Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [proxy]

The word "proxy" is mostly used as short for "proxy server", which is a server that acts as an intermediary between a workstation user and the Internet so that the enterprise can ensure security, administrative control, and caching service.

3
votes
1answer
108 views

What is a SOCKS proxy?

I am having a hard time understanding what a SOCKS proxy really is. I have been searching on Google, but so far, most websites compare SOCKS with an HTTP proxy, but they do not explain in detail what ...
0
votes
0answers
43 views

Azure AD Application Proxy Security Concerns + Azure Application Gateway (WAF) Better?

I am still new to security and still learning the basics so was interested in getting some feedback on two Azure services. Edit: We are a school and the application's host 4000+ parent and student ...
1
vote
1answer
72 views

Defeat iOS Certificate Pinning by replacing the hardcoded certificate in the executable?

I'm analysing an iOS application and its communications through Charles. I have access to most of SSL communications but not all, due to certificate pinning. I know that there are many different ways ...
-1
votes
2answers
125 views

How does this spyware intercept my https traffic? [duplicate]

The firm I'm working for has installed a "spying" software on my computer which intercepts my https traffic. No hard to understand how it works, it's something like mitmproxy, which signs on the fly ...
-2
votes
3answers
184 views

How can I stay anonymous in a LAN without Internet access?

I need to perform attacks (SQL injection) on a server. I thought of using a proxy to be anonymous, but the topology is a LAN without Internet access. I have no idea of the protocols used in the ...
0
votes
0answers
50 views

Meterpreter Over HTTPS Proxy

I have a proxy server on the WAN as well as my box open to the WAN. I want this proxy server to (when it receives a shell), route it to my host so it can be the "man in the middle" between my ...
1
vote
2answers
41 views

What happens if I use a proxy through software such as Proxifier and also use a software which supports working through proxy servers?

Let me give you an example: I use proxifier to use a proxy that uses IP from Germany. So when I check https://www.whatismyip.com/ it shows as if I'm from Germany. So imagine if I have a software on ...
0
votes
1answer
129 views

What's the security concern of browsers using the HTTP CONNECT method?

The XMLHttpRequest spec says that attempted usage of the CONNECT method should throw a security error. Is there a security issue with client-side JavaScript sending CONNECT requests to servers? It ...
3
votes
1answer
38 views

Providing access to Git repo behind a Firewall using Certs/Keys for Authentication

We have a Git repo sitting behind a firewall. As I see it, there are two ways of authenticating/accessing the Git repo: Add a Reverse HTTP Proxy in the DMZ that communicates with the Git repo. This ...
1
vote
0answers
46 views

Transparent proxy with certificate check

I need to filter HTTPS traffic based on the certificate of the destination server. Only traffic to servers which have a certain certificate should be allowed, other traffic needs to be blocked. The ...
0
votes
1answer
106 views

Do I correctly understand how CORS proxy works?

There are a lot of CORS proxy servers like this one: https://cors-anywhere.herokuapp.com/ This allows us to send requests from different origins. For example I can send request from my client's ...
1
vote
1answer
71 views

Problems accessing websites in Netherlands [closed]

I have problems accessing certain websites in Netherlands, I have tried using several VPN, RDP, SOCK5(Vip72), Epic privacy browser. By the way i am in Asia (Malaysia). I used to be able to access it ...
-1
votes
1answer
70 views

Would sniffing all network traffic from android device to check for spyware be a viable solution

I suspect that my Google pixel (Android 9) phone has some sort of a spyware installed. There are no obvious symptoms like overheating, extreme data usage, or battery draining at an unusual rate. But I ...
0
votes
2answers
101 views

What are MITM proxies used for in enterprises?

My company (like many others I assume), uses a "man in the middle" proxy with a personal root CA. Disclaimer : I'm not a security expert so perhaps I do not correctly understand what this network ...
0
votes
0answers
27 views

Preventing admin from changing proxy settings

I am using a proxy server for my environment deployed on premises for internal hosts and on the cloud from BYOD. When a user takes their device off the premises, the proxy changes to an external proxy ...
0
votes
0answers
87 views

PHP socks proxy with no port opening

let's say i have file apache file access on a webserver, but due to firewall rules etc, i can't connect to ssh and can't open a port. Is there a way to do this exactly this : create a socks proxy on ...
2
votes
2answers
76 views

What are the pitfalls of bypassing a proxy to access cloud services such as G Suite or Office 365?

According to a TechNet article published by Microsoft, one of its recommendations is to bypass proxies to access Office 365.The basic premise is focused on performance as opposed to security. ...
1
vote
0answers
51 views

What's the most anonymous way of severing IP from actual physical location? [closed]

There are a number of layers that need to be secured. There's the network layer, for which we have Tor and other anonymizing applications and the physical layer. I don't see how one can be concerned ...
1
vote
1answer
101 views

How effective is the ProxyGambit at allowing access to the internet without revealing true location and IP?

I'm very interested in purchasing or manufacturing this device on my own and maybe using it in conjunction with Tails/Tor: https://samy.pl/proxygambit/ According to the site: ProxyGambit is a ...
0
votes
0answers
44 views

Java http proxy burp

I have a web application which downloads and executes a jnlp file to launch an applet. Using javaws I set a proxy under the network settings at 127.0.0.1 port 8080. Is this enough to monitor through ...
3
votes
5answers
435 views

Difference between SSH Tunnel / Proxy and VPN in terms of security

What benefits does a VPN have over just using a regular SSH Tunnel? I'm considering setting up OpenVPN on a server, but was wondering what benefits that would have over just using that same server as ...
1
vote
1answer
107 views

SQL injection with an auto-incrementing parameter

I'm currently performing an API Pentest and I suspect an SQLi in one of the API calls. It updates a certain item of the web-service and requires an increase of the version number for each request. ...
1
vote
1answer
47 views

Protect app from Http Proxy like Charles [duplicate]

I am using https request for web API in my app. But I know Charles allowed to access https request also, via install root certificates on device. So, someone downloaded the app from PlayStore and ...
1
vote
0answers
27 views

Can a single domain be deleted from HSTS list through GPO

I have proxy performing a IWA authentication which intercepts the web request and redirects it towards the proxy's host name for auth. The redirect url is over http however the HSTS list on the end ...
2
votes
0answers
56 views

Pentest website available through per app VPN

I am trying to intercept web traffic with burp from mobile devices (Android and iPhone) that are enrolled in an MDM solution (MobileIron). There is one specific website I want to proxy, that is ...
1
vote
0answers
45 views

Using Screen or Tmux with Cyberark PIM Proxy [closed]

we discover that log of commands typed during a Cyberark PIM Proxy ssh session to a target host are blind if the user open a screen or a tmux session in its shell... Anyone experienced this issue ? is ...
1
vote
1answer
61 views

Difference between different proxy types

While using VPN handler apps I have come across terms such as real host dual real host reverse proxy These terms appear under the proxy type tab. What is the difference between them and what is ...
1
vote
1answer
46 views

Proxy over pptp VPN in a TMG server

Our Company is using a TMG (Threat Management Gateway) server to grant the employees access to the internet. It's not strict and users can make VPN connections and use the proxy extension of Chrome as ...
1
vote
1answer
43 views

What's the point in a proxy server authorizing/authenticating clients?

I've implemented a SOCKS5 proxy library, but I just don't get the point of authenticating (or encrypting) connections, which the RFC (1928) seemed pretty adamant about. Isn't anonymity the whole idea ...
0
votes
1answer
352 views

Use bettercap to sniff traffic going through a proxy configured in the browser?

Using bettercap, how can I intercept traffic which goes to a proxy server which is configured in browser? With no proxy configured it is working fine. But as soon as a proxy is set in the browser ...
1
vote
1answer
86 views

IP-whitelisting for DB access, does solution fit best practices?

All the data we have on our customers sits in our data-lake, which is hosted by one of our suppliers. Currently the security is such that a limited number of users has (limited) access to the database ...
0
votes
1answer
81 views

How can AWS API Gateway be used to rapidly rotate credentials in this fashion?

Reading through this article, I hit a little wall of understanding. The author states: This is because my laptop doesn’t have the secret weapon. Once you get this up and running on an EC2 ...
0
votes
1answer
68 views

Can I have a certificate on one server and the key on another?

Let's say I have a Server A with a valid certificate and a Server B with the key for the certificate. Client === Nginx Proxy with valid cert === Apache with key I don't want Ngnix to decrypt all ...
2
votes
0answers
73 views

How to reproduce the RTP bleed vulnerability?

I need to demonstrate RTP bleed on an older version of Asterisk/RTPProxy, but I'm struggling with setting up the environment. Can somebody please tell me how to configure a proxy and two clients ...
1
vote
1answer
377 views

Not able to see WebGoat requests in ZAP proxy

I have configured ZAP to port 8090 and also Firefox to 8090, but I am unable to see any requests from WebGoat lessons, whatsoever, except the initial request of http://detectportal.firefox.com. ...
4
votes
1answer
802 views

How to securely store API keys

I need to store API keys for my users. These keys are extremely valuable as they are used to buy and sell things. Some users won't want to give these keys to anyone, and I'm trying to figure out a ...
-3
votes
1answer
151 views

Risks of using free proxy and VPN services [closed]

There are millions of people that are daily using free Proxy and/or free VPN service for different purposes, some of these services are famous and have many users. What are the risks when using a ...
0
votes
2answers
62 views

How does proxylist sites discover new proxy?

I always got proxies from proxylist websites but I never asked me how these sites discover new proxy. So how?
2
votes
1answer
1k views

How do CORS proxy websites work?

While I was developing the front-end side of my web project, I got an CORS protection error. Not surprising since my front-end project was not in the same origin. After some search on how to bypass ...
-1
votes
2answers
154 views

What's the stealthiest proxy program available? [closed]

If, theoretically, one was using a network that force-disconnects your device from itself if you are detected using a proxy (such as a network configured with Cisco Umbrella or similar), but a proxy ...
1
vote
2answers
121 views

nmap -sn through proxychains fails

Why I can not do the following with nmap? proxychains nmap -A -v 10.185.11.0/24 Output: ProxyChains-3.1 (http://proxychains.sf.net) Starting Nmap 7.60 ( https://nmap.org ) at 2018-08-07 10:12 EEST ...
-1
votes
2answers
296 views

How to prevent phishing proxy attack with tool like Evilginx? [closed]

How as a web developer I can prevent phishing proxy attack with a tool like Evilginx?
-1
votes
1answer
398 views

Risk in having the PAC file in a server with no authorisation

So basically I’ve put my PAC-file under a non-secure web server with no authentication whatsoever in my organization. Later, I found out that there have been many attacks using this file type in other ...
0
votes
2answers
171 views

If I'm using a SSL proxy, can the owner of that server decrypt and read my packets when I'm connected to a HTTPS website? (Password and etc)

So basically can they use some sort of man in the middle attack and decrypt and read my packets? I use their own app to use their SSL proxy and i tried scanning it with Kaspersky and it found no ...
1
vote
1answer
138 views

How secure are free proxy and VPN?

Preamble: I live in Russia where some web sites (linkedin e. g.) are blocked by government (Roskomnadzor). So I and many citizens use popular free browser-extensions (and mobile apps from same brands) ...
-1
votes
1answer
110 views

Is this good privacy? [closed]

I would love to protect my privacy online. I thought of a setup when I connect through a VPN, get a Linux VM and use VPN on that, then use just a proxy on the browser in the VM. My computer > VPN &...
2
votes
1answer
735 views

Tunnel ssh over http with custom headers

I'm trying to set up corkscrew to make an SSH tunnel over HTTP, but I need to add custom headers after the "CONNECT" statement and before the ssh tunnel. Does corkscrew support it? If yes, how can I ...
33
votes
6answers
8k views

What legitimate uses do browser proxies have?

The only time I've used my browser's proxy settings is when setting up Burp Pro, which makes me wonder: What was the original use-case for these settings? Other than testing / debugging, what was ...
1
vote
2answers
388 views

Should we enable TLS on backend connection after reverse proxy? [duplicate]

I have a reverse proxy (e.g. nginx, nghttpx, haproxy) that proxies connection to a service running on the same physical server. I think the most common way to configure this setup is to enable TSL ...
0
votes
2answers
336 views

Is it generally safe to disable Windows 10 Proxy Auto-Discovery Protocol (WPAD)?

Is it generally safe to disable Windows 10 Proxy Auto-Discovery Protocol (WPAD)? This might be my only option to try before contacting my ISP which could be quite annoying to do.