Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [http-proxy]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
32 views

Bettercap not detecting HTTPS websites (?)

The built-in sslstripping feature (http.proxy.sslstrip) in bettercap is not working against HTTPS websites in this issue I will be using cygwin.com and winzip.com as an example, as we can see they are ...
LuckyCoder3607's user avatar
0 votes
3 answers
251 views

Using HTTP header to transmit client certificate for mTLS

My client says their API traffic must take the path WAF -> Custom Firewall -> Backend API. Also, mTLS must be terminated after the traffic has gone through the network appliance. I have created ...
chriaass's user avatar
  • 101
0 votes
0 answers
136 views

PCI-DSS Compliance: SSL Tunneling Credit Card Information Through A HTTPS Mobile/Residential Proxy Service to A Destination Service

If a PCI compliant service decides to SSL-Tunnel credit card information via an independent residential/mobile proxy service to a destination payment service, would this protocol still be PCI ...
chukky arinze's user avatar
0 votes
1 answer
108 views

Any (opensource) tool that we can use to detect if our computers has been installed applications that have proxies services

Read something like this on reddit "someone can also be a regular user who does not read terms and conditions of apps that they install. Some apps might include code that will enable them to run ...
Maxfield's user avatar
  • 156
0 votes
2 answers
184 views

Can a WAF transform HTTP response

I have hit a conceptual roadblock here and, to be honest, do not really have a lot of experience with WAFs or firewalls in general. (I did go through this very nice explanation to get upto speed with ...
qre0ct's user avatar
  • 1,522
2 votes
1 answer
2k views

Can a HTTP proxy see HTTPS traffic?

I was checking some things with the (Chromium) inspect tool and I saw that if you go to the 'Network' section the IP address wasn't the actual DNS A (IPv4) or AAAA (IPv6) IP address but the Proxy IP ...
The Bad One's user avatar
1 vote
1 answer
670 views

What can evil HTTP proxy do, when using HTTPS?

I am connecting to a HTTPS service with SSL through a HTTP (not HTTPS) proxy. I am using Chrome/Firefox proxy settings. (Chrome does not directly expose them, but it can be set via chrome extension or ...
Karel Bílek's user avatar
0 votes
1 answer
335 views

Browser Corporate Proxy - Intranet vs Internet

Most corporations have a forward proxy to channel all traffic from devices on the intranet to the internet, for various security reasons. When the device is on the internet, I suppose the proxy is not ...
Nemophile's user avatar
1 vote
1 answer
694 views

SNI leakage prevention with proxy

In TLS 1.2 / HTTP(S) context, plaintext target hostname could potentially leak in 3 different ways: In DNS query prior to TCP/TLS/HTTP connection. In TLS handshake, ClientHello message, in SNI ...
user avatar
0 votes
1 answer
441 views

Does Forcepoint Security Manager 8.5 (WebSense) allows SFTP petitions?

Can I use Forcepoint Security Manager 8.5 (WebSense) as an http proxy for my SFTP client connections to external Servers? Currently when doing http requests I'm able to specify an http proxy to fetch ...
user1261620's user avatar
0 votes
1 answer
127 views

Online platform control (proxy)

To connect to the online platform of the company I work for, I have to use a proxy. Is it possible for the person responsible for this platform to check if I am currently using other programs in ...
Dorboni's user avatar
1 vote
0 answers
725 views

Basic authentication after mTLS?

I work for a software company and I'm currently doing research for an enhancement request. Essentially we have a application client which talks to a rest end point which is authenticated using basic ...
Errol Neal's user avatar
2 votes
1 answer
213 views

Whats the point in setting up an open proxy?

Decided to have a look at a list of "open" proxies. I've noticed that a good deal of these proxies are on residential IPs. One of the IPs, 68.188.59.198, is owned by Charter Communications ...
x43's user avatar
  • 203
1 vote
0 answers
576 views

Should I strip the "Origin" header from client requests?

I'm trying to setup an nginx reverse proxy to a web product I can't modify (it's an appliance). Client --> https://myapp.com --> nginx --> https://10.1.5.9 I managed to do so, but it ...
AoA's user avatar
  • 11
2 votes
0 answers
140 views

http smuglling how can i do a poc in a big websites?

i try to find http smuggling in big bug bouny program if i send this to the server POST /path HTTP/1.1 Host: subdomain.domain.com User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 ...
eyal's user avatar
  • 73
1 vote
1 answer
345 views

Is it possible to completely obfuscate proxy servers?

Stripe's fraud detection documentation claims it has Proxy Detection When I search for how it might be detecting traffic from proxies, I see this great answer, which show how to detect that traffic. ...
stevec's user avatar
  • 1,280
1 vote
2 answers
2k views

What does using a VPN offers over HTTPS + DoH in terms of protection?

What are the security risks that someone using HTTPS (everywhere) + DoH is vulnerable to, comparing to someone using a "trusted" VPN?
Luis Vasconcellos's user avatar
1 vote
1 answer
868 views

Is it worth using an http proxy?

Sorry for my lack of terminology in the field, that's something I've little (or none any) practical knowledge about. I've browsed similar questions on the security risks of using (web) proxies, but ...
Fat32's user avatar
  • 113
10 votes
1 answer
2k views

Is basic HTTP proxy authentication secure?

I have been looking for cloud based proxies, and I notice that it's very common to authenticate to a proxy using basic auth over an unencrypted connection. I don't understand why this is considered ...
William Rosenbloom's user avatar
0 votes
1 answer
324 views

Is it possible to view the cipher suites offered on my behalf by a MITM proxy?

I'm trying to discover what cipher suites are being offered by my corporate proxy. It's set up as a man in the middle so my "secure" connections are to it, and it attempts to create a ...
Disbeliever's user avatar
2 votes
3 answers
3k views

Intercept HTTP Traffic of an android app?

I was trying to test and intercept traffic from an app developed on Rhodes open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can ...
hanan's user avatar
  • 131
0 votes
1 answer
3k views

Verifying client certificate by passing client cert in the header

I'm implementing client certificate authentication. My server is behind a proxy to which I have no control of. And also I don't have any control over the client side communication. During every ...
user1234's user avatar
1 vote
0 answers
135 views

Can server-side caching misconfiguration lead to stolen logins?

If a webapp sends Cache-Control: private it shouldn't be cached for example with nginx proxy_cache. What could happen if it was cached anyhow? Could another visitor see the personalized login of ...
adrelanos's user avatar
  • 764
0 votes
0 answers
512 views

Burp not intercepting live video stream

I have set up Burp proxy to intercept requests of an Android app. I am able to intercept app API calls except for live video streams. I am not aware of how the video stream is implemented but assuming ...
Shashwat Kumar's user avatar
0 votes
0 answers
811 views

Monitor HTTPS URL logging of a specific device of a Network

Goal The main goal is to monitor all the URL logging (HTTPS) of a specific device in my Network. So I’m decided to buy a Security tool WifiPineApple from Hak5 store. Ex. Alexa, Chromecast, and maybe ...
code-8's user avatar
  • 125
1 vote
1 answer
2k views

Private ip address revealed by nginx, should I worry?

I run nikto on a server, let's say www.example.com and it says the following: OSVDB-630: The web server may reveal its internal or real IP in the Location header via a request to / over HTTP/1.0. ...
sebelk's user avatar
  • 509
1 vote
0 answers
669 views

A mesh of Cookie in Header & HttpOnly token - secure "enough"?

This is another attempt of mine to make sense of securing my web-app, which is built with two frameworks: Django REST API - serves as the backend. It generates both a token upon correct login, and a ...
zerohedge's user avatar
  • 135
3 votes
3 answers
794 views

Is it possible to scan the whole IP range to find a domain behind the CDN?

I am very curious if it is possible to find the real IP address of a domain "protected" by a CDN service. For example, www.cnn.com uses Fastly service, and the domain name only resolves to a Fastly ...
SamTest's user avatar
  • 715
2 votes
0 answers
1k views

How can I proxy traffic of macOS Mojave APPS using Burp Suite?

If I do a web search for proxying macOS apps using Burp Suite, I don't get any useful info. Instead, I get dozens of results talking about how to proxy iOS or Android apps. I am talking about desktop ...
the_endian's user avatar
  • 1,179
2 votes
1 answer
444 views

Is there a difference between editing HTTP messages manually or with burp for example? (WebGoat HTTP intercept exercise "problem")

I am diving now into WebGoat, there's this little exercise in the "general" tab calle d "http proxies" which asks you to use zap/burp to intercept and modify a request, this is what is being us asked. ...
Iván's user avatar
  • 23
1 vote
0 answers
264 views

Am i being MITMed?

Lately i was experiencing weird behavour from some big websites. More specifically, when i normally tried to connect to facebook, i would be greeted with this login page: I have placed these with ...
user1584421's user avatar
2 votes
0 answers
133 views

Benefit of authentication with a gateway

Given... a public web service with enabled SSL/TLS the web service enforces authentication using JSON Web Tokens a client on a LAN without an Internet connection a proxy on the LAN that grants point-...
Reiner Rottmann's user avatar
2 votes
1 answer
180 views

Secure GET-based remote API access via PHP

I am programming a way in PHP for my users to be able to access a remote API though my website. I was wondering if any of you had some input on whether or not this was secure (NOT considering any ...
xorist's user avatar
  • 870
1 vote
2 answers
1k views

Is it possible to tunnel my whole linux machine through http proxy? [closed]

For some reason i access my internet through a HTTP proxy. Is there a way to tunnel my whole Linux machine (currently am using ubuntu 18.04) through http proxy. If i change proxy setting in the ...
xaander1's user avatar
  • 113
1 vote
2 answers
6k views

SSL handshake not visible in Wireshark

In my organization we have a cloud proxy that work on a loopback address. The vendor of this proxy has deployed an app on our machine which listens on the loopback address. I have captured the apps ...
Shashank Kumar's user avatar
3 votes
1 answer
1k views

SSL MITM Proxy Security - Can we rely on it?

In my organization, we have an SSL MITM (Man-in-the-middle) proxy (like ZScaler proxy). If I browse an HTTPS website and check the certificate, I can see that the proxy has issued a separate ...
SRaj's user avatar
  • 155
1 vote
1 answer
242 views

Is this a threat if website to connect to is in clear in the TLS SNI extension or when using an HTTP proxy?

As per my understanding, after the TCP three-way handshake we send a TLS ClientHello which has the SNI field in clear text and anyone can see which website I am trying to connect to. Isn't it a ...
Shashank Kumar's user avatar
0 votes
0 answers
693 views

Can charles proxy (with root cert installed) intercept and read all traffic between mobile app and server? [duplicate]

I have a mobile app that queries various 3rd party API/sites (these are https links). I have a concern that SSL proxies (e.g. Charles) can be used to intercept the traffic - man in the middle. Are ...
Architect 's user avatar
1 vote
1 answer
352 views

URL rewrite spoofable

I am considering using URL rewrites in kubernetes nginx proxy to publish selected context paths in microservices which are run in a cluster running internal services. For example https://public....
Gudlaugur Egilsson's user avatar
2 votes
1 answer
546 views

Why isn't an Expect-CT violation report sent when I use a certificate generated with Burp Suite?

I wanted to test the Expect-CT security header. So I searched for sites and found that LinkedIn uses the Expect-CT header: Expect-CT: max-age=86400, report-uri="https://www.linkedin.com/platform-...
Ivanov's user avatar
  • 21
0 votes
2 answers
3k views

CORS Anywhere to bypass CSRF protection

CORS Anywhere helps with accessing data from other websites that is normally forbidden by the Same origin policy of Web browsers. Can CORS Anywhere be used to bypass CSRF protection? Reason to ask ...
user11177344's user avatar
0 votes
2 answers
144 views

Why do we have to specify HTTP proxy specs when inside a LAN that is behind a proxy server?

Following this post, outgoing traffic will go through the proxy only if the requesting app knows the proxy url, if it doesn't then sending the request out of the LAN is denied by the proxy. In this ...
ThCollignon's user avatar
0 votes
1 answer
2k views

Defeating proxy using hosts file

I had somebody say that it would be possible to defeat any http proxy url blocking, "by editing the hosts file and so that some whitelisted site maps to an IP address they control, with a server set ...
DarcyThomas's user avatar
  • 1,298
0 votes
0 answers
113 views

Preventing admin from changing proxy settings

I am using a proxy server for my environment deployed on premises for internal hosts and on the cloud from BYOD. When a user takes their device off the premises, the proxy changes to an external proxy ...
Hammad Qureshi's user avatar
0 votes
2 answers
198 views

Why is the SSL message red?

The site Phonel.ir uses a SSL certificate. Why is the Error message in red? Is there a problem with the SSL certification? I sometimes use a proxy. Can that be the reason?
Turaj's user avatar
  • 3
0 votes
1 answer
442 views

https: Is my company connection intercepted?

I wanted to find out whether my company can see what I'm posting online as soon as using websites using a valid https certificate. I know there are a lot of posts here about whether my company can ...
tim's user avatar
  • 851
2 votes
1 answer
2k views

Bettercap 2.x SSLStrip Is Not Converting Links

I have the latest version of bettercap. I have the latest version of Kali Linux using the latest version of VirtualBox on the latest version of Windows 10. My target machine is the latest version of ...
user21303's user avatar
  • 163
2 votes
3 answers
14k views

Bettercap 2.x SSLStrip Is Not Breaking TLS (Without HSTS)

I have the latest version of bettercap. I have the latest version of Kali linux using the latest version of VirtualBox on the latest version of Windows 10. My target machine is the lowest possible ...
user21303's user avatar
  • 163
1 vote
1 answer
651 views

ESNI (Encrypted Server Network Identification) with HTTP CONNECT (HTTP Proxy)

Regarding ESNI RFC (https://datatracker.ietf.org/doc/html/draft-ietf-tls-esni-02) it copes with many possible security vulnerabilities. However I'm interested how is it supposed to prevent ...
lukyer's user avatar
  • 111
2 votes
1 answer
399 views

Protect app from Http Proxy like Charles [duplicate]

I am using https request for web API in my app. But I know Charles allowed to access https request also, via install root certificates on device. So, someone downloaded the app from PlayStore and ...
Pramod Tapaniya's user avatar