Does anyone have experience with FoxyProxy?

[ShadeDream]

My last thread in the proxies forum has 0 replies so I figured the proxies forum is dead. So anyway, does anyone know why when I select SSL as the proxy type the proxy doesn't work but when I select HTTP the proxy works? I got a few proxies from a BHW seller who claims them to be HTTPS but they don't work when the SSL option is selected. I was thinking it might be the extensions fault? Any ideas?

 

[ShadeDream]

I tried SwitchyOmega and I get the same "Secure Connection Failed" error. Does this mean the proxy seller is selling bullshit proxies?

 

[devkareem]

HTTPS proxies mean they can be used to proxy SSL, Not that they use HTTPS protocol. You cannot SSL an IP.

 

[Keljmenc]

Using it as HTTP and storm rotating residental for more than a year never see any prob. You can always check anonymity, there are tons of sites ofering free check.

But at the end I'm not the pro at this subject so take my advice with a grain of salt.

 

[ShadeDream]

HTTPS proxies mean they can be used to proxy SSL, Not that they use HTTPS protocol. You cannot SSL an IP.

With FoxyProxy there's an option for HTTP and one for SSL as the proxy type. On the other hand with SwitchyOmega there's an option for HTTP and one for HTTPS. The HTTPS proxy does not work with any of these when the proxy type is selected as SSL or HTTPS. Can you explain a little more on how HTTPS proxies proxy SSL? What do you mean by they don't use the HTTPS protocol? I'm a bit confused as if they don't use the HTTPS protocol then doesn't that mean that the data itself isn't encrypted at some point and someone can peak in? The other thing that comes to mind is that HTTP and HTTPS proxies are essentially one and the same thing if the so called HTTPS proxies don't work when the proxy type is selected as SSL / HTTPS but then that would mean a lot of people are misadvertising what they are selling.

Using it as HTTP and storm rotating residental for more than a year never see any prob. You can always check anonymity, there are tons of sites ofering free check.

But at the end I'm not the pro at this subject so take my advice with a grain of salt.

There's no way of telling whether the proxy you are using is HTTP or HTTPS through a website, at least not as far as I'm aware.

 

[devkareem]

With FoxyProxy there's an option for HTTP and one for SSL as the proxy type. On the other hand with SwitchyOmega there's an option for HTTP and one for HTTPS. The HTTPS proxy does not work with any of these when the proxy type is selected as SSL or HTTPS. Can you explain a little more on how HTTPS proxies proxy SSL? What do you mean by they don't use the HTTPS protocol? I'm a bit confused as if they don't use the HTTPS protocol then doesn't that mean that the data itself isn't encrypted at some point and someone can peak in? The other thing that comes to mind is that HTTP and HTTPS proxies are essentially one and the same thing if the so called HTTPS proxies don't work when the proxy type is selected as SSL / HTTPS but then that would mean a lot of people are misadvertising what they are selling.



There's no way of telling whether the proxy you are using is HTTP or HTTPS through a website, at least not as far as I'm aware.

https://stackoverflow.com/questions/10440690/pros-and-cons-of-using-a-http-proxy-v-s-https-proxy
https://stackoverflow.com/questions/516323/https-connections-over-proxy-servers
https://security.stackexchange.com/questions/23561/authenticating-a-proxy-server-over-https

Connecting to the proxy using HTTPS is not the same AS proxying HTTPS websites.

 

[ShadeDream]

https://stackoverflow.com/questions/10440690/pros-and-cons-of-using-a-http-proxy-v-s-https-proxy
https://stackoverflow.com/questions/516323/https-connections-over-proxy-servers
https://security.stackexchange.com/questions/23561/authenticating-a-proxy-server-over-https

Connecting to the proxy using HTTPS is not the same AS proxying HTTPS websites.

I've seen the first link. These responses don't seem to be written in simple English for the simple mind. People like this kind of make me want to learn a lot about technology because then I am sure I could make simple English explanations once I actually understand what they are talking about.

So if with a HTTPS proxy the browser to proxy server connection is encrypted does that mean the proxy server to website connection is also encrypted? Or does a HTTPS request from the browser go through a HTTP tunnel to the proxy server and from the proxy server to the website it becomes encrypted? Wouldn't that mean that I would be sending data in plain text to the proxy server? VPN's are completely different? Or is a HTTPS proxy basically a TCP proxy with the command named CONNECT which is / would be the only way to use a proxy without sending data in plain text?

Also, is it possible to use an SSH SOCKS proxy / tunnel with different browsers? Or is that thing for the whole system?

 

[devkareem]

I've seen the first link. These responses don't seem to be written in simple English for the simple mind. People like this kind of make me want to learn a lot about technology because then I am sure I could make simple English explanations once I actually understand what they are talking about.

I understand, It's just that the way it works itself is complicated, As HTTPS proxies may mean 3 different things, Which are:

#1 - a proxy which knows the "CONNECT" verb and is able to forward connections to a ultimate SSL-powered target server;
#2 - a proxy which is itself a SSL server and will engage in SSL with the client, to protect requests and responses when they transit between client and proxy.
#3 - Both, the proxy server is an SSL server and you will connect to it after you install a self-signed cert so that the content between YOU -> SERVER is encrypted, Also knowns the "CONNECT" protocol which will be tunneling requests between YOU -> PROXY -> HTTPS SERVICE

So if with a HTTPS proxy the browser to proxy server connection is encrypted

encryption of your data from browser to proxy is only applied if the connection to the proxy was made in HTTPS as the proxy server itself runs an ssl server. See point #2.

does that mean the proxy server to website connection is also encrypted?[

Proxy Server to website encryption is what most of the HTTPS Proxies being sold are doing which is basically making a tunnel between you, proxy and ssl-powered target server which means the proxy here sits on the middle of the request but not able to intercept it. since the ssl is being tunneled and verified. to be able to intercept it or read it the proxy server must send you a "fake" ssl cert for domain.com that you install on your device, because that's how SSL works the proxy server can't intercept SSL content for domain.com since it doesn't have the certificate validating its ownership of domain.com.

Or does a HTTPS request from the browser go through a HTTP tunnel to the proxy server and from the proxy server to the website it becomes encrypted? Wouldn't that mean that I would be sending data in plain text to the proxy server?

You can't convert HTTP to HTTPS. if you are sending data in plain-text to HTTP proxy server only you wouldn't be able to open HTTPS sites. since the request were made in HTTP beforehand. nor the proxy server has the valid certificate for domain.com to open a valid SSL connection and intercept your data.

VPN's are completely different?

it's same concept if proxy/vpn server intercepted HTTP plain-text data then created a valid ssl connection to the target server they wouldn't be able to reply back with a valid HTTPS response/website. and the secure connection to target would fail by then.

Also, is it possible to use an SSH SOCKS proxy / tunnel with different browsers? Or is that thing for the whole system?

an SSH Tunnel in simple words is a proxy. your are tunneling all requests from your current application using the proxy (i.e browser) to -> SSH connection sending it to server to handle the request for you then forward the response back to you. Also yes it can be used for whole system in some situation by setting up a forwarding rules in your machine using iptables for example.

Hope i've made it clear enough.

 

[ShadeDream]

Hope i've made it clear enough.

Yes you have, thank you for taking the time to help me out.

One last question, why can't I use a proxy that has been advertised as HTTP(S) with this:

When the protocol is HTTPS the proxy won't work even though it was advertised as HTTP(S). When the protocol is HTTP it works. Why does this extension have a HTTPS protocol option if that's not how it works?

 

[devkareem]

Yes you have, thank you for taking the time to help me out.

One last question, why can't I use a proxy that has been advertised as HTTP(S) with this:

When the protocol is HTTPS the proxy won't work even though it was advertised as HTTP(S). When the protocol is HTTP it works. Why does this extension have a HTTPS protocol option if that's not how it works?

The HTTPS here refers to the protocol used to connect to Proxy. it's advertised as HTTPS probably cuz it support SSL-powered servers. Does it works with HTTPS sites when it's set to HTTP?

 

[ShadeDream]

The HTTPS here refers to the protocol used to connect to Proxy. it's advertised as HTTPS probably cuz it support SSL-powered servers. Does it works with HTTPS sites when it's set to HTTP?

Yes it does.

 

[devkareem]

Yes it does.

Yep. Then HTTPS proxy here refers to it's a proxy that tunnels HTTPS requests but it's not an SSL server itself and you can't connect to it using HTTPS but that doesn't mean the data is not encrypted, since there is a valid HTTPS connection between you and the target server the data is already being sent encrypted to the HTTP proxy server.

 

[devkareem]

I think this thread should be moved to Proxies forum

 

[ShadeDream]

Yep. Then HTTPS proxy here refers to it's a proxy that tunnels HTTPS requests but it's not an SSL server itself and you can't connect to it using HTTPS but that doesn't mean the data is not encrypted, since there is a valid HTTPS connection between you and the target server the data is already being sent encrypted to the HTTP proxy server.

How can there be a valid HTTPS connection between me and the target server when I'm going through a HTTP proxy server? I feel like I am finally getting somewhere with understanding things better. Also where one would find a HTTPS proxy that tunnels HTTPS requests and what would the advantage of such a proxy be? Thank you.

I think this thread should be moved to https://www.blackhatworld.com/forums/proxies.101/ forum

I guess it can now be moved to that section. I didn't want to post it there at first because my last thread about SOCKS proxies got 0 replies and I feel like the same would happen with this thread.

 

[devkareem]

How can there be a valid HTTPS connection between me and the target server when I'm going through a HTTP proxy server? I feel like I am finally getting somewhere with understanding things better. Thank you.

That's how tunneling works #1. The Proxy Server only tunnels the connection between you and target server and forward your SSL encrypted data to the target server. so that the proxy server is only sitting in the middle in this situation like a router connecting to a modem tunneling all devices on the network -> Router -> Modem -> Target Server.

Also where one would find a HTTPS proxy that tunnels HTTPS requests and what would the advantage of such a proxy be?

You can build your own supporting both solutions using squid as it's the only one supporting this feature think (more here). it's advantages depends whether if you go with both or just SSL proxy server:

# SSL ONLY
Used for debugging and reverse engineering. it basically means you will install a self-signed cert on you browser for example to authorize the proxy server to make SSL connections for all domains (or specific domains), which means in this scenario you will be making an HTTPS connection to your proxy server as the target server and it will decrypt content and make the connection on your behalf to the target server then forward response as the target server.

# SSL + CONNECT
This is the best scenario here as you have both options. proxy runs on HTTPS and uses "CONNECT" tunnel. so that your connection to the proxy server that have the HTTPS content for target server would be encrypted itself. so it's double encrypted. that goes for HTTP sites as well:

Browser -> SSL Connection (containing http or https content) -> Proxy Server (decrypting content of SSL connection) -> TUNNEL (forwarding decrypted HTTPS (contating the http/https content) -> Target Server

I guess it can now be moved to that section. I didn't want to post it there at first because my last thread about SOCKS proxies got 0 replies and I feel like the same would happen with this thread.

it really depends whether if there was an online user that able to help at the time where it was on front page. you can use thread bumping.

#1
CONNECT tunnel
The CONNECT method is a way to tunnel any kind of connection through an HTTP proxy. By default, the proxy establishes a TCP connection to the specified server, responds with an HTTP 200 (Connection Established) response, and then shovels packets back and forth between the client and the server, without understanding or interpreting the tunnelled traffic.

 

[ShadeDream]

it really depends whether if there was an online user that able to help at the time where it was on front page. you can use thread bumping.

That forum is literally dead, my thread ain't even at the bottom of the page and it has been sitting at 0 replies for a while.

Browser -> SSL Connection (containing http or https content) -> Proxy Server (decrypting content of SSL connection) -> TUNNEL (forwarding decrypted HTTPS (contating the http/https content) -> Target Server

This bit got me confused so if you could clarify would this be a HTTPS proxy that tunnels HTTPS requests?

 

[devkareem]

This bit got me confused so if you could clarify would this be a HTTPS proxy that tunnels HTTPS requests?

Yep exactly. You are connecting using HTTPS to the proxy server in same time the proxy server is tunneling your requests to target server directly.

 

[ShadeDream]

Yep exactly. You are connecting using HTTPS to the proxy server in same time the proxy server is tunneling your requests to target server directly.

But to make this work you would be required to install certificates?

 

[devkareem]

But to make this work you would be required to install certificates?

If you are using a proxy server that has a self-signed certificate you would be required to install a certificate yes. but if you are connecting through a proxy that uses a domain not an IP you can register a valid SSL certificate for that domain and configure the proxy server to use it.

 

[ShadeDream]

If you are using a proxy server that has a self-signed certificate you would be required to install a certificate yes. but if you are connecting through a proxy that uses a domain not an IP you can register a valid SSL certificate for that domain and configure the proxy server to use it.

Thank you for helping me out with your knowledge, I understand things a bit better now which makes me feel more at ease.