Skip to main content
Share Your Experience: Take the 2024 Developer Survey
66 votes
Accepted

What legitimate uses do browser proxies have?

One of the early uses of HTTP proxies was caching proxies in order to make better use of the expensive bandwidth and to speed up surfing by caching heavily used content near the user. I remember a ...
Steffen Ullrich's user avatar
51 votes
Accepted

Security Headers for a web API

Checking headers off a list is not the best technique to assert a site's security. Services like securityheaders.io can point you in the right direction but all they do is compare against a list of ...
Arminius's user avatar
  • 44.8k
43 votes

What benefits are there to blocking most search engines?

In many jurisdictions, school districts are legally required to have web filtering in place. Google & Bing are two examples of companies who's "Safe Search" API has been around and stable for ...
tjd's user avatar
  • 793
22 votes

How do I know if my company or my ISP is using a TLS proxy?

How to know if your company does TLS intercept As the post you linked to explains, the proxy will decrypt all the traffic, and then encrypt it again but signed with another certificate. Therefore the ...
Anders's user avatar
  • 65.6k
21 votes
Accepted

Nmap through proxy

TL;DR: proxy support is limited right now but there are also theoretical limits of what you could do when using a proxy. nmap can do only CONNECT and SOCKS4 and these protocols can do only TCP. ...
Steffen Ullrich's user avatar
19 votes

Is systemd's hand-rolled Desktop-Bus-over-SSH tunnel a security worry?

Discussing this on Twitter is the modern day equivalent of Fermat discussing mathematical proofs via marginalia. So let us expand upon what Peter Wullinger did not have the space to fit into a margin ...
JdeBP's user avatar
  • 701
15 votes

What legitimate uses do browser proxies have?

Some examples as follows: To enable a firewall rule like 'proxy server to any destination on 80, 443' instead of from 'any internal to any external' To monitor all websites visited through logs To ...
AndyMac's user avatar
  • 3,159
13 votes
Accepted

Why are HTTPS requests blocked by Firefox when using ZAP proxy?

ZAP creates certificates, on the fly, in the name of the site Firefox is going to. Firefox is saying "I don't trust the CA that signed this cert", which is reasonable, because it's a MITM by an ...
gowenfawr's user avatar
  • 72.9k
12 votes
Accepted

Why/how does Firefox bypass my employer's SSL decryption?

It's quite simple really, it's your employer that hasn't secured their network properly. I guess that they add a system proxy settings or they configured the other browsers to use their interception ...
Lie Ryan's user avatar
  • 31.4k
12 votes

What legitimate uses do browser proxies have?

For the "original" reason, think back to 1993, when Netscape 0.9 was released. It had a "Mail and Proxies" Options dialog (per a copy of the manual). At that time, most Internet links were 56-kbit or ...
david's user avatar
  • 721
11 votes

Nmap through proxy

For now, use an external tool like proxychains. The nmap documentation for --proxies states, that the feature is not fully implemented yet: Warning: this feature is still under development and has ...
Arminius's user avatar
  • 44.8k
10 votes

Difference between socks5 and socks4 proxy?

From wikipedia: The SOCKS5 protocol is defined in RFC 1928. It is an extension of the SOCKS4 protocol; it offers more choices for authentication and adds support for IPv6 and UDP, the latter of ...
Steffen Ullrich's user avatar
10 votes

What legitimate uses do browser proxies have?

Yes, they're frequently used in the corporate world. Perhaps less so now than in the past, but years ago they were commonly the only gateway from a local network to the Internet. In many cases only ...
Xander's user avatar
  • 35.8k
10 votes
Accepted

How do CORS proxy websites work?

The CORS policy is enforced by the browser, not by the server. The server just sets a couple of HTTP headers telling the browser how it wants it to behave. There is nothing that forces a proxyserver ...
Anders's user avatar
  • 65.6k
9 votes
Accepted

httpoxy - does TLS/SSL mitigate the vulnerability of HTTP Proxy header?

I did not know about this until I read the link you posted, so do not view this answer as authorative. I would recommend you to take the precautions listed under "Immediate Mitigation" now, ...
Anders's user avatar
  • 65.6k
9 votes
Accepted

How does SSL Proxy server in company work?

I've never seen SSL warning in company Did you verify that SSL interception is done at all? See How do I check that I have a direct SSL connection to a website?. So how does they intercept trafic ...
Steffen Ullrich's user avatar
9 votes
Accepted

Disable or bypass SSL Pinning/Certificate Pinning on Android 6.0.1

Did you go through these procedures to get JustTrustMe to bypass the cert pinning -- http://www.welivesecurity.com/2016/09/08/avoid-certificate-pinning-latest-versions-android/ -- ? If you are just ...
atdre's user avatar
  • 19.1k
9 votes

Difference between SSH Tunnel / Proxy and VPN in terms of security

SSH SSH is at its heart a secure shell. It was originally designed as a encrypted successor to telnet. It can, however, do so so much more! For your uses, you are specifically looking at dynamic ...
CaffeineAddiction's user avatar
9 votes

What benefits are there to blocking most search engines?

If the enterprise considers search engines which aren't Google and Bing "untrustworthy" for some reason (e.g., because they believe they are more likely to intentionally or unintentionally disclose ...
IllusiveBrian's user avatar
8 votes

Proxying MetaSploit through BurpSuite

Use the PROXIES environment variable (while in msfconsole) : set PROXIES HTTP:127.0.0.1:8080 Or run Metalsploit with proxychains (config at /etc/proxychains.conf) http://proxychains.sourceforge.net ...
Jonathan Allon's user avatar
8 votes

How to intercept thick client application traffic (tcp or http[s])

This tool https://github.com/jrmdev/mitm_relay seems to do this. It uses a trick: It embeddeds every request into a HTTP POST Request so you can relay it through burp and use every function of burp ...
BenjaminH's user avatar
  • 572
8 votes

Difference between SSH Tunnel / Proxy and VPN in terms of security

People often speak of SSH tunneling as a poor man's VPN. It is exactly the same on a feature and security point of view: you establish a secure tunnel between the client and a relay host and let a ...
Serge Ballesta's user avatar
7 votes
Accepted

Can you login to Facebook through a VPN or a proxy?

As far as I'm aware, Facebook don't actually block the new attempts from different IPs. Instead, they send an email to the registered email address with a notification that you logged into a new ...
Polynomial's user avatar
  • 135k
7 votes
Accepted

What does "injection proxy" mean in RCS of HackingTeam?

An injection proxy is a man-in-the-middle application that actively monitors traffic and injects (malicious) content based on predefined rules. This is roughly the attack scenario outlined in the ...
Arminius's user avatar
  • 44.8k
7 votes
Accepted

Is OpenVPN actually forwarded over TLS?

Openvpn uses TLS for authentication and key exchange but it does not use it for the actual data encyption. When running on UDP openvpn runs the TLS session on top of a custom "reliability layer", i'm ...
Peter Green's user avatar
  • 5,300
7 votes
Accepted

How does proxychains avoid DNS leaks?

Part of this boils down to how proxychains works in general. In order to proxy traffic from arbitrary programs (that may or may not have proxy support), proxychains uses the LD_PRELOAD environment ...
multithr3at3d's user avatar
6 votes
Accepted

Is proxy useless when connected to VPN?

If your VPN is trusted and secure enough, I don't see any further benefits from using proxy, or another VPN inside your VPN. This would complicate your setup (setting up proxy everywhere), slow down ...
George Y.'s user avatar
  • 3,534
6 votes

How can you hide / fake your ip address without proxy / vpn?

No, and you're not even changing your IP address with the method you've outlined - you're effectively claiming that you're a proxy for whatever IP address you provided in that header. It might work to ...
Matthew's user avatar
  • 27.3k
6 votes
Accepted

Intercepting Android app traffic with Burp

First thing to remember is that Burp is a HTTP(S) proxy. It doesn't do anything about any data which isn't HTTP(S) (OK, except websockets). Android apps, on the other hand, can use any protocol they ...
Matthew's user avatar
  • 27.3k

Only top scored, non community-wiki answers of a minimum length are eligible