Questions tagged [proxy]

The word "proxy" is mostly used as short for "proxy server", which is a server that acts as an intermediary between a workstation user and the Internet so that the enterprise can ensure security, administrative control, and caching service.

Filter by
Sorted by
Tagged with
0
votes
2answers
80 views

Alternative to Proxy servers for limiting internet access?

My company is using on premise DMZ proxy servers to limit internet access to employees working from home. When they use company laptop, they are automatically configured to go through the proxy server ...
0
votes
1answer
72 views

Detailed explanations on OWASP Zap Security scan rules

As an example, I have installed Anti-CSRF Scanning rule in ZAP proxy and scanned a POST request which does not verify the CSRF token value from the back end. Ideally, it is a CSRF vulnerability, but ...
1
vote
1answer
123 views

Local Burp Proxy not showing routed packets

I created a hotspot on wlp2s0 and connected an android device, whose IP is 10.42.0.62. I am trying to route my all packets from my wlp2s0 interface to burp proxy which running on 8080 and I also ...
0
votes
1answer
55 views

Run Hydra Through Series of Proxies?

Is there a way to run Hydra through a series of proxies so a website can't lock you out? Having a hard time finding a way to do this. Most websites will block you out if you take to many attempts at ...
4
votes
3answers
24k views

Get user real IP address if he is using VPN and Elite Proxy

I want to know if it's possible to reveal the real IP address of a user with JS:ScriptIP-inf [trj] or by other means, who is browsing a webpage which doesn't contain any Java Applet and the user uses ...
-1
votes
1answer
55 views

How Zscaler enables system wide proxy?

I have Zscaler service installed on my system and it does a good job of filtering content and malicious websites. I was wondering how does Zscaler manage to do this? I read that it creates a PAC file ...
11
votes
4answers
14k views

Does a TLS interception proxy present the user's browser with the end server's certificate?

I know that TLS (commonly but mistakenly called SSL) interception works by establishing two encrypted tunnels between a client and server, with the interception device (proxy) terminating both tunnels ...
2
votes
1answer
73 views

Should I check Host header or ServerName for CSRF defense when serving behind proxies?

In a CSRF defense based on checking forbidden headers, should I check Origin/Referer header against the ServerName configuration directive, or is it sufficient to simply check against the HTTP Host ...
1
vote
0answers
41 views

Unsupervised proxy - what could go wrong?

I recently finished setting up mitmproxy on a recently created DigitalOcean Ubuntu Droplet server. Almost immediately after opening the necessary ports in the server firewall and starting the proxy up,...
1
vote
1answer
45 views

What are the limitation on encrpyting proxy

i would like to know if i encrypt a proxy server communication with TLS v1.3 is it still possible for a firewall censor to a deep packet scanning to decrypt. Also, what can be done to make the ...
5
votes
1answer
3k views

Is it possible to redirect https to http in modern browsers?

What if I was an evil proxy operator who wanted to modify response content, but did not care if the victim sees http://? What happens if the browser requests https://example.com, but example.com has ...
0
votes
1answer
58 views

TLS/SSL Offloading to PA220 without requiring clients to load additional CA

If I'm understanding this correctly, the Palo Alto PA-220 allows for SSL/TLS traffic decryption using its proxy feature. By generating a Certificate Signing Request and loading it into the firewall, ...
1
vote
1answer
651 views

How effective is the ProxyGambit at allowing access to the internet without revealing true location and IP?

I'm very interested in purchasing or manufacturing this device on my own and maybe using it in conjunction with Tails/Tor: https://samy.pl/proxygambit/ According to the site: ProxyGambit is a ...
0
votes
1answer
36 views

Any there any tools like Burpsuite that fully support HTTP/2? [closed]

Nowadays websites start migrating to HTTP/2, but Burpsuite hasn't fully support HTTP/2 yet. I know HTTPCanary is good and support multiple protocols like replaying HTTP2 and even TCP/UDP, but that ...
2
votes
1answer
671 views

iOS traffic not shown in proxy when SSL pinning enabled

I have and iOS application to test. As per the latest security fix SSL pinning is enabled in the app. But now I am not able to see any traffic related to the application in my proxy tool. But ...
0
votes
1answer
62 views

Burp Suite upstream proxy

Is there a way to configure burpsuite's upstream proxy direct the traffic to the local box's proxy configuration? Additionally is there a way to exclude urls from being directed to the upstream proxy.
3
votes
3answers
567 views

Does Tor still hide all tracks?

I've seen some threads on Reddit that say true hackers, when attacking, go through a public WiFi network, use a VM, proxy through a zombie computer, use a VPN, then proxychain through Tor, use another ...
1
vote
1answer
220 views

IP-whitelisting for DB access, does solution fit best practices?

All the data we have on our customers sits in our data-lake, which is hosted by one of our suppliers. Currently the security is such that a limited number of users has (limited) access to the database ...
3
votes
1answer
134 views

Difference between different proxy types

While using VPN handler apps I have come across terms such as real host dual real host reverse proxy These terms appear under the proxy type tab. What is the difference between them and what is ...
1
vote
1answer
203 views

How to configure VPN + Tor + linux as a proxy server?

Goal To hide the IP address using Tor, which goes through a proxy server to make HTTP/FTP requests look like they came from a regular user, not one who uses Tor. Example A user requests the website. ...
2
votes
1answer
8k views

Proxying MetaSploit through BurpSuite

I was wondering how I would be able to proxy MetaSploit through BurpSuite. I was to reverse engineer a packet being sent to my ChromeCast, but I have no way of viewing the packet. Thanks.
0
votes
0answers
121 views

MITMPROXY on router

I am familiar with MITM LAN attacks using dnsspoof and arpspoof to read client data. Instead of spoofing the DNS and impersonating the router on my physical machine, I want to set up a MITM LAN ...
2
votes
1answer
477 views

tunnelling HTTP request through DMZ from a secured area

In my topology I have a secured area where all the servers are. There is also a DMZ with a few reverse proxy servers. I now need to make one of the servers in the secure area open to make HTTP calls ...
0
votes
1answer
2k views

Website doesn't provide cookie (csrf token) when connecting over proxy. Why/how?

The Python code below should grab a CSRF token cookie from Instagram.com, but I get an error message when running the program through any sort of HTTPS or SOCKS5 proxy, informing me that the CSRF ...
0
votes
0answers
28 views

Force Proxychains random_chaining to use a specific proxy

I want to proxy some of my traffic through the tor network, using proxychains, but I'd also like to have random chaining enabled. I'm worried that some of the traffic would not go through tor when it ...
1
vote
1answer
282 views

Using mitmproxy to analyze mobile application and iOS network data

I followed a guide where the author connected Windows PC and iPhone to his home WiFi network. He installed mitmproxy and ran mitmweb.exe on PC. On iPhone he went to wifi settings and set a manual ...
1
vote
1answer
127 views

Verifying client certificate by passing client cert in the header

I'm implementing client certificate authentication. My server is behind a proxy to which I have no control of. And also I don't have any control over the client side communication. During every ...
0
votes
2answers
88 views

Is it possible to create a hardware 'Plug and Play' TOR proxy?

Is there a way to use a device like a raspberrypi to create a kind of 'Plug and Play' TOR proxy? Ideally, a device would exist with an ethernet port as input and ethernet cable or USB as output which ...
-1
votes
1answer
73 views

CDN end to end encryption?

I setup Cloudflare CDN for my site. I added my site to Cloudflare and it asked me to add Cloudflare nameserver to my domain. I did that in my DNS registrar portal. That's all I did. Now I'm able to ...
4
votes
4answers
11k views

Burpsuite: just passthrough firefox detect portal

When I enable Burpsuite's Proxy I continiously get http GET requests for firefox's detectportal as seen in the following image: How I can configure it to somehow just pass though theese requests ...
2
votes
1answer
1k views

Open source or common implementations for reverse proxy web application security

I realize there is already a question similar to this one, but this is somewhat of a follow-up. I understand that a reverse proxy server by itself is hardly useful as a web app security measure ...
5
votes
5answers
5k views

Is it possible to locate Tor/proxy users? Spam is getting on my nerves

I'm managing a huge forum (over 15k posts and 500 users) and lately some guy uses a VPN (probably) to spam my forums with topics such as: "LOLOLOLOLOLOLOLOL" Now, I'm pretty sure he's using ...
1
vote
0answers
44 views

Strange Proxy Application Behavior on iOS 13.5.1

Background: My buddy is a freelance journalist working on a story on one of the bigger software companies (a household name, starts with an A). Anyway, he asked me to take a look at his iPad because ...
0
votes
0answers
57 views

How can a SOCKS5 proxy know client's datetime?

It seems that SOCKS5 proxies somehow know the client's timezone (at least) or maybe even the precise datetime. I determined this because the proxy tears the connection in case the local timezone on ...
0
votes
1answer
88 views

Is it possible to search HTTPS messages using homomorphic encryption?

We're trying to build a packet sniffer that can search and quarantine malware in encrypted transactions without decrypting said transactions. At present, we're exploring whether homomorphic encryption ...
5
votes
3answers
6k views

Intercepting SSL traffic on Android app

I am trying to intercept SSL traffic from my Android app to test the security. I am using certificate pinning in the hopes I can prevent people from snooping. I have tested by configuring ProxyDroid ...
1
vote
1answer
39 views

Why do CDNs allow arbitrary backend to be set, is it not a big security concern?

I found most CDNs allow the user to claim any domains to be the backend, I wonder why they do this instead of verifying if the user owns the backend domain. If I have myowndomain.com and set the ...
-2
votes
1answer
79 views

How to “see” all the traffic that leaves my network [closed]

Here is my setup: Cable Modem >> ASA 5505 >>> LAN I want to be able to see all the traffic that leaves the network such as what websites are being visited, IP connections made, etc. I would like to ...
1
vote
0answers
395 views

ZAP Error [java.net.ConnectException]: Connection refused (Connection refused)

I am trying to connect to http://challenge01.root-me.org/web-serveur/ch10/ in Firefox with FoxyProxy and OWASP ZAP and I got this error message ZAP Error [java.net.ConnectException]: Connection ...
0
votes
2answers
113 views

Nmap scanning with and without proxychains has different behaviour

I'm doing a nmap scan to my own machine to my own machine. First of all I set the port 333 to listen with this command sudo nc -lvnp 333 On the other terminal I run sudo nmap -O -sV -p 0-65535 IP ...
6
votes
2answers
2k views

Why/how does Firefox bypass my employer's SSL decryption?

My employer has set up what they're calling "SSL decryption" for Internet access from within the company. I believe this is provided by an f5 device. They have installed a trusted root certificate on ...
0
votes
1answer
1k views

How to sniff direct websocket connection in android ( i.e. no HTTP Upgrade connections ) using BURP?

I've pentested a lot of websites and a few apps too but this app eludes them all. On the websites, when there's a websocket upgrade the BURP proxy recognizes it and starts showing it in the websockets ...
1
vote
2answers
85 views

Malicious proxy and HTTPS

I am curious about security of proxy servers. I read a few threads and all of them were overly general or missed the point I am interested in, the devil is in the details. SCENARIO The malicious ...
0
votes
0answers
323 views

Force third party app to trust Charles Root Certificate

I downloaded two different third-party apps (running on Windows) in order to figure what HTTP calls does it make to an external server on the internet. Both apps are calling the same server as far ...
0
votes
1answer
47 views

Connecting to server with Proxy vs VPN

Suppose I have a server and no-one can hack into my local area network. I want to Remote Desktop into my server from Internet. Exposing RDP is the most foolish thing I did do once and the server was ...
0
votes
0answers
109 views

Dsniff doesn't capture packets in MITM attack?

My first time doing MITM attack on my own network. I've used arpspoof to redirect the victim's (my another pc) traffic to my machine and I've enabled packet forwarding. To view the traffic I ran dsiff....
2
votes
1answer
2k views

Burp with whatsapp

While doing some pentesting on an android app with Burp setup as a proxy (with https) I saw no traffic coming from whatsapp messages that I received or send. I looked around in Burp, but I cannot ...
1
vote
0answers
30 views

How to capure my web browser's and any other programs' http requests on my own laptop using mitmproxy?

I am using mitmproxy on ubuntu 18.04 I know how to capture another devices' traffic on my wifi network. but I don't know how to capture http requests which are sent by programs in my own laptop (...
0
votes
1answer
65 views

iptables: force clients to use proxy

My network: 192.168.0.1 server. (enp0s3 NAT, enp0s8 internal) 192.168.0.10-15 clients (enp0s3 internal). I have a proxysquid for blocking websites,and so on. My clients can navigate and browse any ...
0
votes
0answers
181 views

Tor + proxychainsfails fails when using theHarvester

I'm testing theHarvester on Kali Linux without VM. As Google blocks me after 3 times I used theHarvester I'm piping everything into proxychains. First I check my IP address with curl ifconfig.me/ip ...

1
2 3 4 5
13