Category:OWASP Proxy - Revision history

Kait Disney-Leugers at 17:07, 17 April 2014

2014-04-17T17:07:02Z

RoganDawes: /* Project Contributors */ Remove employer

2011-06-21T06:59:49Z

‎Project Contributors: Remove employer

Ricardo Filipe: fix some typos

2010-03-22T20:12:50Z

fix some typos

RoganDawes: Putting it all together

2010-03-18T20:25:30Z

Putting it all together

RoganDawes: Put it all together

2010-03-18T20:24:23Z

Put it all together

RoganDawes: Add some highlights

2010-03-18T20:07:39Z

Add some highlights

RoganDawes: Explain the classes involved

2010-03-18T20:04:59Z

Explain the classes involved

RoganDawes: Adding SSL to a proxy

2010-03-18T19:59:44Z

Adding SSL to a proxy

RoganDawes: Provide up to date examples

2010-03-18T19:38:12Z

Provide up to date examples

Show changes

RoganDawes: /* Implementation details */

2010-03-18T18:52:08Z

‎Implementation details

← Older revision		Revision as of 17:07, 17 April 2014
Line 1:		Line 1:
		+	{\|
		+	\|-
		+	! width="700" align="center" \| <br>
		+	! width="500" align="center" \| <br>
		+	\|-
		+	\| align="right" \| [[Image:OWASP Inactive Banner.jpg\|800px\| link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Inactive_Projects]]
		+	\| align="right" \|
		+
		+	\|}
	{{:Project Information:OWASP Proxy Project}}		{{:Project Information:OWASP Proxy Project}}

@@ Line 249: / Line 249: @@
 ==Project Contributors==
-The OWASP Proxy project is run by Rogan Dawes of Corsaire Security. He can be contacted at rogan AT dawes.za.net
+The OWASP Proxy project is run by Rogan Dawes. He can be contacted at rogan AT dawes.za.net
 [[Category:OWASP Project|Proxy Project]]

@@ Line 170: / Line 170: @@
       public void processResponse(RequestHeader request, MutableBufferedResponse response) {
           try {
-              System.out.println(request.getResource() + " : “ + response.getDecodedContent().length);
+              System.out.println(request.getResource() + " : " + response.getDecodedContent().length);
           } catch (MessageFormatException mfe) {
               mfe.printStackTrace();
@@ Line 191: / Line 191: @@
   char[] password = "password".toCharArray();
   HttpConnectionHandler httpProxy = new HttpProxyConnectionHandler(requestHandler);
-  SSLContextSelector contextSelector = new DefaultServerContextSelector(“server.p12", password, password);
+  SSLContextSelector contextSelector = new DefaultServerContextSelector("server.p12", password, password);
   SSLConnectionHandler ssl = new SSLConnectionHandler(contextSelector, true, httpProxy);             // true -> autodetect SSL
   httpProxy.setConnectHandler(ssl);
@@ Line 210: / Line 210: @@
 In essence, a proxy is just a server that already has a target. i.e. an InetSocketAddress that is automatically associated with all requests that it receives.
-  ConnectionHandler httpProxy = new HttpProxyConnectionHandler(requestHandler);
+  TargetedConnectionHandler httpProxy = new HttpProxyConnectionHandler(requestHandler);
-  InetSocketAddress target = new InetSocketAddress(“example.com", 80);
+  InetSocketAddress target = new InetSocketAddress("example.com", 80);
   InetSocketAddress listen = new InetSocketAddress("localhost", 80);
   Proxy proxy = new Proxy(listen, httpProxy, target);
@@ Line 219: / Line 219: @@
   ConnectionHandler httpProxy = new HttpProxyConnectionHandler(requestHandler);
   SSLConnectionHandler ssl = new SSLConnectionHandler(contextSelector, true, httpProxy);
-  InetSocketAddress target = new InetSocketAddress(“example.com", 80);
+  InetSocketAddress target = new InetSocketAddress("example.com", 80);
   InetSocketAddress listen = new InetSocketAddress("localhost", 80);
   Proxy proxy = new Proxy(listen, ssl, target);

@@ Line 233: / Line 233: @@
   Server proxy = new Server(listen, socks);
-Of course, adding SSL into the mix again is also trivial:
+==Putting it all together==
   ConnectionHandler httpProxy = new HttpProxyConnectionHandler(requestHandler);

← Older revision		Revision as of 20:24, 18 March 2010
Line 205:		Line 205:

	SSLContextSelector contextSelector = new AutoGeneratingContextSelector("keystore", "JKS", password);		SSLContextSelector contextSelector = new AutoGeneratingContextSelector("keystore", "JKS", password);
		+
		+	==Constructing a reverse proxy==
		+
		+	In essence, a proxy is just a server that already has a target. i.e. an InetSocketAddress that is automatically associated with all requests that it receives.
		+
		+	ConnectionHandler httpProxy = new HttpProxyConnectionHandler(requestHandler);
		+	InetSocketAddress target = new InetSocketAddress(“example.com", 80);
		+	InetSocketAddress listen = new InetSocketAddress("localhost", 80);
		+	Proxy proxy = new Proxy(listen, httpProxy, target);
		+
		+	===and adding SSL===
		+
		+	ConnectionHandler httpProxy = new HttpProxyConnectionHandler(requestHandler);
		+	SSLConnectionHandler ssl = new SSLConnectionHandler(contextSelector, true, httpProxy);
		+	InetSocketAddress target = new InetSocketAddress(“example.com", 80);
		+	InetSocketAddress listen = new InetSocketAddress("localhost", 80);
		+	Proxy proxy = new Proxy(listen, ssl, target);
		+
		+	==SOCKS Proxies ROCK!==
		+
		+	While HTTP proxies are the most commonly encountered, SOCKS proxies are better in many ways. For one, SOCKS proxies are expected to simply relay data from client to server, and are not expected to understand the data being proxied. This means that the client doesn't have to add any proxy-specific message headers, and the behaviour of the client is exactly the same as if there was no proxy involved at all. The server should find a browser connecting through a SOCKS proxy indistinguishable from one that is connecting directly without any proxy at all.
		+
		+	This all means that if we want to be as transparent as possible in our interception, operating as a SOCKS proxy is the ideal approach. And it is trivial to do so:
		+
		+	ConnectionHandler httpProxy = new HttpProxyConnectionHandler(requestHandler);
		+	ConnectionHandler socks = new SocksConnectionHandler(httpProxy, true); // true -> autodetect SOCKS
		+	Server proxy = new Server(listen, socks);
		+
		+	Of course, adding SSL into the mix again is also trivial:
		+
		+	ConnectionHandler httpProxy = new HttpProxyConnectionHandler(requestHandler);
		+	SSLContextSelector contextSelector = new AutoGeneratingContextSelector("keystore", "JKS", password);
		+	SSLConnectionHandler ssl = new SSLConnectionHandler(contextSelector, true, httpProxy);
		+	httpProxy.setConnectHandler(ssl);
		+	ConnectionHandler socks = new SocksConnectionHandler(ssl, true);
		+	InetSocketAddress listen = new InetSocketAddress("localhost", 80);
		+	Server proxy = new Server(listen, socks);
		+
		+	This constructs a SOCKS server, that will autodetect the SOCKS protocol, identify the target of the connection, autodetect an SSL connection, generate a suitable X.509 keypair and certificate, read HTTP messages from the client, relay them on to the targeted server, and return the responses to the client.
		+
		+	All in just a few lines of code! WOW!

	==Project Contributors==		==Project Contributors==

@@ Line 41: / Line 41: @@
 A quick explanation of the classes referenced is warranted.
-Server is a mostly trivial class that listens to an InetSocketAddress, accepts connections and passes the accepted Socket on to implementations of the ConnectionHandler interface.
+'''Server''' is a mostly trivial class that listens to an '''InetSocketAddress''', accepts connections and passes the accepted '''Socket''' on to implementations of the '''ConnectionHandler''' interface.
-HttpProxyConnectionHandler is a ConnectionHandler implementation that implements an HTTP Proxy, reading HTTP requests from a client, passes those on to an HttpRequestHandler to fetch the Response, then relays that response back to the client.
+'''HttpProxyConnectionHandler''' is a '''ConnectionHandler''' implementation that implements an HTTP Proxy, reading HTTP requests from a client, passes those on to an '''HttpRequestHandler''' to fetch the '''Response''', then relays that '''Response''' back to the client.
-DefaultHttpRequestHandler is just a simple implementation of the HttpRequestHandler interface, which makes use of the built-in custom HTTP Client to send the Request to the server, and obtain the Response.
+'''DefaultHttpRequestHandler''' is just a simple implementation of the '''HttpRequestHandler''' interface, which makes use of the built-in custom HTTP Client to send the '''Request''' to the server, and obtain the '''Response'''.
 Of course, it is not terribly useful. All it does is forward requests and responses, without doing anything with them.

@@ Line 39: / Line 39: @@
   proxy.start();
-Of course, it is not terribly useful. All it does is forward requests and responses.
+A quick explanation of the classes referenced is warranted.
 ===The Message Object Model===

@@ Line 17: / Line 17: @@
 ==Implementation details==
-In order to achieve byte for byte accuracy with what was sent by the client, and received from the server, OWASP Proxy does the bare minimum of message parsing. The basic storage of an HTTP message is as an array of byte (a byte for byte copy of what was read from the network), rather than parsed out into convenient pieces. The library does provide convenience methods for accessing interesting parts of the message, such as headers, content, etc, but the message itself is always stored as a large byte[].
+In order to achieve byte for byte accuracy with what was sent by the client, and received from the server, OWASP Proxy does the bare minimum of message parsing. The basic storage of an HTTP message header is as an array of byte (a byte for byte copy of what was read from the network), rather than parsed out into convenient pieces. The library does provide convenience methods for accessing interesting parts of the message, such as headers, content, etc, but the message itself is represented as either a byte[] for the header, and an InputStream for the content, or a byte[] for the header, and a (possibly null) byte[] for the message content.
-The Request and Response objects that you may deal with also do not decode the message bodies for you. If the message was sent using chunked encoding, the message body will show the individual chunks that were sent. Of course, again, there are also classes which allow you to obtain the actual entity body, with appropriate decoding.
+The Request and Response objects that you may deal with also do not decode the message bodies for you. If the message was sent using chunked encoding, the message body will show the individual chunks that were sent. Of course, again, there are also classes which allow you to obtain the actual entity body, with appropriate decoding performed.
 ==Future development==