项目地址： https://github.com/xepor/xepor
个人做的一款框架类工具，一款 Web 流量自动化篡改 framework。用户无感知免 root 全流量抓包，十行代码过云端授权，一百行代码过视频加密。用例文档API说明啥啥都有，欢迎点个 star。​
由于项目本身的特性，使用它需要用户结合实际渗透目标编写脚本实现具体功能，存在一定的学习门槛，为了方便大家上手，特意准备了一些简单的实例。包括：
- 以 httpbin 为例演示简单的请求、返回值监听篡改
- 以某软件为例破解云端授权验证
- 以某网站为例，监听、解密、保存加密的视频流
用例位于： xepor/xepor-examples: Examples for using Xepor framework https://github.com/xepor/xepor-examples
以下引用项目介绍（最近文档写太多了我就不翻译了）：
Xepor
Xepor (pronounced /ˈzɛfə/, zephyr), a web routing framework for reverse engineers and security researchers.
It provides a Flask-like API for hackers to intercept and modify HTTP request and/or HTTP response in a human-friendly coding style.
This project is meant to be used with mitmproxy. User write scripts with xepor, and run the script inside mitmproxy with mitmproxy -s your-script.py.
If you want to step from PoC to production, from demo(e.g. http-reply-from-proxy.py, http-trailers.py, http-stream-modify.py) to something you could take out with your WiFi Pineapple, then Xepor is for you!
Features
- Code everything with
@api.route(), just like Flask! Write everything in one script and no if..else any more.
- Handle multiple URL routes, even multiple hosts in one
InterceptedAPI instance.
- For each route, you can choose to modify the request before connecting to server (or even return a fake response without connection to upstream), or modify the response before forwarding to user.
- Blacklist mode or whitelist mode. Only allow URL endpoints defined in scripts to connect to upstream, blocking everything else (in specific domain) with HTTP 404. Suitable for transparent proxying.
- Human readable URL path definition and matching powered by parse
- Host remapping. define rules to redirect to genuine upstream from your fake hosts. Regex matching is supported. Best for SSL stripping and server side license cracking!
- Plus all the bests from mitmproxy! ALL operation modes (
mitmproxy / mitmweb + regular / transparent / socks5 / reverse:SPEC / upstream:SPEC) are fully supported.
Use Case
- Evil AP and phishing through MITM.
- Sniffing traffic from specific device by iptables + transparent proxy, modify the payload with xepor on the fly.
- Cracking cloud based software license. See examples/krisp/ as an example.
- Write complicated web crawler in \~100 lines of codes. See examples/polyv_scrapper/ as an example.
- ... and many more.
SSL stripping is NOT provided by this project.
Installation
pip install xepor
| 
[复制链接]
发表于 2022-3-21 15:52
|
发表于 2022-3-22 10:29
