How to get a proxy for $0.01

[Core]

Information
A long time ago (2 years or so) I created a proxy panel which was never used, and I recently came across it on a old hard drive of mine. It had me thinking, why not develop it even further, so that's what I'm going to do.. However, to do so I need some real world clients to test the features in real time. At the moment, I'm using an old stable release of the panel and will be re coding the core (as the code is messy) and later adding additional features such as real time statistics, graphs, etc.

Why?
A proxy service is in high demand at the moment and I have several spare servers which aren't being used for anything major; just a CDN for my personal portfolio website. So why not use them for the panel?

Server Information
I currently have 3 servers which I have configured to the panel. One of the servers have 480gbps ddos protection with 250mbps. The other two servers have 600gbps with 1gbps uplink. However, you will not get a choice on what server you are assigned to. I will spread them out evenly so each consumes an equal amount of traffic.

How to set up
1. Go to yeno.pw and login to the account (information will be sent via PM).
2. Select the service which you want (

You must be registered for see links

)
3. Change the information to your clients (

You must be registered for see links

)
4. Use the proxy IP and port in your client.php

Why charge $0.01?
Because the staff on here don't like the idea of a free proxy service which was my original idea. So they decided to block all of my other posts, so fixed price of $0.01 but just note I'm lazy and don't always like logging into PayPal so who knows it could be free (shhhhhhhh)

 

[MayoMayn]

Good idea, but proxies are shit if not used for an anonymous machine or website.
If your proxy goes down, so does your website, and proxies are way less secure too. Simply use Bitninja, who cares about getting an IP anonymous if your firewall is good enough.

 

[Core]

Good idea, but proxies are shit if not used for an anonymous machine or website.

What do you mean? an anonymous machine or website

These are reverse proxies, so handle both incoming and outgoing communication between the client and server...
It's not like a socks proxy?

 

[MayoMayn]

What do you mean? an anonymous machine or website

These are reverse proxies, so handle both incoming and outgoing communication between the client and server...
It's not like a socks proxy?

I just never understood why anyone would bother buy or get a proxy for free, when all they do is slow down your server. A proxy is just as big of a scam as "DDoS Protection" services. They literally do nothing.

Sent from my SM-G928F using Tapatalk

 

[Core]

I just never understood why anyone would bother buy or get a proxy for free, when all they do is slow down your server. A proxy is just as big of a scam as "DDoS Protection" services. They literally do nothing.

Sent from my SM-G928F using Tapatalk

They filter the traffic through the ddos protected firewall from the client -> server.
They also hide the original servers IP address as the client will never communicate directly with the server.

In other words, if they manage to take down a reverse proxy, you can just relay the users with another one as it wouldn't affect the main site...

 

[MayoMayn]

They filter the traffic through the ddos protected firewall from the client -> server.
They also hide the original servers IP address as the client will never communicate directly with the server.

In other words, if they manage to take down a reverse proxy, you can just relay the users with another one as it wouldn't affect the main site...

You can ping the IP and receive all incoming/outgoing connections in Kali Linux, and for that the IP that is shown most is obviously the server IP, since thats the IP where all traffic gets redirected to. How do you think FBI etc finds onion sites and people behind a proxy? And for firewall, pff, use Bitninja.io instead, had my trial for months now without paying. You don't get better protection than what they offer. Proxy is a waste of time and money, but for retarded people in retro community that doesnt research shit, this is a good offer. Good luck with this!

Sent from my SM-G928F using Tapatalk

 

[Core]

You can ping the IP and receive all incoming/outgoing connections in Kali Linux, and for that the IP that is shown most is obviously the server IP, since thats the IP where all traffic gets redirected to. How do you think FBI etc finds onion sites and people behind a proxy? And for firewall, pff, use Bitninja.io instead, had my trial for months now without paying. You don't get better protection than what they offer. Proxy is a waste of time and money, but for retarded people in retro community that doesnt research shit, this is a good offer. Good luck with this!

Sent from my SM-G928F using Tapatalk

Your research is completely wrong, tor doesn't use proxies it splits the data which you sends across countless routers, with no meta data of the original location. So in return the exit node has no idea of the original senders data. Tor simply relies on multiple layers of encryption - whereas with a proxy the client will communicate directly to the given server.

In this case, it's the DDoS Protected server which will filter the request before sending it on to the server. In return only sending clean traffic to the users server as the proxy servers firewall would of disposed of most of the malicious traffic.

As for the FBI obtaining access to servers behind a proxy server, it's not hard... Obtain a warrant to a ground, look at server logs and see what outgoing traffic from client -> proxy -> server is happening. Or simply hack the server if it's on a remote network... What do you think they do in the likes of the NSA? Mostly security analysis...

As for a ping, it's only going to show you the IP address of the server (in the case of a reverse proxy, which is what this is...).

 

[MayoMayn]

Your research is completely wrong, tor doesn't use proxies it splits the data which you sends across countless routers, with no meta data of the original location. So in return the exit node has no idea of the original senders data. Tor simply relies on multiple layers of encryption - whereas with a proxy the client will communicate directly to the given server.

In this case, it's the DDoS Protected server which will filter the request before sending it on to the server. In return only sending clean traffic to the users server as the proxy servers firewall would of disposed of most of the malicious traffic.

As for the FBI obtaining access to servers behind a proxy server, it's not hard... Obtain a warrant to a ground, look at server logs and see what outgoing traffic from client -> proxy -> server is happening. Or simply hack the server if it's on a remote network... What do you think they do in the likes of the NSA? Mostly security analysis...

As for a ping, it's only going to show you the IP address of the server (in the case of a reverse proxy, which is what this is...).

Yeah, I do know how Tor works, I just made a statement, that nothing is actually anonymous in the end. Yeah for the "ping" command, yes, but you ever played with Kali Linux? That OS can do some pretty imaginary things.

 

[Core]

Yeah, I do know how Tor works, I just made a statement, that nothing is actually anonymous in the end. Yeah for the "ping" command, yes, but you ever played with Kali Linux? That OS can do some pretty imaginary things.

I have, in fact I have a lot of experience with the 'tools' and utilities on there. None of which running default settings would allow you to penetrate a updated Linux distribution on a secured network - to access the file system or network interfaces. Especially when the network takes great consideration in security.

Let's say the client was running Kali, they still couldn't get the end IP as like I've said many times already. The client communicates with the reverse proxy, not the server. The server will never interact directly with the client.

 

[MayoMayn]

I have, in fact I have a lot of experience with the 'tools' and utilities on there. None of which running default settings would allow you to penetrate a updated Linux distribution on a secured network - to access the file system or network interfaces. Especially when the network takes great consideration in security.

You do realize there's a metasploit program, that is made specifically for what you've just written right?

Easily done, install Beef, lets say the user is running a Chrome Browser, or you know his g-mail and which bank he has, then you can easily fake an e-mail which looks trustworthy, they will then go on to the fake "bank" site, and see a fake "new Google Chrome update", because well, trustworthy source right, if they need the latest versions for example to log into their bank. They download it, executes the file, and boom they got a shell, or whatever it is called, been ages since I used the system, then they continue after thinking wtf just happened, and after that you pretty much have control over the persons computer. What if they have antivirus? No worries, use Veil Invasion, which only gets detected by some pretty much unknown russian antivirus software.

Hacking is not just about utilities and tools on a computer, but also about human interaction, and how they think.

For example Hobba.me is stupid enough to have myBB which has a file uploader that is not really that good encrypted, you can easily fake a .php shell as an image using Burpsuite or just simply but a ".jpg" at the end of the files name, then go to the direct url where the shell has been uploaded, access it, and boom the web server has a shell.

 

[Core]

You do realize there's a metasploit program, that is made specifically for what you've just written right?

Easily done, install Beef, lets say the user is running a Chrome Browser, or you know his g-mail and which bank he has, then you can easily fake an e-mail which looks trustworthy, they will then go on to the fake "bank" site, and see a fake "new Google Chrome update", because well, trustworthy source right, if they need the latest versions for example to log into their bank. They download it, executes the file, and boom they got a shell, or whatever it is called, been ages since I used the system, then they continue after thinking wtf just happened, and after that you pretty much have control over the persons computer. What if they have antivirus? No worries, use Veil Invasion, which only gets detected by some pretty much unknown russian antivirus software.

Hacking is not just about utilities and tools on a computer, but also about human interaction, and how they think.

For example Hobba.me is stupid enough to have myBB which has a file uploader that is not really that good encrypted, you can easily fake a .php shell as an image using Burpsuite or just simply but a ".jpg" at the end of the files name, then go to the direct url where the shell has been uploaded, access it, and boom the web server has a shell.

Phishing and ip logging have nothing to do with obtaining an IP behind a reverse proxy? :/
As for metasploit it's just a bunch of pen testing tools..
It's not as easy as typing 'find zero-day 127.0.0.1' lmao.

 

[MayoMayn]

Phishing and ip logging have nothing to do with obtaining an IP behind a reverse proxy? :/

I know, but well you pretty much changed subject by writing this below, but well all that I am saying, is that it is possible, and neither is a proxy for any good, but well that's just a matter of taste in this case, because a proxy pretty much makes your website slower and less secure anyway, especially if it is a retro hotel, in some ways, and some ways not.

None of which running default settings would allow you to penetrate a updated Linux distribution on a secured network - to access the file system or network interfaces. Especially when the network takes great consideration in security.

 

[Core]

I know, but well you pretty much changed subject by writing this below, but well all that I am saying, is that it is possible.

Yeah and it's also possible to hack Facebook. I don't see that happening anytime soon.

Security researches find and patch exploits long before they're made aware of - if one is made aware of publicly it's a rare occurrence.
- e.g. bash exploit which worked on OLD versions of linux - my proxy server is updated, no need to worry about that.

 

[MayoMayn]

Yeah and it's also possible to hack Facebook. I don't see that happening anytime soon.

Security researches find and patch exploits long before they're made aware of - if one is made aware of publicly it's a rare occurrence.
- e.g. bash exploit which worked on OLD versions of linux - my proxy server is updated, no need to worry about that.

You asked for reverse proxy vulnerabilities, here you got one:

You must be registered for see links

Apache Reverse Proxy Bypass Vulnerability Scanner
Scan for poorly configured reverse proxy servers. By default, this module attempts to force the server to make a request with an invalid domain name. Then, if the bypass is successful, the server will look it up and of course fail, then responding with a status code 502. A baseline status code is always established and if that baseline matches your test status code, the injection attempt does not occur. "set VERBOSE true" if you are paranoid and want to catch potential false negatives. Works best against Apache and mod_rewrite

 

[Core]

You asked for reverse proxy vulnerabilities, here you got one:

You must be registered for see links

Apache Reverse Proxy Bypass Vulnerability Scanner
Scan for poorly configured reverse proxy servers. By default, this module attempts to force the server to make a request with an invalid domain name. Then, if the bypass is successful, the server will look it up and of course fail, then responding with a status code 502. A baseline status code is always established and if that baseline matches your test status code, the injection attempt does not occur. "set VERBOSE true" if you are paranoid and want to catch potential false negatives. Works best against Apache and mod_rewrite

This is only present in return headers of a 502 gateway - tcp doesn't have this anyways...We are using the TCP protcol not HTTP so don't just copy and paste the first link you found on google. The exploit method is done by brute forcing, in which the server must have a bad config, for example wild carding the incoming client address from the server. In other words, rookies who can't configure a server.

 

[MayoMayn]

This is only present in return headers of a 502 gateway - tcp doesn't have this anyways...We are using the TCP protcol not HTTP so don't just copy and paste the first link you found on google. The exploit method is done by brute forcing, in which the server must have a bad config, for example wild carding the incoming client address from the server. In other words, rookies who can't configure a server.

I'm not saying that you don't know what the hell you're doing, obviously I do know that you know how to configure a server correctly, all I am saying is for the sake of the discussion, that by rookies many mistakes are made when it comes to proxies and server configuration

 

[Core]

I'm not saying that you don't know what the hell you're doing, obviously I do know that you know how to configure a server correctly, all I am saying is for the sake of the discussion, that by rookies many mistakes are made when it comes to proxies and server configuration

That's not the point, your attempting to say a (reverse) proxy are pointless; and your only form of justification is referencing other applications such as tor, forum software and reverse proxy vulnerabilities for other protocols.

There is a way of injecting a payload into an echo based server to receive the IP but we don't echo the response so even if this was still possible (patched in latest version of haproxy) it wouldn't work for this type of service.

 

[MasterJiq]

What's the username and password

 

[Core]

What's the username and password

Message me and I'll create you an account.

 

[Pinkman]

I have coded something like this (proxi.uk)