Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [proxy]

The word "proxy" is mostly used as short for "proxy server", which is a server that acts as an intermediary between a workstation user and the Internet so that the enterprise can ensure security, administrative control, and caching service.

0
votes
1answer
69 views

What's the security concern of browsers using the HTTP CONNECT method?

The XMLHttpRequest spec says that attempted usage of the CONNECT method should throw a security error. Is there a security issue with client-side JavaScript sending CONNECT requests to servers? It ...
1
vote
1answer
20 views

Providing access to Git repo behind a Firewall using Certs/Keys for Authentication

We have git repo sitting behind a firewall. As I see, there are two ways of authenticating/accessing the git repo Add a Reverse HTTP Proxy in the DMZ that communicates with the git repo. This will ...
1
vote
0answers
36 views

Transparent proxy with certificate check

I need to filter HTTPS traffic based on the certificate of the destination server. Only traffic to servers which have a certain certificate should be allowed, other traffic needs to be blocked. The ...
0
votes
1answer
53 views

Do I correctly understand how CORS proxy works?

There are a lot of CORS proxy servers like this one: https://cors-anywhere.herokuapp.com/ This allows us to send requests from different origins. For example I can send request from my client's ...
1
vote
1answer
69 views

Problems accessing websites in Netherlands

I have problems accessing certain websites in Netherlands, I have tried using several VPN, RDP, SOCK5(Vip72), Epic privacy browser. By the way i am in Asia (Malaysia). I used to be able to access it ...
-1
votes
1answer
38 views

Would sniffing all network traffic from android device to check for spyware be a viable solution

I suspect that my Google pixel (Android 9) phone has some sort of a spyware installed. There are no obvious symptoms like overheating, extreme data usage, or battery draining at an unusual rate. But I ...
0
votes
2answers
96 views

What are MITM proxies used for in enterprises?

My company (like many others I assume), uses a "man in the middle" proxy with a personal root CA. Disclaimer : I'm not a security expert so perhaps I do not correctly understand what this network ...
0
votes
0answers
25 views

Preventing admin from changing proxy settings

I am using a proxy server for my environment deployed on premises for internal hosts and on the cloud from BYOD. When a user takes their device off the premises, the proxy changes to an external proxy ...
0
votes
0answers
43 views

PHP socks proxy with no port opening

let's say i have file apache file access on a webserver, but due to firewall rules etc, i can't connect to ssh and can't open a port. Is there a way to do this exactly this : create a socks proxy on ...
1
vote
2answers
72 views

What are the pitfalls of bypassing a proxy to access cloud services such as G Suite or Office 365?

According to a TechNet article published by Microsoft, one of its recommendations is to bypass proxies to access Office 365.The basic premise is focused on performance as opposed to security. ...
1
vote
0answers
44 views

What's the most anonymous way of severing IP from actual physical location? [closed]

There are a number of layers that need to be secured. There's the network layer, for which we have Tor and other anonymizing applications and the physical layer. I don't see how one can be concerned ...
1
vote
1answer
55 views

How effective is the ProxyGambit at allowing access to the internet without revealing true location and IP?

I'm very interested in purchasing or manufacturing this device on my own and maybe using it in conjunction with Tails/Tor: https://samy.pl/proxygambit/ According to the site: ProxyGambit is a ...
0
votes
0answers
19 views

Java http proxy burp

I have a web application which downloads and executes a jnlp file to launch an applet. Using javaws I set a proxy under the network settings at 127.0.0.1 port 8080. Is this enough to monitor through ...
3
votes
5answers
213 views

Difference between SSH Tunnel / Proxy and VPN in terms of security

What benefits does a VPN have over just using a regular SSH Tunnel? I'm considering setting up OpenVPN on a server, but was wondering what benefits that would have over just using that same server as ...
1
vote
1answer
99 views

SQL injection with an auto-incrementing parameter

I'm currently performing an API Pentest and I suspect an SQLi in one of the API calls. It updates a certain item of the web-service and requires an increase of the version number for each request. ...
1
vote
1answer
42 views

Protect app from Http Proxy like Charles [duplicate]

I am using https request for web API in my app. But I know Charles allowed to access https request also, via install root certificates on device. So, someone downloaded the app from PlayStore and ...
1
vote
0answers
25 views

Can a single domain be deleted from HSTS list through GPO

I have proxy performing a IWA authentication which intercepts the web request and redirects it towards the proxy's host name for auth. The redirect url is over http however the HSTS list on the end ...
2
votes
0answers
47 views

Pentest website available through per app VPN

I am trying to intercept web traffic with burp from mobile devices (Android and iPhone) that are enrolled in an MDM solution (MobileIron). There is one specific website I want to proxy, that is ...
1
vote
0answers
31 views

Using Screen or Tmux with Cyberark PIM Proxy [closed]

we discover that log of commands typed during a Cyberark PIM Proxy ssh session to a target host are blind if the user open a screen or a tmux session in its shell... Anyone experienced this issue ? is ...
1
vote
1answer
60 views

Difference between different proxy types

While using VPN handler apps I have come across terms such as real host dual real host reverse proxy These terms appear under the proxy type tab. What is the difference between them and what is ...
1
vote
1answer
34 views

Proxy over pptp VPN in a TMG server

Our Company is using a TMG (Threat Management Gateway) server to grant the employees access to the internet. It's not strict and users can make VPN connections and use the proxy extension of Chrome as ...
1
vote
1answer
38 views

What's the point in a proxy server authorizing/authenticating clients?

I've implemented a SOCKS5 proxy library, but I just don't get the point of authenticating (or encrypting) connections, which the RFC (1928) seemed pretty adamant about. Isn't anonymity the whole idea ...
0
votes
1answer
245 views

Use bettercap to sniff traffic going through a proxy configured in the browser?

Using bettercap, how can I intercept traffic which goes to a proxy server which is configured in browser? With no proxy configured it is working fine. But as soon as a proxy is set in the browser ...
1
vote
1answer
75 views

IP-whitelisting for DB access, does solution fit best practices?

All the data we have on our customers sits in our data-lake, which is hosted by one of our suppliers. Currently the security is such that a limited number of users has (limited) access to the database ...
0
votes
1answer
52 views

How can AWS API Gateway be used to rapidly rotate credentials in this fashion?

Reading through this article, I hit a little wall of understanding. The author states: This is because my laptop doesn’t have the secret weapon. Once you get this up and running on an EC2 ...
0
votes
1answer
67 views

Can I have a certificate on one server and the key on another?

Let's say I have a Server A with a valid certificate and a Server B with the key for the certificate. Client === Nginx Proxy with valid cert === Apache with key I don't want Ngnix to decrypt all ...
2
votes
0answers
60 views

How to reproduce the RTP bleed vulnerability?

I need to demonstrate RTP bleed on an older version of Asterisk/RTPProxy, but I'm struggling with setting up the environment. Can somebody please tell me how to configure a proxy and two clients ...
1
vote
1answer
172 views

Not able to see WebGoat requests in ZAP proxy

I have configured ZAP to port 8090 and also Firefox to 8090, but I am unable to see any requests from WebGoat lessons, whatsoever, except the initial request of http://detectportal.firefox.com. ...
4
votes
1answer
468 views

How to securely store API keys

I need to store API keys for my users. These keys are extremely valuable as they are used to buy and sell things. Some users won't want to give these keys to anyone, and I'm trying to figure out a ...
-3
votes
1answer
144 views

Risks of using free proxy and VPN services [closed]

There are millions of people that are daily using free Proxy and/or free VPN service for different purposes, some of these services are famous and have many users. What are the risks when using a ...
0
votes
2answers
57 views

How does proxylist sites discover new proxy?

I always got proxies from proxylist websites but I never asked me how these sites discover new proxy. So how?
2
votes
1answer
637 views

How do CORS proxy websites work?

While I was developing the front-end side of my web project, I got an CORS protection error. Not surprising since my front-end project was not in the same origin. After some search on how to bypass ...
-1
votes
2answers
152 views

What's the stealthiest proxy program available? [closed]

If, theoretically, one was using a network that force-disconnects your device from itself if you are detected using a proxy (such as a network configured with Cisco Umbrella or similar), but a proxy ...
1
vote
2answers
82 views

nmap -sn through proxychains fails

Why I can not do the following with nmap? proxychains nmap -A -v 10.185.11.0/24 Output: ProxyChains-3.1 (http://proxychains.sf.net) Starting Nmap 7.60 ( https://nmap.org ) at 2018-08-07 10:12 EEST ...
-1
votes
2answers
250 views

How to prevent phishing proxy attack with tool like Evilginx? [closed]

How as a web developer I can prevent phishing proxy attack with a tool like Evilginx?
-1
votes
1answer
285 views

Risk in having the PAC file in a server with no authorisation

So basically I’ve put my PAC-file under a non-secure web server with no authentication whatsoever in my organization. Later, I found out that there have been many attacks using this file type in other ...
0
votes
0answers
10 views

Application not able to use authentication when connecting to certain repositories

For development, I got the issue that clients often need to connect to different software repositories and the application itself is not able to use authentication. This does not only concern a ...
0
votes
2answers
132 views

If I'm using a SSL proxy, can the owner of that server decrypt and read my packets when I'm connected to a HTTPS website? (Password and etc)

So basically can they use some sort of man in the middle attack and decrypt and read my packets? I use their own app to use their SSL proxy and i tried scanning it with Kaspersky and it found no ...
1
vote
1answer
118 views

How secure are free proxy and VPN?

Preamble: I live in Russia where some web sites (linkedin e. g.) are blocked by government (Roskomnadzor). So I and many citizens use popular free browser-extensions (and mobile apps from same brands) ...
-1
votes
1answer
106 views

Is this good privacy? [closed]

I would love to protect my privacy online. I thought of a setup when I connect through a VPN, get a Linux VM and use VPN on that, then use just a proxy on the browser in the VM. My computer > VPN &...
2
votes
1answer
557 views

Tunnel ssh over http with custom headers

I'm trying to set up corkscrew to make an SSH tunnel over HTTP, but I need to add custom headers after the "CONNECT" statement and before the ssh tunnel. Does corkscrew support it? If yes, how can I ...
32
votes
6answers
8k views

What legitimate uses do browser proxies have?

The only time I've used my browser's proxy settings is when setting up Burp Pro, which makes me wonder: What was the original use-case for these settings? Other than testing / debugging, what was ...
1
vote
2answers
309 views

Should we enable TLS on backend connection after reverse proxy? [duplicate]

I have a reverse proxy (e.g. nginx, nghttpx, haproxy) that proxies connection to a service running on the same physical server. I think the most common way to configure this setup is to enable TSL ...
0
votes
2answers
293 views

Is it generally safe to disable Windows 10 Proxy Auto-Discovery Protocol (WPAD)?

Is it generally safe to disable Windows 10 Proxy Auto-Discovery Protocol (WPAD)? This might be my only option to try before contacting my ISP which could be quite annoying to do.
1
vote
1answer
340 views

Can you forward TLS connections according to SNI domain without terminating the connection at the reverse proxy?

I am developing an application that needs to expose two services: REST API with https and client certificate authentication (https://api.device.example.org:4431, server certificate issued by private ...
0
votes
0answers
258 views

mitm with Docker

I'm trying to capture traffic between two Docker containers ("webserver" and "chrome_client"), using an "intermediate" container in MITM mode. So we have this basic topology: [chrome_client] --> [...
1
vote
1answer
176 views

Could a VPN server hide all user's information? [closed]

I'm trying to access some server using VPN(Or generally say, proxy). But sometimes the server could detect that I'm behind a proxy(And sometimes not). So I'm wondering what information could be ...
5
votes
2answers
2k views

Would a reverse-proxy authentication server be a secure setup?

I work at a small consultancy and we often make web apps for our clients. One part of the web app that is often repetitive to write is the authentication system. In a lot of our web apps we would ...
3
votes
1answer
7k views

MTproto Proxy Security in Telegram App

In Telegram messenger, latest update, there is an option to set connection type to MTProto Proxy. Note: There is a detailed description by Telegram team on MTProto. Now telegram officially ...
4
votes
2answers
922 views

Burpsuite: just passthrough firefox detect portal

When I enable Burpsuite's Proxy I continiously get http GET requests for firefox's detectportal as seen in the following image: How I can configure it to somehow just pass though theese requests ...