The word "proxy" is mostly used as short for "proxy server", which is a server that acts as an intermediary between a workstation user and the Internet so that the enterprise can ensure security, administrative control, and caching service.

learn more… | top users | synonyms

3
votes
1answer
553 views

Burp proxy between non proxy aware device

I want to intercept traffic between a Ethernet connected device, which is not proxy aware and modify/inject javascript. Conventionally when testing webapps I would use burp. Can burp sit on my ...
2
votes
6answers
518 views

Secure internet access while traveling

Given the risks of shared wi-fi as stated here, here and here, I would like to ask what are good practices for someone who is always traveling. While having your own wi-fi with a strong WPA2 password ...
1
vote
3answers
275 views

How this kind of mechanism considered as vulnerability?

From following news, http://thehackernews.com/2012/12/etsy-for-iphone-loophole-allows.html Someone just setup a proxy to intercept traffic between browser and https protocol, then it called ...
5
votes
2answers
117 views

Is it actually feasible or useful to use a high number of proxy servers?

In the movies, it's not uncommon to see the digitized global map projected on a huge wall with a line of light (presumably a user's connection) travelling back and forth all over the globe in a ...
1
vote
1answer
438 views

RADIUS proxy chains

RADIUS is a widely deployed remote authentication protocol. I'm looking here at its use in wireless roaming. The RADIUS protocol allows for proxies and chains of proxies: |CLIENT|<->|Access ...
2
votes
2answers
2k views

Is it possible to spoof the last proxy of an X-Forwarded-For Header?

I'm using a firefox plugin https://addons.mozilla.org/en-US/firefox/addon/x-forwarded-for-header/ to spoof the X-Forwarded-For Header to 8.8.8.8. For the following php page: echo ...
16
votes
3answers
11k views

Authenticating a Proxy server over HTTPS

When browsing to a website over HTTPS, the web browser typically does a lot of work in the background - negotiating a secure channel, validating the site's certificate, verifying the trust chain, etc. ...
1
vote
2answers
385 views

Is ProxyPass more secure than directly hosting PHP site?

Here's two possible ways, Use Apache and PHP module to interpret a php file Use nginx's ProxyPass with fastcgi So, would passing the request to another server with ProxyPass more secure than a ...
0
votes
1answer
166 views

Proxy Non-HTTPS logins through EC2

I've been thinking a lot about password security these days, and have been becoming more and more hesitant to use services that have login forms that are not on HTTPS. As I was researching security, ...
2
votes
3answers
2k views

How to block the websites on client machines

In our office we are blocking sites like Facebook, Twitter etc.The problem is that some of the users bypass our proxy and firewalls through external proxy sites like www.youhide.com or ...
2
votes
1answer
637 views

Open source or common implementations for reverse proxy web application security

I realize there is already a question similar to this one, but this is somewhat of a follow-up. I understand that a reverse proxy server by itself is hardly useful as a web app security measure ...
8
votes
4answers
20k views

Advanced techniques for detecting a proxy/getting original IP

In what manner can a website detect my original IP address, even though I'm using a proxy server? I've noticed this with a few sites. There are four proxy methods I've used: Firefox with a proxy ...
8
votes
3answers
3k views

SOCKS proxy security concerns

As claimed, "A socks proxy simply transfers data from a client to a server, not penetrating into this data contents (therefore it can work with HTTP, FTP, SMTP, POP3, NNTP, etc.)", I really can't buy ...
1
vote
1answer
243 views

How does http://un****-us.com/ work?

There is this site un**-us.com which supposedly allows you to bypass ISP rules such as content restriction on a particular area. Now , it is well known that routing your traffic through a web proxy ...
4
votes
2answers
2k views

Does Java applets reveal the real IP address, even when using proxy or vpn?

Can a Java applet reveal the original client IP address, when browsing through a proxy or a VPN? Why?
0
votes
2answers
506 views

Anonymous proxy over SSL [closed]

Can you name any anonymous proxy software that don't use VPN connections? Basically, I'm analyzing different encrypted traffic and now I need to analyse a simple anonymity proxy traffic. I'm analyzing ...
2
votes
3answers
1k views

How to intercept an application that bypasses local proxy

I am behind a corporate proxy and the application that i have to test will work only if it is given an exception for using proxy server(i.e it is added to the exceptions list of the sites that do not ...
4
votes
3answers
8k views

How do you properly setup Tor on Windows 7?

How do you properly setup Tor on a Windows 7 box to guarantee that ALL connections will run through Tor?
2
votes
2answers
749 views

Interesting article on a vulnerability found in Tor

This article describes how French researchers compromised users using Tor. I'm not sure I fully understand or agree with it. I don't see what Bit Torrent has to do with anything? I mean they start out ...
1
vote
2answers
681 views

How to secure the connection between the proxy and application

I have designed a framework for my application where I have a proxy to communicate with the outside world. The connection between proxy and the application is encrypted using SSL. But the connection ...
7
votes
2answers
2k views

How can end-users detect malicious attempts at SSL spoofing when the network already has an authorized SSL proxy?

I'm working on one client's network where they have enabled HTTPS authority spoofing on their proxy. This allows them to effectively perform a man-in-the-middle attack to decipher all outgoing ...
-2
votes
1answer
194 views

What is the interest of Reverse Proxy? [closed]

I have read many explanations on reverse proxy I still don't understand the interest. Could someone really explains in plain english
1
vote
3answers
456 views

Client side scripts through proxies

If you're trying to hide your IP address using VPN/proxies can a website using client side scripting record your real ip? If yes is there any alternative to blocking all scripts as that breaks ...
0
votes
3answers
728 views

Proxy Server options for school administrators [closed]

I want to set up a proxy server for a school to prevent users to log-in to site like Facebook, Youtube, etc. I have no idea how to do this, so I´d really appreciate your help.
3
votes
3answers
2k views

How can reverse proxies be used to bypass acceptable use policies of a company?

I am wondering how reverse proxies can be used to bypass company acceptable use policies? What can be done to prevent it?
2
votes
2answers
151 views

Security of asymmetrical decrypting proxy

I'm thinking about the safest possible way to store secure data (eg. Credit Card numbers) with a requirement of sending them in clear text to third party API (so hashing doesn't come into play). I've ...
2
votes
1answer
300 views

How confident is MIME blacklisting on a proxy server?

We are blacklisting a number of MIME types on our proxy server so users can't download certain file types, for example, executables. Could it be possible that somehow, a malicious server can trick a ...
1
vote
1answer
383 views

DNS query through squid? [closed]

My IDS picked up our squid proxy server doing a dynamic DNS request. I wasn't aware squid passed DNS requests from the client to the internal DNS server. Is this possible? Snort Alert: ET POLICY ...
2
votes
2answers
1k views

Protection against DDoS when using proxies

We're trying to protect some sites that are primarily located in Asia using distributed caching. These sites commonly come under DDOS attacks. We are using fail2ban, but still have two problems: ...
5
votes
3answers
4k views

How do I check that I have a direct SSL connection to a website?

I always thought that if I had an SSL connection there would be no MITM attacks. Now it appears that isn't true (see comments in this question Is it okay from a security perspective to read foreign ...
2
votes
1answer
130 views

ISP security compared to enterprise

I've just started reading IT Security, and found some interesting reads on man-in-the-middle and different types of "attacks" that could be used by an enterprise to intercept communications on their ...
0
votes
2answers
485 views

How to build a secure socks tunnel?

I was using a socks proxy to access websites blocked by my ISP, now it don't work any more in an strange way. Using the proxy is same as not using it! (i.e. I can access open sites but filtered sites ...
5
votes
2answers
4k views

Is it possible to connect to a proxy with an ssl (or otherwise encrypted) connection?

What i want to know is whether it is possible to connect to a proxy with an ssl (or otherwise encrypted) connection? (I'm suspecting this is possible because TOR encrypts user connections to it's ...
0
votes
1answer
736 views

Tracing Proxy Easy or Hard for a Normal Website?

I know a membership website which is getting quite popular among people day by day. Now I see people are making more than one accounts by using proxies. They should allow multiple accounts from the ...
0
votes
1answer
173 views

Best practice for selective opening of ports on network gateway

Our network is currently isolated from the outside by a Linux box, running iptables and Squid to control web access. By default we deny all outgoing traffic from all IP's, to force Web traffic ...
3
votes
2answers
824 views

Reveal the True IP of a User

Is there any best practice method (and preferably documented) way of revealing the True IP of a user using a HTTP(S) connection? I.e.: To be able to uncover the true IP from transparent as well as ...
6
votes
4answers
1k views

How to keep secure while browsing on open wifi when SSL VPN is blocked?

After a recent visit to a hotel I was surprised to discover that they blocked access to my OpenVPN server. I often use this as a way to secure my internet traffic when I am on public wireless. ...
3
votes
1answer
319 views

Could somebody explain connect loop DoS?

I'm trying to understand this vulnerability. How can I reproduce this?
3
votes
2answers
804 views

Securely expose WebService from Enterprise Network to Internet Client

(coming from stackoverflow) Are there any standards (or certified solutions) to expose a (Web-)Service to the internet from a very security-sensitive network (e.g. Banking/Finance)? I am not ...
6
votes
7answers
1k views

HTTP Proxy vs bump-in-wire

If I'm an administrator of a corporate network, I could use an HTTP proxy to examine outgoing connections to monitor what websites my employees are going to, and terminate connections based upon ...
6
votes
2answers
4k views

Is there anything like a known proxy server IP list/database?

I'm looking for something like a known proxy servers IP list (text, comma seperated or database based). Do you happen to know if anything like that exists? Free would be nice. I doubt it because these ...
8
votes
3answers
6k views

Proxy vs. Firewall

I understand that very simply put a proxy is a sort of 'man in the middle' allowing/denying access to certain services/resources. Strictly in terms of security (I mean here privacy, parental control ...
1
vote
3answers
448 views

Install my own proxy

My school network has blocked a lot of webpages, including TeamViewer, which I need. The IT department told me to find a proxy, because it was their ISP who had blocked the sites. To connect to the ...
2
votes
1answer
104 views

WebProxy configuration … Which threat could apply?

I need some help to identify possible (and rational) threats that could apply to that part of IT infrastructure (WebProxy). I have a webproxy for my users, which behave like a classic webproxy and ...
3
votes
3answers
14k views

How to force ALL programs to use my Proxy?

I have a local proxy on my PC. (localhost:8888) But unfortunately there are many programs which are not able to go through this proxy. So how can I force all my programs to go through my local proxy ...
8
votes
3answers
1k views

How do I log all my internet-connections

How can I (maybe with a proxy, but I need names of programs!?) log all my interactions of programs with my Internet connection, so that I could see WHAT a program is sending and WHAT it is receiving. ...
6
votes
1answer
4k views

How is tunnelling SSH through Poxytunnel/HTTPS different from doing it through SSL with Stunnel?

In an answer to What is the difference between SSL, TLS, and HTTPS, it's said that HTTPS is HTTP over SSL/TLS. That is, an SSL/TLS connection is established first, and then normal HTTP data is ...
1
vote
3answers
837 views

Benefits to using EV certificates with a privately hosted Certificate Authority

For companies that have implemented their own internal CA, is there any benefit to configuring that CA to issue an EV certificate? Do any SSL Proxies (like Bluecoat) mimic the EV certificate of the ...
2
votes
3answers
1k views

Reverse Proxy Secure Configuration

I have a Forefront TMG 2010 acting as a reverse proxy: I can force HTTP*S* between internet clients and TMG. I can force HTTP*S* between TMG and my web servers. From a security point of view, it ...
5
votes
4answers
1k views

MiTM - Non-HTTP TLS

I'm doing some research into the privacy of various iOS applications. My main source of data is via wireshark or Burp (HTTP/S proxy). This has been rather sucessfull for MiTM for decrypting HTTPS ...