Shulou(Shulou.com)06/01 Report--

Reverse proxy server (Reverse Proxy)

A normal proxy server helps computers in the internal network access the external network. Usually, the proxy server connects both the intranet and the extranet. First of all, the computer in the intranet needs to set the address and port of the proxy server, then send the HTTP request to the proxy server, and finally forward it by the proxy server.

The reverse proxy server helps the extranet computer to access the intranet service. The external network computer does not need to be configured, directly according to the domain name or IP address to access the reverse proxy server, and then the proxy server requests the intranet server to obtain the response data, and then send it to the computer. To the extranet computer, the reverse proxy server is like a Web server. But in fact, the reverse proxy server does not hold the corresponding resources. Through the reverse proxy server, we can protect the real server from leaking in the external network, so as to ensure the data security.

Reverse proxy is reflected in penetration testing:

(1) if you encounter a server that uses a reverse proxy, you can only get the IP of the proxy server through ping, but not the address of the real server.

(2) if you get the resolution permission of the domain name, resolve the domain name to a reverse proxy server, and then proxy the user's request to the real server through the reverse proxy. In this way, the man-in-the-middle attack is realized through the reverse proxy server. Only by checking the IP address of ping can you determine whether it is being reverse proxied.

(3) through the reverse proxy server, you can build a shell website, and most or all of the data are embezzled from the victim's website. The website owner needs to detect the reverse proxy in many ways, such as foreground and background, and does not respond to the data request of the reverse proxy.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.