1

I've seen many developers asking for "How to intercept in/out HTTP packets ", "How to modify them on the fly". The most "clean" answer I've seen is to make a kernel-mode-driver filter from the scratch (TDI for XP and earlier winx9 or NDIS for NT systems).

An other way, is to use a user-mode-driver like Windivert, also Komodia has a great solution (without writing any single code).

The idea behind this introduction is just I want to know is API Hooking can be considered as alternative of writing of whole of driver-filter? writing a driver from the scratch is not an easy task, why just not Hooking the HttpSendRequest or any other API used by the browser? There are many free/commercial libraries to do this in a safe manner (eg: EasyHook, Mhook, Nektra..).

I'm not the first who ask, there already Sockscap that uses Hook(DLL injection) to change behavior to other applications and force them to use a Socks proxy, also Form grabbing attack 'used by keylogger..

Improve this question
3
  • That depends on context, and you didn't describe the context of your application. I'd prefer API hooking when I want to affect a single specific application, and a driver if I want to affect the whole system. But other considerations might apply.
    – CodesInChaos
    Apr 7, 2013 at 18:35
  • My need is just to filter Http packet and block web sites. "But other considerations might apply" if there any other easier solution please tell me :), the problem with driver is not only at their high price but also exaggerated choice(according to my need) but also Hooking is not safe enough, DLL injection can fail or banned by AV..
    – Marwen Trabelsi
    Apr 7, 2013 at 18:51
  • 1
    "My need is just to filter Http packet and block web sites." The question everyone is asking has to be why are you reinventing the wheel when you could do it using a proxy server like squid in about 20 minutes flat.
    – James Snell
    Nov 1, 2013 at 9:35

2 Answers 2

Reset to default
1

Depending on your needs (specifically wanting to filter packets and block sites) the most clean option is definitely not to attempt to roll your own security tools. Instead use a tool specifically made for the job that allows you to put a network level job entirely out of reach of the client. Installation, configuration and maintenance are much simpler than coding your own filters and having to deploy them and manage them.

Squid has a range of ways to do what you want to do (including rewriting http headers and even html content.) If necessary it can be installed 'transparently' on a network to ensure that nobody can get around it even if they are aware it is present. It can even work with SSL if needed.

It also has some other positives which include lists of known proxy servers which are regularly updated to stop people using those to get around your filters.

Improve this answer
2
  • I've get my own solution.. but for curiosity: I don't know squid.. You mean that squid can be embedded in my software? modify code source is necessary in that case?
    – Marwen Trabelsi
    Nov 6, 2013 at 22:16
  • 1
    Squid is open source and is used in a number of other products. It's probably a bit heavyweight for a client application (more a server thing) but without more detailed information on your requirements there's no way to tell.
    – James Snell
    Nov 7, 2013 at 19:33
-4

In most cases, using an API hook is good enough. But for the socket calls, the wininet API hook is not enough to make a workable network filter.

I believe that API hook technique could be used to make a pass-thru wrapper. But it is difficult to give you a sample due to the complexity involved. For example, you need to consider DLL injection, code injection, etc...

Improve this answer
4
  • 2
    I have trouble following your answer, because your grasp of English is lacking. Are you saying API hooks are a good idea but it is too hard for you to give a good example of how it is done, or it is still too hard in general?
    – Martijn Pieters
    Nov 1, 2013 at 8:21
  • I said that API Hooks is detourable. that's it.
    – reinhard v.z.
    Nov 1, 2013 at 8:39
  • 1
    What do you mean by "detourable"?
    – CodeCaster
    Nov 1, 2013 at 9:51
  • 1
    I think what he means is they can be bypassed and shouldn't be relied on for security.
    – James Snell
    Nov 1, 2013 at 10:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.