Darknet – The Darkside

Proxocket is a dll proxy project for the main Winsock functions which allows to capture any type of packet and data sent/received by a specific software of your choice and optionally modifying its content or the connect, bind and accept functions through a custom dll very easy to create.

Proxocket handles the following functions for both ws2_32.dll and wsock32.dll:

• WSAStartup,
• socket,
• WSASocketA,
• WSASocketW,
• closesocket,
• connect,
• WSAConnect,
• bind,
• accept,
• WSAAccept,
• recv,
• recvfrom,
• WSARecv,
• WSARecvFrom,
• WSARecvEx,
• send,
• sendto,
• WSASend,
• & WSASendTo.

It has also specific support for TCP, UDP, ICMP, IGMP and RAW packets with handling of SOCK_STREAM, SOCK_DGRAM and SOCK_RAW on both incoming and outgoing data.

The project is divided in two parts:

1. monitoring/sniffing: a CAP file in tcpdump format will be generated for any captured packet, this is the default operation
2. user’s custom manipulation of the captured data: through a custom myproxocket.dll edited and created by the same user is possible to have control over the captured data like creating a rudimental firewall for a specific software or editing the data which will be passed to the main program on the fly or creating a decompressor/decrypter/protocol_analyzer and so on

Read the text file inside for more information and if you want to write a plugin take a look at the source code ofthe myproxocket.c example.

The following are some “example plugins” the author wrote for proxyfying the main program and or doing some things:

• web proxy forcer 0.1: works like a classical web proxyfier
• web proxy forcer mode2 0.1: works like a classical web proxyfier
• connect proxy forcer 0.1: works like a CONNECT proxyfier

NOTE: If you have Vista and the local ws2_32/wsock32 dlls are not loaded try to set the registry key “HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Image File Execution Options\DevOverrideEnable” to 1.
NOTE: The exported functions of myproxocket.dll MUST be declared as CDECL, this is default on Mingw but not on other compilers.
NOTE: Do NOT use Cygwin for compiling the myproxocket plugins.

There’s some good information on how to use Proxocket here.

You can download Proxocket here:

proxocket.zip

Or read more here.