Give HTTPS Proxies [closed] - https

Question

Closed. This question needs to be more focused. It is not currently accepting answers.
Want to improve this question? Update the question so it focuses on one problem only by editing this post.
Closed 5 years ago.
Improve this question
OK, as admins requested it, i refine my question:
i am searching for local Proxie solutions which can tweak HTTPS / HST websites. They should be able to tweak the content and the headers of the site. Do you know such Proxies? I would prefer Python solutions because they are hackable.
Yes, there are solutions which work with Browser plugins, and i have posted an answer containing an example using Yarip, but the problem is: As soon as the Browser developers decide to remove APIs, not that anyone would do that, the Plugin stops working.
Therefore i want to have a solution which works on the protocol level. So, which Proxies can do that, tweak HTTPS / HST websites? I dont care for performance, my internet is slow anyway and im not in a hurry. Please also give a small example how to tweak the content of the website and a small example how to tweak a header, using your solution.
Hopefully my question is clear now.

Answer 1

Ok, here is my solution to this problem. AJAX with bottle.py and the jQuery Docs were helpful.
Use Firefox (Developer Edition), version 52. Later versions of Firefox do not support Yarip, which is my approach to inject Javascript into the document and to tweak the Content-Security-Policy response header, if there is one. I am interested in solutions for later Firefoxes/Chromes/whatever.
Stop Firefox from blocking mixed content (loading http resources from https sites). Which is nonsense on localhost. According to this Discussion and this Wiki Entry, starting with Firefox 55 localhost is finally whitelisted by default. However, as i need Yarip and therefore can not use Firefox 55, i still need to manually disable this policy.
This can be done globally by setting about.config -> security.mixed_content.block_active_content to false which is lazy and veery dangerous, as it affects every website, or by doing it temporarily per-page which is not so lazy but a little bit less dangerous.
Install Python 3
pip install bottle
Create a file server.py with the following contents:
import os, json
from bottle import request, response, route, static_file, debug, run
#route('/inc') # this handles the ajax calls
def inc():
# only needed when you pass parameters to the ajax call.
response.set_header('Access-Control-Allow-Origin', '*')
number = request.params.get('number', 0, type=int)
return json.dumps({'increased_number': number + 1})
#route('/static/<filename:path>') # this serves the two static javascript files
def send_static(filename):
return static_file(filename, root=os.path.dirname(__file__))
debug(True)
run(port=9030, reloader=True)
Run it
Put a copy of jquery.js into the same directory
Create a file logic.js in the same directory with the following contents:
// http://api.jquery.com/jQuery.noConflict/
var my = {};
my.$ = $.noConflict(true);
// http://api.jquery.com/ready/
my.$(function() {
var target = my.$(
'<div id="my-ajax-result" style="position:absolute; padding:1em; background:'
+ 'white; cursor:pointer; border:3px solid blue; z-index:999;">0</div>'
);
my.$('body').prepend(target);
function ajaxcall(){
// http://api.jquery.com/jQuery.getJSON/
my.$.getJSON(
"http://localhost:9030/inc",
{
number : target.text() // parameters
},
function(result) {
target.text(result.increased_number);
}
);
}
// http://api.jquery.com/click/
target.click(function(event) {
ajaxcall();
return false;
});
ajaxcall();
});
Install Yarip
Save the following xml to a file and, from Yarips manage pages dialog import it. This should create a new rule for en.wikipedia.org. Im too lazy now to explain how yarip works, but it is worth learning it. This rule will inject the jquery.js and the logic.js at the end of body and it will tweak the Content-Security-Policy response header, if there is one.
<?xml version="1.0" encoding="UTF-8"?>
<yarip version="0.3.5">
<page id="{56b07a5d-e2df-41f2-9ca8-34b4ecb04af8}" name="wikipedia.org" allowScript="true" created="1496845936929">
<page>
<header>
<response>
<item created="1496845998973">
<regexp flags="i"><![CDATA[.*wikipedia\.org.*]]></regexp>
<name><![CDATA[Content-Security-Policy]]></name>
<script><![CDATA[function (value) {
return "Content-Security-Policy: connect-src *";
}]]></script>
</item>
</response>
</header>
<stream>
<item created="1496845985382">
<regexp flags="i"><![CDATA[.*wikipedia\.org.*]]></regexp>
<stream_regexp flags="gim"><![CDATA[</body>]]></stream_regexp>
<script><![CDATA[function (match, p1, offset, string) {
return '<script type="text/javascript" src="http://localhost:9030/static/jquery.js"></script><script type="text/javascript" src="http://localhost:9030/static/logic.js"></script></body>';
}
]]></script>
</item>
</stream>
</page>
</page>
</yarip>
Make sure that yarip is enabled
Navigate to en.wikipedia.org. You should see a blue rectangle top left, with a number in it. If you click on it, an ajax call to localhost will be made and the contents of the blue rectangle will be replaced with the result result of that call – the number increased by 1. Screenshot:
Play around with this and tweak the web the way you want, including HTTPS sites. Have read/write access to your computer using the Python. Eat this, Firefox Nanny devs.