Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was wondering if anyone had some insight into the best way to fake a web service response rather than setting up a web server. For instance, while doing dynamic analysis of malware it's useful to redirect C&C traffic to your own fake web server that can reply in the same way.

Right now I've been using a python library and then manually replying with the HTTP responses but this is time consuming and kludgy.

EDIT: Not necessarily looking for an automated tool, just a faster way of doing it.

share|improve this question
    
You are looking for this to be automated rather than manual? –  this.josh Jul 10 '11 at 7:08
add comment

4 Answers

I always like netcat for this kind of thing. In this instance you could create a copy of the real response from the C&C server using

nc candcserver.com 80

submit the headers you want to pass on the command line, press enter twice, and save it to a text file, and then serve up the file you just created using

while true; do sudo nc -l 80 < capturedpage.txt; done

and point the app your testing at 127.0.0.1

share|improve this answer
    
This would work great for static content and replaying a simple response. I'm not sure how well this would work for dynamic content like a value that has a timestamp in it. –  Lizbeth Jul 12 '11 at 3:42
add comment

Consider looking at Meddler:

Meddler is a HTTP(S) Generation tool based around a simple but powerful JScript.NET event-based scripting subsystem.

This is from the excellent Fiddler family of HTTP proxy tools.

share|improve this answer
add comment

There might be some products which are capable of doing this, but I've written similar proxy myself where I wanted to serve local contents rather than remote for some uri's.

Here is a modification of my code written in python. It is based on the twisted library, so you might want to get it from here.

It will match for URL's with the netloc part equal to "security.stackexchange.com" and replace it with "www.xkcd.org".

I hope you are familiar with python, so you can add more functionality in this code. It should be easy to add logging, dynamically rewrite uri's and such.

Also, if you want to modify content in-transit from the malware and the C&C, take a look at my contribution for a content rewriting proxy: http://stackoverflow.com/questions/6491932/need-help-writing-a-twisted-proxy/6521024#6521024

from twisted.web import proxy, http
from twisted.internet import reactor

from urlparse import urlparse, urlunparse
fakeweb_netloc = "www.xkcd.org"
cc_netloc = "security.stackexchange.com"

class ProxyRequest(proxy.ProxyRequest):
    def process(self):

        res = urlparse(self.uri)
        netloc = res.netloc
        print self.uri

        if netloc == cc_netloc:
           netloc = fakeweb_netloc
        self.uri = urlunparse((res.scheme, netloc, res.path, res.params, res.query, res.fragment))

        proxy.ProxyRequest.process(self)

class MyProxy(http.HTTPChannel):
    requestFactory = ProxyRequest

class ProxyFactory(http.HTTPFactory):
    protocol = MyProxy

if __name__ == "__main__":
    factory = ProxyFactory()
    reactor.listenTCP(8080,factory)
    reactor.run()
share|improve this answer
add comment

You can proxy HTTP requests and intercept/modify requests/responses using Ronin::Web.proxy_server from the ronin-web (0.3.0.rc1) library.

$ gem install ronin-web --pre
$ ronin-web
>> Web.proxy_server do
|    every_request do |request|
|      # inspect the request (http://ronin-ruby.github.com/docs/ronin-web/Ronin/Web/Middleware/ProxyRequest.html)
|    end
end
[-] Starting Web Server on 0.0.0.0:8080
[2011-07-12 15:31:11] INFO  WEBrick 1.3.1
[2011-07-12 15:31:11] INFO  ruby 1.9.2 (2011-02-18) [x86_64-linux]
[2011-07-12 15:31:11] INFO  WEBrick::HTTPServer#start: pid=15697 port=8080
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.