eoftedal / malaria-proxy Goto Github PK
View Code? Open in Web Editor NEWProof of concept code (which means poor code quality) for a proxy abusing unrestricted cross domain policies.
Home Page: http://erlend.oftedal.no/blog/?blogid=107
Proof of concept code (which means poor code quality) for a proxy abusing unrestricted cross domain policies.
Home Page: http://erlend.oftedal.no/blog/?blogid=107
This is a Proof-Of-Concept and thus the code quality is very poor and it has some limitations (see below). Any help in approving it appreciated. Brief overview -------------- The backend is what the attacker's browser connects to on port 8080 The silverlight or flex RIA connects to the backend on a seperate download port. This port is set when starting the backend, and it must be 4502-4530 for silverlight (for flex it can be almost any port). The backend forwards the url to either the flex/silverlight RIA which runs in the victim's browser. The RIA downloads the data on behalf of the victim (using the victim's cookies etc.), and passes the data back to the backend, which then sends it back to the attacker. To be able to connect to a socket, the flex or silverlight RIA tries to download a socket policy file on port 843 and 943 respectively. So the backend listens on these ports and supplies files as needed. If the flex RIA is not able to connect to 843, it will try to download the socket policy through the download port mentioned above. Current limitations ------------------- - The proxy runs the requests as a FIFO - not multithreaded
Hey @eoftedal , I'm a writer for an infosec-ish website and I was hoping to demonstrate how hackers are able to proxy HTTP requests from a hooked or compromised browser in an upcoming article.
Your blog post, "I'm in your browser, surfin your webs", was very informative but it was published 8 years ago and it doesn't seem like there's been much development on MalaRIA-Proxy
(unfortunately). Where can I learn more about proxying HTTP requests from a compromised browser? I was playing around with BeEF's Tunneling/proxying module, but as you probably know, cross-domain proxying isn't supported by BeEF. You seem to have an excellent understanding of this subject. I would be very interested in hearing your thoughts on the this.
I've been trying it in a pentest. would be nice a quick fix:)
this is what i get when trying to browse:
java malaria.MalariaServer localhost 8081
Starting listener on port 8081 from hostname localhost
Starting http proxy on port 8080
Starting MalariaServer
Silverlight policy server starting in port 943 for serving policy for localhost and port 8081
Flex policy server starting in port 843 for serving policy for localhost and port 8081
Flex policy server>> Client connected
Flex policy server>> Policy established
0:0:0:0:0:0:0:1
Client connected
Read 5
<- Hello
Read 179
No match
Read 179
No match
Read 179
No match
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.