OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Exploit-Dev Archives: Re: Accessing IE/Netscape incomming data

Re: Accessing IE/Netscape incomming data

Bernhard Kirchmair (bernhardSMARTFORWARD.COM)
Tue, 26 Oct 1999 17:49:24 +0200

> Hi there,
>
> Does anyone know of a way to access the incoming data(packets) between
> the windows stack (winsock) and the Netscape and/or IE application? I
> am intrigued on how such applications like Cyber Patrol and Net Nanny
> intercept sites and keywords within html.
>

Hi Derek,

well there's the "local proxy server" - way:
Your local Proxy-Server is listening on a specified port on your machine for incoming
HTTP requests. All you have to do is to set the "Use Proxy Server" entries of your
browser as follows:
server-ip: 127.0.0.1 (local loopback)
server-port: take a look on your proxy documentation.

How such a Proxy Filter works:
Your browser (with "Use Proxy Server" option enabled) connects to the local proxy and
drops his HTTP request:
-----------
GET http://www.whatever.com/ HTTP/1.0
Proxy-Connection: Keep-Alive
User-Agent: Mozilla/4.51
Host: www.whatever.com
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*
Accept-Encoding: gzip
Accept-Language: de,en
Accept-Charset: iso-8859-1,*,utf-8
----------

Now (maybe after modifing some http header fields like "User-Agent" to hide the users
real browser name for what reason ever, or to cut off cookie data :) the proxy
catches the request, connects to the webserver and requests the file himself. The
webserver sends the file (or an html error message if file not found) to our Proxy
that receives and modifies it. After that the modified data is sent to your
browser... voila! Of course this happens transparent for the browser - but not for
the user (if he looks at the browser settings and sees the use proxy option enabled)
So the Proxy Filter is able to do everything he wants with the data receiving from
the webserver before forwarding it to the browser. In fact he can virtually forbid
the access to some sites that contain special keywords defined in a configuration
file.
For a quite interesting Java program take a look on Muffin available at
http://muffin.doit.org (source code available!)

Cheers,
Bernhard

------- ------ ---- --- --- -- -- - - - -
Bernhard Kirchmair, CEO bernhardsmartForward.com
www.smartForward.com tel: +43 (0)664 487 36 26
Communication Design fax: +1 (603) 691 5629

This archive was generated by hypermail 2.0b3 on Tue Oct 26 1999 - 23:58:53 CDT