Proxy server - Revision history

.FUF: /* Other methods */

2009-02-04T14:17:52Z

‎Other methods

2009-02-04T13:42:59Z

2008-11-04T19:02:12Z

2008-10-19T18:27:21Z

some info about Tor SOCKS

2008-10-17T19:48:30Z

2008-10-17T18:38:31Z

2008-10-17T18:38:22Z

2008-10-16T21:10:43Z

2008-10-16T20:50:09Z

2008-10-15T20:27:33Z

@@ Line 159: / Line 159: @@
 ==== Other methods ====
-* Active detection: see [http://metasploit.com/research/projects/decloak/ Metasploit Decloaking Engine];
+* Active detection: see [http://decloak.net/ Metasploit Decloaking Engine];
 * Comparing source IP address with a list of known proxy servers.

@@ Line 171: / Line 171: @@
 * Comparing destination IP address with a list of known proxy servers.
 [[Category:Anti-Forensics]]
 [[Category:Network Forensics]]

@@ Line 5: / Line 5: @@
 Proxy servers are widely used by organizations and individuals for different purposes:
-* Internet sharing (like [[NAT]]);
+* Internet sharing (like [[Network Address Translator | NAT]]);
 * Traffic compression;
 * Accelerating service requests by retrieving content from cache;
 * In China, proxy servers are commonly used by individuals to get around national connectivity policies. (User A can't reach website Z, but A can reach proxy server P which can reach website Z);
-* Criminals frequently use proxy servers to hide the origin of their connections (User A connects to website Z through proxy server P; the packets appear to come from P, and not A).
+* Criminals frequently use proxy servers to hide the origin of their connections. (User A connects to website Z through proxy server P; the packets appear to come from P, and not A).
 [[Tor]] presents a SOCKS proxy interface to applications, so any application that supports SOCKS (versions 4, 4a and 5) can be anonymized using [[Tor]].

@@ Line 8: / Line 8: @@
 * Traffic compression;
 * Accelerating service requests by retrieving content from cache;
-* and many others.
+* In China, proxy servers are commonly used by individuals to get around national connectivity policies. (User A can't reach website Z, but A can reach proxy server P which can reach website Z);
-Proxy servers are commonly used by individuals who wish to violate network policies.
+[[Tor]] presents a SOCKS proxy interface to applications, so any application that supports SOCKS (versions 4, 4a and 5) can be anonymized using [[Tor]].
-* In China, proxy servers are commonly used by individuals to get around national connectivity policies. (User A can't reach website Z, but A can reach proxy server P which can reach website Z).
-* Criminals frequently use proxy servers to hide the origin of their connections (User A connects to website Z through proxy server P; the packets appear to come from P, and not A).
 === HTTP proxies ===

@@ Line 106: / Line 106: @@
 Accept-Encoding: gzip, deflate
 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506)
-X-Forwarded-For: [scrubbed client real IP address]
+X-Forwarded-For: [scrubbed client's real IP address]
 Via: 1.1 proxy11 (NetCache NetApp/5.6.1D24)
 </pre>

← Older revision		Revision as of 18:38, 17 October 2008
Line 1:		Line 1:
−	~~{{expand}}~~
−
	'''Proxy server''' is a server which services the requests of its clients by forwarding requests to other servers.		'''Proxy server''' is a server which services the requests of its clients by forwarding requests to other servers.

@@ Line 76: / Line 76: @@
 These are web sites that allow a user to access a site through them. They generally use PHP or CGI to implement the proxy functionality.
-Example GET request from [http://anonymouse.ws/ Anonymouse] (to HTTP server):
+Example GET request from [http://anonymouse.ws/ Anonymouse] (to a web server):
 <pre>
 GET / HTTP/1.0
-Host: [scrubbed]:8080
+Host: [scrubbed server host]:8080
 User-Agent: http://Anonymouse.org/ (Unix)
 Connection: keep-alive
@@ Line 87: / Line 87: @@
 <pre>
 GET / HTTP/1.0
-Host: [scrubbed]:8080
+Host: [scrubbed server host]:8080
 User-Agent: Mozilla/5.0 (X11; U; Linux i686; en; rv:1.9.0.3) Gecko/20080528 Epiphany/2.22 Firefox/3.0
 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
@@ Line 96: / Line 96: @@
 === Server-side ===
-* Additional HTTP headers
+==== New HTTP headers ====
 * [[OS fingerprinting]] and User-Agent
 [[Category:Anti-Forensics]]
 [[Category:Network Forensics]]

@@ Line 76: / Line 76: @@
 These are web sites that allow a user to access a site through them. They generally use PHP or CGI to implement the proxy functionality.
-== Proxy detection ==
+Example GET request from [http://anonymouse.ws/ Anonymouse] (to HTTP server):
-=== Headers ===
+Example GET request from [http://www.hidemyass.com/ HideMyAss.com]:
-* User-Agent and [[OS fingerprinting]]
+== Proxy detection ==
-−
-* Other
-−
-=== TCP source ports ===
-−
-=== Active methods ===
 [[Category:Anti-Forensics]]
 [[Category:Network Forensics]]