Web Proxy Penetration Lab Setup Testing using Squid

In this article we are going to setup Squid to use it as a Proxy Server on Ubuntu/Debian machines and will try to penetrate it.

Table of content

  • Introduction to Proxy Setting
  • Squid Proxy Installation
  • Squid Proxy Server Configuration
  • Configuring Apache service for Web Proxy
  • Web Proxy Penetration Testing
  • Directory Brute force Attack on Proxy Server Using DIRB Tool
  • Vulnerability Scanning on Proxy Server Using Nikto Tool
  • SQL Injection on Proxy Server Using Sqlmap Tool
  • WordPress Scanning on Proxy Server Using WPScan Tool

Introduction to Proxy Setting

A proxy is a computer system or program that acts as a kind of middle-man or an intermediary to come between your web browser and another computer. Your ISP operates servers– computers designed to deliver information to other computers. It uses proxy servers to accelerate the transfer of information between the server and your computer.

For Example: Two users say A and B both has requested to access same website of the server then Instead of retrieving the data from the original server, the proxy has “stored or cached” a copy of that site and sends it to User A without troubling the main server.

Squid Proxy Installation

Squid is a cross functional web proxy cache server application which offers proxy and cache services for HTTP, FTP, and other common network protocols such as proxying of Secure Sockets Layer (SSL) requests and caching of Domain Name Server (DNS) lookups, and implement transparent caching. Moreover it also maintains a wide variety of caching protocols.

Let’s Begin!!

Open the host file in your local machine to add localhost address and hostname, because by default squid3 search for Ubuntu as hostname for connection implementation.

Now use apt Repository to install squid3 and enter following command.

Squid Proxy Server Configuration

Once the installation is completed, open its configuration file from the given path: /etc/squid3/squid.conf

With Squid’s access control, you may possibly shape use of Internet services proxy by Squid to be accessible only employers with specific IP addresses.

Suppose you want to grant access by users of the subnetwork only, then add the following line to the  ACL section of the squid.conf file:

Now give permission to your clients to access HTTP service over local network.

To set your Squid server to listen on the default TCP port 3128, change the http_port directive as given below:

Then add following roles for squid after adding HTTP_Port


You can Set forwarded_for :-     on|off|transparent|truncate|delete

  1. If set to “on”, Squid will append your client’s IP address in the HTTP requests it forwards. By default it looks like:


  1. If set to “off”, it will appear as

X-Forwarded-For: unknown

  1. If set to “transparent”, Squid will not alter the

X-Forwarded-For header in any way.

  1. If set to “delete”, Squid will delete the entire

X-Forwarded-For header.

  1. If set to “truncate”, Squid will remove all existing




Here we had set forwarded_for off and save the file, then use the following command to restart the Squid Proxy.

Configuring Apache service for Web Proxy

Now open the “000-default.conf” file from the path: /etc/apache2/sites-available/ and add following line to implement the following rules on /html directory over localhost or Machine IP (

Now the save the file and restart the apache service with the help of following command.

Now when someone try to access web services through our network i.e., he/she will welcome by following web page

“Error 403 Forbidden- You don’t have permission to access <requested page>”.

When you face such type of situation where port 80 is open but you are unable to access it, hence proved the network is running behind proxy server.

Web Proxy Penetration Testing

For web Proxy penetration testing we had already set-up lab for web application server such as DVWA and SQli DHAKKAN (Read Article from here) and wordpress (Read Article from here).

Now to test whether our  proxy server is working or not by configuring , let’s open Firefox and go to Edit –> Preferences –> Advanced –> Network –> Settings and then select “Manual proxy configuration” and enter proxy server IP address ( and Port (3128) to be used for all protocol.