Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [proxy]

The word "proxy" is mostly used as short for "proxy server", which is a server that acts as an intermediary between a workstation user and the Internet so that the enterprise can ensure security, administrative control, and caching service.

1
vote
1answer
78 views

SQL injection with an auto-incrementing parameter

I'm currently performing an API Pentest and I suspect an SQLi in one of the API calls. It updates a certain item of the web-service and requires an increase of the version number for each request. ...
1
vote
1answer
35 views

Protect app from Http Proxy like Charles [duplicate]

I am using https request for web API in my app. But I know Charles allowed to access https request also, via install root certificates on device. So, someone downloaded the app from PlayStore and ...
1
vote
0answers
20 views

Can a single domain be deleted from HSTS list through GPO

I have proxy performing a IWA authentication which intercepts the web request and redirects it towards the proxy's host name for auth. The redirect url is over http however the HSTS list on the end ...
2
votes
0answers
35 views

Pentest website available through per app VPN

I am trying to intercept web traffic with burp from mobile devices (Android and iPhone) that are enrolled in an MDM solution (MobileIron). There is one specific website I want to proxy, that is ...
1
vote
0answers
22 views

Using Screen or Tmux with Cyberark PIM Proxy [closed]

we discover that log of commands typed during a Cyberark PIM Proxy ssh session to a target host are blind if the user open a screen or a tmux session in its shell... Anyone experienced this issue ? is ...
1
vote
1answer
49 views

Difference between different proxy types

While using VPN handler apps I have come across terms such as real host dual real host reverse proxy These terms appear under the proxy type tab. What is the difference between them and what is ...
0
votes
1answer
28 views

Proxy over pptp VPN in a TMG server

Our Company is using a TMG (Threat Management Gateway) server to grant the employees access to the internet. It's not strict and users can make VPN connections and use the proxy extension of Chrome as ...
1
vote
1answer
32 views

What's the point in a proxy server authorizing/authenticating clients?

I've implemented a SOCKS5 proxy library, but I just don't get the point of authenticating (or encrypting) connections, which the RFC (1928) seemed pretty adamant about. Isn't anonymity the whole idea ...
0
votes
1answer
109 views

Use bettercap to sniff traffic going through a proxy configured in the browser?

Using bettercap, how can I intercept traffic which goes to a proxy server which is configured in browser? With no proxy configured it is working fine. But as soon as a proxy is set in the browser ...
1
vote
1answer
62 views

IP-whitelisting for DB access, does solution fit best practices?

All the data we have on our customers sits in our data-lake, which is hosted by one of our suppliers. Currently the security is such that a limited number of users has (limited) access to the database ...
0
votes
1answer
39 views

How can AWS API Gateway be used to rapidly rotate credentials in this fashion?

Reading through this article, I hit a little wall of understanding. The author states: This is because my laptop doesn’t have the secret weapon. Once you get this up and running on an EC2 ...
0
votes
0answers
19 views

Is there workaround for a man in the middle proxy using Shell in a Box?

I noticed at my customer's organisation that there is a proxy breaking the https flow. Certificates do not belong to the https web site, but to the organisation itself. They are using it for scanning ...
0
votes
1answer
51 views

Can I have a certificate on one server and the key on another?

Let's say I have a Server A with a valid certificate and a Server B with the key for the certificate. Client === Nginx Proxy with valid cert === Apache with key I don't want Ngnix to decrypt all ...
1
vote
0answers
45 views

How to reproduce the RTP bleed vulnerability?

I need to demonstrate RTP bleed on an older version of Asterisk/RTPProxy, but I'm struggling with setting up the environment. Can somebody please tell me how to configure a proxy and two clients ...
1
vote
1answer
93 views

Not able to see WebGoat requests in ZAP proxy

I have configured ZAP to port 8090 and also Firefox to 8090, but I am unable to see any requests from WebGoat lessons, whatsoever, except the initial request of http://detectportal.firefox.com. ...
4
votes
1answer
162 views

How to securely store API keys

I need to store API keys for my users. These keys are extremely valuable as they are used to buy and sell things. Some users won't want to give these keys to anyone, and I'm trying to figure out a ...
-3
votes
1answer
135 views

Risks of using free proxy and VPN services [closed]

There are millions of people that are daily using free Proxy and/or free VPN service for different purposes, some of these services are famous and have many users. What are the risks when using a ...
0
votes
2answers
50 views

How does proxylist sites discover new proxy?

I always got proxies from proxylist websites but I never asked me how these sites discover new proxy. So how?
1
vote
1answer
291 views

How do CORS proxy websites work?

While I was developing the front-end side of my web project, I got an CORS protection error. Not surprising since my front-end project was not in the same origin. After some search on how to bypass ...
-1
votes
2answers
149 views

What's the stealthiest proxy program available? [closed]

If, theoretically, one was using a network that force-disconnects your device from itself if you are detected using a proxy (such as a network configured with Cisco Umbrella or similar), but a proxy ...
0
votes
0answers
193 views

OWASP ZAP Gateway timeout?

I'm trying to setup ZAP to run as a part of my build definition in TFS. Whenever the build is running, I can see that the call is reaching ZAP and the spider will start scanning. It seems to ...
1
vote
2answers
71 views

nmap -sn through proxychains fails

Why I can not do the following with nmap? proxychains nmap -A -v 10.185.11.0/24 Output: ProxyChains-3.1 (http://proxychains.sf.net) Starting Nmap 7.60 ( https://nmap.org ) at 2018-08-07 10:12 EEST ...
-1
votes
2answers
182 views

How to prevent phishing proxy attack with tool like Evilginx? [closed]

How as a web developer I can prevent phishing proxy attack with a tool like Evilginx?
-1
votes
1answer
195 views

Risk in having the PAC file in a server with no authorisation

So basically I’ve put my PAC-file under a non-secure web server with no authentication whatsoever in my organization. Later, I found out that there have been many attacks using this file type in other ...
0
votes
0answers
10 views

Application not able to use authentication when connecting to certain repositories

For development, I got the issue that clients often need to connect to different software repositories and the application itself is not able to use authentication. This does not only concern a ...
0
votes
2answers
114 views

If I'm using a SSL proxy, can the owner of that server decrypt and read my packets when I'm connected to a HTTPS website? (Password and etc)

So basically can they use some sort of man in the middle attack and decrypt and read my packets? I use their own app to use their SSL proxy and i tried scanning it with Kaspersky and it found no ...
1
vote
1answer
93 views

How secure are free proxy and VPN?

Preamble: I live in Russia where some web sites (linkedin e. g.) are blocked by government (Roskomnadzor). So I and many citizens use popular free browser-extensions (and mobile apps from same brands) ...
-1
votes
1answer
102 views

Is this good privacy? [closed]

I would love to protect my privacy online. I thought of a setup when I connect through a VPN, get a Linux VM and use VPN on that, then use just a proxy on the browser in the VM. My computer > VPN &...
2
votes
1answer
350 views

Tunnel ssh over http with custom headers

I'm trying to set up corkscrew to make an SSH tunnel over HTTP, but I need to add custom headers after the "CONNECT" statement and before the ssh tunnel. Does corkscrew support it? If yes, how can I ...
32
votes
6answers
8k views

What legitimate uses do browser proxies have?

The only time I've used my browser's proxy settings is when setting up Burp Pro, which makes me wonder: What was the original use-case for these settings? Other than testing / debugging, what was ...
1
vote
2answers
238 views

Should we enable TLS on backend connection after reverse proxy? [duplicate]

I have a reverse proxy (e.g. nginx, nghttpx, haproxy) that proxies connection to a service running on the same physical server. I think the most common way to configure this setup is to enable TSL ...
0
votes
2answers
218 views

Is it generally safe to disable Windows 10 Proxy Auto-Discovery Protocol (WPAD)?

Is it generally safe to disable Windows 10 Proxy Auto-Discovery Protocol (WPAD)? This might be my only option to try before contacting my ISP which could be quite annoying to do.
1
vote
1answer
230 views

Can you forward TLS connections according to SNI domain without terminating the connection at the reverse proxy?

I am developing an application that needs to expose two services: REST API with https and client certificate authentication (https://api.device.example.org:4431, server certificate issued by private ...
0
votes
0answers
216 views

mitm with Docker

I'm trying to capture traffic between two Docker containers ("webserver" and "chrome_client"), using an "intermediate" container in MITM mode. So we have this basic topology: [chrome_client] --> [...
1
vote
1answer
160 views

Could a VPN server hide all user's information? [closed]

I'm trying to access some server using VPN(Or generally say, proxy). But sometimes the server could detect that I'm behind a proxy(And sometimes not). So I'm wondering what information could be ...
5
votes
2answers
1k views

Would a reverse-proxy authentication server be a secure setup?

I work at a small consultancy and we often make web apps for our clients. One part of the web app that is often repetitive to write is the authentication system. In a lot of our web apps we would ...
2
votes
1answer
7k views

MTproto Proxy Security in Telegram App

In Telegram messenger, latest update, there is an option to set connection type to MTProto Proxy. Note: There is a detailed description by Telegram team on MTProto. Now telegram officially ...
4
votes
2answers
530 views

Burpsuite: just passthrough firefox detect portal

When I enable Burpsuite's Proxy I continiously get http GET requests for firefox's detectportal as seen in the following image: How I can configure it to somehow just pass though theese requests ...
1
vote
1answer
83 views

are some IP whois capable of going beyond proxies?

I received a suspicious email (suspicious body) coming from a legit person. The headers always show the legit adress as if the person in question has been hacked. But I wanted to go further and ...
1
vote
0answers
281 views

2ip.io/privacy/ and 'Defining tunnel (two way ping)' on SOCKS5 proxy

I was able to setup my first proxy server on Ubuntu 14 using danted. However, when I visit 2ip.io/privacy/ and run their privacy test, they return: Defining tunnel (two way ping) found This is ...
1
vote
0answers
124 views

iOS traffic not shown in proxy when SSL pinning enabled

I have and iOS application to test. As per the latest security fix SSL pinning is enabled in the app. But now I am not able to see any traffic related to the application in my proxy tool. But ...
2
votes
1answer
297 views

How to route internet traffic through google

I'm in a situation which my network provider blocks all my internet access except for google and its branches (drive , gmail ,etc...). I'm looking for a way to route my traffic through google (with a ...
0
votes
1answer
690 views

Is it safe to use a proxy server within psiphon?

I have to use VPN services to access many websites, and among them, I use Psiphon the most. However, now it is hard to even access Psiphon. So I have to use a proxy server to connect to Psiphon. The ...
1
vote
1answer
175 views

How to create a proxy so that no website or web service can know that I am connecting through a proxy?

I want a proxy, preferably my own but I would be glad if there is a reliable service already, that is undetectable. Obviously, it does not send X-Forwarded-For. But it has to be much more than that to ...
3
votes
1answer
2k views

Telegram: Security risks for a user of using third-party socks5 proxy?

If a user decides to use a third-party SOCKS5 proxy for his Telegram client, what are possible security risks for the user? Specifically if the proxy suggests using the same login and password for ...
0
votes
0answers
40 views

Is Chrome + SOCKS5 anonymous enough to bypass second registration protection [duplicate]

Which level of ansonymyzation is enough if I'm not going to commit a crime but want to bypass a second registration rule at a general purpose site? Is Chrome + SOCKS5 enough for this? Which ...
1
vote
1answer
51 views

A tool or browser which changes the IP Address (Not like a single VPN, lots of different addresses) but fast [closed]

I am curious if there is a browser or tool that changes the IP continuously but not multiple routes like Tor instead just like a single proxy. I think there might be a way of configuring Tor Browser ...
5
votes
2answers
660 views

Why/how does Firefox bypass my employer's SSL decryption?

My employer has set up what they're calling "SSL decryption" for Internet access from within the company. I believe this is provided by an f5 device. They have installed a trusted root certificate on ...
3
votes
1answer
403 views

Highly anonymous proxies vs anonymous proxies

From this link about highly anonymous proxies: There’s another type of anonymous proxy called Highly Anonymous Proxy. The main difference with this one is the fact that aside from hiding your IP, ...
1
vote
0answers
83 views

Intercept data after sslstrip

I am able to use sslstrip successfully as shown here https://moxie.org/software/sslstrip/ What I want to do though is be able to use sslstrip with another proxy/script to modify requests/responses ...