Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was wondering if anyone had some insight into the best way to fake a web service response rather than setting up a web server. For instance, while doing dynamic analysis of malware it's useful to redirect C&C traffic to your own fake web server that can reply in the same way.

Right now I've been using a python library and then manually replying with the HTTP responses but this is time consuming and kludgy.

EDIT: Not necessarily looking for an automated tool, just a faster way of doing it.

share|improve this question
You are looking for this to be automated rather than manual? – this.josh Jul 10 '11 at 7:08

I always like netcat for this kind of thing. In this instance you could create a copy of the real response from the C&C server using

nc 80

submit the headers you want to pass on the command line, press enter twice, and save it to a text file, and then serve up the file you just created using

while true; do sudo nc -l 80 < capturedpage.txt; done

and point the app your testing at

share|improve this answer
This would work great for static content and replaying a simple response. I'm not sure how well this would work for dynamic content like a value that has a timestamp in it. – Lizbeth Jul 12 '11 at 3:42

Consider looking at Meddler:

Meddler is a HTTP(S) Generation tool based around a simple but powerful JScript.NET event-based scripting subsystem.

This is from the excellent Fiddler family of HTTP proxy tools.

share|improve this answer

There might be some products which are capable of doing this, but I've written similar proxy myself where I wanted to serve local contents rather than remote for some uri's.

Here is a modification of my code written in python. It is based on the twisted library, so you might want to get it from here.

It will match for URL's with the netloc part equal to "" and replace it with "".

I hope you are familiar with python, so you can add more functionality in this code. It should be easy to add logging, dynamically rewrite uri's and such.

Also, if you want to modify content in-transit from the malware and the C&C, take a look at my contribution for a content rewriting proxy:

from twisted.web import proxy, http
from twisted.internet import reactor

from urlparse import urlparse, urlunparse
fakeweb_netloc = ""
cc_netloc = ""

class ProxyRequest(proxy.ProxyRequest):
    def process(self):

        res = urlparse(self.uri)
        netloc = res.netloc
        print self.uri

        if netloc == cc_netloc:
           netloc = fakeweb_netloc
        self.uri = urlunparse((res.scheme, netloc, res.path, res.params, res.query, res.fragment))


class MyProxy(http.HTTPChannel):
    requestFactory = ProxyRequest

class ProxyFactory(http.HTTPFactory):
    protocol = MyProxy

if __name__ == "__main__":
    factory = ProxyFactory()
share|improve this answer

You can proxy HTTP requests and intercept/modify requests/responses using Ronin::Web.proxy_server from the ronin-web (0.3.0.rc1) library.

$ gem install ronin-web --pre
$ ronin-web
>> Web.proxy_server do
|    every_request do |request|
|      # inspect the request (
|    end
[-] Starting Web Server on
[2011-07-12 15:31:11] INFO  WEBrick 1.3.1
[2011-07-12 15:31:11] INFO  ruby 1.9.2 (2011-02-18) [x86_64-linux]
[2011-07-12 15:31:11] INFO  WEBrick::HTTPServer#start: pid=15697 port=8080
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.