Questions tagged [proxy]

The word "proxy" is mostly used as short for "proxy server", which is a server that acts as an intermediary between a workstation user and the Internet so that the enterprise can ensure security, administrative control, and caching service.

Filter by
Sorted by
Tagged with
0
votes
0answers
14 views

Let's encrypt certificate in the backend server [migrated]

I created a let's encrypt certificate for my domain and install my SSL certificate in the nginx reverse proxy. Now, I want to secure the communication between the proxy and the backend server using ...
0
votes
2answers
69 views

Is it possible to attack the main server through a reverse proxy server that only serves as a url rewrite?

I have a content site https://www.mysite.com I'm asking a client to configure a reverse proxy server connection in their server so everything inside the subdirectory 'external-content' gets pulled ...
1
vote
1answer
81 views

OpenVPN - efficient way to block websites for specific individual clients

I have been reading around the internet that I should be able to block traffic with two different methods. First of them is the hosts file. That's not my choice, because I would like to be able to ...
1
vote
1answer
66 views

Using mitmproxy to analyze mobile application and iOS network data

I followed a guide where the author connected Windows PC and iPhone to his home WiFi network. He installed mitmproxy and ran mitmweb.exe on PC. On iPhone he went to wifi settings and set a manual ...
0
votes
0answers
69 views

Phishing urls from shnpoc.net/McAfee?

I was looking into my websites traffic and found few entries from a subdomain for shnpoc.net domain. And when I looked into it, it was transparent proxying my website. On checking further, I found ...
2
votes
1answer
74 views

Is there any way to keep the request in intercepting proxy for atleast a min before application says check your connection?

I just bypassed SSL pinning on an android application but the problem is application won't let me play with the request on my intercepting proxy. It says something like problem with your network or ...
2
votes
0answers
53 views

Effective ways to hide your IP address and Device Information from apps on Mobile? [closed]

How can you make sure site admins are not able to get information like your IP, Browser, Device, etc?
1
vote
1answer
62 views

Protect admin page using proxy

I want to protect my admin page not only with a login and password, but also with IP filtering as described here: https://security.stackexchange.com/a/30649/68841 But I have two questions: Can I use ...
0
votes
1answer
55 views

Advantages of http CONNECT method over TLS

I wonder what the advantages of http CONNECT request over TLS are. I understand that the CONNECT request data from client to proxy is encrypted. But I want to know more specific advantages. Which ...
1
vote
2answers
134 views

Is it possible to tunnel my whole linux machine through http proxy? [closed]

For some reason i access my internet through a HTTP proxy. Is there a way to tunnel my whole Linux machine (currently am using ubuntu 18.04) through http proxy. If i change proxy setting in the ...
0
votes
0answers
40 views

Reverse proxy <=> server encryption needed? [duplicate]

We are developing a .NET Core app and we are running it behind reverse proxy (Traefik). Currently, we have 3 instances of .NET Core application running. Infrastructure schema looks something like this:...
41
votes
4answers
6k views

What benefits are there to blocking most search engines?

While on a client's site using the corporate network, I see that only a few search engines are allowed. Google and Bing, possibly others; while my fav DuckDuckGo is blocked, and a few others that I'...
1
vote
1answer
68 views

If I use a VPN, can an enterprise proxy insert itself in the middle?

I'm using the guest Wi-Fi at a large corporation, and connecting to a commercial VPN provider via the OpenVPN client. I do not know one way or another if a proxy is used on the guest wi-fi, but I ...
1
vote
3answers
153 views

TLS and reverse proxies

Hypothetically speaking, let's say I purchase the domain eve-mail.com and get a cert via LetsEncrypt. I then use a reverse proxy to point to the reputable and widely used alice-mail.com. Connecting ...
1
vote
2answers
245 views

SSL handshake not visible in Wireshark

In my organization we have a cloud proxy that work on a loopback address. The vendor of this proxy has deployed an app on our machine which listens on the loopback address. I have captured the apps ...
2
votes
1answer
89 views

SSL MITM Proxy Security - Can we rely on it?

In my organization, we have an SSL MITM (Man-in-the-middle) proxy (like ZScaler proxy). If I browse an HTTPS website and check the certificate, I can see that the proxy has issued a separate ...
3
votes
1answer
216 views

How to verify my connection is not going through MITM proxy?

I realized the issue a MITM proxy can pose to my privacy and I started to dig into it more to see how to detect it as a client. Things I know to check so far are: Checking who issues the certificate ...
1
vote
0answers
48 views

Securing a SOCKS5 to SSH Tunnel on Windows

In order to gain web access from the perspective of a remote device, it is very common to use the SOCKS5 to SSH Tunnel capability built into OpenSSH Client and Putty (detailed here). Both clients ...
2
votes
1answer
54 views

Is it possible to detect the application level protocol in a TLS tunnel without interception?

Consider a proxy that doesn't intercept TLS, but allows CONNECT tunnelling, but only to limited ports (eg: 443 only). If someone runs an ssh server on port 443 and connects to it using CONNECT, would ...
-2
votes
1answer
65 views

How to “see” all the traffic that leaves my network [closed]

Here is my setup: Cable Modem >> ASA 5505 >>> LAN I want to be able to see all the traffic that leaves the network such as what websites are being visited, IP connections made, etc. I would like to ...
0
votes
1answer
111 views

A Proxy that encrypts your data is the same thing as a VPN?

I have heard that a VPN encrypts your data but a proxy doesn't. So a proxy that encrypts your data is the same thing as a VPN?
1
vote
1answer
47 views

Reverse proxy isolation from insecure blog, are sessions vulnerable?

Hi I have a WebApp where security is important. E.g. www.somewebapp.com The app has a wordpress blog (hence not secure since wordpress). e.g. www.somewebapp.com/blog To protect the webapp from ...
0
votes
1answer
119 views

WPAD (badWPAD vulnerability) should I disable or not?

Hi I have read recently very bad things about WPAD vulnerability for example here nakedsecurity.sophos.com/2016/05/25/when-domain-names-attack-the-wpad-name-collision-vulnerability/ (article from ...
1
vote
0answers
127 views

mitmproxy request URL redirection does not work

I need to redirect the user's request in such a way when a user enters: https://a.com the mitmproxy redirect it to: https://www.newsite.com/?somepage From a previous post, I found this script in the ...
3
votes
2answers
563 views

Not able to intercept traffic from nike.com login request

I'm using BurpSuite to intercept the HTTP/HTTPS requests sent when logging in on https://www.nike.com/. I'm trying to achieve this with the following step: Opening BurpSuite and Firefox Turning on ...
-1
votes
1answer
235 views

mitmproxy: Error starting proxy server: OSError(98, 'Address already in use') [closed]

I just installed mitmproxy tool. I want to run it. Once I type: sudo mitmproxy I get this error: Error starting proxy server: OSError(98, 'Address already in use') I searched and found some ...
0
votes
1answer
49 views

Can a proxy server redirect traffic to malicious websites or modify downloads?

I was wondering if a proxy server from the internet could redirect traffic to malicious websites or download malware or even modify downloads( I do not plan on using a proxy server i found from the ...
0
votes
0answers
53 views

Using proxy over VPN? [duplicate]

If I setup a firefox browser with proxy settings, then I launch NordVPN, and start browsing through firefox with the proxy, will my data be encrypted? So in basic terms, will my proxy traffic also go ...
0
votes
2answers
171 views

Concept for (almost) untraceable networking setup

I have been working on an my digital footprint lately, trying to reduce it as much as possible, taking steps like fully encrypting my device with Veracrypt, installing 3 AVs, or spending hours trying ...
1
vote
2answers
405 views

How to locally monitor outgoing internet traffic?

I have a cable internet connection that goes to a ASA firewall and then into my local network where i have several machines including many VM's on a ESXI server. I am looking for a way to monitor ...
1
vote
1answer
93 views

What are the security implications of connecting to Tor through an SSH SOCKS proxy?

Suppose I have a user account on a remote server run by a friend. I create a SOCKS tunnel on my computer that forwards connections from a local port to the remote server: ssh -N -D 12345 john@10.1.1....
0
votes
1answer
189 views

Is it possible to browse HSTS sites over SOCKS5 proxy?

I am unable to browse HSTS websites using SOCKS5 proxy in chrome browser...getting this error... This site can’t be reached The web page at https://www.instagram.com/accounts/login/?hl=en might ...
0
votes
0answers
288 views

SSL handshake: Client Hello and Server Hello

I am trying to understand how a client communicates with a server when using a proxy. The client is an Android device, whom the traffic is proxied to the server through mitmproxy. This is my topology:...
0
votes
0answers
32 views

How can I forward SaaS calls from the client to a third-party service?

In the browser (e.g., for mysite.com) there is Javascript for third-party services, say somesaas.com. Let's say that I rewrite the Javascript so that it calls https://proxy.mysite.com instead of ...
0
votes
1answer
68 views

Is using a VPN or Proxy the only explanation for a wrong location being displayed?

My boyfriend is using an iPhone XS Max. He is in Johor, Malaysia, but his last active session displays that he is in Kuala Lumpur. He told me that he is in Johor, and he said the only reason why it's ...
1
vote
0answers
61 views

How is Indonesia blocking images in e2ee applications?

Indonesia's minister in communication and informatics supposedly blocked the sending of images and videos through social media from 22nd May until 25th May, in order to prevent hoaxes from spreading ...
2
votes
1answer
90 views

Security implications of client TLS termination

I have a bunch of HTTP services/devices TLS unaware. I want to allow them to access WAN, but of course I do not want them to do it in plain HTTP. Updating them is unworkable due to legacy issues and ...
22
votes
2answers
5k views

If the Charles SSL Proxy shows me sensitive data, is that data insecure/exposed?

Today I was exploring a website used for keeping track of student grades and everything related to school. Basically like a school progress tracker for your child which is used by 90% of schools in my ...
0
votes
1answer
133 views

Router administration page is served over HTTP

My wireless router admin page does not include https option. It is always served over http. This is obviously a concern in case someone is sniffing the network and can read my password in plain text. ...
-1
votes
1answer
359 views

Detect Proxy and Tor exit nodes from an IP in python

I have a database (hadoop) of the users who access my website (their IPs) and i want to check if those users either use proxy networks or the TOR network and block them. I also want to differentiate ...
2
votes
2answers
270 views

Security Benefits of Reverse Proxying Java / Tomcat WebApps Locally

Conventional wisdom seems to dictate that java applications should always be reverse proxied. It's what I have always done and so has everywhere I have worked at. I have read multiple times that ...
0
votes
0answers
105 views

How to intercept packets of system apps in Android?

I am unable to capture packets of native android email app in burp suite but able to capture packets of chrome browser. I have configured the proxy of my machine with burp port(8080) on the test ...
3
votes
1answer
320 views

What is a SOCKS proxy? [closed]

I am having a hard time understanding what a SOCKS proxy really is. I have been searching on Google, but so far, most websites compare SOCKS with an HTTP proxy, but they do not explain in detail what ...
0
votes
0answers
312 views

Azure AD Application Proxy Security Concerns + Azure Application Gateway (WAF) Better?

I am still new to security and still learning the basics so was interested in getting some feedback on two Azure services. Edit: We are a school and the application's host 4000+ parent and student ...
1
vote
1answer
266 views

Defeat iOS Certificate Pinning by replacing the hardcoded certificate in the executable?

I'm analysing an iOS application and its communications through Charles. I have access to most of SSL communications but not all, due to certificate pinning. I know that there are many different ways ...
-1
votes
2answers
159 views

How does this spyware intercept my https traffic? [duplicate]

The firm I'm working for has installed a "spying" software on my computer which intercepts my https traffic. No hard to understand how it works, it's something like mitmproxy, which signs on the fly ...
-2
votes
3answers
317 views

How can I stay anonymous in a LAN without Internet access?

I need to perform attacks (SQL injection) on a server. I thought of using a proxy to be anonymous, but the topology is a LAN without Internet access. I have no idea of the protocols used in the ...
0
votes
0answers
157 views

Meterpreter Over HTTPS Proxy

I have a proxy server on the WAN as well as my box open to the WAN. I want this proxy server to (when it receives a shell), route it to my host so it can be the "man in the middle" between my ...
1
vote
2answers
85 views

What happens if I use a proxy through software such as Proxifier and also use a software which supports working through proxy servers?

Let me give you an example: I use proxifier to use a proxy that uses IP from Germany. So when I check https://www.whatismyip.com/ it shows as if I'm from Germany. So imagine if I have a software on ...
0
votes
1answer
356 views

What's the security concern of browsers using the HTTP CONNECT method?

The XMLHttpRequest spec says that attempted usage of the CONNECT method should throw a security error. Is there a security issue with client-side JavaScript sending CONNECT requests to servers? It ...