rapid7/metasploit-framework — pull request #1831 by sempervictus (2013-05-15 08:10:25+00:00)
Title: HTTP Proxy - class, mixin, and module

Add HTTP Proxy class to Rex::Proto::Http
Add Msf::Exploit::Remote::Http::Proxy mixin
Add auxiliary HTTP proxy server

The Rex proxy is capable of keeping sessions alive, rewriting headers
from proxy requests, and exposes callbacks for higher level
operations on request and response data, with the client available
for redirect or other activities. This proxy can function as a
transparent, standard HTTP, or direct-connected (routing all
traffic to a specific host:port) forwarder. Encoding is restricted
to Rex supported types.

Request and response callbacks allow for any action to be taken
during the proxying process and will gracefully return from the
proxy's callbacks if the client is no longer connected.

The mixin provides convenience methods for managing the service
and mixing into modules.

The http_proxy module provides options for performing MITM on
requests and/or responses, with an option to MITM headers as well
as the request body. Substitutions can be entered as semi-colon
separated strings to deal with varying requests during runtime.
Additionally, the proxy can be used to log successful page hits
to the DB, providing crawler, and other web-oriented modules
with targets which are not discovered by our native mechanisms.

Everything runs on Rex, so proxies can be started on pivoted hosts
facing into a compromised network and connecting anywhere on the
switchboard. The same instance will handle directed requests
as well as MITM victims.

Testing:
start the module, configure your browser to use the proxy on your
machine, browse pages. Configure HTTP::proxy::MITM options and
rexploit. Configure HTTP::proxy::report true and run arachni
or your favorite crawler through the proxy to build up a target
list.

This replaces #929.
@mubix: now you can evoke more "awareness" with less effort.