Questions tagged [proxy]

The word "proxy" is mostly used as short for "proxy server", which is a server that acts as an intermediary between a workstation user and the Internet so that the enterprise can ensure security, administrative control, and caching service.

Filter by
Sorted by
Tagged with
15 votes
3 answers
11k views

SOCKS proxy security concerns

As claimed, "A socks proxy simply transfers data from a client to a server, not penetrating into this data contents (therefore it can work with HTTP, FTP, SMTP, POP3, NNTP, etc.)", I really can't buy ...
Tawfik Khalifeh's user avatar
14 votes
4 answers
18k views

Detecting Tor proxy by reading request headers

I am a newbie to the field of security. As I was trying to explore more about HTTP request and response headers, I came across this website which provides a detailed analysis of the request header ...
Rahil Arora's user avatar
  • 4,357
14 votes
6 answers
10k views

Difference between SSH Tunnel / Proxy and VPN in terms of security

What benefits does a VPN have over just using a regular SSH Tunnel? I'm considering setting up OpenVPN on a server, but was wondering what benefits that would have over just using that same server as ...
Jan Vladimir Mostert's user avatar
11 votes
6 answers
5k views

Getting credentials using proxy server

Is it possible to get the username and password we enter into sites like facebook using proxy server? The scenario is like this : 1.My laptop is connected to a network. 2.It is configured to use a ...
Maximin's user avatar
  • 221
11 votes
7 answers
14k views

Does a chain of proxies (e.g. one connecting to another and another and so on) make tracing the original IP harder/impossible?

I see nobody here has asked this question. What if one, instead of just using a single proxy, connected a proxy-to-proxy in a very long chain and downloaded something (illegal) using secure packets (...
Nomad Cla's user avatar
  • 111
11 votes
3 answers
10k views

Is it possible to connect to a proxy with an ssl (or otherwise encrypted) connection?

What i want to know is whether it is possible to connect to a proxy with an ssl (or otherwise encrypted) connection? (I'm suspecting this is possible because TOR encrypts user connections to it's ...
user avatar
10 votes
2 answers
9k views

Is there anything like a known proxy server IP list/database?

I'm looking for something like a known proxy servers IP list (text, comma seperated or database based). Do you happen to know if anything like that exists? Free would be nice. I doubt it because these ...
Ion's user avatar
  • 666
9 votes
3 answers
3k views

Are future TLS versions going to prevent traffic inspection?

Nowadays it is possible to inspect (unencrypt) TLS (HTTPS) traffic inside an organization. The mechanism consists in using a root CA that is configured in the web client and a network device that ...
Eloy Roldán Paredes's user avatar
9 votes
2 answers
1k views

HTTPS login vs MITM attack

http://www.troyhunt.com/2013/05/your-login-form-posts-to-https-but-you.html My question is, if the threat is that someone controls your internet connection and can serve up bad login pages, couldn't ...
tau's user avatar
  • 417
9 votes
2 answers
572 views

WPAD name collision attack victim: possible information leak

This is a home network: a wireless Linksys router serving around 5 wireless devices and 3 wired ones, two PCs and a PS4. The router is setup to serve DHCP to client devices. It has a setting to ...
dhcarmona's user avatar
  • 193
8 votes
2 answers
20k views

Intercepting Android app traffic with Burp

I am trying to understand what do Burp and Android apps do when the traffic is https. I did not install the Burp CA to the phone. Some apps completely refuse to work. They display an error message or ...
b4da's user avatar
  • 710
6 votes
1 answer
5k views

How to securely store API keys

I need to store API keys for my users. These keys are extremely valuable as they are used to buy and sell things. Some users won't want to give these keys to anyone, and I'm trying to figure out a ...
Positonic's user avatar
  • 161
5 votes
4 answers
12k views

How to prevent proxy server from HTTPS packet inspection?

Proxy servers often inspect HTTPS packets. They decrypt client's HTTPS traffic, inspect them, encrypt them again and send it to destination server. The proxy server injects its own CA certificate to ...
defalt's user avatar
  • 6,851
5 votes
2 answers
4k views

Does Java applets reveal the real IP address, even when using proxy or vpn?

Can a Java applet reveal the original client IP address, when browsing through a proxy or a VPN? Why?
Nameless's user avatar
5 votes
5 answers
5k views

Is it possible to locate Tor/proxy users? Spam is getting on my nerves

I'm managing a huge forum (over 15k posts and 500 users) and lately some guy uses a VPN (probably) to spam my forums with topics such as: "LOLOLOLOLOLOLOLOL" Now, I'm pretty sure he's using ...
Ariel Weinberger's user avatar
5 votes
3 answers
3k views

Reverse Proxy Secure Configuration

I have a Forefront TMG 2010 acting as a reverse proxy: I can force HTTP*S* between internet clients and TMG. I can force HTTP*S* between TMG and my web servers. From a security point of view, it is ...
lisa17's user avatar
  • 1,988
4 votes
2 answers
2k views

Reverse Proxy or direct?

imagine I have an architecture as shown. In order to get to the internal web server, should I use a reverse proxy like as shown and redirect traffic to my web server? Is this a more secure way ...
JinPangPang's user avatar
  • 1,951
4 votes
1 answer
952 views

Can a captive portal be secured [closed]

I am interested in using a captive portal on a public network. After reading the wikipedia article and several questions here on sec.SE, I don't understand how I can secure it, or even, if I can ...
just.another.programmer's user avatar
4 votes
3 answers
1k views

Does Tor still hide all tracks?

I've seen some threads on Reddit that say true hackers, when attacking, go through a public WiFi network, use a VM, proxy through a zombie computer, use a VPN, then proxychain through Tor, use another ...
user avatar
4 votes
1 answer
5k views

How come I can see a full HTTPS requests via Fiddler?

I am testing a C# web API hosted on a remote server, and I am monitoring HTTPS traffic using Fiddler. What confuses me is that via Fiddler I can see all of the POST payload, headers and host URL ...
mko's user avatar
  • 179
3 votes
1 answer
817 views

How should this system be protected from ARP spoofing?

Background My university uses an authenticated (squid) HTTP proxy server for accessing the internet. There are a few reasons for this: They want to track misuse of the connection Our university has ...
Manishearth's user avatar
  • 8,317
3 votes
1 answer
827 views

Can Web Proxy Autodiscovery leak HTTPS URLs?

The WPAD protocol can in some circumstances allow an attacker to get clients to use a malicious PAC script. It appears to be well documented, that this can be used to perform MITM-attacks on HTTP ...
kasperd's user avatar
  • 5,482
3 votes
3 answers
1k views

How to get rid of an Ad bot?

The issue started due to setting up a proxy server on a PC connected to my network. I then realized that all of my devices that connected to the network, including PCs and phones, are all infected by ...
Mina Hafzalla's user avatar
3 votes
1 answer
1k views

Burp proxy between non proxy aware device

I want to intercept traffic between a Ethernet connected device, which is not proxy aware and modify/inject javascript. Conventionally when testing webapps I would use burp. Can burp sit on my ...
david bramer's user avatar
2 votes
1 answer
207 views

Secure cloud encryption scheme, do you know what is the standard for this?

I am wondering if the scenario below has a name or it is something in use? The point of it is to keep data encrypted at cloud storage which is big storage therefore cheaper, but then do not allow for ...
Aria's user avatar
  • 2,731
2 votes
1 answer
3k views

SSL Decryption why is the root CA certificate required on clients?

Maybe a quick question. We have Palo Alto's that perform SSL Decryption using a sub CA certificate issued by our internal Root CA. This is working for our internal windows domain computers as the root ...
Jim's user avatar
  • 121
2 votes
1 answer
4k views

Safety of exposing an internal web application to the internet using a reverse proxy in the DMZ

I am creating a web application which needs to make direct connections to internal resources (e.g. database servers), but will also need to be accessed from the internet. The web app exposes web ...
RobSiklos's user avatar
  • 123
2 votes
1 answer
1k views

Can a HTTP proxy see HTTPS traffic?

I was checking some things with the (Chromium) inspect tool and I saw that if you go to the 'Network' section the IP address wasn't the actual DNS A (IPv4) or AAAA (IPv6) IP address but the Proxy IP ...
The Bad One's user avatar
2 votes
1 answer
3k views

Which is more secure - a VPN, a proxy-server, Tor, etc.? And why so, exactly? [closed]

I want to know how to ensure the most complete anonymity when browsing the internet and connecting to remote servers: I want to be as anonymous and secret as possible. I don't know exactly how VPNs ...
Seqchro's user avatar
  • 21
2 votes
1 answer
3k views

MitM-Position with bridged network and iptables

I'm currently trying to get my setup to work. [ victim ] --- [ mitm ] --- [ net ] IPs: net: 10.0.0.0/24 victim: 10.0.0.1 mitm: 10.0.0.2 gateway: 10.0.0.254 setup: ip l a name br0 type bridge ip l ...
David Mändlen's user avatar
2 votes
2 answers
5k views

How can you hide / fake your ip address without proxy / vpn?

Question might sound impossible but I'm still serious. Downloaded a plugin for firefox called "Modify Headers" (https://addons.mozilla.org/de/firefox/addon/modify-headers/). Set it up like that: ...
cnmesr's user avatar
  • 555
1 vote
1 answer
2k views

How secure and anonymous is the --tor parameter in Sqlmap?

How secure and anonymous is the --tor parameter in Sqlmap? Does it really send every request over Tor and does it have any IP/DNS/STUN requests leak loopholes?
UndercoverDog's user avatar
1 vote
1 answer
2k views

Does a http proxy (ziproxy/squid) encrypt communication between client and server

I've read a lot of similar questions, with long answer, and they are making me confused, so for a quick yes/no question. If I, access a https webpage via an http proxy (my own proxy) (like ziproxy/...
JoBe's user avatar
  • 115
1 vote
1 answer
508 views

Can I trust public socks4 proxy when using only HTTPS?

I am using a socks4 public proxy for more speed/bandwidth. I am currently using it for downloading files. Now I want to use it for social media or daily day usage. I know that they will get all my ...
user avatar
1 vote
1 answer
634 views

If a computer is connected to a proxy, will all outgoing traffic go through that proxy? [closed]

My computer is connected to a local proxy. I want to know whether the outgoing script traffic from my computer goes through that proxy. If it is true how can I know? I'm using PHP scripts.
theModerator713's user avatar
1 vote
1 answer
4k views

Proxychains dosen't work, DNS leak test shows location

I've been trying to use Proxy Chains with Tor but when I launch Firefox with them a DNS Leak test will show exactly where I live. I'm on Linux Mint and I'm using the stranded Firefox, not the Tor ...
user136916's user avatar
1 vote
2 answers
447 views

I'm wondering how I hide my identity online well [duplicate]

what are the different ways to become anonymous. Is quicksilver a good email for that? What are the different options? I know about proxies, Tor, and VPNs. Should I do all three? I like computers but ...
user3695903's user avatar
1 vote
1 answer
422 views

Key Management in Interception Proxies?

I'm reading Jarmoc's Black Hat presentation on SSL/TLS Interception Proxies and Transitive Trust. I have a few questions on some of the key management practices. In the paper, Jarmoc states: To ...
user avatar
1 vote
2 answers
1k views

Are SSL encrypted communications through a company network safe?

If I'm using Skype, Facebook, or another type of communication at my work, can the network administrator see my Skype and Facebook conversations, although its encrypted with SSL? I found this text: ...
Newton's user avatar
  • 13
1 vote
1 answer
3k views

How to create a proxy so that no website or web service can know that I am connecting through a proxy?

I want a proxy, preferably my own but I would be glad if there is a reliable service already, that is undetectable. Obviously, it does not send X-Forwarded-For. But it has to be much more than that to ...
Assad Ali's user avatar
1 vote
1 answer
3k views

Burp Suite - Although my configurations are correct, still Chrome doesn't allows me to access HTTPS sites and throws an error!

I'm having a hard time accessing sites with HSTS enabled via burp proxy in Chrome. Everything works perfectly fine with Firefox and IE, but Chrome has stopped working since yesterday. I've followed ...
Prateek T's user avatar
0 votes
4 answers
538 views

Does routing internet traffic via VPN through a company proxy gain any more security?

There is currently an ongoing discussion in our company about what security measures to put in place regarding workstation access to the company network and the internet. Situation: Employees have ...
Bigbohne's user avatar
  • 101
0 votes
2 answers
2k views

WPAD (badWPAD vulnerability) should I disable or not?

Hi I have read recently very bad things about WPAD vulnerability for example here nakedsecurity.sophos.com/2016/05/25/when-domain-names-attack-the-wpad-name-collision-vulnerability/ (article from ...
Mathiew2194's user avatar
0 votes
1 answer
2k views

Is CloudFlare's SSL half-baked since they become the Man-in-the-Middle (MitM)? [duplicate]

I recently read a somewhat funny article at crimeflair.net, questioning (read: murdering) the way CloudFlare provides SSL. In their words: "CloudFlare's half-baked SSL: suspicious sockets layer". ...
Bob Ortiz's user avatar
  • 6,665
0 votes
1 answer
149 views

Identity exposure by using same proxy?

I read several times it is a very bad idea and a huge lack of security to use the same proxy for logging into facebook or other sites containing information about real personal details e.g. linkedin ...
Artery's user avatar
  • 239
-1 votes
1 answer
534 views

CDN end to end encryption?

I setup Cloudflare CDN for my site. I added my site to Cloudflare and it asked me to add Cloudflare nameserver to my domain. I did that in my DNS registrar portal. That's all I did. Now I'm able to ...
Mani Bharathy's user avatar

1
2