Styjun

Download app bundles from App Store to run on iOS Emulator on Mac

Find this Unique UVC Palindrome ( ignoring signs and decimal) from Given Fractional Relationship

Real Analysis: Proof of the equivalent definitions of the derivative.

Are there historical examples of audiences drawn to a work that was "so bad it's good"?

Does attacking (or having a rider attack) cancel Charge/Pounce-like abilities?

What does it mean for something to be strictly less than epsilon for an arbitrary epsilon?

Illustrating that universal optimality is stronger than sphere packing

Why the work done is positive when bringing 2 opposite charges together?

Adobe Illustrator: How can I change the profile of a dashed stroke?

Department head said that group project may be rejected. How to mitigate?

Passport queue length in UK in relation to arrival method

Is ideal gas incompressible?

How to safely discharge oneself

Why is Ni[(PPh₃)₂Cl₂] tetrahedral?

Why do testers need root cause analysis?

How to tease a romance without a cat and mouse chase?

One word for 'the thing that attracts me'?

why "American-born", not "America-born"?

Results relying on higher derived algebraic geometry

If change in free energy (G) is positive, how do those reactions still occur?

size of pointers and architecture

Can the Conjure Barrage spell stack with the Disarming Attack or Trip Attack Battle Master maneuvers?

Is it safe to redirect stdout and stderr to the same file without file descriptor copies?

If I arrive in the UK, and then head to mainland Europe, does my Schengen visa 90 day limit start when I arrived in the UK, or mainland Europe?

How to secure a Node JS proxy with a dynamic target?

Best Practices for securing a REST API / web serviceHow can I prevent SQL injection in PHP?Difference between proxy server and reverse proxy serverSecure hash and salt for PHP passwordsGetting git to work with a proxy serverHow do I pass command line arguments to a Node.js program?How to decide when to use Node.js?How to exit in Node.jsHow do I update each dependency in package.json to the latest version?Node js ECONNRESET

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;

0

In an attempt to learn more about the intricacies of NodeJS and securty. I am playing with communicating via raw TCP sockets via a TCP-to-TCP proxy that I've set up with net.createConnection().

In my playground I have the following setup: My Custom NodeJS Telnet Client > My NodeJS TCP-to-TCP Server Proxy > Server Requested by Telnet Client

What I have discovered is that with my Telnet Client that I can make a request to the proxy server for localhost:3306 and that my proxy server will connect me to the DB running on the proxy server. Of course, not good. It seems easy enough right? Block localhost, 127.0.0.1, etc... But it seems to me that I can never know what hostnames point to an internal address. For example, lndo.site is a public domain, but it publicly points to 127.0.0.1. This means that if this were a real-world application I would have to determine which hosts are safe to forward to. Is this even possible?

Is the only "safe" method to put the proxy on the server that has no other TCP services running? Can loopbacks be blocked?

node.js security proxy

share|improve this question

asked Mar 23 at 20:07

TylersSNTylersSN

73421433

add a comment | 

0

In an attempt to learn more about the intricacies of NodeJS and securty. I am playing with communicating via raw TCP sockets via a TCP-to-TCP proxy that I've set up with net.createConnection().

In my playground I have the following setup: My Custom NodeJS Telnet Client > My NodeJS TCP-to-TCP Server Proxy > Server Requested by Telnet Client

What I have discovered is that with my Telnet Client that I can make a request to the proxy server for localhost:3306 and that my proxy server will connect me to the DB running on the proxy server. Of course, not good. It seems easy enough right? Block localhost, 127.0.0.1, etc... But it seems to me that I can never know what hostnames point to an internal address. For example, lndo.site is a public domain, but it publicly points to 127.0.0.1. This means that if this were a real-world application I would have to determine which hosts are safe to forward to. Is this even possible?

Is the only "safe" method to put the proxy on the server that has no other TCP services running? Can loopbacks be blocked?

node.js security proxy

share|improve this question

asked Mar 23 at 20:07

TylersSNTylersSN

73421433

add a comment | 

In an attempt to learn more about the intricacies of NodeJS and securty. I am playing with communicating via raw TCP sockets via a TCP-to-TCP proxy that I've set up with net.createConnection().

In my playground I have the following setup: My Custom NodeJS Telnet Client > My NodeJS TCP-to-TCP Server Proxy > Server Requested by Telnet Client

What I have discovered is that with my Telnet Client that I can make a request to the proxy server for localhost:3306 and that my proxy server will connect me to the DB running on the proxy server. Of course, not good. It seems easy enough right? Block localhost, 127.0.0.1, etc... But it seems to me that I can never know what hostnames point to an internal address. For example, lndo.site is a public domain, but it publicly points to 127.0.0.1. This means that if this were a real-world application I would have to determine which hosts are safe to forward to. Is this even possible?

Is the only "safe" method to put the proxy on the server that has no other TCP services running? Can loopbacks be blocked?

node.js security proxy

share|improve this question

asked Mar 23 at 20:07

TylersSNTylersSN

73421433

share|improve this question

asked Mar 23 at 20:07

TylersSNTylersSN

73421433

share|improve this question

asked Mar 23 at 20:07

TylersSNTylersSN

73421433

asked Mar 23 at 20:07

TylersSNTylersSN

73421433

asked Mar 23 at 20:07

TylersSNTylersSN

73421433