search

mindedsecurity / behave

Behave! A monitoring browser extension for pages acting as "bad boi"
GNU General Public License v3.0
330 stars 22 forks source link

Proxy ports are flagged as red #14

Open hnapel opened 4 years ago

hnapel commented 4 years ago

Describe the bug I have defined a proxy that uses an rfc1918 address (configured via addon foxyproxy but that is probably not relevant) now every website I access (including mindedsecurity.com ...) is flagged as accessing private IPs

Desktop (please complete the following information):

To Reproduce Steps to reproduce the behavior:

  1. Configure a proxy, for example squid on the same host or another in the local LAN
  2. Define the proxy host /port in firefox or via an addon such as foxyproxy
  3. Access any website
  4. The arbitrary site is flagged accessing a local IP which is the proxy port

Please note foxyproxy allows different proxies for different (parts of) websites (hosted on different domains), so actually I see two local IPs being accessed, the one for a squid proxy and the other for a polipo / tor proxy.

Expected behavior

It should potentially be possible to detect a proxy (or more) is (are) being configured an internally whitelist that (those) host / port (s).

Screenshots n/a

Additional context n/a

wisec commented 4 years ago

Thanks @hnapel , I'll look into it ASAP

wisec commented 4 years ago

Alas, there's no simple way to fix this, since the IP will always be the one directly used for the connection.

Maybe some of the checks Behave! performs is still reliable, I'll see what I can do. I'll also add this limitation to the ReadMe

Thanks @hnapel

dezza commented 1 year ago

Just a simple exception rule would be fine for me.