toxiproxy VS sslstrip

Checkout also shopify's awesome tool called toxiproxy: https://github.com/Shopify/toxiproxy

It turns out to be also a very good way to test a networking library by implementing it. Since your stack needs to be able to basically handle most adverse events properly.

The idea behind 'chaos engineering' is cool.

I use this to simulate delays between various local services:

https://github.com/Shopify/toxiproxy

If you have Docker all you need is a few terminal commands

Idk about firewall level, but application level I’d recommend https://github.com/Shopify/toxiproxy

That's why I usually recommend anybody that develops network critical apps to test their app with something like toxiproxy and purposfully mess with their connections and simulate network issues.

We use this thing. https://github.com/Shopify/toxiproxy I am not sure that it supports windows, but you can install it to the Linux machine and route your application under the test to that proxy.

On the same vibes as https://github.com/Shopify/toxiproxy

https://github.com/Shopify/toxiproxy is a perfect solution for that. I used it quite successfully years ago and it looks like it's still pretty active.

Looking at the toxiproxy you mentioned, it seems like it should do what you want though? TLS is generally over TCP anyway, so it should still be able to throttle those connections - it just wont understand the encryption. I also saw a pull request for having it act as a TLS man-in-the-middle proxy: https://github.com/Shopify/toxiproxy/pull/270

Another option might be to try something like sslstrip to strip off the TLS layer so you can point your tools at the stripped-off/non-TLS endpoint. Probably non-trivial to get this old code working on any system though, let alone a Jetson: https://github.com/moxie0/sslstrip

sslstrip - Demonstration of the HTTPS stripping attacks.

Yeah. And for anyone unaware, this technique, SSL stripping, was made well-known (and arguably pioneered?) by Moxie Marlinspike of Signal with his tool sslstrip back in 2011: https://github.com/moxie0/sslstrip. I believe that's what he was most famous for before Signal.

Once the connection has been intercepted, the attacker can use a tool such as sslstrip to disable all HTTPS redirects and change https:// links to unencrypted http://.

E' possibile, per quanto molto meno facile. https://github.com/moxie0/sslstrip per esempio. Ci sono anche altre tecniche che si basano sulla manipolazione delle richieste di DNS e cose simili. Sicuramente molto piu' facile da notare e ordini di grandezza piu' complesso di HTTP, che è assolutamente triviale.