Questions tagged [proxy]

The word "proxy" is mostly used as short for "proxy server", which is a server that acts as an intermediary between a workstation user and the Internet so that the enterprise can ensure security, administrative control, and caching service.

71 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3 votes
0 answers
894 views

Weird hack attempt nginx proxy manager and photoprism drives me nuts

I have a logged http request in nginx logs which drives me nuts because I don't understand how it's finding its way into the logs: [03/Jul/2023:13:45:04 +0000] 400 - GET http localhost "/bin/...
MuchToKnow's user avatar
3 votes
0 answers
395 views

Pentest website available through per app VPN

I am trying to intercept web traffic with burp from mobile devices (Android and iPhone) that are enrolled in an MDM solution (MobileIron). There is one specific website I want to proxy, that is ...
torjus's user avatar
  • 31
3 votes
2 answers
899 views

tunnelling HTTP request through DMZ from a secured area

In my topology I have a secured area where all the servers are. There is also a DMZ with a few reverse proxy servers. I now need to make one of the servers in the secure area open to make HTTP calls ...
j. doe's user avatar
  • 65
3 votes
0 answers
190 views

Tracing torrent activity behind a proxy

I've got a question about how it is that one may have their torrent activity traced if you are using a proxy. Specifically, I have the following behind a "Socksv5 w/ Auth" proxy in the Deluge ...
tendim's user avatar
  • 131
2 votes
2 answers
755 views

Local Burp Proxy not showing routed packets

I created a hotspot on wlp2s0 and connected an android device, whose IP is 10.42.0.62. I am trying to route my all packets from my wlp2s0 interface to burp proxy which is running on 8080. I also ...
Monu's user avatar
  • 227
2 votes
0 answers
246 views

How to reproduce the RTP bleed vulnerability?

I need to demonstrate RTP bleed on an older version of Asterisk/RTPProxy, but I'm struggling with setting up the environment. Can somebody please tell me how to configure a proxy and two clients ...
clockwork-orange's user avatar
2 votes
0 answers
967 views

HTTP proxy for smart card based SSL

I am trying to pentest a web application, which seems to be using the user's smartcard for building up the SSL tunnel, and by that implementing smartcard authentication. My problem is that I haven't ...
gerion's user avatar
  • 59
2 votes
0 answers
5k views

Intercepting hydra with burp suite

I'm using burp suite as a proxy and when I run hydra, burp suite should be able to catch that and log it in HTTP history, but instead of that I get the error Can not connect [unreachable] I tried ...
Java-Kree's user avatar
  • 319
2 votes
0 answers
2k views

Can SSH tunneling over DNS tunnel work in China to use free WiFi at airport?

I have followed a tutorial here: http://ebnj.net/sshoverdns/ This tutorial tells us how to carry all internet traffic via DNS tunnel if your airport enables no-limit outgoing DNS. This guides us to ...
dotslash's user avatar
  • 387
2 votes
1 answer
1k views

Logging all traffic crossing SSH proxy

Is there a way to log SSH sessions proxied through a machine (User-> SSH Proxy -> Server (with SSH)) without modifying the SSH daemon on the proxy? I need to log all the commands as well as responses ...
BrunoMCBraga's user avatar
2 votes
0 answers
641 views

VPN Server + Anonymity + Adblock for mobile Devices

In order to improve private security and anonymity while browsing the web on my mobile devices I wanted to tunnel all traffic to my own server via VPN and use a proxy software to filter unwanted (...
whlk's user avatar
  • 121
2 votes
0 answers
289 views

Why my proxy is still having some connections blocked

I am behind a firewall in France. I connect to proxy A, in Ireland with Dante via SSH port 22 and make a tunnel forwarding port 1080. The proxy works as expected but still having a port range blocked....
Chroma Funk's user avatar
2 votes
1 answer
1k views

Odd Proxy setting in Microsoft Edge

Today I encountered odd proxy settings on a user's Windows 10 installation. Microsoft Edge had the proxy set to: use proxyserver The address field was set to: ...os=127.0.0.1:51144 The "port" ...
Ralf Hildebrandt's user avatar
1 vote
2 answers
108 views

VPN vs Authentication Proxy to restrict access to internal network/application

A popular new idea at the company I am working for is to remove worldwide access of web applications and restrict them to the internal network only, allowing remote users to work with them through VPN ...
user2374435's user avatar
1 vote
0 answers
403 views

How would you hide yourself whilst conducting a scan on a target network to identify open service ports?

I am working on this question which asks how you would conduct a scan of a target network to identify open service ports without revealing your IP address. It wants details such as IP address ...
Thanos's user avatar
  • 111
1 vote
0 answers
131 views

Is there a real gain in terms of security by not using a reverse proxy?

I need to implement a web application consisting of the components FE (Nginx + React.js) BE (Java SpringBoot) DB (MySQL) For simplicity we will assume that the DB runs in localhost on BE's machine. ...
Dan10's user avatar
  • 11
1 vote
0 answers
170 views

Central Web Proxy vs Endpoint Protection

Imagine the following imaginary scenarios: In order to browse the Internet, users must go through a central web proxy. It is authenticated and can enforce rules about who can access which URLs or ...
Deserializer19's user avatar
1 vote
1 answer
257 views

Does the application gateway firewall function only on the application layer or on all layers of the OSI model?

This is very confusing. I am seeing 2 different things in various books and sites. A. Application gateway firewall scans layer 1 to layer 7 of the OSI model. B. Application gateway firewall only scans ...
zeeshanseikh's user avatar
1 vote
0 answers
194 views

Intercept API calls of powershell module

I am looking at a way to intercept the API call made by the AzureAD powershell module. Wireshark is not able to decrypt the TLS packets sent and I'd also like to work with the HTTP requests rather ...
LucaBonadia's user avatar
1 vote
1 answer
320 views

Encryption with Tomcat & Nginx reverse proxy

I'm working with Tomcat and nginx as a reverse proxy and I'm trying to have a better understanding of how the traffic flows and of what the security issues are. Picture this as what I have in mind: ...
SilentSib's user avatar
1 vote
0 answers
214 views

Certificate Checking for MITM w/ Squid

I have already set up a squid cache proxy server on a Raspberry Pi 4. I need to create some sort of GUI to turn on and off certificate checking for man in the middle attacks. First, how do I get squid ...
LtMuffin's user avatar
  • 452
1 vote
0 answers
504 views

SAML/oauth2/openid-connect login via proxy as another user

I manage a set of service providers (SP1, SP2, SP3, etc), and we currently have this SAML SSO flow working where the SP causes a POST submit to the SAML IDP with an XML SAML request which includes an ...
DavidG's user avatar
  • 111
1 vote
0 answers
116 views

Strange Proxy Application Behavior on iOS 13.5.1

Background: My buddy is a freelance journalist working on a story on one of the bigger software companies (a household name, starts with an A). Anyway, he asked me to take a look at his iPad because ...
David's user avatar
  • 11
1 vote
0 answers
106 views

How to capure my web browser's and any other programs' http requests on my own laptop using mitmproxy?

I am using mitmproxy on ubuntu 18.04 I know how to capture another devices' traffic on my wifi network. but I don't know how to capture http requests which are sent by programs in my own laptop (...
Kavindu Ravishka's user avatar
1 vote
0 answers
2k views

Charles Proxy intercepting SSL Pinning enabled traffic

An Android application that has SSL Pinning was successfully tested on a mobile device running Android 6 (with the certificates installed) using Burp proxy and OWASP ZAP Proxy. As expected the ...
Wolfy's user avatar
  • 11
1 vote
0 answers
1k views

How can I proxy traffic of macOS Mojave APPS using Burp Suite?

If I do a web search for proxying macOS apps using Burp Suite, I don't get any useful info. Instead, I get dozens of results talking about how to proxy iOS or Android apps. I am talking about desktop ...
the_endian's user avatar
  • 1,169
1 vote
0 answers
191 views

Securing a SOCKS5 to SSH Tunnel on Windows

In order to gain web access from the perspective of a remote device, it is very common to use the SOCKS5 to SSH Tunnel capability built into OpenSSH Client and Putty (detailed here). Both clients ...
Liam Kelly's user avatar
1 vote
0 answers
882 views

mitmproxy request URL redirection does not work

I need to redirect the user's request in such a way when a user enters: https://a.com the mitmproxy redirect it to: https://www.newsite.com/?somepage From a previous post, I found this script in the ...
randomname's user avatar
1 vote
0 answers
130 views

How is Indonesia blocking images in e2ee applications?

Indonesia's minister in communication and informatics supposedly blocked the sending of images and videos through social media from 22nd May until 25th May, in order to prevent hoaxes from spreading ...
Zafir's user avatar
  • 11
1 vote
0 answers
472 views

Transparent proxy with certificate check

I need to filter HTTPS traffic based on the certificate of the destination server. Only traffic to servers which have a certain certificate should be allowed, other traffic needs to be blocked. The ...
MarcJ's user avatar
  • 11
1 vote
0 answers
278 views

Can a single domain be deleted from HSTS list through GPO

I have proxy performing a IWA authentication which intercepts the web request and redirects it towards the proxy's host name for auth. The redirect url is over http however the HSTS list on the end ...
Manav Garg's user avatar
1 vote
0 answers
184 views

Intercept data after sslstrip

I am able to use sslstrip successfully as shown here https://moxie.org/software/sslstrip/ What I want to do though is be able to use sslstrip with another proxy/script to modify requests/responses ...
James's user avatar
  • 11
1 vote
0 answers
5k views

Burp suite "Unrecognized SSL message, plaintext connection?" error

While running burp suite as an intercept proxy on a users computer, I am getting an error in the burp log saying: Unrecognized SSL message, plaintext connection? I have the certificate installed on ...
CertifcateJunky's user avatar
1 vote
0 answers
6k views

Failed to connect to www.google.co.in:443 error in burp suite?

I am trying to intercept the https request, but I getting this error while searching anything in URL.it's hitting my burp, but I can't get any response after clicking forward button,it comes with this ...
Arun Kumar's user avatar
1 vote
0 answers
180 views

No fields captured in BurpSuite

I am using burpsuite to bruteforce my routers login form, but I have encountered an issue... When I enter something into the password field, BurpSuite shows the request, but not what was entered. For ...
Python's user avatar
  • 121
1 vote
0 answers
1k views

Is it possible to go through proxy while PK Pinning is enabled?

My JavaFX client application and server has PK Pinning enabled. However, some clients ask us to add proxy support to the client app because the direct access in their office is closed and all the ...
Evgeniy Mishustin's user avatar
1 vote
0 answers
476 views

ARP poisoning HTTP(S) mobile traffic

I'm working on a mobile app security test. This app communicates with a webservice and I'm trying to intercept the traffic between them. I've already accomplished this by setting my HTTP proxy as a ...
luizfzs's user avatar
  • 291
1 vote
0 answers
1k views

How to export decrypted https traffic from mitm proxy

I am using mitm proxy in order to intercept https traffic to an android device and it seems to work great. I downloaded and installed the certificate from mitm.it when the android emulator's internet ...
MikeSchem's user avatar
  • 2,361
1 vote
0 answers
2k views

Metasploit payloads with VPN or proxies?

I have purchased VPN with torguard and asked them to forward ports. I run a test on the VPN IP and ports specified, and says ports closed, but they say otherwise in interface. Anyway I create a ...
M.S420's user avatar
  • 11
1 vote
0 answers
142 views

Making My Cache Work and Not Theirs: Blacklist for Blocking Caching Sites with Squidguard?

Is there a Squid Guard blacklist (assuming SSL decryption and inspection) that will block caching websites like Google Cache, Google Translate, and the Internet Wayback Machine?
leeand00's user avatar
  • 1,431
1 vote
0 answers
955 views

Charles Proxy: Genymotion with certificate pinning

Is there anyway I can use charles proxy with an android app that is using certificate pinning? I read this thread: http://blog.attify.com/2015/08/24/intercepting-network-traffic-android/ and it says ...
Simon's user avatar
  • 131
1 vote
1 answer
2k views

Website doesn't provide cookie (csrf token) when connecting over proxy. Why/how?

The Python code below should grab a CSRF token cookie from Instagram.com, but I get an error message when running the program through any sort of HTTPS or SOCKS5 proxy, informing me that the CSRF ...
user107978's user avatar
1 vote
0 answers
449 views

How to perform a MITM between a server and a client program whose local ports are randomly spawned?

I usually used Burp or similar tools for browser-based communications. The client program in question doesn't offer a proxy option to be configured. So I can't use Burp in this case, besides ports are ...
Arean's user avatar
  • 11
1 vote
0 answers
1k views

bypass proxy metasploit

I am working on a student project with the goal to exploit navigator vulnerabilities on weak Windows XP SP2 and/or Linux computers using only Metasploit Browser Autopwn 1 & 2. Seems trivial but ...
rkouere's user avatar
  • 11
1 vote
0 answers
794 views

How should I configure my Tor-dedicated firewall for optimum security?

I'm setting up a Tor-based isolating proxy using the 'Anonymizing Middlebox' iptables rules specified here: https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy i.e. iptables -t nat -...
Anon's user avatar
  • 11
1 vote
0 answers
719 views

Reverse proxy which only proxies published query strings?

I'm setting up a reverse proxy to limit access to a protected resource. The protected resource provides a status page (http://protected.local/info). That page contains a number of links with query ...
gowenfawr's user avatar
  • 72.9k
0 votes
1 answer
16 views

Would there be any utility for multiple clients sharing the same TLS session key?

I was wondering if there is any utility for multiple hosts sharing the same TLS session key. I have come across proxies and the way they intercept TLS connections is to make the client accept its ...
imawful's user avatar
0 votes
0 answers
141 views

How to reproduce Tomcat 9.0.0.M1 HTTP smuggling vulnerabilities?

I'm trying to reproduce some of the Tomcat 9.x.x vulnerabilities from this list, in particular the HTTP smuggling vulnerabilities. However, so far I haven't been able to reproduce any of them. ...
Franklin Pezzuti Dyer's user avatar
0 votes
1 answer
142 views

Burpsuite proxy does not get HTTP error 429 but vanilla python requests do?

When I make a normal python request to some site without any proxies I am getting a 429 response, too many requests. However when I open up burpsuite proxy and add proxies = { "http": &...
Lorde213423432e43434's user avatar
0 votes
0 answers
80 views

How can I forward and capture all traffic from a device (mobile, or PC) from another network?

Let's say Mobile device A sits on Network A, and I want to monitor their HTTPS traffic remotely, how might I go about doing this? I know that locally, on the same network, a proxy debugging tool can ...
ThanoojJ's user avatar