Questions tagged [proxy]

The word "proxy" is mostly used as short for "proxy server", which is a server that acts as an intermediary between a workstation user and the Internet so that the enterprise can ensure security, administrative control, and caching service.

Filter by
Sorted by
Tagged with
0 votes
3 answers
157 views

Does TLS interception necessarily require a self-signed certificate? Please explain why

A brief schema of a TLS intercepting proxy - the Client connects to the Host via the Proxy in a way which allows the Proxy to perform a (consensual) MITM. [Client] -> [Proxy] -> [Host] It's ...
bbozo's user avatar
  • 511
0 votes
1 answer
65 views

Can a Reverse Proxy be used instead of port filtering?

I want to limit access from the Internet to my Web server but the clients will have a dynamic IP address so the best I can do is to whitelist all addresses belonging to that specific mobile carrier ...
mfloris's user avatar
  • 101
1 vote
0 answers
40 views

Can a proxy server view the request and response bodies? [duplicate]

I'm digging into proxies and VPNs to wrap my head around their security aspects. Wondering: can a proxy server sneak a peek at my raw requests and maybe even tweak them a bit? my connections are HTTPs
Sarkar's user avatar
  • 111
1 vote
2 answers
91 views

VPN vs Authentication Proxy to restrict access to internal network/application

A popular new idea at the company I am working for is to remove worldwide access of web applications and restrict them to the internal network only, allowing remote users to work with them through VPN ...
user2374435's user avatar
0 votes
0 answers
121 views

How to reproduce Tomcat 9.0.0.M1 HTTP smuggling vulnerabilities?

I'm trying to reproduce some of the Tomcat 9.x.x vulnerabilities from this list, in particular the HTTP smuggling vulnerabilities. However, so far I haven't been able to reproduce any of them. ...
Franklin Pezzuti Dyer's user avatar
0 votes
1 answer
111 views

Burpsuite proxy does not get HTTP error 429 but vanilla python requests do?

When I make a normal python request to some site without any proxies I am getting a 429 response, too many requests. However when I open up burpsuite proxy and add proxies = { "http": &...
Lorde213423432e43434's user avatar
0 votes
1 answer
166 views

Setting up Burpsuite with a machine in another network

I'm currently testing a mobile app (suppose it communicates with the domain blablabla.net). For the purposes of testing this app, I've set up an android machine on another netowrk, and I'm currently ...
sag0li's user avatar
  • 3
0 votes
0 answers
71 views

How can I forward and capture all traffic from a device (mobile, or PC) from another network?

Let's say Mobile device A sits on Network A, and I want to monitor their HTTPS traffic remotely, how might I go about doing this? I know that locally, on the same network, a proxy debugging tool can ...
ThanoojJ's user avatar
0 votes
2 answers
150 views

Modify the protocol of a packet

Is it possible that for example there is a TCP packet, and using a proxy, you intercept it and using a tool you change the protocol entirely? Like for example from TCP to UDP or any other custom ...
AndyCrypto's user avatar
0 votes
2 answers
52 views

Can PAC Proxy read other website requests?

I'm using my university's PAC proxy file to reach academic websites and research papers. The pac file provided contains a list of sites, in which if i go over to these sites it asks me for my username ...
zelosleone's user avatar
0 votes
0 answers
66 views

Securing an internal tcp proxy

I am developing a TCP-Proxy in C#/.NET using dotNetty (Port of Netty). The proxy is translating messages between two different systems. It will be hosted on a server in the company network, so it is ...
f.lechleitner's user avatar
0 votes
1 answer
155 views

Proxychains fails but foxyproxy works?

Here's a proxy problem I am trying to understand. There's a http squid proxy in 192.168.215.189:3128 . No other ports of the specified IP is exposed externally. I created a foxyproxy proxy and used ...
Ahnaf Abrar Hasin's user avatar
0 votes
0 answers
142 views

How is client side JWT signature validation beneficial from a security perspective?

I’ve been reading about how clients can verify JWT signatures using a public key provided by the server. I’m struggling to understand how this solves any issues. The only attack I’ve seen which this ...
JoffLobster's user avatar
3 votes
0 answers
845 views

Weird hack attempt nginx proxy manager and photoprism drives me nuts

I have a logged http request in nginx logs which drives me nuts because I don't understand how it's finding its way into the logs: [03/Jul/2023:13:45:04 +0000] 400 - GET http localhost "/bin/...
MuchToKnow's user avatar
1 vote
1 answer
218 views

Can a browser-based HTTPS proxy secure browsing data while using a system-level proxy?

I use Nekoray to set up proxies for my Windows system. When I connect to those proxies, does using a browser-based proxy with HTTPS encryption secure my transferred data through the web browser? Can ...
Winner1's user avatar
  • 113
0 votes
1 answer
88 views

Any (opensource) tool that we can use to detect if our computers has been installed applications that have proxies services

Read something like this on reddit "someone can also be a regular user who does not read terms and conditions of apps that they install. Some apps might include code that will enable them to run ...
Maxfield's user avatar
  • 127
0 votes
2 answers
818 views

Does a docker socket proxy improve security?

It's dangerous to expose the docker socket to a container, as malicious code could break out into the host. There are various ways to avoid this; a simple/popular approach is to use a proxy between ...
lonix's user avatar
  • 445
2 votes
1 answer
152 views

How to avoid breaking end-to-end encryption while employing cloud-based DDoS protection?

I have a few websites and apps that I need to protect from DDoS attacks. These websites and apps are delivered by various servers that sit in several small data centers around the world. I'm thinking ...
hilltothesouth's user avatar
1 vote
2 answers
200 views

Is there is another ways to authenticate requests to remote server other than Client Certificates?

I was trying to do vulnerability testing to an android mobile banking app so to get the endpoints of the API I installed the app into android emulator and captured the requests with transparent proxy ...
Zahal A_Omer's user avatar
0 votes
1 answer
588 views

Staying anonymous while using BurpSuite

While testing any site using BurpSuite, if we send any request it will use BurpSuite HTTP "Proxying through BurpSuite" but still we are not fully anonymous, it will still use our original ...
Noob Hunter's user avatar
1 vote
0 answers
346 views

How would you hide yourself whilst conducting a scan on a target network to identify open service ports?

I am working on this question which asks how you would conduct a scan of a target network to identify open service ports without revealing your IP address. It wants details such as IP address ...
Thanos's user avatar
  • 111
1 vote
0 answers
120 views

Is there a real gain in terms of security by not using a reverse proxy?

I need to implement a web application consisting of the components FE (Nginx + React.js) BE (Java SpringBoot) DB (MySQL) For simplicity we will assume that the DB runs in localhost on BE's machine. ...
Dan10's user avatar
  • 11
0 votes
1 answer
923 views

Not able to see server response when making request using python

Using the requests library, I am trying to make request to a url. I've set the target to the specific url and checked, "And URL Is in Target Scope" in both Request interception rules and ...
Karan Bakshi's user avatar
0 votes
0 answers
118 views

ISP-restricted VPN on Android

How to connect to VPN service on Android via its app if it's restricted by state ISPs, but you're able to connect via cloud VPS network outside the state My idea is about concepts in general: you ...
agiAWjoa0za's user avatar
0 votes
1 answer
94 views

Misuse of trusted certificate authority [duplicate]

Currently I'm working with mitmproxy and intercepting some HTTPs traffic using it. Before I could use it in my browser, I had to trust the certificate via my OS settings. After that, the certificate ...
TrueStar's user avatar
1 vote
0 answers
161 views

Central Web Proxy vs Endpoint Protection

Imagine the following imaginary scenarios: In order to browse the Internet, users must go through a central web proxy. It is authenticated and can enforce rules about who can access which URLs or ...
Deserializer19's user avatar
1 vote
1 answer
465 views

Bandwidth limitation in the censorship systems

Recently, Iran’s government has launched a sort of new censorship system that manipulates bandwidth as I will describe below. When a user connects to a VPN server and does an Ookla speed test, the ...
Erfan's user avatar
  • 13
0 votes
1 answer
308 views

Securing home hosted servers (opening ports vs tunnelling)

When it comes to securing your home hosted servers, the most common advice appears to be: 1.Have a VPS with a reverse proxy 2.Tunnel to your home network from the VPS using a VPN like Wireguard ...
user288803's user avatar
0 votes
2 answers
88 views

How would you enforce user to only connect on a given network?

How would you enforce user PC to only connect to a given network? Answers need to be OS agnostic. One weak solution could be to set client-side firewall rules to only allow communications with ...
Erwan's user avatar
  • 213
0 votes
1 answer
91 views

TLS Private Key Secured with Hardware Fingerprint

I worked for a company where our TLS Private Key was accidentally leaked to the Internet and it was a big mess. The strategy the security team came up for avoiding this in the future was "be more ...
Charlie's user avatar
  • 125
0 votes
2 answers
172 views

Securely access server via FTP through SSH tunnel

Is it right to assume, that when i build up a tunnel with ssh -D from outside my LAN and then access my only locally exposed server via FTP, it can be called 'safe'? Tunnel is established on the same ...
BunchOfEnergy's user avatar
2 votes
1 answer
242 views

How to decrypt Emotet's TLS traffic by MITMProxy

I have a question about Emotet's TLS traffic: Using MITMProxy, I have successfully decrypted TLS traffic with Emotet's C2 server and can read the contents of the traffic. https://mitmproxy.org ...
mokotan's user avatar
  • 21
1 vote
2 answers
227 views

Can an NGINX reverse proxy reveal the backend if serving non-static content?

My setup consists of a public-facing VPS running NGINX, and a local machine running certain services. The VPS and the local machine are connected using WireGuard, and NGINX on the VPS is using ...
blissful.sizable603's user avatar
0 votes
1 answer
781 views

SSH over HTTPS or Directly open Non Standard port

We have a situation where we have an architecture that calls for a Web based UI for querying some data and the data input is through rsync over SSH. I think it would be easier to manage and more ...
Osada Lakmal's user avatar
0 votes
0 answers
51 views

Authenticate requests from landingpage to API passing through proxy

Imagine the scenario where you have a client who wants you to implement calls to an external API on a landingpage that you've setup for them. The external API works based on a contract and API keys ...
DevelJoe's user avatar
  • 141
0 votes
1 answer
313 views

How to solve Web Server Reverse Proxy Detection vulnerability reported by Nessus [closed]

The host to scan is a telecommunication terminal, which has only one network connection via a cat-5 cable directly to a PC, which installs Nessus to scan the terminal. The terminal has no any other ...
li_jessen's user avatar
  • 123
2 votes
1 answer
149 views

Does a proper Email ALG (i.e. Email-Proxy) alter/remove the local Email-Header information?

Does a proper Email ALG (i.e. Email-Proxy) alter/remove the local Email-Header information so the recipient does NOT get information about the locally used IP addresses? Example: Received: from mail....
Christina's user avatar
1 vote
2 answers
232 views

How to sniff connection between web browser and 127.0.0.1:1234 running HTTP proxy on Client B's machine while taking internet from client A's machine?

Client A is connected to the public internet. Client B gateway address is connected to the Client A's network interface. Client B is running a Web browser which is sending requests to 127.0.0.1:1234 ...
A P's user avatar
  • 111
0 votes
1 answer
167 views

ProxyCommand implemented in which OpenSSH Version

Scenario: You as a pentester are in a situation where you want to do multi hopping to jump over several ssh servers to your target. The systems are somehow outdated so you want to check what you can ...
secf00tprint's user avatar
1 vote
1 answer
243 views

Does the application gateway firewall function only on the application layer or on all layers of the OSI model?

This is very confusing. I am seeing 2 different things in various books and sites. A. Application gateway firewall scans layer 1 to layer 7 of the OSI model. B. Application gateway firewall only scans ...
zeeshanseikh's user avatar
3 votes
1 answer
475 views

Is there a reason for a server-side limit on the number of HTTP headers allowed for each request?

The security team at my company has set a limit on the number of headers a HTTP request can contain (not header size, but an actual hard count limit on the number of headers). A vendor has added a few ...
Jessica's user avatar
  • 133
1 vote
2 answers
1k views

Are bandwidth sharing apps such as peer2profit, IPRoyal and PacketStream risky?

Apps like peer2profit, IPRoyal and PacketStream allow you to sell your unused internet bandwidth to others for passive income. Supposedly you could earn about 30 to 75 dollars a month from using these ...
Maurice's user avatar
  • 155
0 votes
1 answer
235 views

How to secure a proxy authorization?

I have a private proxy running on a cloud server. I have some users which I would like to allow access. The typical way of requesting authorization is for the server to return a HTTP 407 response, ...
CaptainCodeman's user avatar
0 votes
2 answers
269 views

How can this website bypass by VPN/proxies and somehow figure out my actual location?

My browser (Vivaldi) does not send any accept-language or similar headers for my native language. Its user-agent does not contain my country or preferred language. My proxy is verified at https://...
Baque's user avatar
  • 1
0 votes
3 answers
953 views

Why is my IP address hidden over HTTPS but not HTTP while I'm behind a proxy?

I am trying to connect to a supplier API but they have a whitelist of the IPs which can consume their API. I gave them my server IP so that they could add it to the whitelist but it is still not ...
Henry Mont's user avatar
2 votes
1 answer
1k views

Can a HTTP proxy see HTTPS traffic?

I was checking some things with the (Chromium) inspect tool and I saw that if you go to the 'Network' section the IP address wasn't the actual DNS A (IPv4) or AAAA (IPv6) IP address but the Proxy IP ...
The Bad One's user avatar
0 votes
0 answers
26 views

Can Proxy replace VPN? [duplicate]

I was reading about proxy vs VPN, to summaries that one could say that VPN is similar to proxy with the addition of encryption for better security. So I have a question, wouldn't it be better to use ...
algo's user avatar
  • 1
3 votes
1 answer
156 views

REST API behind proxy, is TLS sufficient?

I have the following problem: A service provides a REST API. Different kinds of clients (desktop applications, mobile applications, web applications) connect to this API and send and receive data. In ...
Frederik's user avatar
0 votes
1 answer
963 views

apache mod_write RewriteCond %{HTTP_USER_AGENT} Doesn't works

I am trying to redirecto to other machine by filtering the user agent in a apache web server. I have a web server in the machine with the ip 192.168.2.11, but this web server only should send the page ...
P00's user avatar
  • 43
1 vote
1 answer
296 views

Passing traffic from a script through proxy / tor network [closed]

I am applying for a job that involves creating unit tests and end to end tests for a website. Right now, i am assigned with a task, in order to test my skills. However, my country has blocked access ...
user1584421's user avatar

1
2 3 4 5
15