rhaidiz / broxy

An HTTP/HTTPS intercept proxy written in Go.

Broxy

Broxy is an open source intercept proxy written in Go. It makes use of goproxy as core proxy implementation and the interface is implemented with a Qt wrapper for Go.

DISCLAIMER: this is a PoC to understand the feseability of the project. As a result of this test a new project has spawn, named yves.

Features

Broxy is currently a work in progress project. The current version provides the following features:

• Interceptor
• History with filters
• Repeater
• Persistent sessions

Installation

Grab a Binary

Grab a compiled version of Broxy here.

Compiling from Sources

To compile Broxy make sure you have the following installed and properly configured:

• Go
• Qt 5.13 and Qt wrapper

Once Go, Qt 5.13 and the Qt wrapper are ready, just do:

go get github.com/rhaidiz/broxy
cd $GOPATH/src/github.com/rhaidiz/broxy
make build 

Once the compilation is finished, you'll have the binary inside the folder deploy ... 🤞!

License

Broxy is released under the GPLv3 license.

broxy's Issues

Cannot write TLS reponse header

I'm getting lots of cert errors. I've saved the CA from within broxy and imported it into firefox.

Example error:
2020/07/04 14:07:20 [095] WARN: Cannot handshake client github.githubassets.com:443 EOF
2020/07/04 14:07:20 [081] WARN: Cannot write TLS response header from mitm'd client: write tcp 127.0.0.1:8080->127.0.0.1:44238: write: broken pipe

Broken symbols if gzip encoding are used

If the server uses gzip compression, the user will see an unreadable response body when using the repeater.

Offer to help

Hey! So I love this project and it's something I've been toying with building myself. I'd love to help in anyway I can like taking a feature off your hands to build. I've built a handful of Go tools which you can see on my github for some reference. Let me know if you'd like the support!

disable auto update of Content-Length

If we could disable the automatic update of the Content-Length header, this tool would be usable to test for HTTP Smuggling attacks: https://portswigger.net/web-security/request-smuggling

new ui suggestion

https://github.com/fyne-io/fyne

Panic while using broxy

$ ./broxy
panic: runtime error: index out of range [0] with length 0

goroutine 25 [running]:
github.com/rhaidiz/broxy/modules/coreproxy.(*Controller).onReq(0xc00024a800, 0xc00024a100, 0xc0002ba3c0, 0x15, 0xc000024201)
	github.com/rhaidiz/broxy@/modules/coreproxy/coreproxy_controller.go:520 +0xa98
github.com/rhaidiz/broxy/modules/coreproxy.(*Coreproxy).onReqDef(...)
	github.com/rhaidiz/broxy@/modules/coreproxy/coreproxy.go:119
github.com/elazarl/goproxy.FuncReqHandler.Handle(0xc0004601a0, 0xc00024a100, 0xc0002ba3c0, 0xc000024270, 0xc0001ee100)
	github.com/elazarl/[email protected]/actions.go:19 +0x3a
github.com/elazarl/goproxy.(*ReqProxyConds).Do.func1(0xc00024a100, 0xc0002ba3c0, 0x0, 0x0)
	github.com/elazarl/[email protected]/dispatcher.go:200 +0xcc
github.com/elazarl/goproxy.FuncReqHandler.Handle(0xc0003239e0, 0xc00024a100, 0xc0002ba3c0, 0xc000261d70, 0x3)
	github.com/elazarl/[email protected]/actions.go:19 +0x3a
github.com/elazarl/goproxy.(*ProxyHttpServer).filterRequest(0xc000188be0, 0xc00024a100, 0xc0002ba3c0, 0x0, 0x0)
	github.com/elazarl/[email protected]/proxy.go:61 +0x74
github.com/elazarl/goproxy.(*ProxyHttpServer).handleHttps.func2(0x11e1f20, 0xc0003fc018, 0xc00046a780, 0xc0002ba060, 0xc00036a000, 0xc000188be0, 0x11db100, 0xc0001d60e0)
	github.com/elazarl/[email protected]/https.go:210 +0x59d
created by github.com/elazarl/goproxy.(*ProxyHttpServer).handleHttps
	github.com/elazarl/[email protected]/https.go:180 +0x53c

Borxy version: Broxy v1.0.0-alpha.3

possible short-term features

I am not very good at programming on golang yet, and I would like to contribute in some way to the project such as giving ideas or possible improvements and reporting errors. If possible, you could provide information to help with software development.

to fix:

• fix request/response format

ex: curl -k https://www.google.cl -x http://127.0.0.1:8080

Request:

GET /www.google.cl:443/ HTTP/1.1
Host: www.google.cl
User-Agent: curl/7.58.0
Accept: */*

Correct request:

GET / HTTP/1.1
Host: www.google.cl:443
User-Agent: curl/7.58.0
Accept: */*

• use unicode

The possible improvements that can be added in the short term would be in my opinion:

• Copy as curl, python-requests https://github.com/hrbrmstr/curlconverter
• Add scope or option to remove junk traffic from the browser, for example firefox.
• In the proxy and repeater history, detail the response timeout.
• Add highlight to differentiate one request from another.
• The request and response of the broxy do it with letter console. (more comfortable to read)
• Decoder:
      - urlencoder / urldecoder
      - base64 encoder / decoder
• Comparer

Less important:

• Export proxy history to csv, json, xml or pcap.
• add highlight to the request and response.
• add a crawler. https://github.com/PuerkitoBio/gocrawl.
• have a history of requests made by the complete tool as logger++
• Fuzzer (intruder) is not necessary something advanced, just to be able to put dictionaries and perform the attack is great // https://github.com/ffuf/ffuf // https://github.com/xmendez/wfuzz

Hardcoded CA Certificate

The CA Cert in the coreproxy_settings.go file is static and not something that gets generated. Anyone who trusts the Cert in order to capture HTTPS traffic will be vulnerable to using unverified sites later.

Example site signed with the hardcoded CA https://proxy.lf.lc/