Proxo - Fake Proxy Host_Name & IP Filters

Re: Proxo - Fake Proxy Host_Name & IP Filters

"~Peekaboo~",
I can't seem to find out how they are doing the scan. I've search the html on the page, checked out a few other things, but I'm just not sure how they are doing the scan. I do know that it scans port 80 looking for "proxy" activity.

I've looked at some "scan detection" modules to see if I could get it to work with PRoxo, . . .but havent' had any luck with it yet. I even looked at the possibility of making PRoxo look at certain files in My fire-wall as a trigger when the firewall detects port scanning, but so far that's a dead end also.

I have an idea, . . .that if I could point Proxo to "monitor" port 80, and then when it was scanned, to use a "URL Redirector filter" to redirect that particular "connection or connections" through an actual Remote Proxy, the Proxy would cloak Your IP just for the scan but would be "disabled" for the rest of the connections when loading the page up. This could work, but I'm not sure how to make Proxo detect the scan. "Any Ideas"?

Take Care & Safe-surfin,
"~JAK~"

 

Re: Proxo - Fake Proxy Host_Name & IP Filters

Hi Jak,

unless there is some http trigger, I would think this would be difficult.

Is there a way to test the theory that if proxo ran on port 80 with your spoof filter that the lockdown scan would give the result: You Appear to be On A Proxy!

can proxo run on other ports other than 8080?

maybe under proxo config > HTTP tab > change " Proxo's proxy port number" to 80 and reconfig your browser proxy setting to port 80 then run the lockdown test again

if you can fool the test into thinking you are on a proxy, you may be close to the answer.

worth a try maybe

 

Re: Proxo - Fake Proxy Host_Name & IP Filters

Hi "~Peekaboo~",
I tried changing the Port to port 80 and changed the spoofin' filters to where it just "stealthed" the Via, User-agent, X-forwareded-for Headers. I reloaded the page, but the results where the same. I think that setting Proxo's port just changes the local port that Proxo "listens" on.

I'm not sure but I believe that the checker site redirects You through a CGI where it analyzes Your headers is why it's so hard to fool. Still not sure how it can know the difference when it scans port 80 because the IP is the same for any port it would scan. So if My headers appear to be a Proxy, and the IP is the same looks like it would think its a proxy reguardless of what port it scanned. I'm going to studied it more to try to understand exactly how it knows and once I know that I think I can come up with a way to "spoof" it during the scan.

Thankx for all the info and help. I really appreciate You and all Your efforts. I know there is a way to do this, I just don't understand everything I know about it. LOL!

Take Care & Have a Good One,
"~JAK~"

 

Re: Proxo - Fake Proxy Host_Name & IP Filters

JAK,

Thanks for trying.

Take it easy

 

Re: Proxo - Fake Proxy Host_Name & IP Filters

Hi "peakaboo",
I found a way to fool the site. Click Here
Still working on how to send "Spoofed IP", but I'm closer than I was.

Take Care and Have a Great Evening,
"JaK" =