Questions tagged [proxy]

The word "proxy" is mostly used as short for "proxy server", which is a server that acts as an intermediary between a workstation user and the Internet so that the enterprise can ensure security, administrative control, and caching service.

Filter by
Sorted by
Tagged with
2
votes
4answers
134 views

How would you assess the added value of web security gateways/proxies in days of > 90% of all traffic encrypted?

As of today, web security gateways add a layer of complexity to corporate web traffic while - in my opinion - only adding a small layer of protection, as most web traffic is encrypted nowadays. Of ...
0
votes
1answer
87 views

SNI leakage prevention with proxy

In TLS 1.2 / HTTP(S) context, plaintext target hostname could potentially leak in 3 different ways: In DNS query prior to TCP/TLS/HTTP connection. In TLS handshake, ClientHello message, in SNI ...
1
vote
0answers
18 views

Suspicious HEAD http requests [duplicate]

On my Windows 10 machine, I run mitmproxy on localhost:8080. I've changed the system proxy setting to point to my local proxy server. Apart from what I expect to see, I can also see the following HEAD ...
2
votes
2answers
133 views

Why are I and other users of my ISP being used as a proxy server?

I recently noticed a huge amount of downloads made through my IP (iknowwhatyoudownload.com). On the website abuseipdb.com, I discovered some reports of abusive behavior. So I started an investigation ...
0
votes
1answer
61 views

Does a http proxy (ziproxy/squid) encrypt communication between client and server

I've read a lot of similar questions, with long answer, and they are making me confused, so for a quick yes/no question. If I, access a https webpage via an http proxy (my own proxy) (like ziproxy/...
-1
votes
1answer
94 views

IP hiding attempts are detected [closed]

So I am using Tor and I try to log into a certain web site. It gives me a message saying that my IP address was used for spamming and does not let me log in. I think ok, probably the exit node is ...
0
votes
1answer
90 views

Javascript injection bettercap2 over HTTPS

I use bettercap2 http proxy and arp spoof to inject one-line js alert into http pages. It works fine, however what about https? I couldn’t find any working method to inject it without the browser’s ...
0
votes
1answer
106 views

What are the risks when using proxy such as Fiddler

I would like to understand a point. When I use fiddler it creates a local proxy to analyze the traffic, so far everything is fine. However when Fiddler is launched and I browse an HTTPS site the ...
0
votes
1answer
41 views

Reverse-proxy issues

I am trying to create a reverse-proxy web application using Flask. I don't really know weather to call it reverse-proxy or not but my idea is that the web app gets a URL from ../proxy/<URL>, ...
0
votes
0answers
73 views

SSH Tunnel HTTP Security

I think I have this set up right, but I'd appreciate a sanity-check and any info on best practices that I should be using for creating SSH tunnels to my home network while traveling. Home network: ...
0
votes
1answer
32 views

Online platform control (proxy)

To connect to the online platform of the company I work for, I have to use a proxy. Is it possible for the person responsible for this platform to check if I am currently using other programs in ...
0
votes
1answer
92 views

my ip address comes out from a different ISP/Country

I noticed suddenly something weird on my PC. I am currently in Italy, Google all of a sudden is displayed in Arabic, and my IP is from an ISP in Czech Republic, and it is obviously different from the ...
0
votes
1answer
58 views

Encryption with Tomcat & Nginx reverse proxy

I'm working with Tomcat and nginx as a reverse proxy and I'm trying to have a better understanding of how the traffic flows and of what the security issues are. Picture this as what I have in mind: ...
0
votes
0answers
28 views

Possible to automatically store responses in Proxy?

I filter some responses in the HTTP history and would like to automatically store new incoming responses somewhere on disk so I can process these data in another automated script. Is there an... ...
0
votes
1answer
69 views

How reverse proxy works?

I know that forward proxy can enhance security by replacing client IP's address with proxy server IP address. So, the web server or anyone else cannot identify the client identity who's requesting a ...
0
votes
2answers
167 views

Explicit vs transparent proxy

As far as I have understood it: An explicit proxy challenges the user/application within his session. NGFW (transparent proxy) and SSO/identity-based solutions are just letting everything pass that ...
1
vote
1answer
87 views

Can a machine running a packet sniffer see what nginx is forwarding on localhost to a Flask app?

I want to serve a Flask application from my pc. Other machines in my network only should be able to consume the API. However, I wish to have the communication between the other machines and the API ...
0
votes
0answers
117 views

Root-me won't load through Burp proxy

I am trying to access the root-me security website through Burp in order to solve some challenges, as I did many times without any problem in the past on this specific website. In order to do so, I am ...
2
votes
1answer
105 views

Whats the point in setting up an open proxy?

Decided to have a look at a list of "open" proxies. I've noticed that a good deal of these proxies are on residential IPs. One of the IPs, 68.188.59.198, is owned by Charter Communications ...
1
vote
1answer
89 views

Can wifi network administrators see if you are using a proxy?

A friend of mine wants to use a Proxy on his home computer because his parents have blocked many games and social media services. My question is, if he is using a Proxy, will his parents be able to ...
0
votes
0answers
15 views

Enterprise/Universities WIFI CA Certificate for android [duplicate]

I have read an article discussing the issues with enterprise WIFI not validating CA certificates which seemed to be a security flaw. android-11-break-enterprise-wifi-connection I've some similar ...
-1
votes
1answer
85 views

Preventing MITM Attack with Squid

There are two options, what is the best approach? I want to either Create a squid proxy server that detects MITM attacks or Create a python UI application to detect differences between local ...
0
votes
1answer
114 views

Can't free proxies be used to create a botnet?

I recently learned that there are plenty of services on the internet that offer/list free public proxies (freeproxylists.net, hidemyass.com, proxyscrape.com to name a few). Is this safe? Can't an ...
1
vote
1answer
73 views

Is it possible to completely obfuscate proxy servers?

Stripe's fraud detection documentation claims it has Proxy Detection When I search for how it might be detecting traffic from proxies, I see this great answer, which show how to detect that traffic. ...
1
vote
0answers
50 views

Certificate Checking for MITM w/ Squid

I have already set up a squid cache proxy server on a Raspberry Pi 4. I need to create some sort of GUI to turn on and off certificate checking for man in the middle attacks. First, how do I get squid ...
1
vote
1answer
120 views

Can I trust public socks4 proxy when using only HTTPS?

I am using a socks4 public proxy for more speed/bandwidth. I am currently using it for downloading file. Now I want to use it for social media or daily day usage. I know that they will get my all ...
1
vote
1answer
58 views

SSL Termination within corporate network

I know its is advised to encrypt the traffic within the company network. Should we also stay away from SSL termination after a reverse proxy that's proxies multiple worker nodes on the same LAN? By ...
1
vote
0answers
164 views

SAML/oauth2/openid-connect login via proxy as another user

I manage a set of service providers (SP1, SP2, SP3, etc), and we currently have this SAML SSO flow working where the SP causes a POST submit to the SAML IDP with an XML SAML request which includes an ...
0
votes
2answers
136 views

Hiding client IP from a VPN server

VPNs can often be useful for obscuring personably identifying information (IP, geolocation, etc.) from remote destination servers. Traffic is routed through a VPN server and forwarded to the ...
-1
votes
1answer
334 views

How to prevent someone from proxying your Websites

So i think someone is mirroring my site with a proxy and hides behind cloudflare (cloudflare already notified and google also) so i cant find out the real ip of the server to block it. Is there anyway ...
0
votes
0answers
93 views

Why does my IP being leaked with system-wide proxy through webTRC, but it doesn't happen when I use system-wide VPN

WebRTC manages to leak my IP when I use proxy, but when I use VPN it only shows VPN server's IP (both proxy and VPN were system-wide). What's the key difference? Google Chrome was used in both tests (...
1
vote
1answer
63 views

Based on cookies, does a website knows that a user visited it if the user does not log in?

I, user ABC, have an account on some financial website example.com. I have logged in from my browser many times before so cookies were saved. Each time I would log off after I finish browsing that ...
1
vote
1answer
304 views

How to make Squid Proxy undetectable by ip-check.net? [closed]

I have setup squid proxy on a CentOs server where I set forwarded_for to delete and denied request headers on the /etc/squid/squid.conf file. However, whilst connected to the proxy, if I visit http://...
0
votes
0answers
37 views

Can I use IPSec for anonymous browsing (like in commercial proxies)?

In class, we learned how to set up a VPN between two remote sites using IPSec in tunnel mode. I have a VPS for hosting my website (with root access), but if I set up a tunnel between my PC and the VPS,...
1
vote
1answer
353 views

Detailed explanations on OWASP Zap Security scan rules

As an example, I have installed Anti-CSRF Scanning rule in ZAP proxy and scanned a POST request which does not verify the CSRF token value from the back end. Ideally, it is a CSRF vulnerability, but ...
0
votes
2answers
93 views

Alternative to Proxy servers for limiting internet access?

My company is using on premise DMZ proxy servers to limit internet access to employees working from home. When they use company laptop, they are automatically configured to go through the proxy server ...
1
vote
1answer
492 views

Run Hydra Through Series of Proxies?

Is there a way to run Hydra through a series of proxies so a website can't lock you out? Having a hard time finding a way to do this. Most websites will block you out if you take to many attempts at ...
-1
votes
1answer
218 views

How Zscaler enables system wide proxy?

I have Zscaler service installed on my system and it does a good job of filtering content and malicious websites. I was wondering how does Zscaler manage to do this? I read that it creates a PAC file ...
2
votes
1answer
81 views

Should I check Host header or ServerName for CSRF defense when serving behind proxies?

In a CSRF defense based on checking forbidden headers, should I check Origin/Referer header against the ServerName configuration directive, or is it sufficient to simply check against the HTTP Host ...
1
vote
0answers
46 views

Unsupervised proxy - what could go wrong?

I recently finished setting up mitmproxy on a recently created DigitalOcean Ubuntu Droplet server. Almost immediately after opening the necessary ports in the server firewall and starting the proxy up,...
1
vote
1answer
48 views

What are the limitation on encrpyting proxy

i would like to know if i encrypt a proxy server communication with TLS v1.3 is it still possible for a firewall censor to a deep packet scanning to decrypt. Also, what can be done to make the ...
0
votes
1answer
191 views

Any there any tools like Burpsuite that fully support HTTP/2? [closed]

Nowadays websites start migrating to HTTP/2, but Burpsuite hasn't fully support HTTP/2 yet. I know HTTPCanary is good and support multiple protocols like replaying HTTP2 and even TCP/UDP, but that ...
0
votes
1answer
180 views

Burp Suite upstream proxy

Is there a way to configure burpsuite's upstream proxy direct the traffic to the local box's proxy configuration? Additionally is there a way to exclude urls from being directed to the upstream proxy.
0
votes
0answers
479 views

MITMPROXY on router

I am familiar with MITM LAN attacks using dnsspoof and arpspoof to read client data. Instead of spoofing the DNS and impersonating the router on my physical machine, I want to set up a MITM LAN ...
1
vote
1answer
1k views

Verifying client certificate by passing client cert in the header

I'm implementing client certificate authentication. My server is behind a proxy to which I have no control of. And also I don't have any control over the client side communication. During every ...
0
votes
2answers
114 views

Is it possible to create a hardware 'Plug and Play' TOR proxy?

Is there a way to use a device like a raspberrypi to create a kind of 'Plug and Play' TOR proxy? Ideally, a device would exist with an ethernet port as input and ethernet cable or USB as output which ...
1
vote
1answer
368 views

How to configure VPN + Tor + linux as a proxy server? [closed]

Goal To hide the IP address using Tor, which goes through a proxy server to make HTTP/FTP requests look like they came from a regular user, not one who uses Tor. Example A user requests the website. ...
-1
votes
1answer
188 views

CDN end to end encryption?

I setup Cloudflare CDN for my site. I added my site to Cloudflare and it asked me to add Cloudflare nameserver to my domain. I did that in my DNS registrar portal. That's all I did. Now I'm able to ...
1
vote
0answers
52 views

Strange Proxy Application Behavior on iOS 13.5.1

Background: My buddy is a freelance journalist working on a story on one of the bigger software companies (a household name, starts with an A). Anyway, he asked me to take a look at his iPad because ...
0
votes
0answers
80 views

How can a SOCKS5 proxy know client's datetime?

It seems that SOCKS5 proxies somehow know the client's timezone (at least) or maybe even the precise datetime. I determined this because the proxy tears the connection in case the local timezone on ...

1
2 3 4 5
14