Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Httptap: View HTTP/HTTPS requests made by any Linux program

github.com

Post reply on HN
Print view View original

141–148 of 148 posts

Re: Httptap: View HTTP/HTTPS requests made by any Linux program

#141

Post by ddelnano »

jeroenhd wrote: post #117
adtac wrote: post #75

Earlier quoted context omitted.

How would hooking on write(2) solve TLS? You'll be able to read and modify the ciphertext, but the process will never call write(2) with the plaintext bytes, so you can't actually read the HTTP request. You'll just see the encrypted bytes that go on the wire, but so does the NSA :) You need the kind of CA certificate trick that httptap uses. It comes with its own set of caveats (e.g. certificate pinning), but it can…

I believe that's how https://github.com/gojue/ecapture works. I don't know the details, but it seems to work!

Yep, that's correct. It uses eBPF upprobes to attach to the SSL_write/SSL_read functions.

Re: Httptap: View HTTP/HTTPS requests made by any Linux program

#144

Post by infogulch »

fs111 wrote: post #143

How can I run this as non-root? This is not obvious to me.

Based on how it works it cannot run as non-root even in principle. https://github.com/monasticacademy/httptap?tab=readme-ov-fil...

Correction: the readme claims it will work without requiring root, but it does need to manage network namespaces, which afaik may only be available to root users depending on system configuration.

> To run httptap you do not need to be the root user. ... It makes use of linux-specific system calls -- in particular network namespaces ...

Re: Httptap: View HTTP/HTTPS requests made by any Linux program

#145

Post by bityard »

khimaros wrote: post #105
bityard wrote: post #98

Earlier quoted context omitted.

A "cult" is a rather specific kind of organization. The typical hallmarks are non-mainstream spiritual beliefs, highly controlling and exploitative leadership, and rules against interacting with outsiders. Non-conformity generally results in outsized (sometimes violent) punishment and shame. Under this definition, for example, Catholic nuns are decidedly not a cult. They know what they are in for when the join, and m…

i think you just reaffirmed the parent's point. if a cult can only be "non-mainstream", i think you are just saying cults become societies once they're large/successful enough. i see plenty of examples of your other indicators in mainstream society.

Then you are only hearing whatever you want to hear, because I am not saying anything even remotely like that.

You may believe that society is broken in whatever way you chose but saying, "society is bad, and cults are bad, therefore society is a cult" is utterly broken logic.

Re: Httptap: View HTTP/HTTPS requests made by any Linux program

#146

Post by yoavm »

mhss wrote: post #138
yoavm wrote: post #72

Earlier quoted context omitted.

I believe I grew up in a cult myself, and one of the things I've concluded from that experience, and from leaving it, is that everywhere is a cult. Humans have a tendency towards cult-ish life, and if the cult is big enough we just refer to it as "society". People were as afraid (more or less) to leave the cult I was at, as people are around me now when they consider doing anything that is out of the norm. By no mean…

My understanding is that the definition of cult requires a common object of devotion. What's that object of devotion for "society"? it's too large and diverse of a group to categorize it as such IMHO. I agree however that sometimes people will categorize anything strongly deviating from the norm as cult-ish.

Money? Work? Most people around me dedicate their lives to it.

Re: Httptap: View HTTP/HTTPS requests made by any Linux program

#147

Post by _boffin_ »

gear54rus wrote: post #83
_boffin_ wrote: post #73

Earlier quoted context omitted.

Injecting random data into telemetry requests to mess up someone’s pretty dashboard?

There's at least https://adnauseam.io/ for that already

that's a browser addin, if i remember. I'm talking about all the telemetry for native apps. Since those aren't messed with too much, i'm sure there would be a few meetings arranged to figure out what's happening.

Re: Httptap: View HTTP/HTTPS requests made by any Linux program

#148

Post by xorcist »

0x696C6961 wrote: post #93
xorcist wrote: post #74

Earlier quoted context omitted.

It's a bit thin solution though, isn't it? As you say, it's dependent on both specific CA store and resolver behaviour. It's probably going to be robust enough on the most common SSL libraries, such as OpenSSL. But if we're going that route, why not just run the software against a patched SSL library which dumps the traffic? That also doesn't require any elevated privileges (as opposed to other methods of syscall int…

> why not just run the software against a patched SSL library which dumps the traffic? Why run strace when you can just patch libc?

Good point!
Post reply on HN