The word "proxy" is mostly used as short for "proxy server", which is a server that acts as an intermediary between a workstation user and the Internet so that the enterprise can ensure security, administrative control, and caching service.

learn more… | top users | synonyms

1
vote
0answers
92 views

How to check for vulnerability against WPAD / HTTPS attacks?

As described at New attack bypasses HTTPS protection on Macs, Windows, and Linux | Ars Technica, there is a newly identified attack at wifi hotspots etc that can expose the URLs you use even if they ...
0
votes
0answers
20 views

Iphone 6s/ Ipad mini won't connect to proxies? [on hold]

I've tried charles proxy and fiddler. I'm not really tech-savy, and the tutorial mentioned something like using an app that uses connections for charles/fiddler to detect for confirmation, but before ...
10
votes
2answers
918 views

httpoxy - does TLS/SSL mitigate the vulnerability of HTTP Proxy header?

There's a new fancy-named, branded vulnerability called HTTPOXY. My question here: Are sites served via TLS also affected? Or is this an issue only for HTTP sites (unencrypted communication channel)? ...
0
votes
2answers
153 views

Website doesn't provide cookie (csrf token) when connecting over proxy. Why/how?

The Python code below should grab a "csrf token" cookie from Instagram.com, but I get an error message when running the program through any sort of https or socks5 proxy, informing me that the "csrf" ...
0
votes
1answer
39 views

How do I analyze traffic chain when using both Tor and a browser-configured proxy

For example, I have set up the Tor network in Debian. I then set up proxy in Iceweasel browser (via the Preferences). How can I examine the traffic chain to determine if browser requests first go ...
2
votes
3answers
105 views

Does a reverse proxy pass keep the backend server anonymous?

If I have an NGINX server at 1.1.1.1 and in the NGINX server you have the config that forwards on http traffic to 2.2.2.2: upstream 123 { server 2.2.2.2; } server { listen 80 default_server; ...
2
votes
2answers
155 views

Is a vpn connection through a proxy more secure?

At the moment there are a number of online services (Hide my ass or PIA) that offer some type of security through an VPN connection. This of course can work, but the big problem (for me at least) ...
1
vote
1answer
335 views

Some specific website not loading when proxy through Burp

I am conducting web application pentest in which all the traffic will go through BurpSuite. In addition, SOCKS proxy is used so all the requests are sending out from a fix company IP address. However,...
12
votes
4answers
10k views

Detecting Tor proxy by reading request headers

I am a newbie to the field of security. As I was trying to explore more about HTTP request and response headers, I came across this website which provides a detailed analysis of the request header ...
6
votes
1answer
2k views

How do I know if my company or my ISP is using a TLS proxy?

I was reading the other day on "Does https prevent man in the middle attacks by proxy server?". Let me quote few lines: Blue Coat, the biggest name in the SSL interception business, is far from ...
0
votes
1answer
70 views

Best approach to get user's IP

There is two approaches: First approach: if (isset($_SERVER['HTTP_CLIENT_IP'])) $user_ip = $_SERVER['HTTP_CLIENT_IP']; else if(isset($_SERVER['HTTP_X_FORWARDED_FOR'])) $user_ip = $_SERVER['...
1
vote
1answer
54 views

How to configure proxy settings of cellular internet for burp

I am pen testing an android app and using tethering to connect my phone to my laptop. I configured the access point settings as proxy = ipv4 address of my laptop and port = port on which burp is ...
0
votes
2answers
28 views

Transparent Proxy with tight whitelist, permitting GET requests still prevents data egress?

We have a network that currently has zero internet access. I want to provide a means for the users on the network to access certain productive sites for reference, such as the Stack Exchange Network, ...
0
votes
0answers
20 views

Making My Cache Work and Not Theirs: Blacklist for Blocking Caching Sites with Squidguard?

Is there a Squid Guard blacklist (assuming SSL decryption and inspection) that will block caching websites like Google Cache, Google Translate, and the Internet Wayback Machine?
5
votes
4answers
391 views

proxy servers and restricted work computers

I have a work-issued computer that I have limited access to the Internet due to the security protocols in place on the device. I want to use this machine at home, for work. I want to be able to hide ...
4
votes
2answers
46 views

How do I turn off automated testing in OWASP ZAP?

I am trying to find out how to turn off the automated scanner in ZAP. I am not even sure if it is on. How and where can I tell if the scanner is on? I just want it to be a pure proxy for the time ...
1
vote
1answer
24 views

Is it possible to lock down the http / https proxy settings on a Windows Phone?

Is there any way to lock down the proxy settings on a Windows Phone so that they can't be changed by anyone but the person with the password?
1
vote
1answer
30 views

Is it possible to lock down the http / https proxy settings on an Android phone?

Is there any way to lock down the proxy settings on an Android Phone so that they can't be changed by anyone but the person with the password?
0
votes
0answers
12 views

How to use single Tor node as proxy? [duplicate]

I would just like to bypass a geo check (don't care about privacy) on some website. Is it possible to use a single Tor (exit) node as a proxy? (I am hoping to set up a 1 hop Tor connection to have a ...
1
vote
1answer
103 views

Isn't a reverse TLS (reverse) proxy a security risk?

So, after reading Wikipedia's article on reverse SSL/TLS Proxies, I totally get the advantages it offers. But doesn't it also pose a security risk, by basically being a "man in the middle"? As a ...
49
votes
9answers
43k views

Can my company see what HTTPS sites I went to?

At work my company uses internet monitoring software (websense). I know if I visit a https ssl-encrypted site (such as https://secure.logmein.com) they can't see what I'm doing on the site since all ...
4
votes
1answer
83 views

Can a .DER be converted to a .PFX / .P12 ?

Burp-Suite's http://burp/cert:8080 web-interface for downloading the CA Certificate only provides a .der encoded certificate, but for a particular use-case scenario I require a PKCS#12 .pfx/.p12. I ...
1
vote
1answer
200 views

Can Web Proxy Autodiscovery leak HTTPS URLs?

The WPAD protocol can in some circumstances allow an attacker to get clients to use a malicious PAC script. It appears to be well documented, that this can be used to perform MITM-attacks on HTTP ...
2
votes
0answers
798 views

Can SSH tunneling over DNS tunnel work in China to use free WiFi at airport?

I have followed a tutorial here: http://ebnj.net/sshoverdns/ This tutorial tells us how to carry all internet traffic via DNS tunnel if your airport enables no-limit outgoing DNS. This guides us to ...
3
votes
2answers
53 views

Does rotating proxy provide better privacy?

We have anonymous rotating proxy service like ProxyMesh. ProxyMesh provides 14 rotating IP address proxy servers, each with 10 IP addresses rotating twice per day, giving you a total of 280 IP ...
0
votes
1answer
61 views

How to connect to Windows RDP and delegate authentication to a (reverse) proxy?

Looking for the following setup: Client connects to Windows RDP server through proxy server. The client is in public network hence can't send username/password for logon. The proxy server in between ...
1
vote
1answer
52 views

Can proxy server access my cookies and use it?

I recently forgot to turn off proxy and connect through a premium account, will the owner of proxy server be able to use the cookies and access the account?
4
votes
1answer
197 views

Why is BlueCoat proxy passing HTTPS communication to Google sites?

I have a machine behind corporate BlueCoat's proxy server. For any HTTPS site I get a certificate signed by BlueCoat's CA, for example: BlueCoat *.duckduckgo.com The only exceptions are sites ...
0
votes
1answer
43 views

Network configuration: Preventing my computer being used as a proxy?

I recently installed an extension for Chrome called Hola (skip to next paragraph if you know it). It calls itself a VPN, but is basically a proxy pool AFAIK. You can choose a country from a list in a ...
0
votes
0answers
22 views

Is there a way to make sure my SOCKS proxy is connecting through HTTPS?

Disclaimer: newbie. What I mean is, if I set the SOCKS proxy to a program to let him connect through the tor network and this program connects to different websites (because it is required, e.g. a ...
12
votes
3answers
13k views

Proxy vs. Firewall

I understand that very simply put a proxy is a sort of 'man in the middle' allowing/denying access to certain services/resources. Strictly in terms of security (I mean here privacy, parental control ...
0
votes
0answers
23 views

Client blocking based on PKI

I've got following scenario: Own PKI in a private network Some webservers in the private network, accessed by load balancing via proxy from the web Now I'd like to block all clients their ...
0
votes
1answer
77 views

Forwarding traffic to SSLSplit from Android

I want to forward non HTTP traffic to SSLSplit in order to do a MITM attack. How would I forward the traffic to SSLSplit from my Android?
0
votes
0answers
47 views

shared hosted web server used as forward proxy

When setting up personal anonymous forward proxy server, different hosting can be chosen. In the case of shared hosting, web server, transformed into proxy server, shares it's IP with hundreds of ...
3
votes
2answers
118 views

How to protect from WPAD attacks?

If you are in a Windows network, and you basically connect to a website ; And there is an attacker on Linux who changes the hostname to WPAD and configures WPAD.dat in his system, all your PC's ...
2
votes
2answers
183 views

Block mobile tethering on android phones from Windows (DLP)

In our small organisation I have tried my best at implementing DLP by: Making sure users access all files from the server Local disks are denied access (forced to work only on network drives) ...
0
votes
2answers
448 views

Can you login to Facebook through a VPN or a proxy?

I've heard that there's a new type of security in Facebook. When logging in they automatically check if the IP Address is similar to that of the original IP during registration. That's in order to ...
1
vote
1answer
1k views

Privacy error in google chrome

Recently I installed some random softwares on my windows 8.1 PC from the internet and along with that some malware also got installed. I started getting " Your connection is not private " error in ...
0
votes
0answers
26 views

ostinato as replacement for fiddler

Can ostinato be used like fiddler? Fiddler acts as a proxy for recorded traffic and all responses on Wireshark appear to be coming from a local IP where fiddler is hosted. I have a use case where the ...
2
votes
2answers
152 views

Google thinks I am a robot when using proxy, but only in Safari

Google greeted me with this message while being behind a private proxy: Our systems have detected unusual traffic from your computer network. This page checks to see if it's really you sending ...
0
votes
3answers
75 views

Is anyone held responsible if a VPN/proxy that doesn't log is used for illegal purposes?

How do the anonymous VPN services work? It’s my understanding that if an internet connection is misused for something (such as downloading copyright material or hacking a network etc) then the person ...
2
votes
2answers
106 views

What information can my ISP see using squid proxy?

My ISP provides a transparent proxy to use and I can see that they are using the squid proxy for caching this. What I am wondering is what data can they see and what can they see further if they can ...
2
votes
1answer
184 views

Viewing HTTPs Traffic - ZAP Proxy / MacOS / iOS App

I've noticed a curious oddity with some traffic sniffing from my Apps on my iPhone. I've installed the ZAP Proxy CA Cert on the device, but I've noticed I can sniff some App traffic, and others I can'...
1
vote
0answers
83 views

Charles Proxy: Genymotion with certificate pinning

Is there anyway I can use charles proxy with an android app that is using certificate pinning? I read this thread: http://blog.attify.com/2015/08/24/intercepting-network-traffic-android/ and it says ...
0
votes
1answer
82 views

What prevents ISPs from tracking chain of proxies' (or Tor relays') IP addresses?

I searched all over the internet for the answer for my simple question, but couldn't find anything useful. I already know that police have to access PCs used as proxies or Tor relay nodes to read ...
1
vote
1answer
163 views

I have internet at home, need to know who visited what? Possible? [closed]

I have internet at home. I wanted to keep a watch on who visited what without putting a computer on for 24 hours and running some proxy software on it. Is there a possibility to get a track of all the ...
0
votes
0answers
19 views

Hamachi as a way to access home vCal / vCard server - security risk?

I have a home server providing a way to sync contacts and calendars between my machines. Until now, I was using it only with computers in my LAN, but recently I need to sync a computer that is on ...
3
votes
2answers
884 views

Nmap through proxy

Using the following command: nmap --proxy socks4://*.*.*.*:25074 -sV -O --reason scanme.nmap.org I'm not sure if nmap is really using the proxy specified Had an idea of scanning "localhost" or "...
0
votes
0answers
102 views

JWT Best Practice

I have a scenario with multiple applications spread across multiple servers. Each of them are utilizing JWT for authentication. All JWT tokens are generated from the same server. I'm trying to ...
2
votes
2answers
274 views

How to test my anonymity?

let's assume that I've used proxies and anonymizing tools as much as I want. How to be sure that I'm totally anonymous? I'm not talking only about IP spoofing and identity hiding, but other and ...