Skip to main content

Questions tagged [proxy]

The word "proxy" is mostly used as short for "proxy server", which is a server that acts as an intermediary between a workstation user and the Internet so that the enterprise can ensure security, administrative control, and caching service.

Filter by
Sorted by
Tagged with
2 votes
1 answer
478 views

Is a weak appliance behind a reverse proxy affecting the security of the home network?

I have my home network behing a nginx reverse proxy (a Docker container) which is configured to use 4th level domains to reach some of my services I need to open up to the Internet. Some of them ...
FarO's user avatar
  • 343
1 vote
1 answer
84 views

Edge browser + Docker: proxy settings for Burp Suite

This is my case: I'm trying DVWA in a Docker container localhost:4280. I want to test this webapp with Burp Suite (which listen to port 8080) and Microsoft Edge browser. I'm on Windows 11 The way to ...
ranemirusG's user avatar
0 votes
0 answers
66 views

How to fix metasploit handler?

My Termux Meterpreter doesn't work. Commands: msfconsole set Proxies http://185.107.56.83:443 use exploit/multi/handler set PAYLOAD windows/meterpreter/reverse_tcp set LHOST 0.0.0.0 set LPORT 8080 set ...
Duck's user avatar
  • 11
0 votes
1 answer
136 views

Can My University See What I Browse On My Laptop?

I'm a bit paranoid, but I want to know if my university can see what I'm browsing while being on their proxy server: Can they see what I search for, like on Google? (what websites I visit) Can they ...
Ibrahim's user avatar
0 votes
1 answer
60 views

Portswigger SSRF basic lab question

I am working on some portswigger labs to get good at web security. I was doing this lab at the following link: https://portswigger.net/web-security/ssrf/lab-basic-ssrf-against-localhost Spoiler, you ...
PurpleHacker's user avatar
0 votes
0 answers
105 views

Using a static ip (Ipv4) residential ISP proxy / IP address for Binance

My situation is the following: I am a novice when it comes to information security Residing in a country other than my home country in Europe I need a way to reliably access Binance.com without ...
swstuff's user avatar
0 votes
1 answer
91 views

Would there be any utility for multiple clients sharing the same TLS session key?

I was wondering if there is any utility for multiple hosts sharing the same TLS session key. I have come across proxies and the way they intercept TLS connections is to make the client accept its ...
imawful's user avatar
3 votes
1 answer
662 views

In general, is URL shortening safe when used with proxy server?

So, our proxy server blocks all traffic except approved ones. Would allowing a URL shortening (aka.ms, for example) mean any URL will bypass the proxy? Or is it just a redirect and the proxy/security ...
Data-Base's user avatar
  • 131
0 votes
1 answer
127 views

How to prevent spam attacks from rotating proxies

My website has hundreds of thousands of html pages that are open to public. Each time a html page is requested, a call will be made to my database to get the correct data. Therefore the cost of each ...
Tuan Do's user avatar
0 votes
3 answers
220 views

Does TLS interception necessarily require a self-signed certificate? Please explain why

A brief schema of a TLS intercepting proxy - the Client connects to the Host via the Proxy in a way which allows the Proxy to perform a (consensual) MITM. [Client] -> [Proxy] -> [Host] It's ...
bbozo's user avatar
  • 511
0 votes
1 answer
116 views

Can a Reverse Proxy be used instead of port filtering?

I want to limit access from the Internet to my Web server but the clients will have a dynamic IP address so the best I can do is to whitelist all addresses belonging to that specific mobile carrier ...
mfloris's user avatar
  • 101
1 vote
0 answers
102 views

Can a proxy server view the request and response bodies? [duplicate]

I'm digging into proxies and VPNs to wrap my head around their security aspects. Wondering: can a proxy server sneak a peek at my raw requests and maybe even tweak them a bit? my connections are HTTPs
Sarkar's user avatar
  • 111
1 vote
2 answers
215 views

VPN vs Authentication Proxy to restrict access to internal network/application

A popular new idea at the company I am working for is to remove worldwide access of web applications and restrict them to the internal network only, allowing remote users to work with them through VPN ...
user2374435's user avatar
0 votes
0 answers
223 views

How to reproduce Tomcat 9.0.0.M1 HTTP smuggling vulnerabilities?

I'm trying to reproduce some of the Tomcat 9.x.x vulnerabilities from this list, in particular the HTTP smuggling vulnerabilities. However, so far I haven't been able to reproduce any of them. ...
Franklin Pezzuti Dyer's user avatar
0 votes
1 answer
249 views

Burpsuite proxy does not get HTTP error 429 but vanilla python requests do?

When I make a normal python request to some site without any proxies I am getting a 429 response, too many requests. However when I open up burpsuite proxy and add proxies = { "http": &...
Lorde213423432e43434's user avatar
0 votes
1 answer
409 views

Setting up Burpsuite with a machine in another network

I'm currently testing a mobile app (suppose it communicates with the domain blablabla.net). For the purposes of testing this app, I've set up an android machine on another netowrk, and I'm currently ...
sag0li's user avatar
  • 3
0 votes
0 answers
135 views

How can I forward and capture all traffic from a device (mobile, or PC) from another network?

Let's say Mobile device A sits on Network A, and I want to monitor their HTTPS traffic remotely, how might I go about doing this? I know that locally, on the same network, a proxy debugging tool can ...
ThanoojJ's user avatar
0 votes
2 answers
203 views

Modify the protocol of a packet

Is it possible that for example there is a TCP packet, and using a proxy, you intercept it and using a tool you change the protocol entirely? Like for example from TCP to UDP or any other custom ...
19216811's user avatar
0 votes
2 answers
81 views

Can PAC Proxy read other website requests?

I'm using my university's PAC proxy file to reach academic websites and research papers. The pac file provided contains a list of sites, in which if i go over to these sites it asks me for my username ...
zelosleone's user avatar
0 votes
0 answers
93 views

Securing an internal tcp proxy

I am developing a TCP-Proxy in C#/.NET using dotNetty (Port of Netty). The proxy is translating messages between two different systems. It will be hosted on a server in the company network, so it is ...
f.lechleitner's user avatar
0 votes
1 answer
217 views

Proxychains fails but foxyproxy works?

Here's a proxy problem I am trying to understand. There's a http squid proxy in 192.168.215.189:3128 . No other ports of the specified IP is exposed externally. I created a foxyproxy proxy and used ...
Ahnaf Abrar Hasin's user avatar
0 votes
0 answers
229 views

How is client side JWT signature validation beneficial from a security perspective?

I’ve been reading about how clients can verify JWT signatures using a public key provided by the server. I’m struggling to understand how this solves any issues. The only attack I’ve seen which this ...
JoffLobster's user avatar
3 votes
0 answers
1k views

Weird hack attempt nginx proxy manager and photoprism drives me nuts

I have a logged http request in nginx logs which drives me nuts because I don't understand how it's finding its way into the logs: [03/Jul/2023:13:45:04 +0000] 400 - GET http localhost "/bin/...
MuchToKnow's user avatar
1 vote
1 answer
281 views

Can a browser-based HTTPS proxy secure browsing data while using a system-level proxy?

I use Nekoray to set up proxies for my Windows system. When I connect to those proxies, does using a browser-based proxy with HTTPS encryption secure my transferred data through the web browser? Can ...
Winner1's user avatar
  • 113
0 votes
1 answer
111 views

Any (opensource) tool that we can use to detect if our computers has been installed applications that have proxies services

Read something like this on reddit "someone can also be a regular user who does not read terms and conditions of apps that they install. Some apps might include code that will enable them to run ...
Maxfield's user avatar
  • 157
0 votes
2 answers
1k views

Does a docker socket proxy improve security?

It's dangerous to expose the docker socket to a container, as malicious code could break out into the host. There are various ways to avoid this; a simple/popular approach is to use a proxy between ...
lonix's user avatar
  • 455
2 votes
1 answer
208 views

How to avoid breaking end-to-end encryption while employing cloud-based DDoS protection?

I have a few websites and apps that I need to protect from DDoS attacks. These websites and apps are delivered by various servers that sit in several small data centers around the world. I'm thinking ...
hilltothesouth's user avatar
1 vote
2 answers
258 views

Is there is another ways to authenticate requests to remote server other than Client Certificates?

I was trying to do vulnerability testing to an android mobile banking app so to get the endpoints of the API I installed the app into android emulator and captured the requests with transparent proxy ...
Zahal A_Omer's user avatar
0 votes
1 answer
867 views

Staying anonymous while using BurpSuite

While testing any site using BurpSuite, if we send any request it will use BurpSuite HTTP "Proxying through BurpSuite" but still we are not fully anonymous, it will still use our original ...
Noob Hunter's user avatar
1 vote
0 answers
621 views

How would you hide yourself whilst conducting a scan on a target network to identify open service ports?

I am working on this question which asks how you would conduct a scan of a target network to identify open service ports without revealing your IP address. It wants details such as IP address ...
Thanos's user avatar
  • 111
1 vote
0 answers
152 views

Is there a real gain in terms of security by not using a reverse proxy?

I need to implement a web application consisting of the components FE (Nginx + React.js) BE (Java SpringBoot) DB (MySQL) For simplicity we will assume that the DB runs in localhost on BE's machine. ...
Dan10's user avatar
  • 11
0 votes
1 answer
1k views

Not able to see server response when making request using python

Using the requests library, I am trying to make request to a url. I've set the target to the specific url and checked, "And URL Is in Target Scope" in both Request interception rules and ...
Karan Bakshi's user avatar
0 votes
0 answers
153 views

ISP-restricted VPN on Android

How to connect to VPN service on Android via its app if it's restricted by state ISPs, but you're able to connect via cloud VPS network outside the state My idea is about concepts in general: you ...
agiAWjoa0za's user avatar
0 votes
1 answer
127 views

Misuse of trusted certificate authority [duplicate]

Currently I'm working with mitmproxy and intercepting some HTTPs traffic using it. Before I could use it in my browser, I had to trust the certificate via my OS settings. After that, the certificate ...
TrueStar's user avatar
1 vote
0 answers
203 views

Central Web Proxy vs Endpoint Protection

Imagine the following imaginary scenarios: In order to browse the Internet, users must go through a central web proxy. It is authenticated and can enforce rules about who can access which URLs or ...
Deserializer19's user avatar
1 vote
1 answer
538 views

Bandwidth limitation in the censorship systems

Recently, Iran’s government has launched a sort of new censorship system that manipulates bandwidth as I will describe below. When a user connects to a VPN server and does an Ookla speed test, the ...
Erfan's user avatar
  • 13
0 votes
1 answer
477 views

Securing home hosted servers (opening ports vs tunnelling)

When it comes to securing your home hosted servers, the most common advice appears to be: 1.Have a VPS with a reverse proxy 2.Tunnel to your home network from the VPS using a VPN like Wireguard ...
user288803's user avatar
0 votes
2 answers
114 views

How would you enforce user to only connect on a given network?

How would you enforce user PC to only connect to a given network? Answers need to be OS agnostic. One weak solution could be to set client-side firewall rules to only allow communications with ...
Erwan's user avatar
  • 213
0 votes
1 answer
121 views

TLS Private Key Secured with Hardware Fingerprint

I worked for a company where our TLS Private Key was accidentally leaked to the Internet and it was a big mess. The strategy the security team came up for avoiding this in the future was "be more ...
Charlie's user avatar
  • 125
0 votes
2 answers
260 views

Securely access server via FTP through SSH tunnel

Is it right to assume, that when i build up a tunnel with ssh -D from outside my LAN and then access my only locally exposed server via FTP, it can be called 'safe'? Tunnel is established on the same ...
BunchOfEnergy's user avatar
2 votes
1 answer
287 views

How to decrypt Emotet's TLS traffic by MITMProxy

I have a question about Emotet's TLS traffic: Using MITMProxy, I have successfully decrypted TLS traffic with Emotet's C2 server and can read the contents of the traffic. https://mitmproxy.org ...
mokotan's user avatar
  • 21
1 vote
2 answers
296 views

Can an NGINX reverse proxy reveal the backend if serving non-static content?

My setup consists of a public-facing VPS running NGINX, and a local machine running certain services. The VPS and the local machine are connected using WireGuard, and NGINX on the VPS is using ...
blissful.sizable603's user avatar
0 votes
1 answer
1k views

SSH over HTTPS or Directly open Non Standard port

We have a situation where we have an architecture that calls for a Web based UI for querying some data and the data input is through rsync over SSH. I think it would be easier to manage and more ...
Osada Lakmal's user avatar
0 votes
0 answers
73 views

Authenticate requests from landingpage to API passing through proxy

Imagine the scenario where you have a client who wants you to implement calls to an external API on a landingpage that you've setup for them. The external API works based on a contract and API keys ...
DevelJoe's user avatar
  • 141
0 votes
1 answer
437 views

How to solve Web Server Reverse Proxy Detection vulnerability reported by Nessus [closed]

The host to scan is a telecommunication terminal, which has only one network connection via a cat-5 cable directly to a PC, which installs Nessus to scan the terminal. The terminal has no any other ...
li_jessen's user avatar
  • 123
2 votes
1 answer
171 views

Does a proper Email ALG (i.e. Email-Proxy) alter/remove the local Email-Header information?

Does a proper Email ALG (i.e. Email-Proxy) alter/remove the local Email-Header information so the recipient does NOT get information about the locally used IP addresses? Example: Received: from mail....
Christina's user avatar
1 vote
2 answers
290 views

How to sniff connection between web browser and 127.0.0.1:1234 running HTTP proxy on Client B's machine while taking internet from client A's machine?

Client A is connected to the public internet. Client B gateway address is connected to the Client A's network interface. Client B is running a Web browser which is sending requests to 127.0.0.1:1234 ...
A P's user avatar
  • 111
0 votes
1 answer
202 views

ProxyCommand implemented in which OpenSSH Version

Scenario: You as a pentester are in a situation where you want to do multi hopping to jump over several ssh servers to your target. The systems are somehow outdated so you want to check what you can ...
secf00tprint's user avatar
1 vote
1 answer
321 views

Does the application gateway firewall function only on the application layer or on all layers of the OSI model?

This is very confusing. I am seeing 2 different things in various books and sites. A. Application gateway firewall scans layer 1 to layer 7 of the OSI model. B. Application gateway firewall only scans ...
zeeshanseikh's user avatar
3 votes
1 answer
796 views

Is there a reason for a server-side limit on the number of HTTP headers allowed for each request?

The security team at my company has set a limit on the number of headers a HTTP request can contain (not header size, but an actual hard count limit on the number of headers). A vendor has added a few ...
Jessica's user avatar
  • 133

1
2 3 4 5
15