0

I want to log and modify outbound traffic on a Linux machine. I currently have one program that sends requests out to the internet, I would like to process these requests and their responses via another script (mitm).

Current Setup...

diagram 1

What I Want...

diagram 2

MITM Script will log requests/responses into a database, and potentially modify either of them before sending the response back to Traffic Source.

I'm able to write my application specific logic, but how can I put MITM Script into position? Ideally I would like to wrap my script into an existing MITM framework, does a framework like this exist?

I'm only handling TCP traffic, multiple ports, not just HTTP traffic.

1

So if you were just looking at HTTP traffic, I'd have suggested that you'd just want a reverse proxy like mod_rewrite, but if it's arbitrary traffic that makes it a bit more difficult.

Assuming you've written the logic for handling re-writing, putting it in place would likely be done in one of two ways.

  1. If you can specify the destination in the original program, you would specify the destination as the proxy (e.g. point it to 127.0.0.1 [proxy_port]). then configure the proxy program to communicate to the original destination.
  2. If the destination is hard-coded/you can't modify you would usually have to use an OS level solution like iptables to redirect the traffic to your proxy (then as before the proxy would need to know how to get to the original destination)

As to frameworks for this kind of MITM, I'm not aware of any but not really my field so they may well exist..

0

If u want to proxify only HTTP/HTTPS traffic then i would suggest u to use BURP Suite,it is best for doing that job.But as u mentioned that u need to catch and modify other TCP traffic also then i would suggest u go with the TcpCatcher .It has very vast amount of feature's which are perfect for your purpose.

  • Thanks but both of these tools have a GUI, I need a way to automate the process. – Gerve Feb 17 '14 at 17:51
  • I think then mitmdump will fit for your purpose as it also have a feature running your own script mitmproxy.org/doc/mitmdump.html – justtrying123 Feb 17 '14 at 18:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.