52

There are several ways: Proxy headers, such as X-Forwarded-For and X-Client-IP, can be added by non-transparent proxies. Active proxy checking can be used - the target server attempts to connect to the client IP on common proxy ports (e.g. 8080) and flags it as a proxy if it finds such a service running. Servers can check if the request is coming from an IP ...


23

As is customary, let's first answer the exact question which was asked. Right now, using HTTPS to connect to the proxy is not widely supported. The squid documentation has some information on the subject; to sum things up: Chrome supports it, but it must be configured through a proxy auto-configuration script because there is no GUI support. This also ...


17

When a Web browser uses an HTTP proxy, things go the following way. Let's assume that the target URL is http://www.example.com/index.html. The browser then connects to the proxy and says to it: "I want to get the page at http://www.example.com/index.html". The proxy complies, get the data, and sends it back to the browser. By construction, the proxy sees all ...


14

Beyond what Polynomial said, another common practice is to have the browser view the site with and without HTTPS, and see if the connections come from the same IP. Many transparent (e.g. caching) proxies will allow SSL traffic to pass by without proxying, since proxying an SSL connection requires spoofing certificates, and this causes a whole bucket of ...


14

TLS by itself protects the sniffing and modification of traffic between two endpoints, i.e. client and server. TLS interception just makes two TLS connections where only one was, i.e. client to interception device and interception device to server. This will still work with future TLS versions. TLS interception is only possible if the validation of the ...


12

No. AFAIK there is nothing inside the TLS 1.3 Draft about that. And I don't think there's a technical solution to this either. If you allow somebody to install an additional root CA on your computer, then all bets are off.


10

The basic piece of HTTP Response Splitting (HRS) that gets left out most often, is the proxy. HRS is not an attack between a webserver and a browser, or even a browser and a webserver. The attack is on the idiosyncrasies of semi-compliant HTTP devices, namely, the web server and the web proxy. Specifically, the attack takes advantage of the fact that the ...


10

NIST SP 800-44 Guidelines on Securing Public Web Servers is a good starting point, though it's no magic bullet (and it's a few years old now). In my experience some of the most important requirements and mitigations, in no particular order, are: Make sure that your proxy, back-end web (and DB) servers cannot establish direct outbound (internet) connections ...


10

This is part of why you check who the SSL cert is from. If it isn't the site you are trying to access, get the hell out of dodge. If cloudssl is using a root certificate in an insecure way, such as generating certs for each site on demand, then people can simply reject the authorization of that root certificate. Problem solved. A new http header for this ...


10

Based on my understanding, I think you don't even need to get inside the internal network to prove that's it's a terrible idea. An attacker (who can be an ex-employee, third party contractor or an existing disgruntled employee) having some context about this insecure internal application, including details such as internal host address where the application ...


9

I did not know about this until I read the link you posted, so do not view this answer as authorative. I would recommend you to take the precautions listed under "Immediate Mitigation" now, until you are completely sure you are not affected. First, how does this vulnerability work? This is a short form of the PHP example explained under "How it works": The ...


8

This is how a approach your situation in general. Speak to the business There are three things that I think clients can really relate to when discussing the security of their applications. (90% of the time the users are a footnote). IP (Intellectual Property). No customer want their secrets available to their competition. Image. Companies can be kindly ...


7

Cache-Control: private Indicates that all or part of the response message is intended for a single user and MUST NOT be cached by a shared cache, such as a proxy server. Looking at OWASP: Testing for Browser Cache Weakness Browsers can store information for purposes of caching and history. Caching is used to improve performance, so that previously ...


7

An internal user with a browser that also connects to the outside provides routes between the intranet and the public internet. I'm constantly pointing this out to people who tell me, "don't worry this is an internal web app". HTTPS is necessary in your case. This not only protects against the threat you mention, someone who has broken into the network, ...


6

A proxy is a system which relays communications. From your server, you see the communication as coming from the proxy machine. The IP address you see is the one of the proxy. If you block that IP, you block all traffic coming from that proxy, but no traffic from elsewhere. If the villain switches to another proxy, he will pass. Some HTTP proxy add a header ...


5

Google has your answer: http://support.google.com/websearch/bin/answer.py?hl=en&answer=186669 You can use Lock SafeSearch or use the NoSSLSearch option. *Edit* I think your best option after reading your comments is a proxy on the firewalls to re-direct the requests to HTTP. Squid can do this, but it might be more advanced than you want. Here is a ...


5

It may be easier for you all to use a DNS service such as OpenDNS where you can block based on hostnames and/or web categories. This will be a lot easier to setup and maintain if you are not very familiar with IT. Here is the direct link to their web content filtering - https://www.opendns.com/web-filtering


5

Assuming that you're running a relatively modern version of windows server (2008 or 2012) I think you can do this with inbuilt server functionality. The netsh interface portproxy command allows you to setup proxying/port forwarding on a windows server. If possible I'd say go with a solution that uses OS functionality as it reduces the complexity and doesn'...


5

There are two general levels of anonymity: Good enough for hiding from other routine users of the internet. Good enough for hiding from government law enforcement and surveillance agencies. As you can imagine, the second level is much much harder to achieve; and usually unnecessary for law-abiding citizens in a democratic country without a security hobby. ...


5

Did you go through these procedures to get JustTrustMe to bypass the cert pinning -- http://www.welivesecurity.com/2016/09/08/avoid-certificate-pinning-latest-versions-android/ -- ? If you are just looking to intercept WebViews, then the Frida extension, appmon (which allows for API interception), using these techniques will work well -- https://youtu.be/...


5

First of all, just because you use CloudFlare does not mean that the traffic will pass through the US. CloudFlare currently has 102 edges, and requests will be sent to the nearest one. This is what is called "anycast". So if someone in Europe requests your page the request will go from them to an edge somewhere in Europe, and from there to your origin. In ...


4

If your filtering software is implemented as a (possibly transparent) HTTP proxy, then the only way you can filter HTTPS connections is to do Man-in-the-Middle SSL inspection. This is a somewhat tricky and intrusive technique, but some filtering proxies do support it. The way it basically works is this: Whenever the proxy intercepts an SSL handshake, it ...


4

OpenVPN is a 'SSL VPN'. Therefore, the IP address your VPN client connects to is known to the company proxy. The traffic within the tunnel should not be visible to the proxy. OpenVPN's long-running SSL connections are also a giveaway. However, if you are using a Windows workstation provided by the company, chances are that it has anti-virus and other ...


4

I am not sure what the concern is here. Presumably you currently use a mail provider that you send unencrypted mail through. Or if it is sensitive mail, you'll encrypt before you send it, right? Using Good, you'll be doing the same, but you will have some additional protection for the device itself, and some segregation of your corporate mail from the user'...


4

Checking correct usage of HTTPS is ultimately the sole responsibility of the user. The users need to look at at least 3 points when visiting a web-page: Are they expecting HTTPS to be used (at least for this part of the site)? If so, is the certificate valid (lock/green/blue bar, without warning)? If so, is the host name in the address bar that of the site ...


4

ip-10-80-XXX-XXX.eu-west-1.compute.internal:80 110.249.208.XXX - - [11/Dec/2013:10:27:17 +0000] "GET http://mn.sina.com.cn/news/xianchang/2012-06-07/212535.html HTTP/1.1" 200 They are fishing for an open HTTP proxy, and your 200 response code says they found one. By operating an open proxy, you're enabling people to launch any number of web attacks ...


4

There are two distinct things: Connecting to a HTTPS Web site through a non-SSL HTTP proxy. Connecting to a HTTP Web site through an HTTPS proxy. The former uses the CONNECT proxy verb, and it works well. You want to latter, which is ill-supported by browsers. For instance, when you configure proxies in Firefox through this popup: then the entry field ...


4

WhatIsMyIP does not need anything javascript-related to get your IP. Almost always your proxy will set the header X-Forwarded-For on your request. WhatIsMyIP will get your primary IP from that. Try accessing this site and see all the headers your browser sent and the headers your proxy added. If you install Firebug on Firefox, you can compare the headers ...


4

I would personally do 3 things in this situation: Show the client the data on the percentage of major breaches that are a result of phishing (Something like 95-97%) Further show that phishing can directly lead to an attacker to sniffing traffic on the network and he/she can view every bit of data passing to and from those services. Identify the quantity and ...


4

Here are some issues about static resources (SR) that I can think of: SR that are not served via HTTPS in combination with cookies that don't have the Secure flag will leak the respective sensitive cookies and also cause browser warnings JS resources that are not served via HTTPS can be modified by an attacker with a privileged network position and can be ...


Only top voted, non community-wiki answers of a minimum length are eligible