❎
wiki.hackerlab.cz
  • About me
  • Vulnerability Assessment
  • CLOUD PENTESTING
    • AWS
    • GCP
    • Microsoft Azure
    • Labs
  • REST API - Bypasses and Privilege Escalations
  • Python Virtual Environment (VENV)
  • OSINT & Information Gathering
  • Web Pentesting
    • JavaScript .maps
    • SSRF
    • LDAP Injection
    • Django ORM Exploitation
    • HTTP Request Smuggling
    • Server Side Template Injection (SSTI)
    • Insecure Deserialization
    • Brute force
    • Shell Fu - Oneliners
    • CORS
    • Special Chars & NULL Bytes
    • XSS
    • XXE
    • Nuclei
    • SQL Injection
    • Blind SQL Injection
    • SQLmap
    • NoSQL Injection
    • CRLF Injection
    • Input Validation - Fuzz1
    • HTTP Headers - X-Forwarded
    • Log4j
    • Enumeration with Wordlists
    • Bug Bounty - Web Recon
    • HTTP Proxy Override
    • CSV Injection
    • Windows Forbidden File Names
    • Path Traversal
    • OS Command Injection
    • Open Redirect
    • JWT Tool
    • Burp Extensions - TokenJAR & ATOR
    • Upload RCE
    • GUID and UUIDs
  • Toolset
    • Git - Repo and Tools
    • Docker for Pentesters
  • Infrastructure Pentesting
    • Active Directory (AD)
      • Vulnerable Machines (labs)
      • Pass the hash
      • Azure Active Directory
      • Password Cracking
      • Domain Enumeration
      • LLMNR Poisoning with Responder
      • HTB Forest
      • LDAP
      • WinRM
      • SMB & RPC Enumeration
      • SMB Relay
      • Impacket
      • Bloodhound
      • OWA Exchange Server 2019
      • Active Directory Web Services (ADWS)
      • Active Directory Attacks
    • Mail Server Attacks
    • NFS Enumeration
    • Windows PostExploitation
      • Windows Enumeration
      • Powershell Payloads
      • Add RDP Account & Ride on Meterpreter
    • Dump File Analysis
  • Other Pentest Projects
    • Security Projects
  • WIFI Pentesting
    • Kali Linux - Alpha card AWUS 1900 (VirtualBox)
    • Active Card & Monitor Mode
    • Aircrack-ng Suite
  • Certs
    • Burp Suite Certified Practitioner
  • Linux
    • Network Manager
  • Books
    • The Hacker Playbook 3
Powered by GitBook
On this page
  • OS Linux - Terminal
  • Metasploit
  • Java (VM)
  • HTTP
  • HTTP & HTTPS
  • Create Java Keystore
  • Import certificate (CER or DER)
  • Visual Studio 2015|2019

Was this helpful?

  1. Web Pentesting

HTTP Proxy Override

Set up a HTTP proxy forwarding for your app. Usually with combination of Burp Suite web proxy.

PreviousBug Bounty - Web ReconNextCSV Injection

Last updated 2 years ago

Was this helpful?

OS Linux - Terminal

The app or a library has to be coded to reflect these specific environment variables. Otherwise, explore a specific app configuration or CLI parameters for HTTP proxy features.

export http_proxy='127.0.0.1:8080'    
export https_proxy='127.0.0.1:8080'

You can unset back the variables by

unset http_proxy
unset https_proxy

Metasploit

msf> set Proxies http:127.0.0.1:8080

There are different types of proxies you can define.

set Proxies socks4:127.0.0.1:5555
set Proxies socks5:127.0.0.1:5555

Java (VM)

Forward HTTP/HTTPS traffic for your Java app to Burp Suite Proxy. The same analogy applies to FTP, explore the following Java documentation.

HTTP

Before you start your java application, add the following parameters to JVM.

java -Dhttp.proxyHost=127.0.0.1 -Dhttp.proxyPort=8080

HTTP & HTTPS

"%JAVA_HOME%\bin\java" …  
-Dhttp.proxyHost=127.0.0.1 
-Dhttp.proxyPort=8080
-Dhttps.proxyHost=127.0.0.1      
-Dhttps.proxyPort=8080 
-Dhttp.nonProxyHosts=localhost 
-Djavax.net.ssl.trustStore=C:\Users\Administrator\.keystore
-Djavax.net.ssl.trustStorePassword=changeme

HTTPS Troubleshooting - add the following JVM parameter to track SSL/TLS handshake and certificate look up errors Djavax.net.debug=ssl,handshake

Create Java Keystore

Briefly, Java Key Store (JKS) is a secured storage protected by password (trustStorePassword).

cd %JAVA_HOME%/bin
keytool.exe -keystore C:/Users/Administrator/.keystore -genkey -alias client

Import certificate (CER or DER)

keytool.exe -importcert -file certificate.cer -keystore C:\Users\Administrator\.keystore -alias "BurpCert" 

Visual Studio 2015|2019

Find VS software home (installation directory)

%ProgramFiles%\Microsoft Visual Studio\2019\Enterprise\Common7\IDE%

edit devenv.exe.config file

<system.net>
<defaultProxy useDefaultCredentials="true" enabled="true">
    <proxy bypassonlocal="true" proxyaddress="http://127.0.0.1:8080" />
</defaultProxy>
</system.net>

with authentication option

<system.net>
<defaultProxy useDefaultCredentials="true" enabled="true">
    <proxy bypassonlocal="true" proxyaddress="http://Username:Password@yourproxyaddress.net:8080" />
</defaultProxy>
</system.net>
Java Networking and Proxies
Logo