Questions tagged [proxy]

The word "proxy" is mostly used as short for "proxy server", which is a server that acts as an intermediary between a workstation user and the Internet so that the enterprise can ensure security, administrative control, and caching service.

Filter by
Sorted by
Tagged with
0
votes
1answer
66 views

Detailed explanations on OWASP Zap Security scan rules

As an example, I have installed Anti-CSRF Scanning rule in ZAP proxy and scanned a POST request which does not verify the CSRF token value from the back end. Ideally, it is a CSRF vulnerability, but ...
0
votes
2answers
79 views

Alternative to Proxy servers for limiting internet access?

My company is using on premise DMZ proxy servers to limit internet access to employees working from home. When they use company laptop, they are automatically configured to go through the proxy server ...
0
votes
1answer
49 views

Run Hydra Through Series of Proxies?

Is there a way to run Hydra through a series of proxies so a website can't lock you out? Having a hard time finding a way to do this. Most websites will block you out if you take to many attempts at ...
-1
votes
1answer
50 views

How Zscaler enables system wide proxy?

I have Zscaler service installed on my system and it does a good job of filtering content and malicious websites. I was wondering how does Zscaler manage to do this? I read that it creates a PAC file ...
2
votes
1answer
73 views

Should I check Host header or ServerName for CSRF defense when serving behind proxies?

In a CSRF defense based on checking forbidden headers, should I check Origin/Referer header against the ServerName configuration directive, or is it sufficient to simply check against the HTTP Host ...
1
vote
0answers
41 views

Unsupervised proxy - what could go wrong?

I recently finished setting up mitmproxy on a recently created DigitalOcean Ubuntu Droplet server. Almost immediately after opening the necessary ports in the server firewall and starting the proxy up,...
1
vote
1answer
45 views

What are the limitation on encrpyting proxy

i would like to know if i encrypt a proxy server communication with TLS v1.3 is it still possible for a firewall censor to a deep packet scanning to decrypt. Also, what can be done to make the ...
0
votes
1answer
35 views

Any there any tools like Burpsuite that fully support HTTP/2? [closed]

Nowadays websites start migrating to HTTP/2, but Burpsuite hasn't fully support HTTP/2 yet. I know HTTPCanary is good and support multiple protocols like replaying HTTP2 and even TCP/UDP, but that ...
0
votes
1answer
62 views

Burp Suite upstream proxy

Is there a way to configure burpsuite's upstream proxy direct the traffic to the local box's proxy configuration? Additionally is there a way to exclude urls from being directed to the upstream proxy.
0
votes
0answers
114 views

MITMPROXY on router

I am familiar with MITM LAN attacks using dnsspoof and arpspoof to read client data. Instead of spoofing the DNS and impersonating the router on my physical machine, I want to set up a MITM LAN ...
0
votes
0answers
27 views

Force Proxychains random_chaining to use a specific proxy

I want to proxy some of my traffic through the tor network, using proxychains, but I'd also like to have random chaining enabled. I'm worried that some of the traffic would not go through tor when it ...
1
vote
1answer
113 views

Verifying client certificate by passing client cert in the header

I'm implementing client certificate authentication. My server is behind a proxy to which I have no control of. And also I don't have any control over the client side communication. During every ...
0
votes
2answers
87 views

Is it possible to create a hardware 'Plug and Play' TOR proxy?

Is there a way to use a device like a raspberrypi to create a kind of 'Plug and Play' TOR proxy? Ideally, a device would exist with an ethernet port as input and ethernet cable or USB as output which ...
1
vote
1answer
201 views

How to configure VPN + Tor + linux as a proxy server?

Goal To hide the IP address using Tor, which goes through a proxy server to make HTTP/FTP requests look like they came from a regular user, not one who uses Tor. Example A user requests the website. ...
-1
votes
1answer
73 views

CDN end to end encryption?

I setup Cloudflare CDN for my site. I added my site to Cloudflare and it asked me to add Cloudflare nameserver to my domain. I did that in my DNS registrar portal. That's all I did. Now I'm able to ...
1
vote
0answers
44 views

Strange Proxy Application Behavior on iOS 13.5.1

Background: My buddy is a freelance journalist working on a story on one of the bigger software companies (a household name, starts with an A). Anyway, he asked me to take a look at his iPad because ...
0
votes
0answers
56 views

How can a SOCKS5 proxy know client's datetime?

It seems that SOCKS5 proxies somehow know the client's timezone (at least) or maybe even the precise datetime. I determined this because the proxy tears the connection in case the local timezone on ...
0
votes
1answer
88 views

Is it possible to search HTTPS messages using homomorphic encryption?

We're trying to build a packet sniffer that can search and quarantine malware in encrypted transactions without decrypting said transactions. At present, we're exploring whether homomorphic encryption ...
1
vote
1answer
39 views

Why do CDNs allow arbitrary backend to be set, is it not a big security concern?

I found most CDNs allow the user to claim any domains to be the backend, I wonder why they do this instead of verifying if the user owns the backend domain. If I have myowndomain.com and set the ...
1
vote
0answers
364 views

ZAP Error [java.net.ConnectException]: Connection refused (Connection refused)

I am trying to connect to http://challenge01.root-me.org/web-serveur/ch10/ in Firefox with FoxyProxy and OWASP ZAP and I got this error message ZAP Error [java.net.ConnectException]: Connection ...
0
votes
2answers
104 views

Nmap scanning with and without proxychains has different behaviour

I'm doing a nmap scan to my own machine to my own machine. First of all I set the port 333 to listen with this command sudo nc -lvnp 333 On the other terminal I run sudo nmap -O -sV -p 0-65535 IP ...
1
vote
2answers
82 views

Malicious proxy and HTTPS

I am curious about security of proxy servers. I read a few threads and all of them were overly general or missed the point I am interested in, the devil is in the details. SCENARIO The malicious ...
0
votes
0answers
313 views

Force third party app to trust Charles Root Certificate

I downloaded two different third-party apps (running on Windows) in order to figure what HTTP calls does it make to an external server on the internet. Both apps are calling the same server as far ...
0
votes
1answer
47 views

Connecting to server with Proxy vs VPN

Suppose I have a server and no-one can hack into my local area network. I want to Remote Desktop into my server from Internet. Exposing RDP is the most foolish thing I did do once and the server was ...
0
votes
1answer
56 views

TLS/SSL Offloading to PA220 without requiring clients to load additional CA

If I'm understanding this correctly, the Palo Alto PA-220 allows for SSL/TLS traffic decryption using its proxy feature. By generating a Certificate Signing Request and loading it into the firewall, ...
0
votes
0answers
103 views

Dsniff doesn't capture packets in MITM attack?

My first time doing MITM attack on my own network. I've used arpspoof to redirect the victim's (my another pc) traffic to my machine and I've enabled packet forwarding. To view the traffic I ran dsiff....
1
vote
0answers
30 views

How to capure my web browser's and any other programs' http requests on my own laptop using mitmproxy?

I am using mitmproxy on ubuntu 18.04 I know how to capture another devices' traffic on my wifi network. but I don't know how to capture http requests which are sent by programs in my own laptop (...
0
votes
1answer
62 views

iptables: force clients to use proxy

My network: 192.168.0.1 server. (enp0s3 NAT, enp0s8 internal) 192.168.0.10-15 clients (enp0s3 internal). I have a proxysquid for blocking websites,and so on. My clients can navigate and browse any ...
0
votes
0answers
170 views

Tor + proxychainsfails fails when using theHarvester

I'm testing theHarvester on Kali Linux without VM. As Google blocks me after 3 times I used theHarvester I'm piping everything into proxychains. First I check my IP address with curl ifconfig.me/ip ...
0
votes
4answers
93 views

Does routing internet traffic via VPN through a company proxy gain any more security?

There is currently an ongoing discussion in our company about what security measures to put in place regarding workstation access to the company network and the internet. Situation: Employees have ...
2
votes
1answer
645 views

Intercepting TCP traffic through MITM attack

I'm trying to capture TCP requests through Burp Suite with this hacky method. Basically it listens for user selected protocol requests (TCP/UDP) and then forwards them to Burp Suite (or any other ...
0
votes
0answers
77 views

Page keep loading in BurpSuite

I have literally tried everything. Set my proxies to 127.0.0.1 with 8080 port Installed certificate set hijacking proxies to True in Firefox Reset Burp Suite settings to default Other browsers Is ...
0
votes
1answer
94 views

Remote working. Is my employer able to monitor my activity

Due to situation, my employer made a work-from-home policy. And remote administration tool is not installed, since I did clean installation of the system. Is my employer able to see my activity? ...
0
votes
0answers
62 views

Firefox bypass proxy for some addresses - why?

I'm using the latest firefox on a ubuntu 18.04 OS. Today I noticed some outgoing connection which are bypassing my proxy server. For example: $ netstat -tpun tcp 0 0 my-local-ip:44214 ...
0
votes
2answers
105 views

Is it safe to have an opened port on my PC with a proxy server listening?

I have a single port open for my own proxy server. All other ports are closed. Is it safe for my PC? Even if my port will keep getting bombed by hackers could my PC be exposed to them? There is no ...
0
votes
0answers
85 views

How to use Burp Suite together with The BodgeIt Store?

The BodgeIt Store is a vulnerable web application for studying web development security. It can be downloaded from the internet and installed locally on your computer as a docket container. This web ...
1
vote
1answer
80 views

How to display HTTPS contents [Using Proxy]

I'm a beginner at proxy traffic stuff and I'm struggling here with Charles Proxy I'm trying to 'intercept traffic'. I have an HTTPS page and I want to display the data from the content (inside ...
-1
votes
1answer
79 views

Stop VPN access from wifi router

Is it possible to stop VPN access for all devices when you are the administrator of the wireless connection?
0
votes
0answers
66 views

Remotely poisoning Cloudflare's cache servers by James Kettle's Web Cache Poisoning Attack?

I am recently exploring and playing with James Kettle's Practical Web Cache Poisoning attack. The last part of his post mentioned that Cross-Cloud Poisoning is possible, however, I can't find a way to ...
0
votes
1answer
65 views

Is it possible to remote forward tcp through a free proxy

I’m aware you can forward connection from a proxy server like this: ssh -R 8080:localhost:80 public.example.com But I’m curious if it’s possible to forward from a free proxy such as: https://free-...
1
vote
3answers
188 views

Is it possible to scan the whole IP range to find a domain behind the CDN?

I am very curious if it is possible to find the real IP address of a domain "protected" by a CDN service. For example, www.cnn.com uses Fastly service, and the domain name only resolves to a Fastly ...
3
votes
3answers
565 views

Does Tor still hide all tracks?

I've seen some threads on Reddit that say true hackers, when attacking, go through a public WiFi network, use a VM, proxy through a zombie computer, use a VPN, then proxychain through Tor, use another ...
0
votes
0answers
516 views

Charles Proxy intercepting SSL Pinning enabled traffic

An Android application that has SSL Pinning was successfully tested on a mobile device running Android 6 (with the certificates installed) using Burp proxy and OWASP ZAP Proxy. As expected the ...
0
votes
0answers
324 views

How can I proxy traffic of macOS Mojave APPS using Burp Suite?

If I do a web search for proxying macOS apps using Burp Suite, I don't get any useful info. Instead, I get dozens of results talking about how to proxy iOS or Android apps. I am talking about desktop ...
1
vote
1answer
467 views

Pfsense security issues?

I have used pfsense before as the main gateway, load balancer, traffic shaping, proxy, firewall, virus/malware protection, enterprise wifi solution for an entire office of 50+ users. Yet I have ...
1
vote
1answer
122 views

Local Burp Proxy not showing routed packets

I created a hotspot on wlp2s0 and connected an android device, whose IP is 10.42.0.62. I am trying to route my all packets from my wlp2s0 interface to burp proxy which running on 8080 and I also ...
2
votes
1answer
169 views

Is it possible to be infected with malware/virus via a proxy?

I'm curious as to whether you can be infected with malware by using a proxy? I currently process data using Python but occasionally I encounter recaptcha, so I'm looking to implement proxy support. ...
-1
votes
1answer
94 views

What is the difference between browser based VPN and desktop VPN by anonymity point of view?

For example : Nordvpn provides both chrome extension and its desktop software. Opera provides a free browser vpn, etc.. Some people says the browser extensions may leak dns but i never had an ...
1
vote
1answer
916 views

How does proxychains avoid DNS leaks?

Also directly related, how are the DNS servers queried when using proxychains? Assume I'm using Tor for proxychains. If I uncomment the DNS part of proxychains.conf, my requests supposedly get sent ...
0
votes
2answers
79 views

Is there anything I can do past SSL pinning to secure my connection? [closed]

My goal is to prevent man-in-the-middle (MITM) attacks through proxies. I've implemented SSL pinning, which has helped significantly, but I'm wondering if there's anything more I can do that's worth ...

1
2 3 4 5
13