Questions tagged [proxy]

The word "proxy" is mostly used as short for "proxy server", which is a server that acts as an intermediary between a workstation user and the Internet so that the enterprise can ensure security, administrative control, and caching service.

Filter by
Sorted by
Tagged with
85
votes
9answers
96k views

Can my company see what HTTPS sites I went to?

At work my company uses internet monitoring software (Websense). I know if I visit a https ssl-encrypted site (such as https://secure.example.com) they can't see what I'm doing on the site since all ...
21
votes
3answers
4k views

Anonymous web browser. Is it real?

Do anonymous browsers work? What principles do they use? Can I use them to test access to my web site? Can I detect if a visitor is using one? What is the different between traditional and anonymous ...
58
votes
4answers
5k views

What security risks are posed by software vendors deploying SSL Intercepting proxies on user desktops (e.g. Superfish)

There has been quite a bit of concern noted relating to the recent discovery that Lenovo are pre-installing a piece of Adware (Superfish) which has the capability of intercepting SSL traffic from ...
48
votes
2answers
68k views

Why is it possible to sniff an HTTPS / SSL request?

I'm new to the realm of HTTP requests and security and all that good stuff, but from what I've read, if you want your requests and responses encrypted, use HTTPS and SSL, and you'll be good. Someone ...
25
votes
6answers
19k views

Why is Tor safer than a proxy?

If I use a Tor router to browse the regular internet, my traffic must leave the Tor network through an exit node. Apparently the exit node can see the data originally sent. Is this true? If an ...
26
votes
3answers
30k views

Authenticating a Proxy server over HTTPS

When browsing to a website over HTTPS, the web browser typically does a lot of work in the background - negotiating a secure channel, validating the site's certificate, verifying the trust chain, etc. ...
8
votes
2answers
42k views

Nmap through proxy

Using the following command: nmap --proxy socks4://*.*.*.*:25074 -sV -O --reason scanme.nmap.org I'm not sure if nmap is really using the proxy specified Had an idea of scanning "localhost" or "127....
7
votes
3answers
3k views

Reveal the True IP of a User

Is there any best practice method (and preferably documented) way of revealing the True IP of a user using a HTTP(S) connection? I.e.: To be able to uncover the true IP from transparent as well as ...
11
votes
4answers
14k views

Does a TLS interception proxy present the user's browser with the end server's certificate?

I know that TLS (commonly but mistakenly called SSL) interception works by establishing two encrypted tunnels between a client and server, with the interception device (proxy) terminating both tunnels ...
11
votes
3answers
18k views

How do I check that I have a direct SSL connection to a website?

I always thought that if I had an SSL connection there would be no MITM attacks. Now it appears that isn't true (see comments in this question Is it okay from a security perspective to read foreign (...
10
votes
4answers
7k views

How effective are reverse proxies as a web application security measure?

How effective are reverse proxies as a web application security device? Which types of threats do they mitigate against and which don't they? For example are they more effective in preventing ...
10
votes
4answers
11k views

Man-in-the-middle Blue Coat proxy SSL or what?

I have just discovered that my workplace has enabled some new features in the Blue Coat network proxy. It seems like all HTTPS certificates in Chrome on Windows are being issued by this internal ...
9
votes
1answer
5k views

How do I know if my company or my ISP is using a TLS proxy?

I was reading the other day on "Does https prevent man in the middle attacks by proxy server?". Let me quote few lines: Blue Coat, the biggest name in the SSL interception business, is far from ...
14
votes
4answers
4k views

Can real end-to-end SSL encryption be made?

I've read the various questions tagged [ssl] and [mitm] and [proxy] and I couldn't find a duplicate. I've got a very precise question but first I need to give some background. Basically I'm very ...
12
votes
3answers
6k views

How can end-users detect malicious attempts at SSL spoofing when the network already has an authorized SSL proxy?

I'm working on one client's network where they have enabled HTTPS authority spoofing on their proxy. This allows them to effectively perform a man-in-the-middle attack to decipher all outgoing ...
8
votes
2answers
13k views

How does SSL Proxy server in company work?

Many companies use a network proxy in order to intercept web-based traffic for example. I have some questions about their functioning: 1) I've never seen SSL warning in company. I doubt that they ...
8
votes
3answers
11k views

SSL VPN Detection and possible to block

Is it possible to determine the difference between a VPN on port 443 compared to standard SSL traffic? In order to access SSL websites you need port 443 open but if you setup a VPN Service on port ...
0
votes
2answers
141 views

Protect SSL connections from MITM for users with modified clients

I'm working on a web app that uses SSL. I'm afraid that some people might access the app via a network that uses a proxy to intersect and inspect the SSL traffic [MITM]. Some people might access the ...
5
votes
3answers
21k views

Why is JavaScript disabled in the Tor Browser Bundle?

Didn't Tor create a local socks proxy? Why doesn't all the Web traffic go over this local socks proxy and why is JavaScript disabled in the Tor Browser bundle? If you would connect with firefox for ...
9
votes
1answer
19k views

Does an HTTPS proxy encrypt traffic between proxy client and server for HTTP requests?

To bypass censorship in a DIY fashion, I plan to set up private proxies for my personal use. One of the possible methods I would try is to use an HTTPS proxy (not a web proxy, to be explicit) hosted ...
41
votes
2answers
9k views

Why hasn't anyone taken over Tor yet?

Tor is known to encrypt the transferred content and the meta information by layering the encryption. I know there have been correlation attacks that deanonymized some users by federal agencies. Why ...
11
votes
4answers
39k views

Advanced techniques for detecting a proxy/getting original IP

In what manner can a website detect my original IP address, even though I'm using a proxy server? I've noticed this with a few sites. There are four proxy methods I've used: Firefox with a proxy ...
22
votes
1answer
15k views

Is SOCKS secure?

In order to create a VPN, I open an SSH tunnel with a command like ssh -D 9000 user@host, and then I set my system's proxy settings to use SOCKS5 through localhost:9000. Well, setting up my home ...
11
votes
1answer
37k views

How does a website detect proxy? [duplicate]

How can a specific website detect that I'm surfing via proxy? Is there a way to use proxy and not get detected? If so, how?
16
votes
2answers
25k views

Securing remotely accessible IP cameras that do not support HTTPS

I have some IP cameras set up on my home network, which is WPA2 protected. These cameras are setup to be accessible from the Internet thru my router's DDNS address, and port number. So for example, ...
14
votes
2answers
4k views

How does dnsleaktest.com find my DNS provider

Can't see how they find this over the web. I'm on Windows, its in my network config. It changes when I use a VPN provider, but not when I use a local socks proxy connected to a remote server over ...
11
votes
1answer
925 views

Is Nokia's “institutional MITM” of SSL traffic vulnerable to CRIME attack?

It's recently been in the news that some Nokia phones proxy all traffic, including SSL connections, through a Nokia proxy. This is effectively an "institutional MITM" attack on users those phones. ...
5
votes
3answers
6k views

Intercepting SSL traffic on Android app

I am trying to intercept SSL traffic from my Android app to test the security. I am using certificate pinning in the hopes I can prevent people from snooping. I have tested by configuring ProxyDroid ...
3
votes
1answer
6k views

Intercepting HTTPS Android app traffic

I'm trying to intercept Android application traffic from my Android phone....Basically what worked before was that i had simply installed fiddler proxy on my PC, exported the root certificate (and ...
8
votes
4answers
3k views

Outbound proxy which whitelists by server certificate?

Short version: Are you aware of any proxy or firewall device which will permit outbound SSL connections to hosts with approved* SSL certificates only? Long version: Consider the following scenario....
4
votes
1answer
11k views

End-to-end encryption with a reverse proxy and an application server

Lets say that I have an nginx reverse proxy that proxies the traffic to a Tomcat on the same server. I think the most common way to configure this setup is to enable SSL on nginx and then proxy the ...
5
votes
2answers
18k views

Why are HTTPS requests blocked by Firefox when using ZAP proxy?

I have Zed Attack Proxy (ZAP) on my machine and my browser is Firefox. When I route the browser traffic through the ZAP proxy (using FoxyProxy), if it's HTTPS traffic, Firefox says "Your connection is ...
1
vote
1answer
2k views

Can a corporate proxy downgrade an SSL handshake?

At work, I'm behind an NTLM Proxy. When the SSL Poodle flaw came out, I hardened the configuration of my private server, and found out that even if the client and server shared common ciphers, some ...
22
votes
4answers
29k views

Does using an http proxy completely hide my real IP address?

If I obscure my IP by going through a free http proxy and visit a page, will that site's admin ever be able to find out my true IP or anything related to my true connection/info?
14
votes
2answers
14k views

How is it possible to do TLS through proxy without anyone noticing?

My workplace uses a proxy to connect to the internet, even for https sites. It was my understanding that for this to work, the proxy would be considered a MITM, and the certificate presented would be ...
8
votes
3answers
2k views

How do I log all my internet-connections

How can I (maybe with a proxy, but I need names of programs!?) log all my interactions of programs with my Internet connection, so that I could see WHAT a program is sending and WHAT it is receiving. (...
2
votes
1answer
152 views

Can you, with 100% certainty, guarantee the source location of a cyber attack?

There have been reports that American technology and cyber security experts have claimed that Russia is behind the recent cyber attacks on the United States, notably those aimed at influencing the ...
0
votes
2answers
2k views

Tracing Proxy Easy or Hard for a Normal Website?

I know a membership website which is getting quite popular among people day by day. Now I see people are making more than one accounts by using proxies. They should allow multiple accounts from the ...
4
votes
3answers
565 views

The safest way to circumventing Iran's Internet censorship

We usually buy services like VPN, SOCKS, Kerio [Kerio Connect?]... to circumvent Iran's Internet censorship policy. Recently, one of the shops started selling [one of] Kerio's products, for which I do ...
2
votes
3answers
1k views

Is there an anti-proxy detection available?

Sites like Wikipedia and Google (among others) don't let you sign up through a proxy or TOR (at least with Google, you have to provide SMS verification if you sign up through proxy.) Somehow they ...
-1
votes
2answers
1k views

HTTPS Proxy Content Inspection [closed]

Is it possible for a proxy server to do content inspection on HTTPS traffic?
-5
votes
1answer
1k views

How to camouflage at the best on internet? [closed]

What it would be a decent setup to cover your traces on internet and still having a decent connection? SSL? Proxy? Private VPN?
14
votes
4answers
17k views

Detecting Tor proxy by reading request headers

I am a newbie to the field of security. As I was trying to explore more about HTTP request and response headers, I came across this website which provides a detailed analysis of the request header ...
14
votes
3answers
11k views

SOCKS proxy security concerns

As claimed, "A socks proxy simply transfers data from a client to a server, not penetrating into this data contents (therefore it can work with HTTP, FTP, SMTP, POP3, NNTP, etc.)", I really can't buy ...
4
votes
1answer
27k views

Disable or bypass SSL Pinning/Certificate Pinning on Android 6.0.1

Previously I have been able to bypass SSL Pinning by using the program JustTrustMe with the Xposed framework for nearly every app. https://github.com/Fuzion24/JustTrustMe However it has started to ...
8
votes
2answers
18k views

Intercepting Android app traffic with Burp

I am trying to understand what do Burp and Android apps do when the traffic is https. I did not install the Burp CA to the phone. Some apps completely refuse to work. They display an error message or ...
9
votes
2answers
1k views

HTTPS login vs MITM attack

http://www.troyhunt.com/2013/05/your-login-form-posts-to-https-but-you.html My question is, if the threat is that someone controls your internet connection and can serve up bad login pages, couldn't ...
11
votes
6answers
4k views

Getting credentials using proxy server

Is it possible to get the username and password we enter into sites like facebook using proxy server? The scenario is like this : 1.My laptop is connected to a network. 2.It is configured to use a ...
10
votes
3answers
9k views

Is it possible to connect to a proxy with an ssl (or otherwise encrypted) connection?

What i want to know is whether it is possible to connect to a proxy with an ssl (or otherwise encrypted) connection? (I'm suspecting this is possible because TOR encrypts user connections to it's ...
4
votes
2answers
4k views

Does Java applets reveal the real IP address, even when using proxy or vpn?

Can a Java applet reveal the original client IP address, when browsing through a proxy or a VPN? Why?