工具发布：Xepor，Web 流量自动化篡改 framework
项目地址： https://github.com/xepor/xepor个人做的一款框架类工具，一款 Web 流量自动化篡改 framework。用户无感知免 root 全流量抓包，十行代码过云端授权，一百行代码过视频加密。用例文档API说明啥啥都有，欢迎点个 star。
由于项目本身的特性，使用它需要用户结合实际渗透目标编写脚本实现具体功能，存在一定的学习门槛，为了方便大家上手，特意准备了一些简单的实例。包括：
[*]以 httpbin 为例演示简单的请求、返回值监听篡改
[*]以某软件为例破解云端授权验证
[*]以某网站为例，监听、解密、保存加密的视频流
用例位于： xepor/xepor-examples: Examples for using Xepor framework https://github.com/xepor/xepor-examples
以下引用项目介绍（最近文档写太多了我就不翻译了）：
# Xepor
(https://github.com/xepor/xepor) (pronounced */ˈzɛfə/*, zephyr), a web routing framework for reverse engineers and security researchers.
It provides a Flask-like API for hackers to intercept and modify HTTP request and/or HTTP response in a human-friendly coding style.
This project is meant to be used with (https://github.com/mitmproxy/mitmproxy/). User write scripts with `xepor`, and run the script *inside* mitmproxy with `mitmproxy -s your-script.py`.
If you want to step from PoC to production, from demo(e.g. (https://github.com/mitmproxy/mitmproxy/blob/v7.0.4/examples/addons/http-reply-from-proxy.py), (https://github.com/mitmproxy/mitmproxy/blob/v7.0.4/examples/addons/http-trailers.py), (https://github.com/mitmproxy/mitmproxy/blob/v7.0.4/examples/addons/http-stream-modify.py)) to something you could take out with your WiFi Pineapple, then Xepor is for you!
## Features
1. Code everything with `@api.route()`, just like Flask! Write everything in *one* script and no `if..else` any more.
2. Handle multiple URL routes, even multiple hosts in one `InterceptedAPI` instance.
3. For each route, you can choose to modify the request *before* connecting to server (or even return a fake response without connection to upstream), or modify the response *before* forwarding to user.
4. Blacklist mode or whitelist mode. Only allow URL endpoints defined in scripts to connect to upstream, blocking everything else (in specific domain) with HTTP 404. Suitable for transparent proxying.
5. Human readable URL path definition and matching powered by (https://pypi.org/project/parse/)
6. Host remapping. define rules to redirect to genuine upstream from your fake hosts. Regex matching is supported. **Best for SSL stripping and server side license cracking**!
7. Plus all the bests from (https://github.com/mitmproxy/mitmproxy/)! **ALL** operation modes ( `mitmproxy` / `mitmweb` + `regular` / `transparent`/ `socks5` / `reverse:SPEC` / `upstream:SPEC`) are fully supported.
## Use Case
1. Evil AP and phishing through MITM.
2. Sniffing traffic from specific device by iptables + transparent proxy, modify the payload with xepor on the fly.
3. Cracking cloud based software license. See (https://github.com/xepor/xepor-examples/tree/main/krisp/) as an example.
4. Write complicated web crawler in **\~100 lines of codes**. See (https://github.com/xepor/xepor-examples/tree/main/polyv_scrapper/) as an example.
5. ... and many more.
SSL stripping is NOT provided by this project.
# Installation
```bash
pip install xepor
``` 慵懒丶L先森 发表于 2022-3-21 23:17
感谢开源，不知道是不是和BurpSuite/ZAP一样的原理，还是再更上一层进行流量转发
原理一样，但xepor是一个提高自动化改报文效率的API框架。
burp就没有自动化的功能，ZAP的API偏向于对GUI功能的封装，改数据包这一块没啥能好用的API。Fiddler和mitmproxy的脚本功能类似，只能在报文里一个一个字段去手动判断，封装的不够。 高手，关注学习 有用，感谢楼主分享 感谢分享，我去学习学习 x学习一下{:1_927:} 感谢分享，值得学习深入~！~~！~！~
有用，感谢楼主分享CB 好东西，有玩具可以研究了 这个主要能用来干嘛啊 高手，感谢分享。