Questions tagged [http-proxy]
The http-proxy tag has no usage guidance.
0
votes
1answer
35 views
Bettercap 2.x SSLStrip Is Not Converting Links
I posted this before. I am creating a new post because of all the changes I would need to [edit] out.
I have the latest version of bettercap. I have the latest version of Kali Linux using the latest ...
1
vote
1answer
43 views
Bettercap 2.x SSLStrip Is Not Breaking TLS (Without HSTS)
I have the latest version of bettercap. I have the latest version of Kali linux using the latest version of VirtualBox on the latest version of Windows 10. My target machine is the lowest possible ...
1
vote
1answer
22 views
ESNI (Encrypted Server Network Identification) with HTTP CONNECT (HTTP Proxy)
Regarding ESNI RFC (https://tools.ietf.org/html/draft-ietf-tls-esni-02) it copes with many possible security vulnerabilities. However I'm interested how is it supposed to prevent confidential ...
1
vote
1answer
37 views
Protect app from Http Proxy like Charles [duplicate]
I am using https request for web API in my app. But I know Charles allowed to access https request also, via install root certificates on device. So, someone downloaded the app from PlayStore and ...
0
votes
2answers
50 views
How does proxylist sites discover new proxy?
I always got proxies from proxylist websites but I never asked me how these sites discover new proxy. So how?
-1
votes
1answer
197 views
Risk in having the PAC file in a server with no authorisation
So basically I’ve put my PAC-file under a non-secure web server with no authentication whatsoever in my organization. Later, I found out that there have been many attacks using this file type in other ...
5
votes
2answers
1k views
Would a reverse-proxy authentication server be a secure setup?
I work at a small consultancy and we often make web apps for our clients. One part of the web app that is often repetitive to write is the authentication system. In a lot of our web apps we would ...
4
votes
2answers
532 views
Burpsuite: just passthrough firefox detect portal
When I enable Burpsuite's Proxy I continiously get http GET requests for firefox's detectportal as seen in the following image:
How I can configure it to somehow just pass though theese requests ...
6
votes
1answer
124 views
How SSL/TLS handshake happens when we use Cloudflare Service?
I was reading about the offerings of the Cloudflare and then I read about the working of Cloudflare.
Based on my understanding, the domain name of my website(alice.com) is resolved to the IP address ...
1
vote
0answers
21 views
Concerns when passing all OPTIONS requests through authorization proxy gateway
I have a React based application which uses RESTful services on backend distributed on private network. To communicate with such services using AJAX, client application sends all its request through ...
0
votes
1answer
55 views
How to capture HTTP Traffic if the application uses Automatic Configuration Script?
I am testing an application that requires "Automatic configuration script" to be configured in web browser.
How can i intercept HTTP traffic in such case. I am aware of temper data add-on but is ...
0
votes
1answer
94 views
POST Request to Server
Assume that a user logged in to a webpage with their own account, then makes a POST request and captures it. With some modification to the captured request, it is being executed. Sure. It goes through ...
0
votes
1answer
1k views
Node.js http-proxy-middleware: secure connection between servers
I have a back-end and a front-end application which are running on two different servers (hosts). To prevent using CORS and simplify the communication, I would like to serve the static front-end with ...
1
vote
1answer
62 views
Server is returning an unrecognized error message?
I've received reports of a strange error message (over HTTPS) that is not a part of my web application. The only thing I can think of is that it's coming from a proxy server. Is that possible? Can a ...
1
vote
0answers
201 views
AnalogX Proxy on Windows: Would it be possible to make it secured? [closed]
I am using AnalogX Proxy Server to share my internet connection, my question is, would it be possible or does this software supports authentication? I mean, connecting to the proxy will require login ...
0
votes
0answers
105 views
How to generate / sign ssl certificate for intermediate proxy
I am developing an intermediate http proxy in Ubuntu 14, and I use gnutls for tls/ssl.
So far I am able to access any http sites, one side browser, then my intermediate proxy and other side original ...
1
vote
2answers
166 views
Monitor HTTP requests in a TLS transaction
I want to know if there is a way to monitor the size and time taken for an HTTP request in a TLS transaction using a proxy or other network traffic inspection tool. Note that I do not want to inspect ...
1
vote
2answers
237 views
Certificate chain differs depending upon what network I use to reach an app
We have built an application on Heroku.com for an enterprise customer, and when the customer reaches the site via their normal internal network, they get an SSL certificate warning in their browser, ...
7
votes
2answers
7k views
How does mobile free internet bypass works? (UBT / FBT)
I have encountered a mobile application named "HTTP Injector" which lets you get free internet access (UBT / FBT).
The process to get it work and receive free internet seems to be as follows:
...
1
vote
0answers
286 views
ARP poisoning HTTP(S) mobile traffic
I'm working on a mobile app security test. This app communicates with a webservice and I'm trying to intercept the traffic between them.
I've already accomplished this by setting my HTTP proxy as a ...
3
votes
1answer
568 views
Can I use CloudFlare if I want to avoid NSA and FISA secret orders? [closed]
We're running a web service in Europe, secured with TLS and we're using private keys generated on our private hardware.
We would like to use CloudFlare for DDoS protection and caching reverse proxy.
...
0
votes
1answer
1k views
Proxying Requests through Python and Burpsuite not working
I have BurpSuite configured as a proxy. I have generated and installed a certificate for Burp in my Mac's keychain. On a Kali box I have also configured Iceweasel to proxy through my Burp Proxy ...
2
votes
1answer
16k views
Disable or bypass SSL Pinning/Certificate Pinning on Android 6.0.1
Previously I have been able to bypass SSL Pinning by using the program JustTrustMe with the Xposed framework for nearly every app.
https://github.com/Fuzion24/JustTrustMe
However it has started to ...
1
vote
0answers
453 views
How to export decrypted https traffic from mitm proxy
I am using mitm proxy in order to intercept https traffic to an android device and it seems to work great. I downloaded and installed the certificate from mitm.it when the android emulator's internet ...
0
votes
2answers
115 views
How can I see if a site supports HTTPS? [closed]
I have a classic C forking proxy in my LAN; now that I know "how to socket", I'd like to grant some privacy to it.
For instance, the browser extension HTTPS Everywhere (from its Wikipedia page),
...
2
votes
2answers
426 views
Authentication helpers for tunneling through an HTTP proxy?
corkscrew is quite good for tunning SSH through an HTTP proxy. However, it only supports basic authentication. Have other people developed similar software supporting other types of authentications? ...
3
votes
1answer
5k views
Working of SSH connection through Proxy
I have to configure my web browser's proxy to 172.18.10.1:3128 every time I want to connect to internet from my college. Since I'm configuring a web browser's proxy, I believe that the proxy is a "...
1
vote
3answers
129 views
How does a router calculate the amount of data used per device?
I'm using WiFi of the firm I work for and they only allow an employee to use 30 GBs of data in a month. Now, based on the answer to this question, I wonder if I encrypt my traffic, would the firm ...
1
vote
1answer
577 views
Nmap through Burp ¿?
I know nmap and burp work at different levels, but in the same way, metasploit allows to set either an http or socks4 proxy, and I know and have used proxychains with Burp also.
But what I want is to ...
0
votes
1answer
56 views
Block to record http requests using recorder
When I log into any website, I can record all calls while login using jmeter test script recorder or Burp suite but when I try to record calls from face book, it gives me following message on browser.
...
1
vote
1answer
2k views
Intercept traffic other than port 80 and 443 on burp suite
I am trying to intercept traffic on port 8000. For example my application is running on abc.com:8000. I am unable to intercept this traffic on burp suite. How can I intercept this traffic in Burp?
1
vote
1answer
69 views
Does a continuously freshly installed proxy server increase security?
If a small number of physical servers are used to run an OS and reverse proxy purely in RAM and have no storage, and they are rebooted/re-initiated in relay every X minutes - so that changes to the ...
0
votes
0answers
89 views
Is a proxy server using Squid / Squid Guard (or something similar) necessary if you're running a kiosk network?
When setting up a Kiosk network, one that you're using so that people can access a single website, shouldn't you use a proxy server that uses Squid or Squid Guard (or some sort of proxy) to limit the ...
12
votes
2answers
1k views
httpoxy - does TLS/SSL mitigate the vulnerability of HTTP Proxy header?
There's a new fancy-named, branded vulnerability called HTTPOXY.
My question here: Are sites served via TLS also affected? Or is this an issue only for HTTP sites (unencrypted communication channel)?
...
1
vote
0answers
77 views
Making My Cache Work and Not Theirs: Blacklist for Blocking Caching Sites with Squidguard?
Is there a Squid Guard blacklist (assuming SSL decryption and inspection) that will block caching websites like Google Cache, Google Translate, and the Internet Wayback Machine?
1
vote
1answer
71 views
Is it possible to lock down the http / https proxy settings on a Windows Phone?
Is there any way to lock down the proxy settings on a Windows Phone so that they can't be changed by anyone but the person with the password?
1
vote
1answer
80 views
Is it possible to lock down the http / https proxy settings on an Android phone?
Is there any way to lock down the proxy settings on an Android Phone so that they can't be changed by anyone but the person with the password?
1
vote
1answer
246 views
Is it possible to lock down the http / https proxy settings on an iPhone?
Is there any way to lock down the proxy settings on an iPhone so that they can't be changed by anyone but the person with the password?
3
votes
1answer
195 views
How does firewall differentiate between browsing and downloading?
The firewall installed at my college's router allows me to surf the internet but never allows me to download any package that has a size more than 100mb. I wonder how exactly does it differentiate ...
2
votes
0answers
529 views
Prevent external script from loading using Burp
I am using free edition of Burp Suite to analyze some requests. Suppose, website is https://www.example.com.
Now, there is a javascript file in https://www.example.com/templates/scripts/xyz.js. I ...
1
vote
1answer
3k views
Is it possible to utilize an outbound proxy to upgrade to TLS
Given a situation where legacy technology exists from a system and we don't want to do a complete upgrade (.net in this case w/ version that doesn't have any support for TLS 1.1/1.2) as the product ...
5
votes
3answers
1k views
Reverse Proxy + WAF
AS part of network design, I am implementing a HTTP Reverse proxy as well as a WAF.
The HTTP Proxy, I am thinking about terminating SSL, on either the outer firewall - so the WAF can insect the layer ...
-1
votes
1answer
343 views
proxies do not render HTTPS pages with javascript correctly [closed]
In technical terms, how come all proxies fail to display https pages (e.g. Facebook) correctly? The use of javascript is almost always disabled. The problem is in https? Can someone technically ...
9
votes
3answers
2k views
Are future TLS versions going to prevent traffic inspection?
Nowadays it is possible to inspect (unencrypt) TLS (HTTPS) traffic inside an organization. The mechanism consists in using a root CA that is configured in the web client and a network device that ...
7
votes
1answer
156 views
Restricting access to “hacking” sites and tools
I tried following a link from a post on this site and discovered that insecure.org is blocked by our internet proxy.
What are the potential benefits and risks of allowing access to such sites to ...
6
votes
1answer
880 views
How do Lync and SSL inspection play together?
Whitelisting all Lync hostnames is cumbersome. Globally deactivating SSL inspection is undesirable.
At a place I work for, they have SSL-inspection enabled on their proxy. All traffic to the Internet ...
3
votes
1answer
345 views
HTTP Response splitting - is it browser caching or server caching issue?
I am trying to wrap my head around HTTP Response splitting. Although using WebGoat etc. I was able to learn how to do it in practice, but I guess I am still confused with some very fundamental ...
0
votes
1answer
352 views
How to configure proxy settings of cellular internet for burp
I am pen testing an android app and using tethering to connect my phone to my laptop. I configured the access point settings as proxy = ipv4 address of my laptop and port = port on which burp is ...
10
votes
1answer
7k views
HTTP Caching Headers: private vs no-cache
We're currently reviewing our set of "no-cache" security headers:
Cache-Control "no-cache, no-store, must-revalidate
Pragma "no-cache"
Expires 0
Besides the "standard" set above, I found this ...
2
votes
3answers
1k views
How does Facebook really identify requests?
Today I have discovered something very strange. It seems like Facebook is playing some kind of unfair game for identifying one's online identity. So, here is what I have done: I have a regular ...
