31–40 of 148 posts
Another tool that can be used by an unprivileged user for analysing network traffic is rootless Podman with Pasta. Just add the podman run option --network=pasta:--pcap,myfile.pcap Pasta then records the network traffic into a PCAP file that could later be analysed. I wrote a simple example where I used tshark to analyse the recorded PCAP file https://github.com/eriksjolund/podman-networking-docs?tab=re...
Why not use eBPF instead? Then you could see all http requests from all processes at once, including ones that are already running. Plus you wouldn't need to bother with TLS at all, just hook on e.g. write(2).
Presumably eBPF requires root privs?
httptap is a process-scoped http tracer that you can run without root priveleges. You can run `httptap ` where is a linux program and you get a trace of http/https requests and responses in standard output: httptap -- python -c "import requests; requests.get('https://monasticacademy.org')" ---> GET https://monasticacademy.org/ GET https://www.monasticacademy.org/ It works by running in an isolated network namespace.…
can it modify requests or responses? with the current web getting increasingly user-hostile a need for tool like this was never more apparent especially if it doesn't require proxy configuration
Earlier quoted context omitted.
Presumably eBPF requires root privs?
I'm having a hard time coming up with a use case where I want to use a tool like that but I'm also lacking root privileges
httptap is a process-scoped http tracer that you can run without root priveleges. You can run `httptap ` where is a linux program and you get a trace of http/https requests and responses in standard output: httptap -- python -c "import requests; requests.get('https://monasticacademy.org')" ---> GET https://monasticacademy.org/ GET https://www.monasticacademy.org/ It works by running in an isolated network namespace.…
Do you know if it's possible to get this working on macos? I believe Tailscale uses gvisor's tcp/ip lib (as their netstack lib) on macos for certain things.
Earlier quoted context omitted.
To be honest: This sounds like just another of the many many other yoga/spiritual cults that currently exist all over the western world. EDIT: typos and slight wording changes
There is absolutely nothing in their README to suggest that you are using the word "cult" properly.
While I cannot judge them outright, their article "Cyborgs Need a Trustworthy Religion" can appear cultist as they try to intertwine technology and religion.
Earlier quoted context omitted.
I'm having a hard time coming up with a use case where I want to use a tool like that but I'm also lacking root privileges
Inside most production environments. I could use this today inside a Pod that isn't allowed root privs.
I'm more interested in the HTTPS part. I see that it sets some common environment variables [1] to instruct the program to use the CA bundle in the temporary directory. This seems to pose a similar issue like all the variants of `http_proxy`: the program may simply choose to ignore the variable.
I see it also mounts an overlay fs for `/etc/resolv.conf` [2]. Does it help if httptap mounts `/etc/ca-certificates` directory with the temporary CA bundle?
[1] https://github.com/monasticacademy/httptap/blob/cb92ee3acfb2...
[2] https://github.com/monasticacademy/httptap/blob/cb92ee3acfb2...
Another tool that can be used by an unprivileged user for analysing network traffic is rootless Podman with Pasta. Just add the podman run option --network=pasta:--pcap,myfile.pcap Pasta then records the network traffic into a PCAP file that could later be analysed. I wrote a simple example where I used tshark to analyse the recorded PCAP file https://github.com/eriksjolund/podman-networking-docs?tab=re...
Very good to know about. But you still have the problem of decrypting TLS traffic.