How can I "man-in-the-middle" a specific port?

Question

When I want to figure out how a certain protocol works (let's say in this case, the HTTP protocol on port 80), I open two terminal windows:

nc -l 80
nc google.com 80

I then fire up the program I want to "man-in-the-middle", in this case FireFox, and go to http://localhost:80.

When the terminal on the left side sends a message, I copy and paste the data into the terminal on the right side. When the terminal on the right side sends a message, I do the same for the left terminal.

In addition to being manual and tedious, this process has two downsides:

1. If I'm not fast enough, the connection may time-out.
2. Copying and pasting does not handle binary data very well.

Can I automate this process? Can I have one port automatically forward data to another port, or even another machine, in a way that allows me to inspect and debug the data going back and forth?

Answer 1

Use socat, which is netcat on steroids.

           netcat                                                                                                socat

_{Left: Swiss army knife model 1951, photo by Ivlianvs. Right: Wenger “Giant”, photo by Slartibartfass.}

socat TCP-LISTEN:8080 TCP:google.com:80

(You need to be root to listen on ports below 1024, so pick a higher port.)

But if what you want is to observe traffic, and you have root permissions, scratch that and run Wireshark. Start it up, set the filter to tcp.port == 80, start listening on your default network interface, and start browsing.

Note that Google redirects you to HTTPS. If you look at HTTPS traffic, you'll only see the encrypted TLS connection, which isn't interesting unless you want to observe the TLS handshake. While you can arrange to intercept an HTTPS session by feeding fake certificate authorities to your browser, it's harder to set up. If you want to observe the HTTP protocol, stick to the unencrypted version, i.e. to sites that don't use SSL.

Answer 2

**If it is in the localhost you can just sniff it. Have a look at ngrep, tcdpump, or wireshark.

ngrep -q "." "port 80"

Alternatively you can use socat in a loop.