Intercepting TCP traffic through MITM attack

Question

I'm trying to capture TCP requests through Burp Suite with this hacky method.

Basically it listens for user selected protocol requests (TCP/UDP) and then forwards them to Burp Suite (or any other tool, if you want to) just like they're HTTP requests. All this by setting a proxy, and Burp Suite will listen to that proxy IP/Port.

However, what I need to do is listening to a website which sends TCP packets, so I should see HTTP/HTTPS requests too. This is what I tried:

sudo python mitm_relay.py -l 0.0.0.0 -p 127.0.0.1:8081 -r tcp:80:example.com:80

where 0.0.0.0 listens to any local interface, proxy listener has been set to 127.0.0.1:8081 and example.com hostname will be converted to his IP address I will send TCP packets to (port set to 80). However, I've set my default Firefox proxy to 127.0.0.1:8081 and when I navigate to example.com I can't see any packet being sniffed under my terminal.

Also this is not an HTTP request, so I've generated my server.pem and server.key just exactly it's been described here:

~/mitm_relay/ $ ls | grep -iE 'ca|ser'
cacert.cer
cacert.pem
cacert.srl
cakey.cer
cakey.pem
server.csr
server.key
server.pem

(those are all generated files through those commands).

1. How can I intercept TCP requests to example.com on port 80?
2. How can I intercept any domain TCP request on port 80?
3. What's an example command of intercepting SSL data (like HTTPS) through that script with those generated certificate files?
4. Is setting Burp to listen to 127.0.0.1:8081 proxy enough for applying the 3 precedent questions?

Answer 1

I've set my default Firefox proxy to 127.0.0.1:8081

You shouldn't do that, the -p argument is there to specify where the Burp proxy is running.

when I navigate to example.com

It doesn't matter where in particular you navigate (though google.com probably wouldn't work because of strict transport security). All requests targeting the port 80/tcp would be intercepted with the script and routed to example.com through Burp proxy.

Note that you may be running something on your port 80 already. I suggest changing the port number, e.g. to tcp:81:example.com:80, and try navigating to 127.0.0.1:81 to see if it works this way. If the port 81 works and port 80 doesn't, try using ss or netstat to figure out which program is taking over the port 80.

Also this is not an HTTPS request, so I've generated my server.pem and server.key

You don't need them for HTTP requests.

How can I intercept any domain TCP request on port 80?

I don't think this tool is generally well suitable for this task.

You can do it only by setting up a real proxy (like Squid) somewhere on your machine. The -l argument controls what resource do you intercept. The -r argument only controls:

• The port
• Where do you forward traffic.

In order for your requests to be handled by the target domain you need a proxy under the -r argument.

What's an example command of intercepting SSL data (like HTTPS) through that script with those generated certificate files?

sudo python mitm_relay.py -l 0.0.0.0 -p 127.0.0.1:8081 -r tcp:443:example.com:443 -c server.pem -k server.key

Note that your browser would display a warning that the connection is untrusted, and google.com inevitably wouldn't work in Chrome. Firefox would be okay as of 12 April, 2020 — though this particular part of the answer probably won't age well.