Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/lijiejie/MisConfig_HTTP_Proxy_Scanner
The scanner helps to scan misconfigured reverse proxy servers and misconfigured forward proxy servers
https://github.com/lijiejie/MisConfig_HTTP_Proxy_Scanner
Last synced: 3 months ago
JSON representation
The scanner helps to scan misconfigured reverse proxy servers and misconfigured forward proxy servers
- Host: GitHub
- URL: https://github.com/lijiejie/MisConfig_HTTP_Proxy_Scanner
- Owner: lijiejie
- License: apache-2.0
- Created: 2023-04-17T11:50:13.000Z (over 1 year ago)
- Default Branch: main
- Last Pushed: 2023-04-19T06:28:30.000Z (over 1 year ago)
- Last Synced: 2023-11-07T20:46:02.204Z (about 1 year ago)
- Language: Python
- Size: 2.36 MB
- Stars: 160
- Watchers: 7
- Forks: 6
- Open Issues: 2
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
- awesome-hacking-lists - lijiejie/MisConfig_HTTP_Proxy_Scanner - The scanner helps to scan misconfigured reverse proxy servers and misconfigured forward proxy servers (Python)
README
# MisConfig HTTP Proxy Scanner
The scanner helps to:
1) Scan misconfigured reverse proxy servers, to find those web services designed Intra-net access only but accidentally exposed to the Internet.
2) Attack known forward proxy servers, brute with generated intra-net domains to find those existed ones, like:
* *.company.internal
* \*.company.local
* \*.company-inc.net
## Install
This app developed and tested with python3.8 only. Create a python3.8 virtual env, and then install with
```
pip3 install -r requirements.txt
```
## ChangeLog
* 2023-04-19: Fix vulnerability report panel sort bug.
## How To Use
For the left side input box, input some public IPs or domains that you find via brute / crawler / PassiveDNS etc.
For the right side input box, you have two choices:
* Input some domains you already know that are resolved to private IPs (10.x.x.x 192.168.x.x)
* If the target corp uses private DNS Zone, use the **brute force attack** to find valid private domain names.
## Screenshot
