+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: Bypass reverse proxy (/showthread.php?tid=6189461)
Bypass reverse proxy - induna3000 - Jan 17, 2022
Hi everyone,
I am a noob hacker. In my country we have a problem with internet bundles being too expensive. As a result we have resolved to siphoning internet from our ISP.
In my case, as I was browsing my ISP landing page, accessible only when your internet bundle is depleted (z3ro-ra7ed). I saw an ad. Upon further investigation I saw this ad was being shown via an internal server set up by the ISP that is freely accessible to clients.
The catch is that the server has a reverse proxy that filters out certain untrusted sites (unfortunately online learning sites, movie sites, YouTube player *wails). The only way to use this vuln is by entering <desired-site> at the end of the url, ie.
https[:]//vuln-server[.]com/reverse-proxy/www[.]<desired-site>
(I can't post links, yet, forgive the square brackets)
My question is since I can't insert full url, how else can I bypass the reverse proxy to be able to use the internal server 100%
RE: Bypass reverse proxy - Beladonis - Jan 17, 2022
Can't you just do the same and setup a website acting like a reverse proxy?
Code
ISP -> Their reverse proxy -> your own reverse proxy -> youtube.com
or
https://yourisp.com/reverse-proxy/www.mywebsite.net/?url=https://youtube.com/RE: Bypass reverse proxy - induna3000 - Jan 17, 2022
Thank you very much I will try this and get back to you :D
(Jan 17, 2022 11:32 AM)Beladonis Wrote: Can't you just do the same and setup a website acting like a reverse proxy?
CodeISP -> Their reverse proxy -> your own reverse proxy -> youtube
Urhmm sorry Beladonials, but I'm stuck and need further help :(
So I got what you meant about setting up my own proxy server, the problem I have is configuring my site to work as one.
I found an article that I add this php to my webfiles
Code
<?php
if (isset($_GET['url']))
$url = $_GET['url'];
$content = file_get_contents(url);
echo $content;
?>
OR
<?php
$address = "http[:]//target-site";
if(isset($_GET['link']))
{
$loc = $_GET['link'];
}
header('Location: '.$address);
?>Which supposedly would work like:
https[:]//vuln-server[.]com/reverse-proxy/my-site[.]com/file.php?link=youtube[.]com
But doesn't!
Any idea how I could set my site as a proxy? How would you do it, senpai!
RE: Bypass reverse proxy - nCoXo - Jan 18, 2022
Can you try shorting you url with link shortner and place that link over there, example Link bit.ly [WARNING: potentially infected].
RE: Bypass reverse proxy - induna3000 - Jan 18, 2022
(Jan 18, 2022 04:38 AM)nCoXo Wrote: Can you try shorting you url with link shortner and place that link over there, example Link bit.ly [WARNING: potentially infected].
No can't do, besides link doesn't connect to internet via external clients, you need to be inside the ISP network.
Like have a sim, which I doubt you do. No disrespect.
But this is the format of the link:
hxxps://vuln-site,com/clientless_vpn/reverse-proxy/www,desired-site,com
RE: Bypass reverse proxy - linkinpork - Jan 18, 2022
(Jan 17, 2022 09:30 PM)induna3000 Wrote: Any idea how I could set my site as a proxy? How would you do it, senpai!
Not sure if this will work with you, but maybe you can try using a site like https://www.proxysite.com/ to proxy straight away. It'll only run websites though, you're stuck in ports 80/443.
You can also search more similar sites on Google if that doesn't work. Try this Google Dork:
Code
intext:proxy "web"RE: Bypass reverse proxy - induna3000 - Jan 19, 2022
(Jan 18, 2022 07:30 PM)linkinpork Wrote:Codeintext:proxy "web"
Thank you for this, really help me.
Much appreciated.