NDIS Driver Filter VS API Hooking

Posted by Smarty Twiti on Programmers See other posts from Programmers or by Smarty Twiti
Published on 2013-04-07T18:23:20Z Indexed on 2013/11/01 10:22 UTC
Read the original article Hit count: 250

Filed under:

http-request

I've seen many developers asking for "How to intercept in/out HTTP packets ", "How to modify them on the fly". The most "clean" answer I've seen is to make a kernel-mode-driver filter from the scratch (TDI for XP and earlier winx9 or NDIS for NT systems).

An other way, is to use a user-mode-driver like Windivert, also Komodia has a great solution (without writing any single code).

The idea behind this introduction is just I want to know is API Hooking can be considered as alternative of writing of whole of driver-filter? writing a driver from the scratch is not an easy task, why just not Hooking the HttpSendRequest or any other API used by the browser? There are many free/commercial libraries to do this in a safe manner (eg: EasyHook, Mhook, Nektra..).

I'm not the first who ask, there already Sockscap that uses Hook(DLL injection) to change behavior to other applications and force them to use a Socks proxy, also Form grabbing attack 'used by keylogger..

Related posts about http-request

Understanding Request Validation in ASP.NET MVC 3

as seen on ASP.net Weblogs - Search for 'ASP.net Weblogs'
Introduction: A fact that you must always remember "never ever trust user inputs". An application that trusts user inputs may be easily vulnerable to XSS, XSRF, SQL Injection, etc attacks. XSS and XSRF are… >>> More
Google slideshow shows a blank screen when calling from ajax

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm having problems implementing google slideshow (http://www.google.com/uds/solutions/slideshow/index.html) to my web application by loading it using a jquery load() function. index.html: <script type="text/javascript" src="jquery-1.3.2.js"></script> <div id="moshe"></div> <script… >>> More
Logging all Firefox HTTP Request Headers?

as seen on Super User - Search for 'Super User'
I'm using Ruby+Watir to request pages through Firefox. I would like to record the headers and content of every http request made through the browser. Would it be possible to configure a proxy solution to store this information, either in a file or pipe it into an application? I'm running Ubuntu… >>> More
on Google App Engine 500 Error, it should be 200 instead of 500

as seen on Stack Overflow - Search for 'Stack Overflow'
requestToken = function() { var getTokenURI = '/gettoken?userid=' + userid; var httpRequest = makeRequest(getTokenURI, true); httpRequest.onreadystatechange = function() { if (httpRequest.readyState == 4) { if (httpRequest.status == 200) { openChannel(httpRequest… >>> More
Specifying culture for http request/reponse

as seen on Stack Overflow - Search for 'Stack Overflow'
I have a ReSTful web service which needs to parse culture-sensitive data from the request. This data could either be in an XML body or part of the query string. Is there any acepted way of determining which culture the data is being sent in (and by extension the culture in which the response should… >>> More

Developer IT