5 ms·

Show HN: Forwarder – FOSS MITM proxy written in Go

78 points by michalmatczuk 3y ago

I'm working at Sauce Labs on a fast MITM proxy. If you are using mitmproxy, Fiddler or Charles proxy in your job I believe you'll find it invaluable. Forwarder 1.1 is now available, complete with a Grafana Dashboard for effortless monitoring. We are committed to making it great. I welcome your feedback. Cheers Michał

jzelinskie 3y ago
For those with blocking rules around newly registered DNS: https://github.com/saucelabs/forwarder https://github.com/saucelabs/forwarder
- ronsor 3y ago
  > blocking rules around newly registered DNS Why is this even a thing?
  - tedunangst 3y ago
    Moderately effective anti phishing. Your real bank's domain is older than last week.
    - ronsor 3y ago
      Most malware/scam domains I've seen are generally a few weeks old, which is still fairly new, but not quite last week.
Snawoot 3y ago
Great! Here is the feedback: https://github.com/saucelabs/forwarder/issues/616 https://github.com/saucelabs/forwarder/issues/616
- michalmatczuk 3y ago
  Thank you, looks like we could apply some hardening here indeed.
- epicfeedback 3y ago
  This is incredible feedback, good eye
- michalmatczuk 3y ago
  Sent a PR to fix that https://github.com/saucelabs/forwarder/pull/617 https://github.com/saucelabs/forwarder/pull/617.
sigmonsays 3y ago
am i reading this correctly that it could be used as an adblock? is the PAC format powerful enough to handle everything that current adblockers do?
- michalmatczuk 3y ago
  You have a lot of flexibility with PAC files, so I guess that's possible. Some PAC files can be quite complex. Another option would be using --deny-domains it accepts a list of regular expressions, you can prefix an item with - to exclude it. https://forwarder-proxy.io/cli/forwarder_run/#deny-domains https://forwarder-proxy.io/cli/forwarder_run/#deny-domains
visualphoenix 3y ago
Wish this had a caching feature… Setting up squid as a https caching forward proxy in docker is a pain.
- michalmatczuk 3y ago
  That's not currently on the roadmap. Please file an issue, we'll see what we can do.
toasted-subs 3y ago
I'm not too versed on these, but why not use nginx?
- sakjur 3y ago
  Nginx is built as a reverse proxy, useful to intercept traffic coming in to a server and route it to the correct service. This is the opposite, I guess we can call it an obverse proxy: it sits near a client and allows the owner (or a malicious party) of the client to intercept the traffic as it leaves the client. A former employer of mine used something like this to gain access to the API calls being made from iPhone apps, but you could use it to say attach authentication to calls heading a certain way (think what AWS is doing to make service to service calls work transparently to the user) or tons of other stuff (blocking content, if you’re so inclined). I haven’t tried to use nginx as an MITM proxy or this project at all, but presumably it’s easier to use this when your usecase lies closer to the client than the server and vice versa.
- 8organicbits 3y ago
  Tools like Fiddler allow traffic modification based on rules, so you can tamper traffic. Forwarder doesn't appear to allow modification (other than headers?) so I think it's about logging traffic and collecting metrics. Still looking at the docs, I could have missed something.
  - michalmatczuk 3y ago
    Good point. We are getting stated. Here's draft proposal for 1.3 to add this feature https://github.com/saucelabs/forwarder/issues/584 https://github.com/saucelabs/forwarder/issues/584. The idea is to allow users work in JavaScript with Go http.Request and http.Request. Interop between Go and JS in Goja is very good.
remram 3y ago
> If you are using mitmproxy, Fiddler or Charles proxy in your job I believe you'll find it invaluable. Why? Do you have a comparison? Or even a list of your features, beyond the 6 bullet points on your homepage?

78 points by michalmatczuk 3y ago

jzelinskie 3y ago

For those with blocking rules around newly registered DNS: https://github.com/saucelabs/forwarder https://github.com/saucelabs/forwarder

ronsor 3y ago
> blocking rules around newly registered DNS Why is this even a thing?
- tedunangst 3y ago
  Moderately effective anti phishing. Your real bank's domain is older than last week.
  - ronsor 3y ago
    Most malware/scam domains I've seen are generally a few weeks old, which is still fairly new, but not quite last week.

Snawoot 3y ago

Great! Here is the feedback: https://github.com/saucelabs/forwarder/issues/616 https://github.com/saucelabs/forwarder/issues/616

michalmatczuk 3y ago
Thank you, looks like we could apply some hardening here indeed.
epicfeedback 3y ago
This is incredible feedback, good eye
michalmatczuk 3y ago
Sent a PR to fix that https://github.com/saucelabs/forwarder/pull/617 https://github.com/saucelabs/forwarder/pull/617.

sigmonsays 3y ago

am i reading this correctly that it could be used as an adblock? is the PAC format powerful enough to handle everything that current adblockers do?

michalmatczuk 3y ago
You have a lot of flexibility with PAC files, so I guess that's possible. Some PAC files can be quite complex. Another option would be using --deny-domains it accepts a list of regular expressions, you can prefix an item with - to exclude it. https://forwarder-proxy.io/cli/forwarder_run/#deny-domains https://forwarder-proxy.io/cli/forwarder_run/#deny-domains

visualphoenix 3y ago

Wish this had a caching feature… Setting up squid as a https caching forward proxy in docker is a pain.

michalmatczuk 3y ago
That's not currently on the roadmap. Please file an issue, we'll see what we can do.

toasted-subs 3y ago

I'm not too versed on these, but why not use nginx?

sakjur 3y ago
Nginx is built as a reverse proxy, useful to intercept traffic coming in to a server and route it to the correct service. This is the opposite, I guess we can call it an obverse proxy: it sits near a client and allows the owner (or a malicious party) of the client to intercept the traffic as it leaves the client. A former employer of mine used something like this to gain access to the API calls being made from iPhone apps, but you could use it to say attach authentication to calls heading a certain way (think what AWS is doing to make service to service calls work transparently to the user) or tons of other stuff (blocking content, if you’re so inclined). I haven’t tried to use nginx as an MITM proxy or this project at all, but presumably it’s easier to use this when your usecase lies closer to the client than the server and vice versa.
8organicbits 3y ago
Tools like Fiddler allow traffic modification based on rules, so you can tamper traffic. Forwarder doesn't appear to allow modification (other than headers?) so I think it's about logging traffic and collecting metrics. Still looking at the docs, I could have missed something.
- michalmatczuk 3y ago
  Good point. We are getting stated. Here's draft proposal for 1.3 to add this feature https://github.com/saucelabs/forwarder/issues/584 https://github.com/saucelabs/forwarder/issues/584. The idea is to allow users work in JavaScript with Go http.Request and http.Request. Interop between Go and JS in Goja is very good.

remram 3y ago

> If you are using mitmproxy, Fiddler or Charles proxy in your job I believe you'll find it invaluable. Why? Do you have a comparison? Or even a list of your features, beyond the 6 bullet points on your homepage?