smokescreen VS baserunner

Also from Stripe

https://github.com/stripe/smokescreen

Smokescreen is a HTTP CONNECT proxy. It proxies most traffic from Stripe to the external world (e.g., webhooks).

Smokescreen restricts which URLs it connects to:

It uses a pre-configured hostname ACL to only allow requests addressed to certain allow-listed hostnames, to ensure that no malicious code is attempting to make requests to unexpected services.

It is built on Elixir/Phoenix with live view and uses https://github.com/stripe/smokescreen and nextdns in the background.

I often need to make a HTTP request to a user supplied URL, but I then need to protect myself from SSRF attacks, such as users supplying URL's to "localhost:3000/protected-thing" etc. SSRF Proxy is hopefully the simplest and quickest way to get protection. Currently there is just a Node SDK but I will generate other languages soon.

It is built on Elixir/Phoenix with live view and uses https://github.com/stripe/smokescreen and nextdns in the background.

Sometimes, webhooks consumers require providers to send webhooks from predefined IP addresses. In this release, Convoy ships with an HTTP connect proxy support to route webhooks traffic through a dedicated egress. With this, we can maintain the IP address of our cluster across all requests. To configure, we deploy mole(our fork of smokescreen) and configure convoy to use this proxy with this environment variable - HTTP_PROXY

Nice. Looking more at it, looks like its a mix of wireguard and smokescreen maybe?

> "https://github.com/stripe/smokescreen"

I don't understand why they built this.

The problem described here is solved by using a firewall. What else is there to it?

Baserunner [1] does exactly this. I described using it for Firebase security research in my blog post [2].

[1] https://github.com/iosiro/baserunner

[2] https://saligrama.io/blog/post/firebase-insecure-by-default/

I've seen a fair bit of this with Firebase apps, where devs don't write enough rules, or have collections that mix non-sensitive and sensitive fields. It's tricky, because the whole query-the-database-from-JavaScript model causes your app to fail open. I wrote a tool that acts as a generic Firebase datastore client to help find these sorts of flaws.[1]

[1]: https://github.com/iosiro/baserunner

GitHub repository: https://github.com/iosiro/baserunner

Announcement blog post: https://iosiro.com/blog/baserunner-exploiting-firebase-datastores