ziloka/proxybroker

Command line application to concurrently collect and check proxies

ProxyBroker

Proxy is an open source tool that asynchronously finds public proxies from multiple sources and concurrently checks them.

Features

• Supported protocols: HTTP(S), SOCKS4/5.
• Proxies may be filtered by type, anonymity level, response time, country and status
• Work as a proxy server that distributes incoming requests to external proxies. With automatic proxy rotation.
• Automatically removes duplicate proxies
• Is asynchrous

Requirements

• Operating system must be Windows, MacOS, or Linux

Good things to know

• Why I rewrote it in golang
• Use Https instead of http, http might leak your ip address if you are using a high level proxy

Building from source

• Golang 1.17
• UPX 3.96
• [Strip]

Run

cd src && \
go build -o ProxyBroker main.go

To build for Linux, MacOS, and windows run

cd src && \
../build.bash github.com/Ziloka/ProxyBroker main.go

Features to be implemented:

• Web server has api rest service to serve proxies, as well as let users surf the web something like NodeUnblocker Npm Package

Motiviation

• Inspired by ProxyBroker (A more maintained version of that project)
• Web Service inspired by go-shadowsocks2

proxybroker's Issues

CVE-2012-6708 (Medium) detected in github.com/golang/tools-v0.1.0

CVE-2012-6708 - Medium Severity Vulnerability

Vulnerable Library - github.com/golang/tools-v0.1.0

[mirror] Go Tools

Dependency Hierarchy:

• github.com/swaggo/swag-v1.7.1 (Root Library)
  • ❌ github.com/golang/tools-v0.1.0 (Vulnerable Library)

Found in HEAD commit: ea45e6676935a6de2afd29c39ee5dada24e9224c

Found in base branch: main

Vulnerability Details

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.

Publish Date: 2018-01-18

URL: CVE-2012-6708

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-6708

Release Date: 2018-01-18

Fix Resolution: jQuery - v1.9.0

---

Step up your Open Source Security Game with Mend here

CVE-2022-28948 (Medium) detected in github.com/go-yaml/yaml-v2.4.0 - autoclosed

CVE-2022-28948 - Medium Severity Vulnerability

Vulnerable Library - github.com/go-yaml/yaml-v2.4.0

YAML support for the Go language.

Dependency Hierarchy:

• github.com/gin-gonic/gin-v1.7.4 (Root Library)
  • ❌ github.com/go-yaml/yaml-v2.4.0 (Vulnerable Library)

Found in HEAD commit: ea45e6676935a6de2afd29c39ee5dada24e9224c

Found in base branch: main

Vulnerability Details

An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.

Publish Date: 2022-05-19

URL: CVE-2022-28948

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-fm53-mpmp-7qw2

Release Date: 2022-05-19

Fix Resolution: v3.0.0

---

Step up your Open Source Security Game with Mend here

CVE-2020-11022 (Medium) detected in github.com/golang/tools-v0.1.0

CVE-2020-11022 - Medium Severity Vulnerability

Vulnerable Library - github.com/golang/tools-v0.1.0

[mirror] Go Tools

Dependency Hierarchy:

• github.com/swaggo/swag-v1.7.1 (Root Library)
  • ❌ github.com/golang/tools-v0.1.0 (Vulnerable Library)

Found in HEAD commit: ea45e6676935a6de2afd29c39ee5dada24e9224c

Found in base branch: main

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0

---

Step up your Open Source Security Game with Mend here

Multiple issues

For some reason, the checker command doesn't work, the grab command doesn't work, it doesn't show the types of proxies that its getting.

Found a couple more

The find and check commands have no —output ability.
The check command does not notify/exit when it’s done checking the document.

CVE-2015-9251 (Medium) detected in github.com/golang/tools-v0.1.0

CVE-2015-9251 - Medium Severity Vulnerability

Vulnerable Library - github.com/golang/tools-v0.1.0

[mirror] Go Tools

Dependency Hierarchy:

• github.com/swaggo/swag-v1.7.1 (Root Library)
  • ❌ github.com/golang/tools-v0.1.0 (Vulnerable Library)

Found in HEAD commit: ea45e6676935a6de2afd29c39ee5dada24e9224c

Found in base branch: main

Vulnerability Details

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Publish Date: 2018-01-18

URL: CVE-2015-9251

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9251

Release Date: 2018-01-18

Fix Resolution: jQuery - v3.0.0

---

Step up your Open Source Security Game with Mend here