monkeym4ster

Use nginx as Non-Transparent SSL Proxy

Introduction

Many mobile apps have back-end API servers. They usually rely on the API replies to determine whether certain information is supposed to be shown. If the API responses could be manipulated on the fly, we may easily fool an unmodified app to expose some private data.

This manual guides you to set up nginx as non-transparent SSL proxy, which just subsitutes strings in the server responses (i.e. man-in-the-middle attack ourself). For both server-side (their API servers) and client-side (your device), the whole process is almost transparent.

monkeym4ster

How to install nginx (>= 1.9.5) with http2 support on Ubuntu 14.04 LTS (Trusty)

IMPORTANT: Backup your nginx site configs (usually under /etc/nginx/sites-available)!

Remove old nginx

Remove old nginx incl. nginx-common:

apt-get autoremove --purge nginx nginx-common

monkeym4ster

#!/usr/bin/env python2
 
# lrdcq 
# usage python2 unwxapkg.py filename
 
import sys, os
import struct
 
class WxapkgFile(object):
  nameLen = 0

monkeym4ster

var dns = require('dns');
var net = require('net');


var axfrReqProloge = 
    "\x00\x00" +        /* Size */
    "\x00\x00" +        /* Transaction ID */
    "\x00\x20" +        /* Flags: Standard Query */
    "\x00\x01" +        /* Number of questions */
    "\x00\x00" +        /* Number of answers */

monkeym4ster

axios({
  url: 'http://localhost:5000/static/example.pdf',
  method: 'GET',
  responseType: 'blob', // important
}).then((response) => {
  const url = window.URL.createObjectURL(new Blob([response.data]));
  const link = document.createElement('a');
  link.href = url;
  link.setAttribute('download', 'file.pdf');
  document.body.appendChild(link);

monkeym4ster

{
  "卧": "臣卜",
  "项": "工页",
  "功": "工力",
  "攻": "工攵",
  "荆": "茾刂",
  "邪": "牙阝",
  "雅": "牙隹",
  "期": "其月",
  "欺": "其欠",

monkeym4ster

<?php

//php gd-gif.php image.gif gd-image.gif 

$gif = imagecreatefromgif($argv[1]);
imagegif($gif, $argv[2]);
imagedestroy($gif);
?>