Questions tagged [http-proxy]
The http-proxy tag has no usage guidance.
0
votes
1answer
37 views
Defeating proxy using hosts file
I had somebody say that it would be possible to defeat any http proxy url blocking, "by editing the hosts file and so that some whitelisted site maps to an IP address they control, with a server set ...
0
votes
0answers
25 views
Preventing admin from changing proxy settings
I am using a proxy server for my environment deployed on premises for internal hosts and on the cloud from BYOD. When a user takes their device off the premises, the proxy changes to an external proxy ...
0
votes
2answers
70 views
Why is the SSL message red?
The site Phonel.ir uses a SSL certificate. Why is the Error message in red? Is there a problem with the SSL certification?
I sometimes use a proxy. Can that be the reason?
0
votes
1answer
169 views
https: Is my company connection intercepted?
I wanted to find out whether my company can see what I'm posting online as soon as using websites using a valid https certificate.
I know there are a lot of posts here about whether my company can ...
2
votes
1answer
237 views
Bettercap 2.x SSLStrip Is Not Converting Links
I posted this before. I am creating a new post because of all the changes I would need to [edit] out.
I have the latest version of bettercap. I have the latest version of Kali Linux using the latest ...
1
vote
3answers
471 views
Bettercap 2.x SSLStrip Is Not Breaking TLS (Without HSTS)
I have the latest version of bettercap. I have the latest version of Kali linux using the latest version of VirtualBox on the latest version of Windows 10. My target machine is the lowest possible ...
1
vote
1answer
80 views
ESNI (Encrypted Server Network Identification) with HTTP CONNECT (HTTP Proxy)
Regarding ESNI RFC (https://tools.ietf.org/html/draft-ietf-tls-esni-02) it copes with many possible security vulnerabilities. However I'm interested how is it supposed to prevent confidential ...
1
vote
1answer
42 views
Protect app from Http Proxy like Charles [duplicate]
I am using https request for web API in my app. But I know Charles allowed to access https request also, via install root certificates on device. So, someone downloaded the app from PlayStore and ...
0
votes
2answers
58 views
How does proxylist sites discover new proxy?
I always got proxies from proxylist websites but I never asked me how these sites discover new proxy. So how?
-1
votes
1answer
296 views
Risk in having the PAC file in a server with no authorisation
So basically I’ve put my PAC-file under a non-secure web server with no authentication whatsoever in my organization. Later, I found out that there have been many attacks using this file type in other ...
5
votes
2answers
2k views
Would a reverse-proxy authentication server be a secure setup?
I work at a small consultancy and we often make web apps for our clients. One part of the web app that is often repetitive to write is the authentication system. In a lot of our web apps we would ...
4
votes
2answers
956 views
Burpsuite: just passthrough firefox detect portal
When I enable Burpsuite's Proxy I continiously get http GET requests for firefox's detectportal as seen in the following image:
How I can configure it to somehow just pass though theese requests ...
6
votes
1answer
139 views
How SSL/TLS handshake happens when we use Cloudflare Service?
I was reading about the offerings of the Cloudflare and then I read about the working of Cloudflare.
Based on my understanding, the domain name of my website(alice.com) is resolved to the IP address ...
1
vote
0answers
22 views
Concerns when passing all OPTIONS requests through authorization proxy gateway
I have a React based application which uses RESTful services on backend distributed on private network. To communicate with such services using AJAX, client application sends all its request through ...
0
votes
1answer
59 views
How to capture HTTP Traffic if the application uses Automatic Configuration Script?
I am testing an application that requires "Automatic configuration script" to be configured in web browser.
How can i intercept HTTP traffic in such case. I am aware of temper data add-on but is ...
0
votes
1answer
97 views
POST Request to Server
Assume that a user logged in to a webpage with their own account, then makes a POST request and captures it. With some modification to the captured request, it is being executed. Sure. It goes through ...
0
votes
1answer
1k views
Node.js http-proxy-middleware: secure connection between servers
I have a back-end and a front-end application which are running on two different servers (hosts). To prevent using CORS and simplify the communication, I would like to serve the static front-end with ...
1
vote
1answer
62 views
Server is returning an unrecognized error message?
I've received reports of a strange error message (over HTTPS) that is not a part of my web application. The only thing I can think of is that it's coming from a proxy server. Is that possible? Can a ...
2
votes
0answers
222 views
AnalogX Proxy on Windows: Would it be possible to make it secured? [closed]
I am using AnalogX Proxy Server to share my internet connection, my question is, would it be possible or does this software supports authentication? I mean, connecting to the proxy will require login ...
0
votes
0answers
114 views
How to generate / sign ssl certificate for intermediate proxy
I am developing an intermediate http proxy in Ubuntu 14, and I use gnutls for tls/ssl.
So far I am able to access any http sites, one side browser, then my intermediate proxy and other side original ...
1
vote
2answers
186 views
Monitor HTTP requests in a TLS transaction
I want to know if there is a way to monitor the size and time taken for an HTTP request in a TLS transaction using a proxy or other network traffic inspection tool. Note that I do not want to inspect ...
1
vote
2answers
240 views
Certificate chain differs depending upon what network I use to reach an app
We have built an application on Heroku.com for an enterprise customer, and when the customer reaches the site via their normal internal network, they get an SSL certificate warning in their browser, ...
7
votes
2answers
8k views
How does mobile free internet bypass works? (UBT / FBT)
I have encountered a mobile application named "HTTP Injector" which lets you get free internet access (UBT / FBT).
The process to get it work and receive free internet seems to be as follows:
...
1
vote
0answers
297 views
ARP poisoning HTTP(S) mobile traffic
I'm working on a mobile app security test. This app communicates with a webservice and I'm trying to intercept the traffic between them.
I've already accomplished this by setting my HTTP proxy as a ...
3
votes
1answer
627 views
Can I use CloudFlare if I want to avoid NSA and FISA secret orders? [closed]
We're running a web service in Europe, secured with TLS and we're using private keys generated on our private hardware.
We would like to use CloudFlare for DDoS protection and caching reverse proxy.
...
0
votes
1answer
1k views
Proxying Requests through Python and Burpsuite not working
I have BurpSuite configured as a proxy. I have generated and installed a certificate for Burp in my Mac's keychain. On a Kali box I have also configured Iceweasel to proxy through my Burp Proxy ...
2
votes
1answer
17k views
Disable or bypass SSL Pinning/Certificate Pinning on Android 6.0.1
Previously I have been able to bypass SSL Pinning by using the program JustTrustMe with the Xposed framework for nearly every app.
https://github.com/Fuzion24/JustTrustMe
However it has started to ...
1
vote
0answers
477 views
How to export decrypted https traffic from mitm proxy
I am using mitm proxy in order to intercept https traffic to an android device and it seems to work great. I downloaded and installed the certificate from mitm.it when the android emulator's internet ...
0
votes
2answers
115 views
How can I see if a site supports HTTPS? [closed]
I have a classic C forking proxy in my LAN; now that I know "how to socket", I'd like to grant some privacy to it.
For instance, the browser extension HTTPS Everywhere (from its Wikipedia page),
...
2
votes
2answers
443 views
Authentication helpers for tunneling through an HTTP proxy?
corkscrew is quite good for tunning SSH through an HTTP proxy. However, it only supports basic authentication. Have other people developed similar software supporting other types of authentications? ...
3
votes
1answer
6k views
Working of SSH connection through Proxy
I have to configure my web browser's proxy to 172.18.10.1:3128 every time I want to connect to internet from my college. Since I'm configuring a web browser's proxy, I believe that the proxy is a "...
1
vote
3answers
129 views
How does a router calculate the amount of data used per device?
I'm using WiFi of the firm I work for and they only allow an employee to use 30 GBs of data in a month. Now, based on the answer to this question, I wonder if I encrypt my traffic, would the firm ...
1
vote
1answer
649 views
Nmap through Burp ¿?
I know nmap and burp work at different levels, but in the same way, metasploit allows to set either an http or socks4 proxy, and I know and have used proxychains with Burp also.
But what I want is to ...
0
votes
1answer
56 views
Block to record http requests using recorder
When I log into any website, I can record all calls while login using jmeter test script recorder or Burp suite but when I try to record calls from face book, it gives me following message on browser.
...
1
vote
1answer
2k views
Intercept traffic other than port 80 and 443 on burp suite
I am trying to intercept traffic on port 8000. For example my application is running on abc.com:8000. I am unable to intercept this traffic on burp suite. How can I intercept this traffic in Burp?
1
vote
1answer
69 views
Does a continuously freshly installed proxy server increase security?
If a small number of physical servers are used to run an OS and reverse proxy purely in RAM and have no storage, and they are rebooted/re-initiated in relay every X minutes - so that changes to the ...
0
votes
0answers
89 views
Is a proxy server using Squid / Squid Guard (or something similar) necessary if you're running a kiosk network?
When setting up a Kiosk network, one that you're using so that people can access a single website, shouldn't you use a proxy server that uses Squid or Squid Guard (or some sort of proxy) to limit the ...
12
votes
2answers
1k views
httpoxy - does TLS/SSL mitigate the vulnerability of HTTP Proxy header?
There's a new fancy-named, branded vulnerability called HTTPOXY.
My question here: Are sites served via TLS also affected? Or is this an issue only for HTTP sites (unencrypted communication channel)?
...
1
vote
0answers
78 views
Making My Cache Work and Not Theirs: Blacklist for Blocking Caching Sites with Squidguard?
Is there a Squid Guard blacklist (assuming SSL decryption and inspection) that will block caching websites like Google Cache, Google Translate, and the Internet Wayback Machine?
1
vote
1answer
72 views
Is it possible to lock down the http / https proxy settings on a Windows Phone?
Is there any way to lock down the proxy settings on a Windows Phone so that they can't be changed by anyone but the person with the password?
1
vote
1answer
82 views
Is it possible to lock down the http / https proxy settings on an Android phone?
Is there any way to lock down the proxy settings on an Android Phone so that they can't be changed by anyone but the person with the password?
1
vote
1answer
262 views
Is it possible to lock down the http / https proxy settings on an iPhone?
Is there any way to lock down the proxy settings on an iPhone so that they can't be changed by anyone but the person with the password?
3
votes
1answer
202 views
How does firewall differentiate between browsing and downloading?
The firewall installed at my college's router allows me to surf the internet but never allows me to download any package that has a size more than 100mb. I wonder how exactly does it differentiate ...
3
votes
1answer
574 views
Prevent external script from loading using Burp
I am using free edition of Burp Suite to analyze some requests. Suppose, website is https://www.example.com.
Now, there is a javascript file in https://www.example.com/templates/scripts/xyz.js. I ...
1
vote
1answer
3k views
Is it possible to utilize an outbound proxy to upgrade to TLS
Given a situation where legacy technology exists from a system and we don't want to do a complete upgrade (.net in this case w/ version that doesn't have any support for TLS 1.1/1.2) as the product ...
5
votes
3answers
1k views
Reverse Proxy + WAF
AS part of network design, I am implementing a HTTP Reverse proxy as well as a WAF.
The HTTP Proxy, I am thinking about terminating SSL, on either the outer firewall - so the WAF can insect the layer ...
-1
votes
1answer
365 views
proxies do not render HTTPS pages with javascript correctly [closed]
In technical terms, how come all proxies fail to display https pages (e.g. Facebook) correctly? The use of javascript is almost always disabled. The problem is in https? Can someone technically ...
9
votes
3answers
2k views
Are future TLS versions going to prevent traffic inspection?
Nowadays it is possible to inspect (unencrypt) TLS (HTTPS) traffic inside an organization. The mechanism consists in using a root CA that is configured in the web client and a network device that ...
7
votes
1answer
157 views
Restricting access to “hacking” sites and tools
I tried following a link from a post on this site and discovered that insecure.org is blocked by our internet proxy.
What are the potential benefits and risks of allowing access to such sites to ...
6
votes
1answer
892 views
How do Lync and SSL inspection play together?
Whitelisting all Lync hostnames is cumbersome. Globally deactivating SSL inspection is undesirable.
At a place I work for, they have SSL-inspection enabled on their proxy. All traffic to the Internet ...
