Questions tagged [proxy]

The word "proxy" is mostly used as short for "proxy server", which is a server that acts as an intermediary between a workstation user and the Internet so that the enterprise can ensure security, administrative control, and caching service.

Filter by
Sorted by
Tagged with
0
votes
1answer
51 views

Application throwing 500 internal server error only when i use burp

I am performing a security testing on one application. It is throwing 500 internal server error when i intercept with burp proxy. It is working fine if i turn off the proxy. I have tried the ...
0
votes
0answers
55 views

How can I call an API that requires TLS 1.2 when my http client can only support TLS 1.0?

We have an application written in PLC Structured Text using the B&R Automation Studio. This application needs to send HTTP requests to an external API server that only supports TLS 1.2. According ...
1
vote
0answers
45 views

Securing a SOCKS5 to SSH Tunnel on Windows

In order to gain web access from the perspective of a remote device, it is very common to use the SOCKS5 to SSH Tunnel capability built into OpenSSH Client and Putty (detailed here). Both clients ...
0
votes
0answers
58 views

How to configure Burp Suite for traffic to/from Docker container? [closed]

I'm running https://github.com/OWASP/SecurityShepherd/wiki/Docker-Environment-Setup successfully in a container. However, this is only really useful if you can inspect the traffic. I have it (Burp ...
2
votes
1answer
50 views

Is it possible to detect the application level protocol in a TLS tunnel without interception?

Consider a proxy that doesn't intercept TLS, but allows CONNECT tunnelling, but only to limited ports (eg: 443 only). If someone runs an ssh server on port 443 and connects to it using CONNECT, would ...
-2
votes
1answer
62 views

How to “see” all the traffic that leaves my network [closed]

Here is my setup: Cable Modem >> ASA 5505 >>> LAN I want to be able to see all the traffic that leaves the network such as what websites are being visited, IP connections made, etc. I would like to ...
-1
votes
1answer
91 views

A Proxy that encrypts your data is the same thing as a VPN?

I have heard that a VPN encrypts your data but a proxy doesn't. So a proxy that encrypts your data is the same thing as a VPN?
1
vote
1answer
43 views

Reverse proxy isolation from insecure blog, are sessions vulnerable?

Hi I have a WebApp where security is important. E.g. www.somewebapp.com The app has a wordpress blog (hence not secure since wordpress). e.g. www.somewebapp.com/blog To protect the webapp from ...
0
votes
1answer
61 views

WPAD (badWPAD vulnerability) should I disable or not?

Hi I have read recently very bad things about WPAD vulnerability for example here nakedsecurity.sophos.com/2016/05/25/when-domain-names-attack-the-wpad-name-collision-vulnerability/ (article from ...
0
votes
0answers
73 views

How to listen to port 443 on BurpSuite [migrated]

I'm trying to set up an invisible proxy (using this guide). At some point in the guide it is said that I have to listen to the following interface: 127.0.0.1:443 Once set up, I'm not able to select ...
1
vote
0answers
44 views

mitmproxy request URL redirection does not work

I need to redirect the user's request in such a way when a user enters: https://a.com the mitmproxy redirect it to: https://www.newsite.com/?somepage From a previous post, I found this script in the ...
3
votes
2answers
481 views

Not able to intercept traffic from nike.com login request

I'm using BurpSuite to intercept the HTTP/HTTPS requests sent when logging in on https://www.nike.com/. I'm trying to achieve this with the following step: Opening BurpSuite and Firefox Turning on ...
-1
votes
1answer
70 views

mitmproxy: Error starting proxy server: OSError(98, 'Address already in use') [closed]

I just installed mitmproxy tool. I want to run it. Once I type: sudo mitmproxy I get this error: Error starting proxy server: OSError(98, 'Address already in use') I searched and found some ...
0
votes
1answer
47 views

Can a proxy server redirect traffic to malicious websites or modify downloads?

I was wondering if a proxy server from the internet could redirect traffic to malicious websites or download malware or even modify downloads( I do not plan on using a proxy server i found from the ...
0
votes
0answers
52 views

Using proxy over VPN?

If I setup a firefox browser with proxy settings, then I launch NordVPN, and start browsing through firefox with the proxy, will my data be encrypted? So in basic terms, will my proxy traffic also go ...
0
votes
2answers
164 views

Concept for (almost) untraceable networking setup

I have been working on an my digital footprint lately, trying to reduce it as much as possible, taking steps like fully encrypting my device with Veracrypt, installing 3 AVs, or spending hours trying ...
1
vote
2answers
138 views

How to locally monitor outgoing internet traffic?

I have a cable internet connection that goes to a ASA firewall and then into my local network where i have several machines including many VM's on a ESXI server. I am looking for a way to monitor ...
1
vote
1answer
76 views

What are the security implications of connecting to Tor through an SSH SOCKS proxy?

Suppose I have a user account on a remote server run by a friend. I create a SOCKS tunnel on my computer that forwards connections from a local port to the remote server: ssh -N -D 12345 john@10.1.1....
0
votes
1answer
91 views

Is it possible to browse HSTS sites over SOCKS5 proxy?

I am unable to browse HSTS websites using SOCKS5 proxy in chrome browser...getting this error... This site can’t be reached The web page at https://www.instagram.com/accounts/login/?hl=en might ...
0
votes
0answers
115 views

SSL handshake: Client Hello and Server Hello

I am trying to understand how a client communicates with a server when using a proxy. The client is an Android device, whom the traffic is proxied to the server through mitmproxy. This is my topology:...
0
votes
0answers
32 views

How can I forward SaaS calls from the client to a third-party service?

In the browser (e.g., for mysite.com) there is Javascript for third-party services, say somesaas.com. Let's say that I rewrite the Javascript so that it calls https://proxy.mysite.com instead of ...
0
votes
1answer
62 views

Is using a VPN or Proxy the only explanation for a wrong location being displayed?

My boyfriend is using an iPhone XS Max. He is in Johor, Malaysia, but his last active session displays that he is in Kuala Lumpur. He told me that he is in Johor, and he said the only reason why it's ...
1
vote
0answers
59 views

How is Indonesia blocking images in e2ee applications?

Indonesia's minister in communication and informatics supposedly blocked the sending of images and videos through social media from 22nd May until 25th May, in order to prevent hoaxes from spreading ...
2
votes
1answer
72 views

Security implications of client TLS termination

I have a bunch of HTTP services/devices TLS unaware. I want to allow them to access WAN, but of course I do not want them to do it in plain HTTP. Updating them is unworkable due to legacy issues and ...
22
votes
2answers
5k views

If the Charles SSL Proxy shows me sensitive data, is that data insecure/exposed?

Today I was exploring a website used for keeping track of student grades and everything related to school. Basically like a school progress tracker for your child which is used by 90% of schools in my ...
0
votes
1answer
122 views

Router administration page is served over HTTP

My wireless router admin page does not include https option. It is always served over http. This is obviously a concern in case someone is sniffing the network and can read my password in plain text. ...
-1
votes
1answer
189 views

Detect Proxy and Tor exit nodes from an IP in python

I have a database (hadoop) of the users who access my website (their IPs) and i want to check if those users either use proxy networks or the TOR network and block them. I also want to differentiate ...
2
votes
2answers
161 views

Security Benefits of Reverse Proxying Java / Tomcat WebApps Locally

Conventional wisdom seems to dictate that java applications should always be reverse proxied. It's what I have always done and so has everywhere I have worked at. I have read multiple times that ...
0
votes
0answers
95 views

How to intercept packets of system apps in Android?

I am unable to capture packets of native android email app in burp suite but able to capture packets of chrome browser. I have configured the proxy of my machine with burp port(8080) on the test ...
4
votes
1answer
215 views

What is a SOCKS proxy? [closed]

I am having a hard time understanding what a SOCKS proxy really is. I have been searching on Google, but so far, most websites compare SOCKS with an HTTP proxy, but they do not explain in detail what ...
0
votes
0answers
208 views

Azure AD Application Proxy Security Concerns + Azure Application Gateway (WAF) Better?

I am still new to security and still learning the basics so was interested in getting some feedback on two Azure services. Edit: We are a school and the application's host 4000+ parent and student ...
1
vote
1answer
227 views

Defeat iOS Certificate Pinning by replacing the hardcoded certificate in the executable?

I'm analysing an iOS application and its communications through Charles. I have access to most of SSL communications but not all, due to certificate pinning. I know that there are many different ways ...
-1
votes
2answers
146 views

How does this spyware intercept my https traffic? [duplicate]

The firm I'm working for has installed a "spying" software on my computer which intercepts my https traffic. No hard to understand how it works, it's something like mitmproxy, which signs on the fly ...
-2
votes
3answers
237 views

How can I stay anonymous in a LAN without Internet access?

I need to perform attacks (SQL injection) on a server. I thought of using a proxy to be anonymous, but the topology is a LAN without Internet access. I have no idea of the protocols used in the ...
0
votes
0answers
93 views

Meterpreter Over HTTPS Proxy

I have a proxy server on the WAN as well as my box open to the WAN. I want this proxy server to (when it receives a shell), route it to my host so it can be the "man in the middle" between my ...
1
vote
2answers
65 views

What happens if I use a proxy through software such as Proxifier and also use a software which supports working through proxy servers?

Let me give you an example: I use proxifier to use a proxy that uses IP from Germany. So when I check https://www.whatismyip.com/ it shows as if I'm from Germany. So imagine if I have a software on ...
0
votes
1answer
269 views

What's the security concern of browsers using the HTTP CONNECT method?

The XMLHttpRequest spec says that attempted usage of the CONNECT method should throw a security error. Is there a security issue with client-side JavaScript sending CONNECT requests to servers? It ...
3
votes
1answer
55 views

Providing access to Git repo behind a Firewall using Certs/Keys for Authentication

We have a Git repo sitting behind a firewall. As I see it, there are two ways of authenticating/accessing the Git repo: Add a Reverse HTTP Proxy in the DMZ that communicates with the Git repo. This ...
1
vote
0answers
108 views

Transparent proxy with certificate check

I need to filter HTTPS traffic based on the certificate of the destination server. Only traffic to servers which have a certain certificate should be allowed, other traffic needs to be blocked. The ...
0
votes
1answer
300 views

Do I correctly understand how CORS proxy works?

There are a lot of CORS proxy servers like this one: https://cors-anywhere.herokuapp.com/ This allows us to send requests from different origins. For example I can send request from my client's ...
1
vote
1answer
84 views

Problems accessing websites in Netherlands [closed]

I have problems accessing certain websites in Netherlands, I have tried using several VPN, RDP, SOCK5(Vip72), Epic privacy browser. By the way i am in Asia (Malaysia). I used to be able to access it ...
-1
votes
1answer
128 views

Would sniffing all network traffic from android device to check for spyware be a viable solution

I suspect that my Google pixel (Android 9) phone has some sort of a spyware installed. There are no obvious symptoms like overheating, extreme data usage, or battery draining at an unusual rate. But I ...
0
votes
1answer
109 views

What are MITM proxies used for in enterprises?

My company (like many others I assume), uses a "man in the middle" proxy with a personal root CA. Disclaimer : I'm not a security expert so perhaps I do not correctly understand what this network ...
0
votes
0answers
33 views

Preventing admin from changing proxy settings

I am using a proxy server for my environment deployed on premises for internal hosts and on the cloud from BYOD. When a user takes their device off the premises, the proxy changes to an external proxy ...
0
votes
0answers
107 views

PHP socks proxy with no port opening

let's say i have file apache file access on a webserver, but due to firewall rules etc, i can't connect to ssh and can't open a port. Is there a way to do this exactly this : create a socks proxy on ...
2
votes
2answers
87 views

What are the pitfalls of bypassing a proxy to access cloud services such as G Suite or Office 365?

According to a TechNet article published by Microsoft, one of its recommendations is to bypass proxies to access Office 365.The basic premise is focused on performance as opposed to security. ...
1
vote
0answers
61 views

What's the most anonymous way of severing IP from actual physical location? [closed]

There are a number of layers that need to be secured. There's the network layer, for which we have Tor and other anonymizing applications and the physical layer. I don't see how one can be concerned ...
1
vote
1answer
252 views

How effective is the ProxyGambit at allowing access to the internet without revealing true location and IP?

I'm very interested in purchasing or manufacturing this device on my own and maybe using it in conjunction with Tails/Tor: https://samy.pl/proxygambit/ According to the site: ProxyGambit is a ...
0
votes
0answers
116 views

Java http proxy burp

I have a web application which downloads and executes a jnlp file to launch an applet. Using javaws I set a proxy under the network settings at 127.0.0.1 port 8080. Is this enough to monitor through ...
5
votes
5answers
1k views

Difference between SSH Tunnel / Proxy and VPN in terms of security

What benefits does a VPN have over just using a regular SSH Tunnel? I'm considering setting up OpenVPN on a server, but was wondering what benefits that would have over just using that same server as ...