Questions tagged [http-proxy]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
33 views

Can charles proxy (with root cert installed) intercept and read all traffic between mobile app and server? [duplicate]

I have a mobile app that queries various 3rd party API/sites (these are https links). I have a concern that SSL proxies (e.g. Charles) can be used to intercept the traffic - man in the middle. Are ...
0
votes
1answer
63 views

URL rewrite spoofable

I am considering using URL rewrites in kubernetes nginx proxy to publish selected context paths in microservices which are run in a cluster running internal services. For example https://public....
2
votes
0answers
56 views

Why isn't an Expect-CT violation report sent when I use a certificate generated with Burp Suite?

I wanted to test the Expect-CT security header. So I searched for sites and found that LinkedIn uses the Expect-CT header: Expect-CT: max-age=86400, report-uri="https://www.linkedin.com/platform-...
0
votes
2answers
272 views

CORS Anywhere to bypass CSRF protection

CORS Anywhere helps with accessing data from other websites that is normally forbidden by the Same origin policy of Web browsers. Can CORS Anywhere able to bypass CSRF protections? Reason to ask ...
0
votes
2answers
43 views

Why do we have to specify HTTP proxy specs when inside a LAN that is behind a proxy server?

Following this post, outgoing traffic will go through the proxy only if the requesting app knows the proxy url, if it doesn't then sending the request out of the LAN is denied by the proxy. In this ...
0
votes
1answer
57 views

Defeating proxy using hosts file

I had somebody say that it would be possible to defeat any http proxy url blocking, "by editing the hosts file and so that some whitelisted site maps to an IP address they control, with a server set ...
0
votes
0answers
33 views

Preventing admin from changing proxy settings

I am using a proxy server for my environment deployed on premises for internal hosts and on the cloud from BYOD. When a user takes their device off the premises, the proxy changes to an external proxy ...
0
votes
2answers
72 views

Why is the SSL message red?

The site Phonel.ir uses a SSL certificate. Why is the Error message in red? Is there a problem with the SSL certification? I sometimes use a proxy. Can that be the reason?
0
votes
1answer
183 views

https: Is my company connection intercepted?

I wanted to find out whether my company can see what I'm posting online as soon as using websites using a valid https certificate. I know there are a lot of posts here about whether my company can ...
2
votes
1answer
531 views

Bettercap 2.x SSLStrip Is Not Converting Links

I posted this before. I am creating a new post because of all the changes I would need to [edit] out. I have the latest version of bettercap. I have the latest version of Kali Linux using the latest ...
1
vote
3answers
2k views

Bettercap 2.x SSLStrip Is Not Breaking TLS (Without HSTS)

I have the latest version of bettercap. I have the latest version of Kali linux using the latest version of VirtualBox on the latest version of Windows 10. My target machine is the lowest possible ...
1
vote
1answer
170 views

ESNI (Encrypted Server Network Identification) with HTTP CONNECT (HTTP Proxy)

Regarding ESNI RFC (https://tools.ietf.org/html/draft-ietf-tls-esni-02) it copes with many possible security vulnerabilities. However I'm interested how is it supposed to prevent confidential ...
1
vote
1answer
61 views

Protect app from Http Proxy like Charles [duplicate]

I am using https request for web API in my app. But I know Charles allowed to access https request also, via install root certificates on device. So, someone downloaded the app from PlayStore and ...
0
votes
2answers
69 views

How does proxylist sites discover new proxy?

I always got proxies from proxylist websites but I never asked me how these sites discover new proxy. So how?
-1
votes
1answer
536 views

Risk in having the PAC file in a server with no authorisation

So basically I’ve put my PAC-file under a non-secure web server with no authentication whatsoever in my organization. Later, I found out that there have been many attacks using this file type in other ...
7
votes
2answers
4k views

Would a reverse-proxy authentication server be a secure setup?

I work at a small consultancy and we often make web apps for our clients. One part of the web app that is often repetitive to write is the authentication system. In a lot of our web apps we would ...
4
votes
2answers
3k views

Burpsuite: just passthrough firefox detect portal

When I enable Burpsuite's Proxy I continiously get http GET requests for firefox's detectportal as seen in the following image: How I can configure it to somehow just pass though theese requests ...
6
votes
1answer
161 views

How SSL/TLS handshake happens when we use Cloudflare Service?

I was reading about the offerings of the Cloudflare and then I read about the working of Cloudflare. Based on my understanding, the domain name of my website(alice.com) is resolved to the IP address ...
1
vote
0answers
23 views

Concerns when passing all OPTIONS requests through authorization proxy gateway

I have a React based application which uses RESTful services on backend distributed on private network. To communicate with such services using AJAX, client application sends all its request through ...
0
votes
1answer
61 views

How to capture HTTP Traffic if the application uses Automatic Configuration Script?

I am testing an application that requires "Automatic configuration script" to be configured in web browser. How can i intercept HTTP traffic in such case. I am aware of temper data add-on but is ...
0
votes
1answer
113 views

POST Request to Server

Assume that a user logged in to a webpage with their own account, then makes a POST request and captures it. With some modification to the captured request, it is being executed. Sure. It goes through ...
0
votes
1answer
2k views

Node.js http-proxy-middleware: secure connection between servers

I have a back-end and a front-end application which are running on two different servers (hosts). To prevent using CORS and simplify the communication, I would like to serve the static front-end with ...
1
vote
1answer
64 views

Server is returning an unrecognized error message?

I've received reports of a strange error message (over HTTPS) that is not a part of my web application. The only thing I can think of is that it's coming from a proxy server. Is that possible? Can a ...
2
votes
0answers
255 views

AnalogX Proxy on Windows: Would it be possible to make it secured? [closed]

I am using AnalogX Proxy Server to share my internet connection, my question is, would it be possible or does this software supports authentication? I mean, connecting to the proxy will require login ...
1
vote
2answers
228 views

Monitor HTTP requests in a TLS transaction

I want to know if there is a way to monitor the size and time taken for an HTTP request in a TLS transaction using a proxy or other network traffic inspection tool. Note that I do not want to inspect ...
1
vote
2answers
249 views

Certificate chain differs depending upon what network I use to reach an app

We have built an application on Heroku.com for an enterprise customer, and when the customer reaches the site via their normal internal network, they get an SSL certificate warning in their browser, ...
7
votes
2answers
11k views

How does mobile free internet bypass works? (UBT / FBT)

I have encountered a mobile application named "HTTP Injector" which lets you get free internet access (UBT / FBT). The process to get it work and receive free internet seems to be as follows: ...
1
vote
0answers
317 views

ARP poisoning HTTP(S) mobile traffic

I'm working on a mobile app security test. This app communicates with a webservice and I'm trying to intercept the traffic between them. I've already accomplished this by setting my HTTP proxy as a ...
3
votes
1answer
741 views

Can I use CloudFlare if I want to avoid NSA and FISA secret orders? [closed]

We're running a web service in Europe, secured with TLS and we're using private keys generated on our private hardware. We would like to use CloudFlare for DDoS protection and caching reverse proxy. ...
0
votes
1answer
2k views

Proxying Requests through Python and Burpsuite not working

I have BurpSuite configured as a proxy. I have generated and installed a certificate for Burp in my Mac's keychain. On a Kali box I have also configured Iceweasel to proxy through my Burp Proxy ...
2
votes
1answer
20k views

Disable or bypass SSL Pinning/Certificate Pinning on Android 6.0.1

Previously I have been able to bypass SSL Pinning by using the program JustTrustMe with the Xposed framework for nearly every app. https://github.com/Fuzion24/JustTrustMe However it has started to ...
1
vote
0answers
539 views

How to export decrypted https traffic from mitm proxy

I am using mitm proxy in order to intercept https traffic to an android device and it seems to work great. I downloaded and installed the certificate from mitm.it when the android emulator's internet ...
0
votes
2answers
131 views

How can I see if a site supports HTTPS? [closed]

I have a classic C forking proxy in my LAN; now that I know "how to socket", I'd like to grant some privacy to it. For instance, the browser extension HTTPS Everywhere (from its Wikipedia page), ...
2
votes
2answers
473 views

Authentication helpers for tunneling through an HTTP proxy?

corkscrew is quite good for tunning SSH through an HTTP proxy. However, it only supports basic authentication. Have other people developed similar software supporting other types of authentications? ...
4
votes
1answer
7k views

Working of SSH connection through Proxy

I have to configure my web browser's proxy to 172.18.10.1:3128 every time I want to connect to internet from my college. Since I'm configuring a web browser's proxy, I believe that the proxy is a "...
1
vote
3answers
131 views

How does a router calculate the amount of data used per device?

I'm using WiFi of the firm I work for and they only allow an employee to use 30 GBs of data in a month. Now, based on the answer to this question, I wonder if I encrypt my traffic, would the firm ...
1
vote
1answer
838 views

Nmap through Burp ¿?

I know nmap and burp work at different levels, but in the same way, metasploit allows to set either an http or socks4 proxy, and I know and have used proxychains with Burp also. But what I want is to ...
0
votes
1answer
58 views

Block to record http requests using recorder

When I log into any website, I can record all calls while login using jmeter test script recorder or Burp suite but when I try to record calls from face book, it gives me following message on browser. ...
1
vote
1answer
3k views

Intercept traffic other than port 80 and 443 on burp suite

I am trying to intercept traffic on port 8000. For example my application is running on abc.com:8000. I am unable to intercept this traffic on burp suite. How can I intercept this traffic in Burp?
1
vote
1answer
69 views

Does a continuously freshly installed proxy server increase security?

If a small number of physical servers are used to run an OS and reverse proxy purely in RAM and have no storage, and they are rebooted/re-initiated in relay every X minutes - so that changes to the ...
0
votes
0answers
95 views

Is a proxy server using Squid / Squid Guard (or something similar) necessary if you're running a kiosk network?

When setting up a Kiosk network, one that you're using so that people can access a single website, shouldn't you use a proxy server that uses Squid or Squid Guard (or some sort of proxy) to limit the ...
12
votes
2answers
1k views

httpoxy - does TLS/SSL mitigate the vulnerability of HTTP Proxy header?

There's a new fancy-named, branded vulnerability called HTTPOXY. My question here: Are sites served via TLS also affected? Or is this an issue only for HTTP sites (unencrypted communication channel)? ...
1
vote
0answers
79 views

Making My Cache Work and Not Theirs: Blacklist for Blocking Caching Sites with Squidguard?

Is there a Squid Guard blacklist (assuming SSL decryption and inspection) that will block caching websites like Google Cache, Google Translate, and the Internet Wayback Machine?
1
vote
1answer
77 views

Is it possible to lock down the http / https proxy settings on a Windows Phone?

Is there any way to lock down the proxy settings on a Windows Phone so that they can't be changed by anyone but the person with the password?
1
vote
1answer
91 views

Is it possible to lock down the http / https proxy settings on an Android phone?

Is there any way to lock down the proxy settings on an Android Phone so that they can't be changed by anyone but the person with the password?
1
vote
1answer
293 views

Is it possible to lock down the http / https proxy settings on an iPhone?

Is there any way to lock down the proxy settings on an iPhone so that they can't be changed by anyone but the person with the password?
2
votes
1answer
269 views

How does firewall differentiate between browsing and downloading?

The firewall installed at my college's router allows me to surf the internet but never allows me to download any package that has a size more than 100mb. I wonder how exactly does it differentiate ...
3
votes
1answer
696 views

Prevent external script from loading using Burp

I am using free edition of Burp Suite to analyze some requests. Suppose, website is https://www.example.com. Now, there is a javascript file in https://www.example.com/templates/scripts/xyz.js. I ...
1
vote
1answer
4k views

Is it possible to utilize an outbound proxy to upgrade to TLS

Given a situation where legacy technology exists from a system and we don't want to do a complete upgrade (.net in this case w/ version that doesn't have any support for TLS 1.1/1.2) as the product ...
5
votes
3answers
2k views

Reverse Proxy + WAF

AS part of network design, I am implementing a HTTP Reverse proxy as well as a WAF. The HTTP Proxy, I am thinking about terminating SSL, on either the outer firewall - so the WAF can insect the layer ...