Blog | G5 Cyber Security

Modify HTTP Responses (Local Machine)

G5 Cyber Security

TL;DR

An unprivileged program can’t directly modify an HTTP response after it’s been sent by a server process. However, it can intercept and alter requests before they reach the server or manipulate responses before they are fully written to the network using techniques like reverse proxies, middleware, or shared memory. The success depends heavily on how the server is configured and whether the program has control over any part of the request/response pipeline.

How it Works

HTTP requests follow a path: Client -> Program (if present) -> Server. Responses go back the other way: Server -> Program -> Client. An unprivileged process can’t usually change data that has already passed through the server and been sent to the client.

Steps to Modify HTTP Responses

  1. Reverse Proxy Approach
    • Set up a reverse proxy (e.g., Nginx, Apache) in front of your target server. The unprivileged program can then configure this proxy.
    • Configure the proxy to intercept requests and responses.
    • Use Lua scripting (Nginx) or similar mechanisms within the proxy to modify headers, content, etc.
    # Nginx example (simplified)
location /my-app {
  proxy_pass http://localhost:8080;
  proxy_set_header X-Custom-Header "Modified by Proxy";
}
  2. Middleware Injection
    • If the server application uses middleware (e.g., in Python with Flask or Django, Node.js with Express), you might be able to inject your own middleware.
    • This requires finding a way to load your code into the server process – often through configuration files or environment variables.
    • Your middleware can then intercept requests and responses before they are sent or received. 
    # Python Flask example (simplified)
from flask import Flask, request
app = Flask(__name__)

@app.after_request
def modify_response(response):
  response.headers['X-Custom-Header'] = 'Modified by Middleware'
  return response
  3. Shared Memory/Files
    • The server application could be configured to read responses from a shared memory segment or file.
    • Your unprivileged program can write modified responses to this location before the server reads them. This requires coordination with the server process. 
    # Example (very simplified - assumes a dedicated file)
echo "Modified Response Content" > /tmp/response_file
  4. Network Interception (Limited Scope)
    • Tools like tcpdump or Wireshark can capture network traffic, but modifying it in real-time is complex and often requires root privileges.
    • You could potentially use a tool to rewrite packets on the fly, but this is unreliable and prone to errors.
    # Example (tcpdump - for capturing only)
tcpdump -i eth0 port 80 or port 443 -w capture.pcap
  5. Browser Extensions/Proxies
    • For client-side modifications, a browser extension or local proxy can intercept and alter requests and responses before they reach the server or are displayed in the browser.
    • This doesn’t modify the server’s response directly but changes what the user sees.

Important Considerations

Exit mobile version