pasi@infosec.exchange
pasi@infosec.exchange

Latest update to Proxygen comes with intercept rules that allow accurately selecting which requests and responses should be intercepted 👍

#appkit #iosdev

|
Embed
Progress spinner
pajp
pajp

@pasi amazing! Can’t wait to try it out!

|
Embed
Progress spinner
pasi@infosec.exchange
pasi@infosec.exchange

@pajp One thing: the rules can only use message headers as that’s the point where matching is done. The proxy currently cannot wait until the end of a 10MB response body until it decides to intercept it. But I guess that’s a decent trade off?

|
Embed
Progress spinner
pasi@infosec.exchange
pasi@infosec.exchange

@pajp This now on App Store 👍

|
Embed
Progress spinner
pajp
pajp

@pasi awesome! I’ll dig into it next week when I’m back at work. Now I’m off to Stockholm for a Taylor Swift concert. 😀

|
Embed
Progress spinner
pasi@infosec.exchange
pasi@infosec.exchange

@pajp Wow cool! Have fun 💃🏻

|
Embed
Progress spinner
pasi@infosec.exchange
pasi@infosec.exchange

There are a few embarrassing bugs in the 1.8.0 version. I have now fixed a bunch and will release 1.8.1 after I think I have squashed them all.

|
Embed
Progress spinner
pasi@infosec.exchange
pasi@infosec.exchange

Proxygen 1.8.1 update is now out for iOS and Mac and it fixes several bugs 👍

|
Embed
Progress spinner
pasi@infosec.exchange
pasi@infosec.exchange

@pajp Anxiously waiting for your thoughts 😛

|
Embed
Progress spinner
pajp
pajp

@pasi haven’t had a reason to use the interception logic just yet, I’ll get there, but I manage to beachball Proxygen quite easily by simply having a ~big binary request payload (multipart POST, one of the parts a 12K executable file) and trying to view it in the raw request view

|
Embed
Progress spinner
pasi@infosec.exchange
pasi@infosec.exchange

@pajp Hmm yeah NSTextView will beachball if you give it too much text. “Show Binary Message Data” should be disabled in Advanced settings by default but that doesn’t apply to Intercept tool.

Hmm.. I wonder what would be a good way to prevent that. Maybe a “maximum message size” Intercept option 🤔

|
Embed
Progress spinner
pasi@infosec.exchange
pasi@infosec.exchange

@pajp In the mean time, you could try limiting content types under Intercept options to only those you expect to intercept, so that the binary blobs don’t get in the way!

|
Embed
Progress spinner
In reply to
pajp
pajp

@pasi ah to be clear this isn’t in the intercept view, this is in the normal history view,
no interception performed. And ”Show binary message data” is left at the default unchecked. Maybe it doesn’t know how to handle multipart requests with binary data?

|
Embed
Progress spinner
pasi@infosec.exchange
pasi@infosec.exchange

@pajp Hmm it tries to decode the body as UTF8 string and if that fails deems it as binary. Multipart should not affect that logic at all. Maybe the content-type indicates that it’s textual and that confuses the categorization.

|
Embed
Progress spinner
pasi@infosec.exchange
pasi@infosec.exchange

@pajp Okay just check, if the body is under 1MB in size, content-type indicates that its text based _or_ it can be decoded as UTF8 string, then it is displayed inline even if “Show Binary Messages” is unchecked.

|
Embed
Progress spinner
pasi@infosec.exchange
pasi@infosec.exchange

@pajp Aside from the sluggish NSTextView performance (which I don’t pay much attention to for now) anything else that you’d like to see improved in Proxygen?

|
Embed
Progress spinner
pajp
pajp

@pasi hey! Sorry I never got back to you - I’ve been waiting to come up with something useful to say! I use it several times per week and it’s great. Maybe auto-rewrite of content would be one thing, as I turn to mitmproxy for that. Maybe colourful JSON presentation. 🙂

|
Embed
Progress spinner
pasi@infosec.exchange
pasi@infosec.exchange

@pajp I’ll get tree-sitter based syntax highlighting once Runestone comes out. Just need to wait for all that niceness.

There is match & replace in Proxygen too. Since you have Plus subscription you should be able to configure regex based rules pretty easily. Try it out!

|
Embed
Progress spinner