Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've seen many developers asking for "How to intercept in/out HTTP packets ", "How to modify them on the fly". The most "clean" answer I've seen is to make a kernel-mode-driver filter from the scratch (TDI for XP and earlier winx9 or NDIS for NT systems).

An other way, is to use a user-mode-driver like Windivert, also Komodia has a great solution (without writing any single code).

The idea behind this introduction is just I want to know is API Hooking can be considered as alternative of writing of whole of driver-filter? writing a driver from the scratch is not an easy task, why just not Hooking the HttpSendRequest or any other API used by the browser? There are many free/commercial libraries to do this in a safe manner (eg: EasyHook, Mhook, Nektra..).

I'm not the first who ask, there already Sockscap that uses Hook(DLL injection) to change behavior to other applications and force them to use a Socks proxy, also Form grabbing attack 'used by keylogger..

share|improve this question
That depends on context, and you didn't describe the context of your application. I'd prefer API hooking when I want to affect a single specific application, and a driver if I want to affect the whole system. But other considerations might apply. – CodesInChaos Apr 7 '13 at 18:35
My need is just to filter Http packet and block web sites. "But other considerations might apply" if there any other easier solution please tell me :), the problem with driver is not only at their high price but also exaggerated choice(according to my need) but also Hooking is not safe enough, DLL injection can fail or banned by AV.. – Marwen Trabelsi Apr 7 '13 at 18:51
"My need is just to filter Http packet and block web sites." The question everyone is asking has to be why are you reinventing the wheel when you could do it using a proxy server like squid in about 20 minutes flat. – James Snell Nov 1 '13 at 9:35

Depending on your needs (specifically wanting to filter packets and block sites) the most clean option is definitely not to attempt to roll your own security tools. Instead use a tool specifically made for the job that allows you to put a network level job entirely out of reach of the client. Installation, configuration and maintenance are much simpler than coding your own filters and having to deploy them and manage them.

Squid has a range of ways to do what you want to do (including rewriting http headers and even html content.) If necessary it can be installed 'transparently' on a network to ensure that nobody can get around it even if they are aware it is present. It can even work with SSL if needed.

It also has some other positives which include lists of known proxy servers which are regularly updated to stop people using those to get around your filters.

share|improve this answer
I've get my own solution.. but for curiosity: I don't know squid.. You mean that squid can be embedded in my software? modify code source is necessary in that case? – Marwen Trabelsi Nov 6 '13 at 22:16
Squid is open source and is used in a number of other products. It's probably a bit heavyweight for a client application (more a server thing) but without more detailed information on your requirements there's no way to tell. – James Snell Nov 7 '13 at 19:33

In most cases, using an API hook is good enough. But for the socket calls, the wininet API hook is not enough to make a workable network filter.

I believe that API hook technique could be used to make a pass-thru wrapper. But it is difficult to give you a sample due to the complexity involved. For example, you need to consider DLL injection, code injection, etc...

share|improve this answer
I have trouble following your answer, because your grasp of English is lacking. Are you saying API hooks are a good idea but it is too hard for you to give a good example of how it is done, or it is still too hard in general? – Martijn Pieters Nov 1 '13 at 8:21
I said that API Hooks is detourable. that's it. – reinhard v.z. Nov 1 '13 at 8:39
What do you mean by "detourable"? – CodeCaster Nov 1 '13 at 9:51
I think what he means is they can be bypassed and shouldn't be relied on for security. – James Snell Nov 1 '13 at 10:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.