Questions tagged [proxy]
The word "proxy" is mostly used as short for "proxy server", which is a server that acts as an intermediary between a workstation user and the Internet so that the enterprise can ensure security, administrative control, and caching service.
96
questions
15
votes
3
answers
11k
views
SOCKS proxy security concerns
As claimed, "A socks proxy simply transfers data from a client to a server, not penetrating into this data contents (therefore it can work with HTTP, FTP, SMTP, POP3, NNTP, etc.)", I really can't buy ...
14
votes
4
answers
18k
views
Detecting Tor proxy by reading request headers
I am a newbie to the field of security. As I was trying to explore more about HTTP request and response headers, I came across this website which provides a detailed analysis of the request header ...
14
votes
6
answers
10k
views
Difference between SSH Tunnel / Proxy and VPN in terms of security
What benefits does a VPN have over just using a regular SSH Tunnel?
I'm considering setting up OpenVPN on a server, but was wondering what benefits that would have over just using that same server as ...
11
votes
6
answers
5k
views
Getting credentials using proxy server
Is it possible to get the username and password we enter into sites like facebook using proxy server?
The scenario is like this :
1.My laptop is connected to a network.
2.It is configured to use a ...
11
votes
7
answers
14k
views
Does a chain of proxies (e.g. one connecting to another and another and so on) make tracing the original IP harder/impossible?
I see nobody here has asked this question. What if one, instead of just using a single proxy, connected a proxy-to-proxy in a very long chain and downloaded something (illegal) using secure packets (...
11
votes
3
answers
10k
views
Is it possible to connect to a proxy with an ssl (or otherwise encrypted) connection?
What i want to know is whether it is possible to connect to a proxy with an ssl (or otherwise encrypted) connection? (I'm suspecting this is possible because TOR encrypts user connections to it's ...
10
votes
2
answers
9k
views
Is there anything like a known proxy server IP list/database?
I'm looking for something like a known proxy servers IP list (text, comma seperated or database based). Do you happen to know if anything like that exists? Free would be nice. I doubt it because these ...
9
votes
3
answers
3k
views
Are future TLS versions going to prevent traffic inspection?
Nowadays it is possible to inspect (unencrypt) TLS (HTTPS) traffic inside an organization. The mechanism consists in using a root CA that is configured in the web client and a network device that ...
9
votes
2
answers
1k
views
HTTPS login vs MITM attack
http://www.troyhunt.com/2013/05/your-login-form-posts-to-https-but-you.html
My question is, if the threat is that someone controls your internet connection and can serve up bad login pages, couldn't ...
9
votes
2
answers
572
views
WPAD name collision attack victim: possible information leak
This is a home network: a wireless Linksys router serving around 5 wireless devices and 3 wired ones, two PCs and a PS4.
The router is setup to serve DHCP to client devices. It has a setting to ...
8
votes
2
answers
20k
views
Intercepting Android app traffic with Burp
I am trying to understand what do Burp and Android apps do when the traffic is https. I did not install the Burp CA to the phone.
Some apps completely refuse to work. They display an error message or ...
6
votes
1
answer
5k
views
How to securely store API keys
I need to store API keys for my users. These keys are extremely valuable as they are used to buy and sell things. Some users won't want to give these keys to anyone, and I'm trying to figure out a ...
5
votes
4
answers
12k
views
How to prevent proxy server from HTTPS packet inspection?
Proxy servers often inspect HTTPS packets. They decrypt client's HTTPS traffic, inspect them, encrypt them again and send it to destination server.
The proxy server injects its own CA certificate to ...
5
votes
2
answers
4k
views
Does Java applets reveal the real IP address, even when using proxy or vpn?
Can a Java applet reveal the original client IP address, when browsing through a proxy or a VPN? Why?
5
votes
5
answers
5k
views
Is it possible to locate Tor/proxy users? Spam is getting on my nerves
I'm managing a huge forum (over 15k posts and 500 users) and lately some guy uses a VPN (probably) to spam my forums with topics such as:
"LOLOLOLOLOLOLOLOL"
Now, I'm pretty sure he's using ...
5
votes
3
answers
3k
views
Reverse Proxy Secure Configuration
I have a Forefront TMG 2010 acting as a reverse proxy:
I can force HTTP*S* between internet clients and TMG.
I can force HTTP*S* between TMG and my web servers.
From a security point of view, it is ...
4
votes
2
answers
2k
views
Reverse Proxy or direct?
imagine I have an architecture as shown.
In order to get to the internal web server, should I use a reverse proxy like as shown and redirect traffic to my web server? Is this a more secure way ...
4
votes
1
answer
952
views
Can a captive portal be secured [closed]
I am interested in using a captive portal on a public network. After reading the wikipedia article and several questions here on sec.SE, I don't understand how I can secure it, or even, if I can ...
4
votes
3
answers
1k
views
Does Tor still hide all tracks?
I've seen some threads on Reddit that say true hackers, when attacking, go through a public WiFi network, use a VM, proxy through a zombie computer, use a VPN, then proxychain through Tor, use another ...
4
votes
1
answer
5k
views
How come I can see a full HTTPS requests via Fiddler?
I am testing a C# web API hosted on a remote server, and I am monitoring HTTPS traffic using Fiddler.
What confuses me is that via Fiddler I can see all of the POST payload, headers and host URL ...
3
votes
1
answer
817
views
How should this system be protected from ARP spoofing?
Background
My university uses an authenticated (squid) HTTP proxy server for accessing the internet.
There are a few reasons for this:
They want to track misuse of the connection
Our university has ...
3
votes
1
answer
827
views
Can Web Proxy Autodiscovery leak HTTPS URLs?
The WPAD protocol can in some circumstances allow an attacker to get clients to use a malicious PAC script.
It appears to be well documented, that this can be used to perform MITM-attacks on HTTP ...
3
votes
3
answers
1k
views
How to get rid of an Ad bot?
The issue started due to setting up a proxy server on a PC connected to my network. I then realized that all of my devices that connected to the network, including PCs and phones, are all infected by ...
3
votes
1
answer
1k
views
Burp proxy between non proxy aware device
I want to intercept traffic between a Ethernet connected device, which is not proxy aware and modify/inject javascript. Conventionally when testing webapps I would use burp.
Can burp sit on my ...
2
votes
1
answer
207
views
Secure cloud encryption scheme, do you know what is the standard for this?
I am wondering if the scenario below has a name or it is something in use?
The point of it is to keep data encrypted at cloud storage which is big storage therefore cheaper, but then do not allow for ...
2
votes
1
answer
3k
views
SSL Decryption why is the root CA certificate required on clients?
Maybe a quick question. We have Palo Alto's that perform SSL Decryption using a sub CA certificate issued by our internal Root CA. This is working for our internal windows domain computers as the root ...
2
votes
1
answer
4k
views
Safety of exposing an internal web application to the internet using a reverse proxy in the DMZ
I am creating a web application which needs to make direct connections to internal resources (e.g. database servers), but will also need to be accessed from the internet.
The web app exposes web ...
2
votes
1
answer
1k
views
Can a HTTP proxy see HTTPS traffic?
I was checking some things with the (Chromium) inspect tool and I saw that if you go to the 'Network' section the IP address wasn't the actual DNS A (IPv4) or AAAA (IPv6) IP address but the Proxy IP ...
2
votes
1
answer
3k
views
Which is more secure - a VPN, a proxy-server, Tor, etc.? And why so, exactly? [closed]
I want to know how to ensure the most complete anonymity when browsing the internet and connecting to remote servers: I want to be as anonymous and secret as possible. I don't know exactly how VPNs ...
2
votes
1
answer
3k
views
MitM-Position with bridged network and iptables
I'm currently trying to get my setup to work.
[ victim ] --- [ mitm ] --- [ net ]
IPs:
net: 10.0.0.0/24
victim: 10.0.0.1
mitm: 10.0.0.2
gateway: 10.0.0.254
setup:
ip l a name br0 type bridge
ip l ...
2
votes
2
answers
5k
views
How can you hide / fake your ip address without proxy / vpn?
Question might sound impossible but I'm still serious. Downloaded a plugin for firefox called "Modify Headers" (https://addons.mozilla.org/de/firefox/addon/modify-headers/).
Set it up like that:
...
1
vote
1
answer
2k
views
How secure and anonymous is the --tor parameter in Sqlmap?
How secure and anonymous is the --tor parameter in Sqlmap?
Does it really send every request over Tor and does it have any IP/DNS/STUN requests leak loopholes?
1
vote
1
answer
2k
views
Does a http proxy (ziproxy/squid) encrypt communication between client and server
I've read a lot of similar questions, with long answer, and they are making me confused, so for a quick yes/no question.
If I, access a https webpage via an http proxy (my own proxy) (like ziproxy/...
1
vote
1
answer
508
views
Can I trust public socks4 proxy when using only HTTPS?
I am using a socks4 public proxy for more speed/bandwidth. I am currently using it for downloading files. Now I want to use it for social media or daily day usage. I know that they will get all my ...
1
vote
1
answer
634
views
If a computer is connected to a proxy, will all outgoing traffic go through that proxy? [closed]
My computer is connected to a local proxy. I want to know whether the outgoing script traffic from my computer goes through that proxy. If it is true how can I know? I'm using PHP scripts.
1
vote
1
answer
4k
views
Proxychains dosen't work, DNS leak test shows location
I've been trying to use Proxy Chains with Tor but when I launch Firefox with them a DNS Leak test will show exactly where I live. I'm on Linux Mint and I'm using the stranded Firefox, not the Tor ...
1
vote
2
answers
447
views
I'm wondering how I hide my identity online well [duplicate]
what are the different ways to become anonymous. Is quicksilver a good email for that? What are the different options?
I know about proxies, Tor, and VPNs. Should I do all three? I like computers but ...
1
vote
1
answer
422
views
Key Management in Interception Proxies?
I'm reading Jarmoc's Black Hat presentation on SSL/TLS Interception Proxies and Transitive Trust. I have a few questions on some of the key management practices.
In the paper, Jarmoc states:
To ...
1
vote
2
answers
1k
views
Are SSL encrypted communications through a company network safe?
If I'm using Skype, Facebook, or another type of communication at my work, can the network administrator see my Skype and Facebook conversations, although its encrypted with SSL?
I found this text:
...
1
vote
1
answer
3k
views
How to create a proxy so that no website or web service can know that I am connecting through a proxy?
I want a proxy, preferably my own but I would be glad if there is a reliable service already, that is undetectable. Obviously, it does not send X-Forwarded-For. But it has to be much more than that to ...
1
vote
1
answer
3k
views
Burp Suite - Although my configurations are correct, still Chrome doesn't allows me to access HTTPS sites and throws an error!
I'm having a hard time accessing sites with HSTS enabled via burp proxy in Chrome. Everything works perfectly fine with Firefox and IE, but Chrome has stopped working since yesterday.
I've followed ...
0
votes
4
answers
538
views
Does routing internet traffic via VPN through a company proxy gain any more security?
There is currently an ongoing discussion in our company about what security measures to put in place regarding workstation access to the company network and the internet.
Situation:
Employees have ...
0
votes
2
answers
2k
views
WPAD (badWPAD vulnerability) should I disable or not?
Hi I have read recently very bad things about WPAD vulnerability for example here nakedsecurity.sophos.com/2016/05/25/when-domain-names-attack-the-wpad-name-collision-vulnerability/ (article from ...
0
votes
1
answer
2k
views
Is CloudFlare's SSL half-baked since they become the Man-in-the-Middle (MitM)? [duplicate]
I recently read a somewhat funny article at crimeflair.net, questioning (read: murdering) the way CloudFlare provides SSL. In their words: "CloudFlare's half-baked SSL: suspicious sockets layer".
...
0
votes
1
answer
149
views
Identity exposure by using same proxy?
I read several times it is a very bad idea and a huge lack of security to use the same proxy for logging into facebook or other sites containing information about real personal details e.g. linkedin ...
-1
votes
1
answer
534
views
CDN end to end encryption?
I setup Cloudflare CDN for my site. I added my site to Cloudflare and it asked me to add Cloudflare nameserver to my domain. I did that in my DNS registrar portal. That's all I did.
Now I'm able to ...