Songhua Liu xros

Intercepts HTTPs Traffic with Python & mitmproxy

Warning

This Gist is created in 2014, and it's highliy outdated now, according to one of mitmproxy's manjor contributor (check his comment below). Thanks for letting us know, @mhils!

Introduction

Modern applications usually make use of back-end API servers to provide their services. With a non-transparent HTTPs proxy, which intercepts the communication between clients and servers (aka the man-in-the-middle scheme), you can easily manipulate both API requests and responses.

Set up Django, Nginx and Gunicorn in a Virtualenv controled by Supervisor

Steps with explanations to set up a server using:

Virtualenv
Virtualenvwrapper
Django
Gunicorn

Git 协作流程

master 分支

master 永远处于稳定状态，这个分支代码可以随时用来部署。不允许在该分支直接提交代码。

develop 分支

开发分支，包含了项目最新的功能和代码，所有开发都在 develop 上进行。一般情况下小的修改直接在这个分支上提交代码。

	server {
	listen 80;

	server_name MY.WEBSITE.TLD;
	root /Users/ME/Sites/FOLDER;
	client_header_buffer_size 16k;
	large_client_header_buffers 16 16k;

	# qsa
	rewrite ^/api/?(.*)$ /webservice/dispatcher.php?url=$1 last;

	# /etc/fail2ban/jail.local

	# [...]

	[nginx-dos]
	# Based on apache-badbots but a simple IP check (any IP requesting more than
	# 240 pages in 60 seconds, or 4p/s average, is suspicious)
	# Block for two full days.
	# @author Yannick Warnier
	enabled = true

	function BrowseServer( startupPath, functionData )
	{
	// You can use the "CKFinder" class to render CKFinder in a page:
	var finder = new CKFinder();

	// The path for the installation of CKFinder (default = "/ckfinder/").
	finder.basePath = '/manage/libarary/editor/ckfinder';

	//Startup path in a form: "Type:/path/to/directory/"
	finder.startupPath = startupPath;

	#!/usr/bin/env python

	from scapy.all import *

	ap_list = []

	def PacketHandler(pkt) :

	if pkt.haslayer(Dot11) :
	if pkt.type == 0 and pkt.subtype == 8 :

	server {
	listen 80;

	server_name MY.WEBSITE.TLD;
	root /Users/ME/Sites/FOLDER;
	client_header_buffer_size 16k;
	large_client_header_buffers 16 16k;

	# qsa
	rewrite ^/api/?(.*)$ /webservice/dispatcher.php?url=$1 last;

	# Reset our signal handler
	signal.signal(signal.SIGINT, signal.SIG_DFL)
	target_bssid = raw_input('Enter a BSSID to perform an deauth attack (q to quit): ')
	while target_bssid not in networks:
	if target_bssid == 'q' : sys.exit(0)
	raw_input('BSSID not detected... Please enter another (q to quit): ')
	# Get our interface to the correct channel
	print 'Changing ' + args.interface + ' to channel ' + str(networks[target_bssid][1])
	os.system("iwconfig %s channel %d" % (args.interface, networks[target_bssid][1]))
	# Now we have a bssid that we have detected, let's get the client MAC

	import sqlalchemy as sa
	import sqlalchemy.orm as orm
	from sqlalchemy.ext.declarative import declarative_base
	from sqlalchemy.ext.declarative import declared_attr
	from sqlalchemy.orm import scoped_session, sessionmaker

	DBSession = scoped_session(sessionmaker())
	class BaseMixin(object):
	query = DBSession.query_property()
	id = sa.Column(sa.Integer, primary_key=True)