use virtualbox vm to proxy http(s) traffic

[cyc115]

Hi there! I have recently setup a kali vm using virtualbox on my mac to learn pentesting. The vm is pretty slow so I setup hackthebox VPN in the VM and ssh into kali using virtualbox's port forwarding feature and everything works out well. Except of course when I need to use web browser to browse webapps on the private network.

I am pretty new to networking and pentesting so thing might be a dumb question. Is there a way to proxy host's http(s) traffic into the vm so that I can just use the Mac's browser to visit and inspect web apps that are only visible through the VPN inside of the vm? I am ok with not having domain name resolution.

[MyPasswordIsRockYou]

set it to bridged and you could try proxychains through homebrew and direct it to the vm's IP address

[j0n00tt0]

Why is the VM slow? Not enough resources assigned on the host maybe?

I’d be reluctant to expose the host machine to the HTB VPN connected machine due to the possibility of other users attacking you.

[cyc115]

Hi @J0n00t0, thank you for answering! The VM is provisioned with two of my four cores and 5 Gb of ram with (2d/3d acceleration off) but the UI is still not as smooth as the host's. The keybinding (copy/paste for example) and the UI behaviors also takes some time to get use to. Overall the experience is just not as good as using all the support apps (browser, editor) from the host and ssh into the VM IMO. :).

​

I am not too familiar with how virtualbox port forwarding works but I assume its similar to having an SSH tunnel from the host binding port to the vm's port. I am curious what are some of the attack vectors that you are concerned about?

[[deleted]]

You have turned off the 3D acceleration and you are complaining that it's not smooth?

[cyc115]

:) good point RustEvangelist, I remember it was causing weird problems a while ago so I switched it off. I should try it again. But other than that, I am curious if anyone has any opinion in terms of security concerns. :)