goproxy icon indicating copy to clipboard operation
goproxy copied to clipboard

Security issue: if use mitn handler websocket ignores cascade end proxy and use direct connect

Open 4n70w4 opened this issue 3 years ago • 1 comments

Hi! I get code from https://github.com/elazarl/goproxy/blob/0581fc3aee2d07555835bed1a876aca196a4a511/examples/cascadeproxy/main.go

and connect to wss://webhook.site/.... or ws://webhook.site/....

all ok - connected via end proxy.

But if add Mitm handler to middleProxy

middleProxy.OnRequest(goproxy.ReqHostMatches(regexp.MustCompile("^.*$"))).HandleConnect(goproxy.AlwaysMitm)

not ok - connected via server IP.

I believe this is a security issue and should not be enabled by default.

4n70w4 avatar Jan 09 '21 17:01 4n70w4

May be related: https://github.com/elazarl/goproxy/issues/125

4n70w4 avatar Jan 12 '21 20:01 4n70w4