[MUMBLING]
A dum-dum.
Now, I kind of want to take a side here for a second
and really dive into something that we've touched on,
but haven't really directly addressed yet.
And that is proxies.
So we kind of get the understanding
that a proxy is a server or an application of some type that's
in between us and something else on the outside
of the actual internet itself.
But what does it really and what does it do?
Excellent questions.
Glad you asked here to answer.
In the world of pen testing, we look at a proxy
as a way for us to be able to hide what it is that we're
doing or try to hide.
A proxy is an application or a server
that allows us to be able to mask our traffic
from the outside world.
So if we're going from our personal workstation out
to the Google and don't have a proxy involved,
it would be our IP address from our ISP inside of our house
or where we're at, maybe your local coffee shop.
And by incorporating a proxy in your connection,
you're basically routing the traffic from your ISP
to somewhere else first, and then going to the Google
if you decide to go to onto the Google.
And then all traffic is going to be interpreted
and handled by that proxy.
Now generally proxies are used on everyday occurrence
for users to be able to get around geo location tagging.
I'm onto you, don't worry, I do it too sometimes.
And basically it allows us to be able to,
for what is commonly used for its day,
is for us to be able to say we're from a certain location
that doesn't have as many restrictions
as where we're currently at.
Now while I was in the army and stationed all over the world,
I had my own proxy server at my house in Texas.
The reason for this was,
is because there was a lot of sites that I used to go to
for the state of Texas, for my side hustles,
that only operated if the IP address was listed
as being from Texas.
So I would proxy my way from, let's say Germany,
for instance, back to my personal proxy server,
and then that proxy server would handle
all the in and out calls of internet traffic,
from me to the actual state of Texas server
that I was going to.
So that way the state of Texas servers
and their IDS and IPS systems,
identified that my traffic was legitimately
coming from Texas.
Now is that the right way to do things?
I'm not here to judge and I'm not here to make that call
because different jurisdictions have different rules
and different permissions.
But a proxy in the term of pen testing for us,
basically mask what IP address and what traffic
that we're really originating from.
And this comes in really handy
when we have a truly defined rules of engagements
with scopes identified.
Because in a perfect world,
pen testing is going to be originating
from a certain set of IP addresses.
It's gonna be identified by the pen testers, that's us,
to the organization that we're actually pen testing.
And in order for us to be able to stay true
to what we're doing,
we have to originate traffic from that IP range or scope
that we originally agreed on.
But there's nothing in the rules of engagements,
you know, depending on how you write it,
this says we can't go through a proxy
because part of our pen testing requirement may be
to see if we can still get in the network,
even though our scope of IP addresses
that we're originating from
and doing all of our work at is blocked already.
Now, coming from a blocked IP address on a CaliBox
into a network that we're trying to pen test
without the use of a proxy proves very difficult.
It can still be done and can still be achieved,
but the use of a proxy allows us to be able to mask
our IP address and look like we're coming from somewhere else.
So let's say we're monitoring the organization's traffic
going in and out like we've done in previous skills.
If we see that during the course of our pen test
that legitimate traffic to the organization that's our target
is receiving traffic from certain IPs,
we may want to originate a proxy
that has that IP address on it
or is within that range to allow us to be able to sneak in
with legitimate traffic and be able to conduct our pen test.
And this is where tools like the proxy or Zapp proxy
and Burbsweet come into play
because not only do they allow us to be able to test
against web servers and web applications,
but they do have functions inside of them
that allow us to use them as proxies as well.
Now, this is usually done in a multi-system setup
or if we have multiple IP addresses
on the actual system itself, for instance.
Let's say that on our system in the lab
we have two interfaces, check, we do.
And one of them is set for a public IP address
and the other one is set for a separate public IP address
that is on a completely different range.
The IP address of interface A
is what we're allowed to actually run from
in the scope of our pen test inside the ROE.
And we may use that second interface interface B
with that second public address as the actual proxy
for Burbsweet for us to be able to tunnel our traffic
if we're using a single system setup.
Now, yes, this is kind of like elbow to hand here.
We're having to go out and come back into our own system
from one interface to the other and go out,
but we are masking our IP address the best we can
using certain tools to be able to try to speak in
with legitimate traffic for our pen test.
Or let's say that we have a second separate system,
physical, virtual, however you wanna do it, set up
and it has its single interface set up
in a public IP address that is allowed
to the organization we're pen testing.
If we go from our Kali box, because that's generally
what we're gonna try to stick with
and use a tool like Burbsweet,
we can identify that second system as our proxy
and run Burbsweet on that and remotely manage it
from the original Kali box.
You see, Burbsweet doesn't just have tools
on the local system itself.
It can be remotely managed.
And if you spring the money for the actual
professional edition, it has way more tools
to wear way more folks can manage it
at the exact same time.
But there are different ways for us to be able to do this.
And in this lab, we're going to be sticking with
using Burbsweet on the single Kali system
and analyzing some of the traffic
and utilizing some of the Burbsweet tools.
But I did wanna cover proxy and how it relates to us
as pen testers and also get an idea
of what a proxy actually is.
Last thing I wanna add is that proxies
don't necessarily secure the traffic.
This would be a better question for those
in the Cisco world here at CBT Nuggets
when you start getting into things like IPsec.
That's actual tunnel encryption that can be set up
from point to point and goes beyond the capabilities
of a simplistic proxy.
Things to keep in mind that you may want to use
a proxy incorporated with something like IPsec.
But definitely check out those skills
across the yard over there and let me know
what you would do at a later time
when we start getting deeper into the course.
But for now, since we know what a proxy is
and how it's useful to us,
back to our regularly scheduled programming.
(mumbles)