Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Web-App-Sec
[Top] [All Lists]

Re: NTLM and man-in-the-middle proxies not working

Subject: Re: NTLM and man-in-the-middle proxies not working
Date: 26 Sep 2005 22:18:05 -0000
I see several possibilities here:

1-Security Zone
This seems one of the best explanations. I've tried fuzzing with the 
configuration, but no luck. With same configuration on my browser, doesn't 
explain why mine works on my demo network but not on the client.

2-"Enable IWA (requires restart)" option in IE->Tools->Internet 
Option->Advanced.
This would seem another clear option. But once again, this option doesn't work 
on the client side.

3-Network definitions
Some bizarre option could define what is a sort of Intranet. Same subnetwork 
vs. differrent network. Subnetworks are pretty the same in my test network and 
at the client. I intend to change my demo network to exactly the same addresses 
at the client.

4-Group policy
Another possibility, as my computer doesn't have an exact same behaviour on the 
client side as a browser belonging to the client domain. THis could also relate 
to the fact that at the client, users are typically logged on to the domain 
when access is made. But once again, doesn't explain why connecting though a 
proxy should change this.

5-Special Headers
Rogan talked about the proxy introduced headers. I recall seing that at the 
client, but also doesn't explain why the same browser with the same proxy 
sometimes works and others not.

Seems probably there are at least two of the above messing with the results. 
I'll be checking on the client side again this week. Will make network captures 
to detail the information being sent. Any suggestions I may try them (like 
testing it with Webscarab) and then will post conclusions back.

rj

-----Original Message-----

Quoting "Amit Klein (AKsecurity)" <aksecurity@hotpop.com>:


WebScarab did not (and does not currently) set the "Proxy-Support" 
header mentioned below, so there seems to be some inconsistency here.


Yes, this is pretty weird. We definitely have inconsistent reports from 
credible sources. 
Perhaps this has something to do with the seurity zone? or some obscure 
configuration of IE? I think Raymond is in a good position to find out, because 
he experiences both phenoma (if I understand correctly).

-Amit

<Prev in Thread] Current Thread [Next in Thread>