1

I have to read http/https messages sent from a client system and see that the messages are not being modified within system by any malware and the server receives what exactly the user wants to send.

For Example, a User in an online Banking Transaction wants to send Amount $100 to Account 'A' and lets say that the message has been modified by a spurious program within system outside of users knowledge and sends it as $1000 ,Account 'B' before it is sent to the Server over the Network. I need to verify the details of the message before it is sent to the server.

Thus I want to use a Proxy to see what request is being sent to the Banking Server and display it to user. Then the User observes that it has changed to B,$1000 and immediately aborts or kills the request.

In this way I want to ensure the integrity of the details of a secure Transaction. For this reason, I need a Proxy which made me research about them and came up with these four proxies. As I am beginner in this area and don't know much about it. Want to know if any of these proxies work or Is there a better approach to work out my purpose.

Paros, BURP Free Version, Webscarab, SQUID.

If anyone has a better user friendly and useful proxy please feel free to suggest it

Thanks, Pavan.

Improve this question
3
  • You are trying to make more secure a configuration which is inherently insecure. To work, such a proxy would require the connection to be unencrypted; use an unencrypted connection for secure purposes is folly. Actually, I would not expect a bank to allow an unencrypted transaction to be established in the first place.
    – LSerni
    Mar 17, 2014 at 22:59
  • Yeah..I agree with you. But my assumption deals with in real world the secured and encrypted connection are bound to be broken and finding alternative ways to alert user about the integrity compromise in transaction. A good example is like a Security code you need to enter that you receive over the phone or an email to let the transaction proceed. Likewise I am trying to find a similar approach which needs user to verify and validate his transaction integrity is not compromised before its processed by the server.
    – Pavan K
    Mar 17, 2014 at 23:08
  • The problem is that to ensure this protection, the user must expose to an increased danger. Normally, transactions are encrypted so that no one (not your proxy, not an attacker) can snoop. To work, your proxy must be able to perform a successful man-in-the-middle attack: it is the equivalent of leaving your front door always open, so that the police may check you aren't being burgled.
    – LSerni
    Mar 17, 2014 at 23:18

2 Answers 2

Reset to default
3

To answer the original question : OWASP ZAP: https://www.owasp.org/index.php/ZAP Its a fork of Paros, but has been significantly updated. Its completely free, open source, and was voted the most popular security tool of 2013 by ToolsWatch.org readers: http://www.toolswatch.org/2013/12/2013-top-security-tools-as-voted-by-toolswatch-org-readers/

OK, I'm biased, as I'm the ZAP project lead ;)

Improve this answer
1

So who will guarantee the safety of the connection to the proxy? Sounds like a framing issue to me. If you make sure you have a good TLS implementation you can skip the proxy and have end-to-end encryption from client to server.

Improve this answer
1
  • That rests with Assumption that proxy is within client system and malware modifies this message before it reaches to proxy.FYI encryption is a good idea but I am trying to implement an alterantive mechanism assuming that Current techniques might fail in real time.
    – Pavan K
    Mar 17, 2014 at 22:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .