Dan Chen dannvix

Use nginx as Non-Transparent SSL Proxy

Introduction

Many mobile apps have back-end API servers. They usually rely on the API replies to determine whether certain information is supposed to be shown. If the API responses could be manipulated on the fly, we may easily fool an unmodified app to expose some private data.

This manual guides you to set up nginx as non-transparent SSL proxy, which just subsitutes strings in the server responses (i.e. man-in-the-middle attack ourself). For both server-side (their API servers) and client-side (your device), the whole process is almost transparent.

Intercepts HTTPs Traffic with Python & mitmproxy

Warning

This Gist is created in 2014, and it's highliy outdated now, according to one of mitmproxy's manjor contributor (check his comment below). Thanks for letting us know, @mhils!

Introduction

Modern applications usually make use of back-end API servers to provide their services. With a non-transparent HTTPs proxy, which intercepts the communication between clients and servers (aka the man-in-the-middle scheme), you can easily manipulate both API requests and responses.

	package main

	import (
	"log"
	"net/http"
	"net/http/httputil"
	"net/url"
	)

	func main() {

	var extend_keyboard_event_with_keycode = function(original_event_name) {
	var $fn_original = $.fn[original_event_name];

	var keyboard_event_function_wrapper = function(keycodes, handler) {
	return function(e) {
	if(keycodes.indexOf(e.which) != -1)
	return handler(e);
	}
	}

	{
	"binary_file_patterns":
	[
	"*.psd"
	],
	"close_windows_when_empty": false,
	"color_scheme": "Packages/Tomorrow Color Schemes/Tomorrow-Night.tmTheme",
	"detect_indentation": false,
	"disable_formatted_linebreak": true,
	"drag_text": false,

	# First commit

	echo "hello" \| git hash-object -w --stdin
	git update-index --add --cacheinfo 100644 ce013625030ba8dba906f756967f9e9ca394464a hello.txt
	git write-tree
	git commit-tree aaa96c -m "First commit"
	git update-ref refs/heads/master 30b060d9a7b5e93c158642b2b6f64b2b758da40d

	# Second commit

	require 'digest'

	filename = "House.Of.Cards.2013.S02E01.720p.WEB-DL.x264-Sohu.mp4"
	f = File.new(filename, "rb")
	puts f.stat.inspect

	file_size = File.size?(filename)


	offset = []

	#!/usr/bin/env python
	import os
	import re
	import md5
	import sys
	import json
	import urllib
	import urllib2

	try:

	// ==UserScript==
	// @name Pocket Web Customized
	// @description Cusotmizations/Simplifications for Pocket Web
	// @namespace http://getpocket.com
	// @author Shao-Chung Chen
	// @license MIT (http://opensource.org/licenses/MIT)
	// @version 1.9.1
	// @include http://getpocket.com/*
	// @include https://getpocket.com/*
	//

	#include <unistd.h>
	#include <mach/mach.h>
	#include <mach/mach_vm.h>
	#include <mach-o/dyld.h>

	int
	main (int argc, char * argv[])
	{
	volatile char * library;
	const mach_vm_size_t page_size = getpagesize ();