Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [proxy]

The word "proxy" is mostly used as short for "proxy server", which is a server that acts as an intermediary between a workstation user and the Internet so that the enterprise can ensure security, administrative control, and caching service.

0
votes
1answer
25 views

Proxy over pptp VPN in a TMG server

Our Company is using a TMG (Threat Management Gateway) server to grant the employees access to the internet. It's not strict and users can make VPN connections and use the proxy extension of Chrome as ...
-1
votes
0answers
25 views

Basic reverse proxy setup with Nginx [on hold]

I'm trying to set up a basic reverse proxy server for the first time to harden my home IP security camera with HTTPS because the camera doesn't support it natively. The camera is behind my pfSense ...
1
vote
1answer
28 views

What's the point in a proxy server authorizing/authenticating clients?

I've implemented a SOCKS5 proxy library, but I just don't get the point of authenticating (or encrypting) connections, which the RFC (1928) seemed pretty adamant about. Isn't anonymity the whole idea ...
0
votes
1answer
58 views

Use bettercap to sniff traffic going through a proxy configured in the browser?

Using bettercap, how can I intercept traffic which goes to a proxy server which is configured in browser? With no proxy configured it is working fine. But as soon as a proxy is set in the browser ...
1
vote
1answer
46 views

IP-whitelisting for DB access, does solution fit best practices?

All the data we have on our customers sits in our data-lake, which is hosted by one of our suppliers. Currently the security is such that a limited number of users has (limited) access to the database ...
0
votes
1answer
26 views

How can AWS API Gateway be used to rapidly rotate credentials in this fashion?

Reading through this article, I hit a little wall of understanding. The author states: This is because my laptop doesn’t have the secret weapon. Once you get this up and running on an EC2 ...
0
votes
0answers
22 views

MITM between device and PC in a different network using adb

I am trying to intercept my Android network. Is it possible to intercept network traffic between an Android device and my computer only by using ADB (Android Debug Bridge)? Only a cable should be used ...
0
votes
0answers
19 views

Is there workaround for a man in the middle proxy using Shell in a Box?

I noticed at my customer's organisation that there is a proxy breaking the https flow. Certificates do not belong to the https web site, but to the organisation itself. They are using it for scanning ...
0
votes
0answers
15 views

iOS traffics fails to proxy

I have an issue proxying my traffic from my jailbroken iPhone device (iOS 11, iPhone 8) I have already checked/done the following: The laptop with burp and the iPhone are on the same network. I can ...
0
votes
1answer
35 views

Can I have a certificate on one server and the key on another?

Let's say I have a Server A with a valid certificate and a Server B with the key for the certificate. Client === Nginx Proxy with valid cert === Apache with key I don't want Ngnix to decrypt all ...
1
vote
0answers
37 views

How to reproduce the RTP bleed vulnerability?

I need to demonstrate RTP bleed on an older version of Asterisk/RTPProxy, but I'm struggling with setting up the environment. Can somebody please tell me how to configure a proxy and two clients ...
0
votes
1answer
31 views

Not able to see WebGoat requests in ZAP proxy

I have configured ZAP to port 8090 and also Firefox to 8090, but I am unable to see any requests from WebGoat lessons, whatsoever, except the initial request of http://detectportal.firefox.com. ...
4
votes
1answer
117 views

How to securely store API keys

I need to store API keys for my users. These keys are extremely valuable as they are used to buy and sell things. Some users won't want to give these keys to anyone, and I'm trying to figure out a ...
-3
votes
1answer
130 views

Risks of using free proxy and VPN services [closed]

There are millions of people that are daily using free Proxy and/or free VPN service for different purposes, some of these services are famous and have many users. What are the risks when using a ...
0
votes
2answers
48 views

How does proxylist sites discover new proxy?

I always got proxies from proxylist websites but I never asked me how these sites discover new proxy. So how?
1
vote
1answer
116 views

How do CORS proxy websites work?

While I was developing the front-end side of my web project, I got an CORS protection error. Not surprising since my front-end project was not in the same origin. After some search on how to bypass ...
-1
votes
2answers
143 views

What's the stealthiest proxy program available? [closed]

If, theoretically, one was using a network that force-disconnects your device from itself if you are detected using a proxy (such as a network configured with Cisco Umbrella or similar), but a proxy ...
0
votes
0answers
112 views

OWASP ZAP Gateway timeout?

I'm trying to setup ZAP to run as a part of my build definition in TFS. Whenever the build is running, I can see that the call is reaching ZAP and the spider will start scanning. It seems to ...
1
vote
2answers
59 views

nmap -sn through proxychains fails

Why I can not do the following with nmap? proxychains nmap -A -v 10.185.11.0/24 Output: ProxyChains-3.1 (http://proxychains.sf.net) Starting Nmap 7.60 ( https://nmap.org ) at 2018-08-07 10:12 EEST ...
-1
votes
2answers
131 views

How to prevent phishing proxy attack with tool like Evilginx? [closed]

How as a web developer I can prevent phishing proxy attack with a tool like Evilginx?
-1
votes
1answer
97 views

Risk in having the PAC file in a server with no authorisation

So basically I’ve put my PAC-file under a non-secure web server with no authentication whatsoever in my organization. Later, I found out that there have been many attacks using this file type in other ...
0
votes
0answers
9 views

Application not able to use authentication when connecting to certain repositories

For development, I got the issue that clients often need to connect to different software repositories and the application itself is not able to use authentication. This does not only concern a ...
0
votes
2answers
93 views

If I'm using a SSL proxy, can the owner of that server decrypt and read my packets when I'm connected to a HTTPS website? (Password and etc)

So basically can they use some sort of man in the middle attack and decrypt and read my packets? I use their own app to use their SSL proxy and i tried scanning it with Kaspersky and it found no ...
1
vote
1answer
85 views

How secure are free proxy and VPN?

Preamble: I live in Russia where some web sites (linkedin e. g.) are blocked by government (Roskomnadzor). So I and many citizens use popular free browser-extensions (and mobile apps from same brands) ...
-1
votes
1answer
100 views

Is this good privacy? [closed]

I would love to protect my privacy online. I thought of a setup when I connect through a VPN, get a Linux VM and use VPN on that, then use just a proxy on the browser in the VM. My computer > VPN &...
2
votes
1answer
238 views

Tunnel ssh over http with custom headers

I'm trying to set up corkscrew to make an SSH tunnel over HTTP, but I need to add custom headers after the "CONNECT" statement and before the ssh tunnel. Does corkscrew support it? If yes, how can I ...
32
votes
6answers
8k views

What legitimate uses do browser proxies have?

The only time I've used my browser's proxy settings is when setting up Burp Pro, which makes me wonder: What was the original use-case for these settings? Other than testing / debugging, what was ...
1
vote
2answers
182 views

Should we enable TLS on backend connection after reverse proxy? [duplicate]

I have a reverse proxy (e.g. nginx, nghttpx, haproxy) that proxies connection to a service running on the same physical server. I think the most common way to configure this setup is to enable TSL ...
0
votes
2answers
154 views

Is it generally safe to disable Windows 10 Proxy Auto-Discovery Protocol (WPAD)?

Is it generally safe to disable Windows 10 Proxy Auto-Discovery Protocol (WPAD)? This might be my only option to try before contacting my ISP which could be quite annoying to do.
1
vote
1answer
141 views

Can you forward TLS connections according to SNI domain without terminating the connection at the reverse proxy?

I am developing an application that needs to expose two services: REST API with https and client certificate authentication (https://api.device.example.org:4431, server certificate issued by private ...
0
votes
0answers
160 views

mitm with Docker

I'm trying to capture traffic between two Docker containers ("webserver" and "chrome_client"), using an "intermediate" container in MITM mode. So we have this basic topology: [chrome_client] --> [...
1
vote
1answer
130 views

Could a VPN server hide all user's information? [closed]

I'm trying to access some server using VPN(Or generally say, proxy). But sometimes the server could detect that I'm behind a proxy(And sometimes not). So I'm wondering what information could be ...
5
votes
2answers
674 views

Would a reverse-proxy authentication server be a secure setup?

I work at a small consultancy and we often make web apps for our clients. One part of the web app that is often repetitive to write is the authentication system. In a lot of our web apps we would ...
2
votes
1answer
6k views

MTproto Proxy Security in Telegram App

In Telegram messenger, latest update, there is an option to set connection type to MTProto Proxy. Note: There is a detailed description by Telegram team on MTProto. Now telegram officially ...
4
votes
2answers
301 views

Burpsuite: just passthrough firefox detect portal

When I enable Burpsuite's Proxy I continiously get http GET requests for firefox's detectportal as seen in the following image: How I can configure it to somehow just pass though theese requests ...
1
vote
1answer
82 views

are some IP whois capable of going beyond proxies?

I received a suspicious email (suspicious body) coming from a legit person. The headers always show the legit adress as if the person in question has been hacked. But I wanted to go further and ...
1
vote
0answers
204 views

2ip.io/privacy/ and 'Defining tunnel (two way ping)' on SOCKS5 proxy

I was able to setup my first proxy server on Ubuntu 14 using danted. However, when I visit 2ip.io/privacy/ and run their privacy test, they return: Defining tunnel (two way ping) found This is ...
1
vote
0answers
97 views

iOS traffic not shown in proxy when SSL pinning enabled

I have and iOS application to test. As per the latest security fix SSL pinning is enabled in the app. But now I am not able to see any traffic related to the application in my proxy tool. But ...
2
votes
1answer
260 views

How to route internet traffic through google

I'm in a situation which my network provider blocks all my internet access except for google and its branches (drive , gmail ,etc...). I'm looking for a way to route my traffic through google (with a ...
0
votes
1answer
547 views

Is it safe to use a proxy server within psiphon?

I have to use VPN services to access many websites, and among them, I use Psiphon the most. However, now it is hard to even access Psiphon. So I have to use a proxy server to connect to Psiphon. The ...
1
vote
1answer
154 views

How to create a proxy so that no website or web service can know that I am connecting through a proxy?

I want a proxy, preferably my own but I would be glad if there is a reliable service already, that is undetectable. Obviously, it does not send X-Forwarded-For. But it has to be much more than that to ...
3
votes
1answer
1k views

Telegram: Security risks for a user of using third-party socks5 proxy?

If a user decides to use a third-party SOCKS5 proxy for his Telegram client, what are possible security risks for the user? Specifically if the proxy suggests using the same login and password for ...
0
votes
0answers
38 views

Is Chrome + SOCKS5 anonymous enough to bypass second registration protection [duplicate]

Which level of ansonymyzation is enough if I'm not going to commit a crime but want to bypass a second registration rule at a general purpose site? Is Chrome + SOCKS5 enough for this? Which ...
1
vote
1answer
50 views

A tool or browser which changes the IP Address (Not like a single VPN, lots of different addresses) but fast [closed]

I am curious if there is a browser or tool that changes the IP continuously but not multiple routes like Tor instead just like a single proxy. I think there might be a way of configuring Tor Browser ...
5
votes
2answers
542 views

Why/how does Firefox bypass my employer's SSL decryption?

My employer has set up what they're calling "SSL decryption" for Internet access from within the company. I believe this is provided by an f5 device. They have installed a trusted root certificate on ...
3
votes
1answer
307 views

Highly anonymous proxies vs anonymous proxies

From this link about highly anonymous proxies: There’s another type of anonymous proxy called Highly Anonymous Proxy. The main difference with this one is the fact that aside from hiding your IP, ...
1
vote
0answers
70 views

Intercept data after sslstrip

I am able to use sslstrip successfully as shown here https://moxie.org/software/sslstrip/ What I want to do though is be able to use sslstrip with another proxy/script to modify requests/responses ...
-3
votes
2answers
236 views

HTTPS Proxy Content Inspection [closed]

Is it possible for a proxy server to do content inspection on HTTPS traffic?
1
vote
0answers
283 views

Burp suite “Unrecognized SSL message, plaintext connection?” error

While running burp suite as an intercept proxy on a users computer, I am getting an error in the burp log saying: Unrecognized SSL message, plaintext connection? I have the certificate installed on ...
5
votes
3answers
81 views

How do I diagram a network node with multiple layers of trust?

If I'm communicating security and trust over a network, I might simply note trusted and untrusted nodes. For example, when making an HTTPS connection over some kind proxy node that I own and operate, ...