3128/tcp - Pentesting Squid

Tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

Taarifa za Msingi

Kutoka Wikipedia:

Squid ni proxy wa wavuti wa caching na forwarding wa HTTP. Ina matumizi mbalimbali, ikiwemo kuharakisha web server kwa kuhifadhi maombi yanayorudiwa (caching), kuhifadhi cache ya web, DNS na ulipuaji mwingine wa mtandao kwa kikundi cha watu wanaoshiriki rasilimali za mtandao, na kusaidia usalama kwa kuchuja trafiki. Ingawa inatumiwa hasa kwa HTTP na FTP, Squid ina msaada mdogo kwa itifaki nyingine kadhaa ikiwemo Internet Gopher, SSL, TLS na HTTPS. Squid haisaidii itifaki ya SOCKS, tofauti na Privoxy, ambayo inaweza kutumika pamoja na Squid ili kutoa msaada wa SOCKS.

Bandari ya chaguo-msingi: 3128

PORT     STATE  SERVICE      VERSION
3128/tcp open   http-proxy   Squid http proxy 4.11

Enumeration

Web Proxy

Unaweza kujaribu kuweka huduma hii iliyogunduliwa kama proxy kwenye browser yako. Hata hivyo, ikiwa imewekwa na HTTP authentication utaombwa kuingiza usernames na password.

# Try to proxify curl
curl --proxy http://10.10.11.131:3128 http://10.10.11.131

Nmap proxified

Unaweza pia kujaribu kutumia proxy vibaya ili scan internal ports proxifying nmap.
Sanidi proxychains kutumia squid proxy kwa kuongeza mstari ufuatao mwishoni mwa faili proxichains.conf: http 10.10.10.10 3128 Kwa proxies zinazohitaji uthibitisho, ongeza taarifa za kuingia kwenye usanidi kwa kujumuisha username na password mwishoni: http 10.10.10.10 3128 username passw0rd.

Kisha endesha nmap kwa proxychains ili scan the host from local: proxychains nmap -sT -n -p- localhost

SPOSE Scanner

Kwa mbadala, Squid Pivoting Open Port Scanner (spose.py) inaweza kutumika.

python spose.py --proxy http://10.10.11.131:3128 --target 10.10.11.131

Pivot & usanidi wa zana

Tumia Squid kama pivot ya ugunduzi na hop ya upstream wazi kwa zana za CLI na browser.

  • Scan “from” the proxy: endesha SPOSE kupitia Squid ili kuorodhesha ports zinazofikika kutoka proxy host/loopback. Kwa uv unaweza kusakinisha deps na kuchunguza TCP ports zote moja kwa moja:
uv add --script spose.py -r requirements.txt
uv run spose.py --proxy http://SQUID_IP:3128 --target localhost --allports
  • Proxychains kwa mwingiliano wa HTTP: ongeza rekodi kali ya HTTP mwishoni mwa /etc/proxychains.conf:
[ProxyList]
http    SQUID_IP   3128

Kisha uingiliane na listeners za ndani (kwa mfano, web UI iliyofungwa kwa 127.0.0.1) kwa uwazi kupitia Squid:

proxychains curl http://127.0.0.1:9191 -v
  • Chaining Burp/Browser → Squid: sanidi Burp Proxy → Settings → Network → Connections → Upstream proxy servers ili kuelekeza kwa http://SQUID_IP:3128. Maombi kwa host za ndani kama http://127.0.0.1:9191 yatafika kupitia Browser → Burp → Squid → target, na hivyo kuruhusu kukamata kikamilifu huduma ambazo vinginevyo hazingeweza kupatikana kutoka nje.

Marejeo

Tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks