Questions tagged [http-proxy]
The http-proxy tag has no usage guidance.
114
questions
0
votes
0answers
25 views
How can I proxy traffic of macOS Mojave APPS using Burp Suite?
If I do a web search for proxying macOS apps using Burp Suite, I don't get any useful info. Instead, I get dozens of results talking about how to proxy iOS or Android apps. I am talking about desktop ...
2
votes
1answer
54 views
Is there a difference between editing HTTP messages manually or with burp for example? (WebGoat HTTP intercept exercise “problem”)
I am diving now into WebGoat, there's this little exercise in the "general" tab calle d "http proxies" which asks you to use zap/burp to intercept and modify a request, this is what is being us asked.
...
1
vote
0answers
114 views
Am i being MITMed?
Lately i was experiencing weird behavour from some big websites.
More specifically, when i normally tried to connect to facebook, i would be greeted with this login page:
I have placed these with ...
2
votes
0answers
58 views
Benefit of authentication with a gateway
Given...
a public web service with enabled SSL/TLS
the web service enforces authentication using JSON Web Tokens
a client on a LAN without an Internet connection
a proxy on the LAN that grants point-...
2
votes
1answer
81 views
Secure GET-based remote API access via PHP
I am programming a way in PHP for my users to be able to access a remote API though my website. I was wondering if any of you had some input on whether or not this was secure (NOT considering any ...
1
vote
2answers
208 views
Is it possible to tunnel my whole linux machine through http proxy? [closed]
For some reason i access my internet through a HTTP proxy.
Is there a way to tunnel my whole Linux machine (currently am using ubuntu 18.04) through http proxy.
If i change proxy setting in the ...
1
vote
2answers
476 views
SSL handshake not visible in Wireshark
In my organization we have a cloud proxy that work on a loopback address. The vendor of this proxy has deployed an app on our machine which listens on the loopback address.
I have captured the apps ...
2
votes
1answer
97 views
SSL MITM Proxy Security - Can we rely on it?
In my organization, we have an SSL MITM (Man-in-the-middle) proxy (like ZScaler proxy). If I browse an HTTPS website and check the certificate, I can see that the proxy has issued a separate ...
1
vote
1answer
65 views
Is this a threat if website to connect to is in clear in the TLS SNI extension or when using an HTTP proxy?
As per my understanding, after the TCP three-way handshake we send a TLS ClientHello which has the SNI field in clear text and anyone can see which website I am trying to connect to.
Isn't it a ...
0
votes
0answers
110 views
Can charles proxy (with root cert installed) intercept and read all traffic between mobile app and server? [duplicate]
I have a mobile app that queries various 3rd party API/sites (these are https links). I have a concern that SSL proxies (e.g. Charles) can be used to intercept the traffic - man in the middle.
Are ...
0
votes
1answer
89 views
URL rewrite spoofable
I am considering using URL rewrites in kubernetes nginx proxy to publish selected context paths in microservices which are run in a cluster running internal services. For example
https://public....
2
votes
1answer
152 views
Why isn't an Expect-CT violation report sent when I use a certificate generated with Burp Suite?
I wanted to test the Expect-CT security header. So I searched for sites and found that LinkedIn uses the Expect-CT header:
Expect-CT: max-age=86400, report-uri="https://www.linkedin.com/platform-...
0
votes
2answers
565 views
CORS Anywhere to bypass CSRF protection
CORS Anywhere helps with accessing data from other websites that is normally forbidden by the Same origin policy of Web browsers.
Can CORS Anywhere be used to bypass CSRF protection?
Reason to ask ...
0
votes
2answers
48 views
Why do we have to specify HTTP proxy specs when inside a LAN that is behind a proxy server?
Following this post, outgoing traffic will go through the proxy only if the requesting app knows the proxy url, if it doesn't then sending the request out of the LAN is denied by the proxy.
In this ...
0
votes
1answer
263 views
Defeating proxy using hosts file
I had somebody say that it would be possible to defeat any http proxy url blocking, "by editing the hosts file and so that some whitelisted site maps to an IP address they control, with a server set ...
0
votes
0answers
40 views
Preventing admin from changing proxy settings
I am using a proxy server for my environment deployed on premises for internal hosts and on the cloud from BYOD. When a user takes their device off the premises, the proxy changes to an external proxy ...
0
votes
2answers
75 views
Why is the SSL message red?
The site Phonel.ir uses a SSL certificate. Why is the Error message in red? Is there a problem with the SSL certification?
I sometimes use a proxy. Can that be the reason?
0
votes
1answer
203 views
https: Is my company connection intercepted?
I wanted to find out whether my company can see what I'm posting online as soon as using websites using a valid https certificate.
I know there are a lot of posts here about whether my company can ...
2
votes
1answer
907 views
Bettercap 2.x SSLStrip Is Not Converting Links
I posted this before. I am creating a new post because of all the changes I would need to [edit] out.
I have the latest version of bettercap. I have the latest version of Kali Linux using the latest ...
1
vote
3answers
5k views
Bettercap 2.x SSLStrip Is Not Breaking TLS (Without HSTS)
I have the latest version of bettercap. I have the latest version of Kali linux using the latest version of VirtualBox on the latest version of Windows 10. My target machine is the lowest possible ...
1
vote
1answer
278 views
ESNI (Encrypted Server Network Identification) with HTTP CONNECT (HTTP Proxy)
Regarding ESNI RFC (https://tools.ietf.org/html/draft-ietf-tls-esni-02) it copes with many possible security vulnerabilities. However I'm interested how is it supposed to prevent confidential ...
1
vote
1answer
112 views
Protect app from Http Proxy like Charles [duplicate]
I am using https request for web API in my app. But I know Charles allowed to access https request also, via install root certificates on device. So, someone downloaded the app from PlayStore and ...
0
votes
2answers
100 views
How does proxylist sites discover new proxy?
I always got proxies from proxylist websites but I never asked me how these sites discover new proxy. So how?
-1
votes
1answer
749 views
Risk in having the PAC file in a server with no authorisation
So basically I’ve put my PAC-file under a non-secure web server with no authentication whatsoever in my organization. Later, I found out that there have been many attacks using this file type in other ...
9
votes
2answers
6k views
Would a reverse-proxy authentication server be a secure setup?
I work at a small consultancy and we often make web apps for our clients. One part of the web app that is often repetitive to write is the authentication system. In a lot of our web apps we would ...
4
votes
2answers
7k views
Burpsuite: just passthrough firefox detect portal
When I enable Burpsuite's Proxy I continiously get http GET requests for firefox's detectportal as seen in the following image:
How I can configure it to somehow just pass though theese requests ...
6
votes
1answer
177 views
How SSL/TLS handshake happens when we use Cloudflare Service?
I was reading about the offerings of the Cloudflare and then I read about the working of Cloudflare.
Based on my understanding, the domain name of my website(alice.com) is resolved to the IP address ...
2
votes
0answers
25 views
Concerns when passing all OPTIONS requests through authorization proxy gateway
I have a React based application which uses RESTful services on backend distributed on private network. To communicate with such services using AJAX, client application sends all its request through ...
0
votes
1answer
71 views
How to capture HTTP Traffic if the application uses Automatic Configuration Script?
I am testing an application that requires "Automatic configuration script" to be configured in web browser.
How can i intercept HTTP traffic in such case. I am aware of temper data add-on but is ...
0
votes
1answer
125 views
POST Request to Server
Assume that a user logged in to a webpage with their own account, then makes a POST request and captures it. With some modification to the captured request, it is being executed. Sure. It goes through ...
0
votes
1answer
2k views
Node.js http-proxy-middleware: secure connection between servers
I have a back-end and a front-end application which are running on two different servers (hosts). To prevent using CORS and simplify the communication, I would like to serve the static front-end with ...
1
vote
1answer
65 views
Server is returning an unrecognized error message?
I've received reports of a strange error message (over HTTPS) that is not a part of my web application. The only thing I can think of is that it's coming from a proxy server. Is that possible? Can a ...
2
votes
0answers
304 views
AnalogX Proxy on Windows: Would it be possible to make it secured? [closed]
I am using AnalogX Proxy Server to share my internet connection, my question is, would it be possible or does this software supports authentication? I mean, connecting to the proxy will require login ...
1
vote
2answers
248 views
Monitor HTTP requests in a TLS transaction
I want to know if there is a way to monitor the size and time taken for an HTTP request in a TLS transaction using a proxy or other network traffic inspection tool. Note that I do not want to inspect ...
1
vote
2answers
260 views
Certificate chain differs depending upon what network I use to reach an app
We have built an application on Heroku.com for an enterprise customer, and when the customer reaches the site via their normal internal network, they get an SSL certificate warning in their browser, ...
7
votes
2answers
14k views
How does mobile free internet bypass works? (UBT / FBT)
I have encountered a mobile application named "HTTP Injector" which lets you get free internet access (UBT / FBT).
The process to get it work and receive free internet seems to be as follows:
...
1
vote
0answers
332 views
ARP poisoning HTTP(S) mobile traffic
I'm working on a mobile app security test. This app communicates with a webservice and I'm trying to intercept the traffic between them.
I've already accomplished this by setting my HTTP proxy as a ...
3
votes
1answer
940 views
Can I use CloudFlare if I want to avoid NSA and FISA secret orders? [closed]
We're running a web service in Europe, secured with TLS and we're using private keys generated on our private hardware.
We would like to use CloudFlare for DDoS protection and caching reverse proxy.
...
0
votes
1answer
2k views
Proxying Requests through Python and Burpsuite not working
I have BurpSuite configured as a proxy. I have generated and installed a certificate for Burp in my Mac's keychain. On a Kali box I have also configured Iceweasel to proxy through my Burp Proxy ...
3
votes
1answer
22k views
Disable or bypass SSL Pinning/Certificate Pinning on Android 6.0.1
Previously I have been able to bypass SSL Pinning by using the program JustTrustMe with the Xposed framework for nearly every app.
https://github.com/Fuzion24/JustTrustMe
However it has started to ...
1
vote
0answers
633 views
How to export decrypted https traffic from mitm proxy
I am using mitm proxy in order to intercept https traffic to an android device and it seems to work great. I downloaded and installed the certificate from mitm.it when the android emulator's internet ...
0
votes
2answers
164 views
How can I see if a site supports HTTPS? [closed]
I have a classic C forking proxy in my LAN; now that I know "how to socket", I'd like to grant some privacy to it.
For instance, the browser extension HTTPS Everywhere (from its Wikipedia page),
...
2
votes
2answers
493 views
Authentication helpers for tunneling through an HTTP proxy?
corkscrew is quite good for tunning SSH through an HTTP proxy. However, it only supports basic authentication. Have other people developed similar software supporting other types of authentications? ...
5
votes
1answer
9k views
Working of SSH connection through Proxy
I have to configure my web browser's proxy to 172.18.10.1:3128 every time I want to connect to internet from my college. Since I'm configuring a web browser's proxy, I believe that the proxy is a "...
1
vote
3answers
140 views
How does a router calculate the amount of data used per device?
I'm using WiFi of the firm I work for and they only allow an employee to use 30 GBs of data in a month. Now, based on the answer to this question, I wonder if I encrypt my traffic, would the firm ...
1
vote
1answer
1k views
Nmap through Burp ¿?
I know nmap and burp work at different levels, but in the same way, metasploit allows to set either an http or socks4 proxy, and I know and have used proxychains with Burp also.
But what I want is to ...
0
votes
1answer
59 views
Block to record http requests using recorder
When I log into any website, I can record all calls while login using jmeter test script recorder or Burp suite but when I try to record calls from face book, it gives me following message on browser.
...
1
vote
1answer
3k views
Intercept traffic other than port 80 and 443 on burp suite
I am trying to intercept traffic on port 8000. For example my application is running on abc.com:8000. I am unable to intercept this traffic on burp suite. How can I intercept this traffic in Burp?
1
vote
1answer
70 views
Does a continuously freshly installed proxy server increase security?
If a small number of physical servers are used to run an OS and reverse proxy purely in RAM and have no storage, and they are rebooted/re-initiated in relay every X minutes - so that changes to the ...
0
votes
0answers
97 views
Is a proxy server using Squid / Squid Guard (or something similar) necessary if you're running a kiosk network?
When setting up a Kiosk network, one that you're using so that people can access a single website, shouldn't you use a proxy server that uses Squid or Squid Guard (or some sort of proxy) to limit the ...
