Ahmeket
Jul 29 2005, 08:09 PM
I've been pondering a thing and it's the security one is granted when using a proxy in the following way:
Me -> Proxy -> Server(only accept SSL)
Now it's quite obvious that the Proxy -> server needs to talk with SSL, but how exactly does it work? Is my connection to the proxy secure too, or am I sending in plaintext to the Proxy and only the last part is through SSL.
For example using a proxy server to connect to an IRC-server that supports SSL, is the stuff sent to the proxy in plaintext and easily viewable by the proxy owner?
click
Jul 29 2005, 08:54 PM
Actually, your question is a lot more complicated then you think. Firstly, you need to identify how your proxy works.
For example, the MS ISA Proxy service supports only HTTP connections. When initiating an SSL session, the proxy will first begin the session for both the client and the server, but then will establish a direct-connection tunnel. Oppositely, when working with a SOCKS proxy, the session is already being tunneled, and therefore is not filtered at all.
When working with IRC, you session is already tunneled through the proxy, so the SSL just acts as a tunnel inside a tunnel. For more information on this, check out:
h**p://www.mirc.co.uk/ssl.html
Really, your question needs to be narrowed down a lot more to be answered accurately:
- What type of proxy is this?
- What is your relation (network proximity) to the proxy?
- What service(s) are you trying to tunnel?
- Are you using chaining?
Eventually, anything can be done. Hope this helped!
Ahmeket
Jul 30 2005, 01:33 AM
I'm not really into the whole proxy thing, so I'm sorry for being a bit unclear.
What I'm interested in is if I connect to an SSL IRC server through a proxy (HTTP) will the proxy be able to intercept what I type without needing to unencrypt it.
Basicly I've two theories.
1. SSL to the proxy, proxy SSL to the server, so the proxy really sees what you type in plain text.
2. SSL straight to server in some weird way through the proxy, even if the proxy sniffs you it won't understand anything because it's crypted.
stay
Jul 30 2005, 02:05 PM
a proxy normally only redirects traffic, maybe it modifies some headers, but that's all.
encryption is done by your browser/irc program. therefore it also has the ssl dlls!
what should be possible, is to trick out local proxys which redirect your traffic encrypted to a remote proxy (whererom it's then normally send to the target, except you use a ssl connection), e.g. the TOR project.
browser - local proxy - local tor (ssl) - remote proxy (ssl till here) - target (only ssl if website or whatever uses ssl)
so here you could sniff at the local proxy (except you visit e.g. a ssl site or the program itself somehow crypts the traffic).
but somehow i didn't get it to sniff local traffic (local to local), somebody can help me with this?
also i didn't find a good local proxy server where i can enter another proxy for redirection (the TOR proxy), with socksyfing it gets complex, especially if the first part (browser) doesn't support socks/proxy...
Ahmeket
Jul 30 2005, 02:48 PM
So basicly you're saying that under normal circumstances the proxy only redirects the traffic and won't be able to read the encrypted messages.
ceder
Jul 30 2005, 03:32 PM
QUOTE
So basicly you're saying that under normal circumstances the proxy only redirects the traffic and won't be able to read the encrypted messages.
Several weeks ago, I tried to sniff my connection on my proxy ( socks 5 ). I was connected to an IRC server with SSL and all I saw was crypted.
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please
click here.