Is it possible to intercept http requests and modify the data (eg replace content using regex) before it renders in the browser? If so, how?

Question

Today I stumbled upon Wireshark which is capable of intercepting all the network traffic on your PC. I was wondering if it is possible to modify data after a request (so the data that is sent back to the PC) and modify it using regex? Like replace words and patterns in the data before it is rendered in the browser? (Example: replace the word mad with happy or replace a whole website with "Stop procrastinating")

If this is possible:

• How should I implement it? What functions will be essential?
• Are there any open source libraries that will help me accomplish this?
• Are there any prior reading I should do before implementing this?

Note that the platform for this will be Windows and I'll try and do this in C++

Answer 1

You can use WinDivert (LGPL) for this purpose (disclaimer: WinDivert is my project). WinDivert is a user-mode API that lifts some kernel-mode WFP call-out driver functionality to user space.

The pseudo-code would look something like this:

HANDLE handle = DivertOpen(
    "inbound && "                // Inbound packets
    "tcp.SrcPort == 80 && "      // HTTP
    "tcp.PayloadLength > 0",     // Data
    0, 0, 0);
while (TRUE)
{
    // Capture a packet.
    DivertRecv(handle, buf, size, &addr, &len);

    // Modify the packet.
    ...

    // Re-inject modified packet.
    DivertSend(handle, buf, len, &addr, NULL);
}

Note that WinDivert is packet-level, so the HTTP stream may be split over multiple packets, which may complicate things.

Answer 2

What you're describing is called a "transparent proxy". (Assuming that you aren't modifying the browser). You'll generally need some help from the OS to get in between the browser and the network, or you need to implement the proxy in a separate router. In linux this can be accomplished with iptables. I imagine windows has a similar feature.