Package: xepor
XeporXepor(pronounced/ˈzɛfə/, zephyr) is a web routing framework for reverse engineers and security researchers.
It provides a Flask-like API for hackers to intercept and modify HTTP requests and/or HTTP responses in a human-friendly coding style.This project is meant to be used withmitmproxy. Users write scripts withxepor, and run the scriptinsidemitmproxy withmitmproxy -s your-script.py.If you want to step from PoC to production, from demo(e.g.http-reply-from-proxy.py,http-trailers.py,http-stream-modify.py) to something you could take out with your WiFi Pineapple, then Xepor is for you!FeaturesCode everything with@api.route(), just like Flask! Write everything inonescript and noif..elseany more.Handle multiple URL routes, even multiple hosts in oneInterceptedAPIinstance.For each route, you can choose to modify the requestbeforeconnecting to server (or even return a fake response without connection to upstream), or modify the responsebeforeforwarding to user.Blacklist mode or whitelist mode. Only allow URL endpoints defined in scripts to connect to upstream, blocking everything else (in specific domains) with HTTP 404. Suitable for transparent proxying.Human readable URL path definition and matching powered byparseHost remapping. define rules to redirect to genuine upstream from your fake hosts. Regex matching is supported.Best for SSL stripping and server-side license cracking!Plus all the bests frommitmproxy!ALLoperation modes (mitmproxy/mitmweb+regular/transparent/socks5/reverse:SPEC/upstream:SPEC) are fully supported.Use CaseEvil AP and phishing through MITM.Sniffing traffic from target device by iptables + transparent proxy, modify the payload with xepor on the fly.Cracking cloud-based software license. Seeexamples/krisp/as an example.Write a complicated web crawler in~100 lines of code. Seeexamples/polyv_scrapper/as an example.... and many more.SSL stripping is NOT provided by this project.InstallationpipinstallxeporQuick startTake the script fromexamples/httpbinas an example.mitmweb-sexample/httpbin/httpbin.pySet your Browser HTTP Proxy tohttp://127.0.0.1:8080, and access the web interface athttp://127.0.0.1:8081/.Send a GET request fromhttp://httpbin.org/#/HTTP_Methods/get_get, Then you could see the modification made by Xepor in mitmweb interface, browser dev tools or Wireshark.Thehttpbin.pydo two things.When user accesshttp://httpbin.org/get, inject a query string parameterpayload=evil_paraminside HTTP request.When user accesshttp://httpbin.org/basic-auth/xx/xx/(we just pretend we don't know the password), sniffAuthorizationheaders from HTTP requests and print the password to the attacker.Just what mitmproxy always does, but with code written inxeporway.# https://github.com/xepor/xepor-examples/tree/main/httpbin/httpbin.pyfrommitmproxy.httpimportHTTPFlowfromxeporimportInterceptedAPI,RouteTypeHOST_HTTPBIN="httpbin.org"api=InterceptedAPI(HOST_HTTPBIN)@api.route("/get")defchange_your_request(flow:HTTPFlow):"""Modify URL query param.Test at:http://httpbin.org/#/HTTP_Methods/get_get"""flow.request.query["payload"]="evil_param"@api.route("/basic-auth/{usr}/{pwd}",rtype=RouteType.RESPONSE)defcapture_auth(flow:HTTPFlow,usr=None,pwd=None):"""Sniffing password.Test at:http://httpbin.org/#/Auth/get_basic_auth__user___passwd_"""print(f"auth @{usr}+{pwd}:",f"Captured{'successful'ifflow.response.status_code<300else'unsuccessful'}login:",flow.request.headers.get("Authorization",""),)addons=[api]