proxychains VS frida

Fun fact: proxychains uses LD_PRELOAD [0] to hook the necessary syscalls [1] for setting up a "proxy environment" for the wrapped program, e.g. `connect`, `gethostbyname`, `gethostbyaddr`, etc. Note this also implies that it could be leaky in some cases when applied to a program that uses alternative syscalls to make an external connection.

[0] https://github.com/haad/proxychains/blob/master/src/proxycha...

[1] https://github.com/haad/proxychains/blob/master/src/libproxy...

You can use ProxyChains in order to use the SOCKS5 proxy with any application, depending on the OS you are using.

I assume that https://github.com/haad/proxychains is the project in question. At https://github.com/haad/proxychains/blob/master/src/proxychains.conf you can view the contents of the configuration file and then save it in /etc/proxychains.conf.

That is weird. However, missing configs are usually an easy problem to solve - simply find one online and copy it (once you understand it). Here is the one from the proxy chains repo. Lastly, be careful with Kali, it's definitely not suited to beginners (you're doing the right thing running it in a VM at least).

ntlmrelayx2proxychains aims to connect the tool of the SecureAuthCorps' impacket suite, ntlmrelayx.py (hereafter referred to as "ntlmrelayx"), along with @byt3bl33d3r's tool, CrackMapExec (hereafter referred to as "CME"), over proxychains, developped by haad.

You can go even further with tools like proxychains that let you chain multiple proxies. This is used while setting up tor and comes pre-installed with pentesting distros like Kali and ParrotOS.

Frida, uff this is just AMAZING, yes with uppercase and in bold letters. They also has bindings on different languages that can be found in their github repository. Spoiler alert...the Go binding it's pure shit...really couldn't run it. Use just the default that it's installed with pip install frida-tools.

A great framework for doing something along those lines is Frida (https://github.com/frida/frida). Works on a bunch of stuff, including Android and iOS. Some global-ish certificate pinning bypasses work through Frida, by patching http libraries to not raise exceptions, accept system certificates, etc and just quietly hum along instead. Certificate unpinning in turn enables network MITM with mitmproxy, which makes it a lot quicker and easier to inspect, block, or modify network traffic.

Funnily enough, I've seen much stronger obfuscation from reverse engineering from my cheap Tuya IoT devices app than from my bank app.

Install Frida from Github :- https://github.com/frida/frida

// see: https://github.com/frida/frida/issues/382

If anyone needs a "monkey" not for web pages but for any process on your computer system, may I recommend Frida:

https://frida.re

https://github.com/frida/frida

With Frida, you write JavaScript programs and inject them into arbitrary processes, to hook and modify and call whatever you please.

It gets a lot of use in the reverse engineering and vulnerability research communities, but has broader scope too. For instance, I used it recently to automate the UI of a video production program on Windows, by injecting a thread that sends window messages to the main message loop and hooks into various system dialog functions.

var android_log_write = new NativeFunction( Module.getExportByName(null, '__android_log_write'), 'int', ['int', 'pointer', 'pointer'] ); var tag = Memory.allocUtf8String("[frida-sript][ax]"); var work = function() { setTimeout(function() { android_log_write(3, tag, Memory.allocUtf8String("ping @ " + Date.now())); work(); }, 1000); } work(); // console.log does not seems to work. see: https://github.com/frida/frida/issues/382 console.log("console.log"); console.error("console.error"); console.warn("WARN"); android_log_write(3, tag, Memory.allocUtf8String(">--(O.o)-<)");

Go to https://github.com/frida/frida/releases and download the latest frida-server--android-arm64.xz. Extract it and run adb push frida-server--android-arm64 /sdcard/frida-server

It sounds like a kind of black magic:

> ...It’s a dynamic code instrumentation toolkit. It lets you inject snippets of JavaScript or your own library into native apps on Windows, macOS, GNU/Linux, iOS, Android, and QNX.

> ...Frida’s core is written in C and injects QuickJS into the target processes, where your JS gets executed with full access to memory, hooking functions and even calling native functions inside the process.

> There’s a bi-directional communication channel that is used to talk between your app and the JS running inside the target process.

Here's a description of the architecture:

https://frida.re/docs/hacking/

And the source:

https://github.com/frida/frida

---

Apparently using "wxWindows Library Licence, Version 3.1":

> This is essentially the LGPL, with an exception stating that derived works in binary form may be distributed on the user's own terms. This is a solution that satisfies those who wish to produce GPL'ed software using Frida, and also those producing proprietary software.

https://github.com/frida/frida/blob/master/COPYING