Penetration Testing mailing list archives

Re: HTTP Proxy Question


From: Matt Gardenghi <mtgarden () gmail com>
Date: Mon, 16 Mar 2009 08:50:09 -0400

OK.  Let's check a few things.

First, you changed your browser's proxy to use the localhost proxy, correct? So, test your browser on www.google.com. Trap the requests and response and ensure that you are manipulating the traffic at will. Second, point one browser through the proxy and the other directly at the site. See if one or the other or both work. It could be a security setting in the browsers objecting to your proxy if the site had initiated an SSL connection. FF3 and IE7 have become annoying if you aren't using a MS or Mozilla approved certificate provider.
Try out those things and let us know.

jfvanmeter () comcast net wrote:
Hello Everyone, I have a assessment on a application that installs a web server, uses a web broser as the user interfacer.
I've tried to monitor the connectioning using Burp, Feddler 2, TamperIE, and Firefox/HTTPFox. I"m going to try 
webscarab tonight.

When I start the proxy, it monitors traffic over port 80 and port 443 to the internet with out any problems.

When I start IE7 or Firefox, the proxy shows the start of the connection, but the browse shows that it can not connect 
to the server.

The urls are https://mycomputername:portnumber

Are the proxies failing to redirect the browser output back to the mycomputername so the connection fails?

Thanks //John



------------------------------------------------------------------------
This list is sponsored by: InfoSec Institute

Learn all of the latest penetration testing techniques in InfoSec Institute's Ethical Hacking class. Totally hands-on course with evening Capture The Flag (CTF) exercises, Certified Ethical Hacker and Certified Penetration Tester exams, taught by an expert with years of real pen testing experience.

http://www.infosecinstitute.com/courses/ethical_hacking_training.html
------------------------------------------------------------------------


Current thread: