can't lock you out? Having a hard time finding a way to do this. Most websites will block you out if you take to many attempts at ...
-1 votes
1 answer
806 views

How Zscaler enables system wide proxy?

I have Zscaler service installed on my system and it does a good job of filtering content and malicious websites. I was wondering how does Zscaler manage to do this? I read that it creates a PAC file ...
12 votes
4 answers
15k views

Does a TLS interception proxy present the user's browser with the end server's certificate?

I know that TLS (commonly but mistakenly called SSL) interception works by establishing two encrypted tunnels between a client and server, with the interception device (proxy) terminating both tunnels ...
2 votes
1 answer
349 views

Should I check Host header or ServerName for CSRF defense when serving behind proxies?

In a CSRF defense based on checking forbidden headers, should I check Origin/Referer header against the ServerName configuration directive, or is it sufficient to simply check against the HTTP Host ...
1 vote
1 answer
99 views

What are the limitation on encrpyting proxy

i would like to know if i encrypt a proxy server communication with TLS v1.3 is it still possible for a firewall censor to a deep packet scanning to decrypt. Also, what can be done to make the ...
5 votes
1 answer
5k views

Is it possible to redirect https to http in modern browsers?

What if I was an evil proxy operator who wanted to modify response content, but did not care if the victim sees http://? What happens if the browser requests https://example.com, but example.com has ...
0 votes
1 answer
418 views

TLS/SSL Offloading to PA220 without requiring clients to load additional CA

If I'm understanding this correctly, the Palo Alto PA-220 allows for SSL/TLS traffic decryption using its proxy feature. By generating a Certificate Signing Request and loading it into the firewall, ...
0 votes
1 answer
357 views

Any there any tools like Burpsuite that fully support HTTP/2? [closed]

Nowadays websites start migrating to HTTP/2, but Burpsuite hasn't fully support HTTP/2 yet. I know HTTPCanary is good and support multiple protocols like replaying HTTP2 and even TCP/UDP, but that ...
0 votes
1 answer
988 views

Burp Suite upstream proxy

Is there a way to configure burpsuite's upstream proxy direct the traffic to the local box's proxy configuration? Additionally is there a way to exclude urls from being directed to the upstream proxy.
4 votes
1 answer
18k views

Proxying MetaSploit through BurpSuite

I was wondering how I would be able to proxy MetaSploit through BurpSuite. I was to reverse engineer a packet being sent to my ChromeCast, but I have no way of viewing the packet. Thanks.

1 2
3
4 5
15