D2T2 - Mallet: Towards a Generic Intercepting Proxy
summary
Mallet is a Netty-based intercepting proxy that actually wires protocol decoders into a drag-and-drop graph UI, letting users build pipelines from existing handlers instead of writing sockets and parsers from scratch. Demos demonstrate WebSocket message tampering (lowercase → uppercase), DNS rewriting to redirect google.com to sensepost.com, JSON framing + aggregation and automatic checksum recalculation via Groovy scripts and Jackson, and UDP handling with a 10s idle timeout. It leverages the Netty framework (used in ~400,000 instances, 10PB/day) and supports TLS/SNI and many transports; the prototype works as shown.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 0:50About StPost
- 1:39Why do we care
- 5:30UDP Pipeline
- 8:16Why HTTP
- 13:35Prior work
- 15:18Objectives
- 16:54Nettie
- 19:41Transport Services
- 20:35Pipelines
- 26:00Demo
- 30:43Recalculating the checksum
- 33:29Groovy script
- 34:31JSON object
- 37:22Intercept handler
- 39:43Example
- 41:09Nodes
- 44:56Next Steps
- 48:30Script Handler
related talks
36mInterception
29mMalware Development: Asynchronous Backdoor Built on Public APIs
45mHTTP Desync Attacks: Smashing Into The Cell Next Door
51mMarshalling Pickles
34mDeserialization: what, how and why [not]
35m"How to hijack, proxy and smuggle sockets with Rack/Ruby"
47mMultipath TCP: Breaking Today's Networks with Tomorrow's Protocols
11mTurbo Tunnel, a good way to design censorship circumvention protocols