search

rhaidiz / broxy

An HTTP/HTTPS intercept proxy written in Go.
GNU General Public License v3.0
998 stars 58 forks source link

Hardcoded CA Certificate #2

Closed bpsizemore closed 4 years ago

bpsizemore commented 4 years ago

The CA Cert in the coreproxy_settings.go file is static and not something that gets generated. Anyone who trusts the Cert in order to capture HTTPS traffic will be vulnerable to using unverified sites later.

Example site signed with the hardcoded CA https://proxy.lf.lc/

bpsizemore commented 4 years ago

This is mostly an issue with the Releases since someone could easily use their own when building themselves, but I think it might make sense to pull it out into a config file.

rhaidiz commented 4 years ago

Yes sure, this is going to change in the next iteration.

rhaidiz commented 4 years ago

I have finally released the version I was working on and this issue is now fixed.

bpsizemore commented 4 years ago

Really looking forward to seeing where this project goes and hopefully lending a hand where I can once you are ready for some more contributors. Burp has so many bugs and a terrible UI so I'm rooting for Broxy!

rhaidiz commented 4 years ago

Thanks. The user interface is definitely an important aspect, for the time being I decided to implement something that looks like Burp to see if the whole thing would actually work. As for the contribution, I have been thinking about it but I don't really know how to organize it at this time. I guess that if you have an idea on a specific component\module and how to implement it (for example how to make the UI more accessible) you might open an issue that can be discussed here on GitHub.