• Home
  • Become a Hacker
    • Get Started
    • Hacker Mindset
    • Roadmap
    • Simple Setup – Hacker 101
    • Types of Hackers
    • Recommended Courses
  • Boot People Offline
  • Courses
    • All Hacking Courses
    • Cyber Security School
  • CTF
    • Beginners to Advanced Guide
    • Create your own CTF box
    • Field and Resources Guide
    • Platforms & Wargames
    • Tools Used for Solving CTF
    • Writeups
  • Dark Web
    • Beginners Guide
    • Darknet Markets
    • Darkweb 101 (Anonymity Guide)
    • Dark Web OSINT Tools
    • Hacking Forums
    • Latest News
    • Onion Links
  • Hacker Gadgets
  • Hacking Books
  • Tools Directory
Menu
  • Home
  • Become a Hacker
    • Get Started
    • Hacker Mindset
    • Roadmap
    • Simple Setup – Hacker 101
    • Types of Hackers
    • Recommended Courses
  • Boot People Offline
  • Courses
    • All Hacking Courses
    • Cyber Security School
  • CTF
    • Beginners to Advanced Guide
    • Create your own CTF box
    • Field and Resources Guide
    • Platforms & Wargames
    • Tools Used for Solving CTF
    • Writeups
  • Dark Web
    • Beginners Guide
    • Darknet Markets
    • Darkweb 101 (Anonymity Guide)
    • Dark Web OSINT Tools
    • Hacking Forums
    • Latest News
    • Onion Links
  • Hacker Gadgets
  • Hacking Books
  • Tools Directory
Search
Close
  • Home
  • 2022
  • May
  • 21
  • Xepor – Web Routing Framework For Reverse Engineers And Security Researchers, Brings The Best Of Mitmproxy And Flask

Xepor – Web Routing Framework For Reverse Engineers And Security Researchers, Brings The Best Of Mitmproxy And Flask

May 21, 2022 Comments Off on Xepor – Web Routing Framework For Reverse Engineers And Security Researchers, Brings The Best Of Mitmproxy And Flask
Xepor - Web Routing Framework For Reverse Engineers And Security Researchers, Brings The Best Of Mitmproxy And Flask cybersecurity ethical hacking hack android hack app hack wordpress hacker news hacking hacking tools for windows keylogger kit kitploit password brute force penetration testing pentest pentest android pentest linux pentest toolkit pentest tools spy tool kit spyware tools

Xepor (pronounced /ˈzɛfə/, zephyr), a web routing framework for reverse engineers and security researchers. It provides a Flask-like API for hackers to intercept and modify HTTP request and/or HTTP response in a human-friendly coding style.

This project is meant to be used with mitmproxy. User write scripts with xepor, and run the script inside mitmproxy with mitmproxy -s your-script.py.

If you want to step from PoC to production, from demo(e.g. http-reply-from-proxy.py, http-trailers.py, http-stream-modify.py) to something you could take out with your WiFi Pineapple, then Xepor is for you!

Features

  1. Code everything with @api.route(), just like Flask! Write everything in one script and no if..else any more.
  2. Handle multiple URL routes, even multiple hosts in one InterceptedAPI instance.
  3. For each route, you can choose to modify the request before connecting to server (or even return a fake response without connection to upstream), or modify the response before forwarding to user.
  4. Blacklist mode or whitelist mode. Only allow URL endpoints defined in scripts to connect to upstream, blocking everything else (in specific domain) with HTTP 404. Suitable for transparent proxying.
  5. Human readable URL path definition and matching powered by parse
  6. Host remapping. define rules to redirect to genuine upstream from your fake hosts. Regex matching is supported. Best for SSL stripping and server side license cracking!
  7. Plus all the bests from mitmproxy! ALL operation modes ( mitmproxy / mitmweb + regular / transparent / socks5 / reverse:SPEC / upstream:SPEC) are fully supported.

Use Case

  1. Evil AP and phishing through MITM.
  2. Sniffing traffic from specific device by iptables + transparent proxy, modify the payload with xepor on the fly.
  3. Cracking cloud based software license. See examples/krisp/ as an example.
  4. Write complicated web crawler in ~100 lines of codes. See examples/polyv_scrapper/ as an example.
  5. … and many more.

SSL stripping is NOT provided by this project.

Installation

pip install xepor

Quick start

Take the script from examples/httpbin as an example.

mitmweb --web-host=* --set connection_strategy=lazy -s example/httpbin/httpbin.py

In this example, we setup the mitmproxy server on 127.0.0.1. You could change it to any IP on your machine or alternatively to the IP of your VPS. The mitmproxy server running in reverse, upstream and transparent mode requires --set connection_strategy=lazy option to be set so that Xepor could function correctly. I recommand this option always be on for best stability.

Set your Browser HTTP Proxy to http://127.0.0.1:8080, and access web interface at http://127.0.0.1:8081/.

Send a GET request from http://httpbin.org/#/HTTP_Methods/get_get , Then you could see the modification made by Xepor in mitmweb interface, browser devtools or Wireshark.

The httpbin.py do two things.

  1. When user access http://httpbin.org/get, inject a query string parameter payload=evil_param inside HTTP request.
  2. When user access http://httpbin.org/basic-auth/xx/xx/ (we just pretends we don’t know the password), sniff Authorization headers from HTTP requests and print the password to the attacker.

Just what mitmproxy always do, but with code written in xepor way.

# https://github.com/xepor/xepor-examples/tree/main/httpbin/httpbin.py
from mitmproxy.http import HTTPFlow
from xepor import InterceptedAPI, RouteType


HOST_HTTPBIN = "httpbin.org"

api = InterceptedAPI(HOST_HTTPBIN)


@api.route("/get")
def change_your_request(flow: HTTPFlow):
"""
Modify URL query param.
Test at:
http://httpbin.org/#/HTTP_Methods/get_get
"""
flow.request.query["payload"] = "evil_param"


@api.route("/basic-auth/{usr}/{pwd}", rtype=RouteType.RESPONSE)
def capture_auth(flow: HTTPFlow, usr=None, pwd=None):
"""
Sniffing password.
Test at:
http://httpbin.org/#/Auth/get_basic_auth__user___passwd_
"""
print(
f"auth @ {usr} + {pwd}:",
f"Captured {'successful' if flow.response.status_code < 300 else 'unsuccessful'} login:",
flow.request.headers.get("Author ization", ""),
)


addons = [api]
Download Xepor

Post navigation

Octopus – Open Source Pre-Operation C2 Server Based On Python And Powershell
EncroChat: Coke Dealer Sentenced to Almost 13 Years in Prison

Related Articles

ElfPack: ELF Binary Section Docking for Stageless Payload Delivery

ElfPack: ELF Binary Section Docking for Stageless Payload Delivery

- Hack Tools
June 24, 2022
Norimaci - Simple And Lightweight Malware Analysis Sandbox For macOS

Norimaci – Simple And Lightweight Malware Analysis Sandbox For macOS

- Hack Tools
June 24, 2022
CVE-2022-34305: Apache Tomcat Cross-Site Scripting Vulnerability

CVE-2022-34305: Apache Tomcat Cross-Site Scripting Vulnerability

- Hack Tools
June 24, 2022
hacker gadgets
hacker phone covers

Recent Posts

ElfPack: ELF Binary Section Docking for Stageless Payload Delivery

ElfPack: ELF Binary Section Docking for Stageless Payload Delivery

June 24, 2022
Norimaci - Simple And Lightweight Malware Analysis Sandbox For macOS

Norimaci – Simple And Lightweight Malware Analysis Sandbox For macOS

June 24, 2022
CVE-2022-34305: Apache Tomcat Cross-Site Scripting Vulnerability

CVE-2022-34305: Apache Tomcat Cross-Site Scripting Vulnerability

June 24, 2022
TrelloC2 - Simple C2 Over The Trello API

TrelloC2 – Simple C2 Over The Trello API

June 24, 2022
Elliptic: Illicit Use of Dogecoin Increasing

Elliptic: Illicit Use of Dogecoin Increasing

June 23, 2022
bofhound: offline BloodHound ingestor and LDAP result parser

bofhound: offline BloodHound ingestor and LDAP result parser

June 23, 2022

Social Media Hacking

SocialPath – Track users across Social Media Platforms

SocialPath – Track users across Social Media Platforms

- Social Media Hacking
October 16, 2019October 16, 2019

SocialPath is a django application for gathering social media intelligence on specific username. It checks for Twitter, Instagram, Facebook, Reddit...

SocialScan – Check Email Address and Username Availability on Online Platforms

SocialScan – Check Email Address and Username Availability on Online Platforms

June 17, 2019
Shellphish – Phishing Tool For 18 Social Media Apps

Shellphish – Phishing Tool For 18 Social Media Apps

June 10, 2019July 27, 2019
WhatsApp Hacking using QRLJacking

WhatsApp Hacking using QRLJacking

May 2, 2019May 19, 2019
How to Hack any Facebook Account with Z-Shadow

How to Hack any Facebook Account with Z-Shadow

April 26, 2019June 29, 2020
hacker buffs
ABOUT US

Haxf4rall is a collective, a good starting point and provides a variety of quality material for cyber security professionals.

Our primary focus revolves around the latest tools released in the Infosec community and provide a platform for developers to showcase their skillset and current projects.

COMPANY
  • Contact Us
  • Disclaimer
  • Hacker Gadgets
  • LANC Remastered
  • PCPS IP Puller
  • Privacy Policy
  • Sitemap
  • Submit your Tool
Menu
  • Contact Us
  • Disclaimer
  • Hacker Gadgets
  • LANC Remastered
  • PCPS IP Puller
  • Privacy Policy
  • Sitemap
  • Submit your Tool
Live Chat
RESOURCES
  • Attack Process
  • Become a Hacker
  • Career Pathways
  • Dark Web
  • Hacking Books
  • Practice Your Skills
  • Recommended Courses
  • Simple Setup – Hacker 101
Menu
  • Attack Process
  • Become a Hacker
  • Career Pathways
  • Dark Web
  • Hacking Books
  • Practice Your Skills
  • Recommended Courses
  • Simple Setup – Hacker 101
Get Started
TOOLBOX
  • Anonymity
  • Bruteforce
  • DoS – Denial of Service
  • Information Gathering
  • Phishing
  • SQL Injection
  • Vulnerability Scanners
  • Wifi Hacking
Menu
  • Anonymity
  • Bruteforce
  • DoS – Denial of Service
  • Information Gathering
  • Phishing
  • SQL Injection
  • Vulnerability Scanners
  • Wifi Hacking
Tools Directory

2014 – 2020 | Haxf4rall.com               Stay Connected:

Facebook Twitter Google-plus Wordpress
Please wait...

Join Our Community

Subscribe now and get your free HACKERS HANDBOOK

Don't Worry ! You will not be spammed
SIGN UP FOR NEWSLETTER NOW