Write-Up: Using web proxies
The Importance of Web Proxies in Modern Web Application Security
Modern web and mobile applications rely heavily on continuous communication with back-end servers. These servers handle data processing, storage, and business logic, while user devices such as browsers and mobile phones display and interact with the processed data. Because of this strong dependency on back-end infrastructure, securing and testing back-end servers has become a critical component of application security.
A large portion of Web Application Penetration Testing focuses on analyzing and testing the HTTP/HTTPS requests exchanged between applications and back-end servers. To effectively capture, inspect, and manipulate this traffic, security professionals use specialized tools known as web proxies.
What Are Web Proxies?
Web proxies are tools positioned between a client (browser or mobile app) and a back-end server. They act as a man-in-the-middle (MITM), allowing testers to intercept, view, and modify web traffic in real time. Unlike network sniffing tools such as Wireshark, which capture all network traffic, web proxies specifically focus on web-based communication over ports like HTTP (80) and HTTPS (443).
Web proxies are considered essential tools for web penetration testers. They simplify the process of capturing and replaying HTTP requests, making testing more efficient compared to older command-line-based methods. Once configured, a web proxy allows testers to:
- View all outgoing HTTP requests
- Inspect server responses
- Intercept and modify requests before they reach the server
- Analyze how the server handles manipulated input
This ability to intercept and alter requests is fundamental for identifying vulnerabilities.
Common Uses of Web Proxies
Although capturing and replaying HTTP requests is their primary function, web proxies offer many additional features that support comprehensive security testing. These include:
- Web application vulnerability scanning
- Web fuzzing
- Web crawling
- Application mapping
- Web request analysis
- Configuration testing
- Code reviews
While specific web attacks are covered in dedicated security modules, mastering web proxy tools is essential for performing those attacks effectively. Two of the most widely used web proxy tools in the industry are Burp Suite and OWASP ZAP, both of which provide powerful features for web application testing.
Get Jordi Been’s stories in your inbox
Join Medium for free to get updates from this writer.
Intercepting Web Requests
Try intercepting the ping request on the server shown above, and change the post data similarly to what we did in this section. Change the command to read ‘flag.txt’
Excersise 1: Try using the payload we used last time directly within the browser, to test how intercepting responses can make web application penetration testing easier.
ls to list the contents of the current directory.
Exercise 2: Try adding a rule that automatically adds ;ls; when we click on Ping, by matching and replace the request body of the Ping request.
required attribute means that the form cannot be submitted if the field is empty. Therefore, we remove the required attribute in the response body. Additionally, in the request body, we change ip= to ip=;ls;.
ip=;ls;. We click Forward to send the traffic to the web server and return to the browser.
ls command displaying the contents of the current directory.Try using request repeating to be able to quickly test commands. With that, try looking for the other flag.
ls ../../../../../ to move up multiple levels in the filesystem and determine whether we can reach the root directory (/).
flag.txt file. We can read its contents using cat ../../../../../flag.txt. And we got the flag!The string found in the attached file has been encoded several times with various encoders. Try to use the decoding tools we discussed to decode it and get the flag.
Try running ‘auxiliary/scanner/http/http_put’ in Metasploit on any website, while routing the traffic through Burp. Once you view the requests sent, what is the last line in the request?
auxiliary/scanner/http/http_put. Then configure the required options. Make sure your web proxy is intercepting the requests.Open metasploit and choose payload auxiliary/scanner/http/http_put. Then fill in the options. Make sure your web proxy is intercepting the requests.
Use Burp Intruder to fuzz for ‘.html’ files under the /admin directory, to find a file containing the flag.
GET /admin/$$.html HTTP/1.1Then start the attack.
200 OK response for the entry 2010.
Skills Assessment — Using Web Proxies
The /admin.php page uses a cookie that has been encoded multiple times. Try to decode the cookie until you get a value with 31-characters. Submit the value as the answer.
Cookie header and send it to Decoder. Intercept the request with the web proxy. Select an copy the cookie value from the cookie header and send this to Decoder.
Once you decode the cookie, you will notice that it is only 31 characters long, which appears to be an md5 hash missing its last character. So, try to fuzz the last character of the decoded md5 cookie with all alpha-numeric characters, while encoding each request with the encoding methods you identified above. (You may use the “alphanum-case.txt” wordlist from Seclist for the payload)
3dac93b8cd250aa8c1a36fffc79a17a obtained in the previous question. Select the value and click Add § to mark it as a payload position. Under Payload Options, load the file alphanum-case.txt as the wordlist. Under Payload Processing, click Add and select Add prefix as the processing rule. Paste the MD5 hash as the prefix. Then add the following processing rules: Base64-encode and Encode as ASCII hex. After configuring everything, click Start Attack.
You are using the ‘auxiliary/scanner/http/coldfusion_locale_traversal’ tool within Metasploit, but it is not working properly for you. You decide to capture the request sent by Metasploit so you can manually verify it and repeat it. Once you capture the request, what is the ‘XXXXX’ directory being called in ‘/XXXXX/administrator/..’?
locale attribute. You can provide any URL as RHOST. Before executing this payload, ensure that your web proxy is intercepting the requests.
I hope the explanation was somewhat clear and useful to you.
It is important to understand the material in this module thoroughly so that you can apply these techniques effectively whether in a test environment or during a real penetration test.
