# interception Interception is an attack pattern in which an adversary monitors data streams to or from a target to gather information, including by sniffing network traffic. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Harnessing the Power of Service Workers: Building Offline-Ready Web Apps DevFeed: [Harnessing the Power of Service Workers: Building Offline-Ready Web Apps]() Original publisher: [Read original article]() Author: Jitendra Kumar Published: 2024-06-12T06:49:30Z Content type: tutorial Language: en Sources: [Housing.com]() Topics: [Web Development](), [web applications](), [Caching](), [browser](), [interception](), [JavaScript](), [Persistence]() Tags: [browser](), [building](), [cache](), [caching](), [interception](), [javascript](), [offline](), [persistence](), [web](), [web-apps]() ### AI overview This tutorial explains how service workers run in the background of web applications, act as proxies between pages and the network, and enable offline functionality by serving cached content. It compares service worker caching with standard browser caching and describes Cache Storage as distinct from Local Storage and Session Storage. ### Source excerpt In the dynamic world of web development, where user experience reigns supreme, having a web application that functions seamlessly even in offline mode is no longer a luxury but a necessity. Enter service workers -- the unsung heroes behind the scenes, making this magic possible. In this blog post, we'll delve into the world of service workers, exploring what they are, how they work, and how you can harness their power to supercharge your web applications. What is a service worker ? At its core, a service worker is a script that runs in the background of a web application, separate from the main JavaScript thread. It acts as a proxy between your web page and the network, enabling a host of powerful features such as offline functionality. This means that even if the user loses internet connection, the service worker can still serve cached content, providing a seamless offline experience. How service worker caching is different than standard browser caching ? Location and Scope: Service Worker: JavaScript files running in the background, separate from the main browser thread. Browser Caching: Resources stored within the browser itself, part of the main browsing environment. 2. Control Over Network Requests: Service Worker: Provides fine-grained control over network requests, allowing interception and customized handling. Browser Caching: More passive, resources are stored and retrieved by the browser without direct developer intervention. 3. Offline Functionality: Service Worker: Enables creation of offline experiences by caching and serving resources even when offline. Browser Caching: Improves performance but doesn't inherently provide offline functionality. 4. Persistence and Management: Service Worker: Persistent and programmatically managed caches, controlled by developers. Browser Caching: Managed by the browser, with limited developer control over cache lifecycle. Where service worker data is stored ? Service worker caching is stored in a separate storage called ## EU Funding for Mobile App Traffic Interception DevFeed: [EU Funding for Mobile App Traffic Interception]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2023-02-27T12:00:00Z Content type: article Language: en Sources: [HTTP Toolkit]() Topics: [interception](), [Mobile](), [Security & Privacy](), [Android](), [iOS](), [Instrumentation](), [Open Source](), [Network]() Tags: [android](), [announcements](), [certificates](), [development](), [eu](), [frida](), [funding](), [hooks](), [http](), [instrumentation](), [interception](), [ios](), [mobile](), [mobile-apps](), [network](), [open](), [privacy](), [product-development](), [security](), [technical]() ### AI overview HTTP Toolkit announces EU-backed funding to improve HTTPS traffic interception for mobile apps on iOS and Android. The project will use Frida integrations and hooks to support app-specific interception, automatic certificate unpinning, and simpler setup. ### Source excerpt HTTP Toolkit has been selected to receive another round of open-source funding from the EU! This aims to improve interception of HTTPS traffic from mobile apps, making it easier for both security/privacy researchers and normal technical users to inspect & manipulate the data that any app they use sends & receives. This funding will directly support work to improve the precision & usability of mobile app interception, on both iOS and Android. In a couple of clicks, you'll be able to target any app installed on a connected device (on either platform) and inspect all its traffic. That means no background noise from full system interception, automatic certificate unpinning, and no fiddly manual setup required. HTTP Toolkit can already automatically intercept Android devices, but only globally for the whole device (using Android's VPN APIs), with system certificates injected but without certificate unpinning, and with no automatic setup support for iOS at all. All those caveats are going away (of course, I'm intending the existing device-wide interception to remain a fully supported option indefinitely too). This is going be powered by a set of new integrations & hooks for Frida, a popular open-source instrumentation toolkit. Many advanced HTTP Toolkit users are already using Frida independently (see the Frida certificate unpinning guide for more info) but doing so often requires quite a bit of setup and specialist knowledge. This project is going to take that away, making network interception of mobile apps easily accessible to anybody who knows what "HTTP" is. All this is being funded by the fantastic NLNet Foundation as part of NGI Zero Entrust, a program funding open-source EU projects that support transparency around data use & privacy in modern technology. This is part of the EU's Next Generation Internet (NGI) initiative, aiming to directly fund researchers & open-source developers to encourage the future engineering of the Internet towards European values: "openn ## On my resignation as regulator of the Dutch intelligence and security services DevFeed: [On my resignation as regulator of the Dutch intelligence and security services]() Original publisher: [Read original article]() Published: 2022-09-09T08:55:00Z Content type: opinion Language: en Sources: [Bert Hubert's writings]() Topics: [Security](), [like](), [interception](), [Hacking]() Tags: [authorization](), [hacking](), [intelligence](), [interception](), [national-security](), [security](), [technical]() ### AI overview A former member of the Dutch intelligence and security services oversight board explains his resignation. He says proposed changes would largely eliminate his technical risk-analysis role, reduce regulatory requirements for bulk interception, permit algorithmic analysis of bulk-intercepted data without external approval, and shift parts of oversight from prior authorization to ongoing or retrospective review. ### Source excerpt I've seen some mediocre automated translations of my Dutch language resignation statement go round. To prevent any confusion, please find the story here in English: Until today I was one of the three members of the board that checks warrants for the Dutch intelligence and security services. This board is called "Toetsingscommissie Inzet Bevoegdheden" or TIB. If either of the civil or the military intelligence and security services of The Netherlands want to use their lawful intercept, SIGINT or hacking (& some other) legal powers, they have to first convince their own jurists, then their ministry and finally the TIB. ## EU Funding for Dev Tools for the Decentralized Web DevFeed: [EU Funding for Dev Tools for the Decentralized Web]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2021-09-15T12:00:00Z Content type: article Language: en Sources: [HTTP Toolkit]() Topics: [dev-tools](), [ZeroNet](), [IPFS](), [WebRTC](), [Ethereum](), [interception](), [debug](), [Testing](), [Logging](), [Script]() Tags: [announcements](), [applications](), [decentralized-web](), [dev-tools](), [development](), [ethereum](), [funding](), [interception](), [logging](), [open-source](), [webrtc]() ### AI overview HTTP Toolkit received EU Horizon funding through the Next Generation Internet initiative to expand its interception, debugging, and testing capabilities for decentralized-web applications. The project will focus on IPFS, WebRTC, and Ethereum, with results released under free and open-source licenses. ### Source excerpt Through the Next Generation Internet (NGI) initiative, HTTP Toolkit has been selected for funding from the EU's Horizon research & innovation program, to expand beyond HTTP and offer the same interception, debugging & testing functionality for applications built on top of the decentralized web. This is going to be a huge opportunity to invest in expanding HTTP Toolkit to support some very exciting new technologies, and extending existing core functionality to do so along the way. For this project I'm going to be specifically focusing on 3 main protocols that today form the backbone of the decentralized web: IPFS, WebRTC & Ethereum. For each of these protocols, the essential technologies are usable now, but the wider ecosystem and uptake is still in their infancy. I think it's clear that most mainstream web developers are not currently using these technologies to build production-grade decentralized applications. There are many reasons for this, but one is a lack of high-quality developer tooling. Moving from traditional client/server architectures to building decentralized applications requires developers to replace many day-to-day debugging & testing tools with manual logging, custom scripts and guesswork. This tooling gap makes decentralized development significantly more difficult. The goal here is to fix that, by providing modern tools for the future of the web. This is funded as part of the NGI Pointer project, funding me as an individual to work on this for a year, with all the resulting output to be available under free & open-source licenses (of course, HTTP Toolkit is conveniently already 100% open-source, so that's no change at all). If you're interested in the future of the web and you think developer tooling matters, I hope this is very exciting! If you're an existing HTTP Toolkit user though and you're only interested in HTTP, don't worry. This is equity-free R&D funding, so HTTP Toolkit remains a completely independent open-source project, and although ## Defeating Android Certificate Pinning with Frida DevFeed: [Defeating Android Certificate Pinning with Frida]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2021-07-06T13:30:00Z Content type: tutorial Language: en Sources: [HTTP Toolkit]() Topics: [Android](), [interception](), [SSL](), [debug](), [Security]() Tags: [android](), [certificates](), [debugging](), [frida](), [http](), [interception](), [security](), [security-research](), [tls]() ### AI overview This tutorial explains Android certificate pinning, why it prevents HTTPS interception, and how Frida can be used to remove SSL pinning so researchers, developers, and privacy advocates can inspect an app's traffic. ### Source excerpt Some Android apps go to astounding lengths to ensure that even the owner of a device can never see the content of the app's HTTPS requests. This is problematic for security research, privacy analysis and debugging, and for control over your own device in general. It's not a purely theoretical problem either - protections like this attempt to directly block HTTPS inspection tools like HTTP Toolkit, which allow you to automatically intercept HTTPS from Android devices for inspection, testing & mocking, like so: This depends on the target application(s) trusting the debugging proxy's certificate for HTTPS traffic. These HTTP interception and mocking techniques are super useful for testing and understanding most apps, but they have issues with the small set of hyper-vigilant apps that add extra protections aiming to lock down their HTTPS traffic and block this kind of inspection. In the end, this is your Android device, and whether you're a security researcher checking for vulnerabilities, a developer trying to understand how an app uses its API, or a privacy advocate documenting what data an app is sharing, you should be able to see the messages that the apps you use transmit and receive on your own phone. Protections like certificate pinning make this difficult. Let's talk about how you can fight back, by using Frida to remove SSL pinning, and expose the real traffic that any app is sending. What's certificate pinning? By default, when an Android app makes an HTTPS connection, it makes sure that it's talking to a trusted server by comparing the issuer of the server's certificate to Android's built-in list of trusted system certificate authorities. 99% of apps stick with that default. You can't change the system certificate authorities on normal devices, so this list is fairly reliable and secure. You can change it though on rooted devices and most emulators, so it's quite possible to intercept and inspect HTTPS traffic from these apps by using a debugging proxy for HT ## How HTTP Toolkit handles HTTP and HTTPS traffic on a single port DevFeed: [How HTTP Toolkit handles HTTP and HTTPS traffic on a single port]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2021-04-15T16:45:00Z Content type: article Language: en Sources: [HTTP Toolkit]() Topics: [HTTP](), [interception](), [Protocol (disambiguation)](), [servers](), [Tooling]() Tags: [http](), [interception](), [protocol](), [proxy](), [request](), [responses](), [tls]() ### AI overview HTTP Toolkit uses one incoming TCP port to accept multiple HTTP and HTTPS formats, including HTTP/1.x, HTTP/2, and TLS connections. It combines direct requests, explicit proxying, redirection, and tunneling so traffic can be intercepted and handled by configured rules. ### Source excerpt Traditionally, a TCP port has a single server listening for incoming connections, and that server expects you to send messages in the right protocol for that port. For HTTP, it's normally a web server that'll send you a response directly, or some kind of proxy that will pass all requests through to another server, and then pass the responses back. This is boring. What if you could accept everything, from proxied HTTPS to plain-text HTTP/1.0, all on a single port? HTTP Toolkit acts as an HTTP(S) proxy for debugging and interception. With all the possible combinations of clients and configurations, tools like this can be complicated to set up, and getting everything working and properly intercepted is a common pain point. To make setup as easy as possible, HTTP Toolkit uses a single incoming port for absolutely everything, for every widespread HTTP format, for both HTTP & HTTPS, for both direct and proxied requests. Specifically, on one single port it accepts: Plain HTTP/1.* (1.1, or 1.0 if you just can't quit the 90s) HTTP/1.* over TLS (HTTPS) Plain-text HTTP/2 with prior knowledge Plain-text HTTP/2, upgraded on the first request by an Upgrade header HTTP/2 over TLS (HTTPS) negotiated via ALPN These can then all be combined to suit your tastes with a selection of ways to make your actual HTTP request: Make a direct request to HTTP Toolkit's URL as if it were a server, and mock a response for that in the app (GET /). Proxy through HTTP Toolkit explicitly in plain text (GET http://example.com/). Redirect unsuspecting traffic that's not aware of the proxy to HTTP Toolkit, to transparently proxy traffic elsewhere: GET / Host: example.com Tunnel traffic by connecting with HTTP/1.1, sending CONNECT example.com:443 to make the connection into a tunnel to another server, and then doing any of the above within that tunnel. Tunnel traffic within a single HTTP/2 stream, by sending a CONNECT request to convert that one stream into a tunnel, and then doing any of the above again ## Native Controls DevFeed: [Native Controls]() Original publisher: [Read original article]() Author: Shai Almog Published: 2019-01-28T00:00:00Z Content type: article Language: en Sources: [CodeName One]() Topics: [Library](), [iOS](), [passwords](), [interception]() Tags: [blog](), [interception](), [library](), [native](), [password]() ### AI overview The Codename One cn1-native-controls library wraps native widgets for features that are difficult to support otherwise, including device password managers and an iOS SMS interception text field. ### Source excerpt We supported native widgets within the native interface feature since the first public beta. However, this requires native coding and isn't always trivial. Normally you don't really need to do that. E.g. for text fields we implicitly convert the field to a native field as necessary. However, if you wish to use the password manager of the device this won't work. To solve this Steve introduced a new cn1lib: cn1-native-controls. This library wraps some native widgets and lets us use some features that might be tricky without them. Good use cases for this include the password managers which need a native text widget constantly in that spot. Another use case would be iOS's SMS interception text field that can automatically intercept the next incoming SMS and set it to a special native text field. ## TIP: Activation UI and the Builder Pattern DevFeed: [TIP: Activation UI and the Builder Pattern]() Original publisher: [Read original article]() Author: Shai Almog Published: 2017-10-02T00:00:00Z Content type: tutorial Language: en Sources: [CodeName One]() Topics: [API](), [ui](), [twilio api](), [Android](), [interception](), [SDKs]() Tags: [android](), [api](), [app](), [code](), [interception](), [json](), [rest](), [simulator](), [svg](), [transcoder](), [twilio-api](), [ui](), [ui-ux]() ### AI overview A tutorial on combining Twilio REST SMS calls with Android SMS interception into a single builder-based API for an SMS activation flow. It explains how the builder exposes a customizable UI while hiding implementation details, including country selection and flag assets. ### Source excerpt I wrote two posts about the SMS activation process. In the first I discussed using the Twilio API via REST and in the second I discussed the native interfaces for SMS interception we can use in Android. Now it's time to put this all together and create a single API that's fluid. It should include the full UI process but be flexible enough to let you design your own experience.