HTTP traffic redirection

[entr0py]

Hello!

I have just installed WinGate 8 to see if it'll work the way I need. Unfortunately I can't see it get it to work the way I need it to.

A little background: I'm a security research / pen-tester. I am looking for a software application for my Windows machine to redirect traffic. During a MitM attack, I'll be forwarding traffic on for the rest of the LAN clients. I'm looking to intercept HTTP traffic and redirect it to another port on my machine. This other port will be my HTTP inspection proxy.

I can do this very easily on my Linux machine but I don't always have it with me, so I wanted try to set this up on my Windows laptop as well.

I understand that there are some redirection options within NAT but my system only has one networking interface which from what I've read, might be causing a problem.

Thanks for taking the time to read this point!

[adrien]

hi

ok, for the other topic you posted, that only works for traffic received from other computers. WinGate doesn't have an option to redirect outbound traffic from the local host itself.

But you should be able to do what you want to for the LAN computers.

WinGate 8 has https inspection also built-in.

To redirect outbound traffic from local, you could look into something like an auto SOCKS client. That can redirect connections made by an app to a SOCKS server (e.g. WinGate) where you can do things like change the destination etc.

Adrien

[entr0py]

[quote="adrien"

But you should be able to do what you want to for the LAN computers.
[/quote]

Thanks for the reply Adrien!

I attempted to set this up using the Extended Networking and setting up the interception however the traffic never seemed to get to my HTTP inspection proxy. I'll give it another shot tomorrow and post another comment with my setup

[entr0py]

I got this working!

I found the "TCP Mapping Service" which seemed exactly what I wanted to do (map once tcp port to another). To get it working there were a few things I needed to do.

The first things I did was modify the WinGate Firewall. It was causing issues with my spoofed ARP packets.

Next was to remove the "WWW Proxy" service and install the "TCP Mapping Service". Once installed I set up a map from port 80 to the port my intercepting HTTP proxy listens on

Once I had these things set up, HTTP traffic started flowing through my HTTP proxy and I was able to see/modify the clients web traffic.