1

I've got a bunch of IoT devices that can only be controlled through the Internet, as all their traffic goes through their own "cloud" server. I want to reclaim full control and low latency on my AC unit.

The device doesn't offer a way to configure a proxy.

I am considering the following:

  • install PiHole on my network (I want that for other reasons too)
  • get PiHole to snitch what DNS queries the device is making
  • configure PiHole to hijack the control server name and route http requests to a server of mine
  • have this server log all the traffic an pass it through to the legit control server
  • then reverse engineer this logged traffic and implement my own control server

This is going to work only if the device is making http requests to a domain name (and not if it is making them directly to an ip adress). Https could be an issue too.

Does any software exist already, with the kind of MITM features I am looking for: copy and dump the http traffic? Anything simpler than the above?

2
  • 2
    I assume the device connects to Internet through your network (wifi or ethernet). In this case I would pair the device with dummy wifi network, and then redirect all the packets to your computer via wifi proxy with software like Burp Suite, that allows sniff and intercept packets out of the box. It can also work with https if the device doesn't check if the server certificate is correct.
    – morsisko
    Jul 11 '20 at 13:33
  • That makes sense, thanks. Now, I'm willing to build a longer term solution with my 8 AC units scattered around my house, connected onto a meshed wifi setup. The wifi pairing process is a PITA, and I don't think I'll be able to put them all in the range of one single access point. If it was only about reverse engineering, I would probably do what you say with one AC unit; but when I'm done, I want to run a custom control server replica, and I feel like it will work smoother the way I 'm thinking.
    – dotvav
    Jul 11 '20 at 14:58
1

Does any software exist already, with the kind of MITM features I am looking for: copy and dump the http traffic? Anything simpler than the above?

Yes, you could put your IoT devices behind a system acting as their router. This way, all of their internet-bound traffic traversers the router, and you can monitor everything passively from there. The router can serve DNS, which you will be able to customize to do what you'd like. On the router, you could run a simple packet capture with tcpdump, intercept HTTP using mitmproxy, and/or redirect all traffic to a server of your choice.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.