Proxies

A proxy is a mediator that sits between two points/connections. Unlike a gateway, which just checks the source and destination IP Address, a proxy opens up the data packets and inspects what is inside and then makes a call as the whether or not to send on the data packet. Proxies can filter content, scan for malware, cache data(save a copy of popular websites locally to speed up load times for everyone else on the network), and hide your identity or rewrite the web request before sending it along. Proxies almost always operate at layer 7 of the OSI Model.

Dedicated Proxy / Forward Proxy

A Forward Proxy sits in front of clients (like employees’ laptops) and acts as an intermediary before their traffic hits the internet.

eg. When you try to visit example.com:

• Your browser sends the request to the Forward Proxy inside your company.
• The proxy inspects the request (checking rules like “Is this site allowed? Is it safe?”).
• The proxy reaches out to example.com on your behalf, gets the webpage, and hands it back to you.

Why Forward Proxies Block Malware (C2 Communication)
When malware infects a machine, it needs to reach back out to the attacker’s server, known as a Command and Control (C2) server, to receive instructions or steal data.

In a corporate environment with a forward proxy the infected computer cannot connect directly to the internet. To talk to the outside world, the malware must know how to route its traffic through the proxy. If the malware tries to make a direct connection without going through the proxy, the corporate firewall simply drops the connection, leaving the malware stranded and unable to operate.

The “System Proxy” vs. Firefox Advantage

• Windows Native Apps (Chrome, Edge, IE, WinSock): Most Windows malware uses built-in Windows network tools (like WinSock). Because these built-in tools automatically read and use the computer’s “System Proxy” settings, the malware unintentionally routes its traffic right through the corporate proxy, where security teams can detect and block it.

• Firefox (Cross-Platform/libcurl): Firefox ignores Windows’ built-in system proxy settings and uses its own independent networking code (libcurl).

If a company exclusively uses Firefox and configures proxy settings inside Firefox itself (rather than at the Windows system level), standard malware using Windows built-in tools won’t know how to find those proxy settings. The malware fails to talk to its C2 server because it doesn’t know where the proxy is.

Alternative Malware Tactics
If malware realizes web traffic (HTTP/HTTPS) is blocked, it might try using DNS requests to leak data or get commands (since DNS requests often bypass web proxies). However, security tools like Sysmon easily log and alert on weird DNS patterns, catching the attacker anyway.

Burp Suite is a popular cybersecurity tool used by ethical hackers and security testers. While usually set up on a tester’s machine as a forward proxy to capture and tweak web requests in real-time, it is flexible enough to be reconfigured as a reverse proxy or a transparent proxy depending on the test scenario.

Reverse Proxy

This is the reverse of the Forward Proxy. Rather than monitoring requests that go out, it monitors requests that come into the network. The most common goal of this type of proxy is to listen on and forward it to a closed-off network.

Penetration Testers will configure reverse proxies on infected endpoints. The infected endpoint will listen on a port and send any client that connects to the port back to the attacker through the infected endpoint. This is useful to bypass firewalls or evade logging. Organizations may have IDS (Intrusion Detection Systems), watching external web requests. If the attacker gains access to the organization over SSH, a reverse proxy can send web requests through the SSH Tunnel and evade the IDS.

(Non-) Transparent Proxy

All these proxy services act either transparently or non-transparently.

With a transparent proxy, the client doesn’t know about its existence. The transparent proxy intercepts the client’s communication requests to the Internet and acts as a substitute instance. To the outside, the transparent proxy, like the non-transparent proxy, acts as a communication partner.

If it is a non-transparent proxy, we must be informed about its existence. For this purpose, we and the software we want to use are given a special proxy configuration that ensures that traffic to the Internet is first addressed to the proxy. If this configuration does not exist, we cannot communicate via the proxy. However, since the proxy usually provides the only communication path to other networks, communication to the Internet is generally cut off without a corresponding proxy configuration.