r/netsecstudents

I built a configurable HTTP MITM proxy in Rust focused on giving you full control over what an upstream connection looks like at the network level.

The main idea behind the project was that I didn't want another MITM proxy that simply tries to emulate Chrome, Firefox, or some other predefined browser. I wanted to be able to define the fingerprint myself - not just pick one of the profiles provided by a library.

A lot of existing solutions take the approach of providing ready-made browser fingerprints. That's convenient, but it also means that when a browser changes its TLS or HTTP/2 behavior, you're dependent on the library/project adding a new profile. I wanted the fingerprint to be configuration-driven instead, so the user can adjust individual parameters without waiting for a predefined browser profile.

The proxy currently gives control over several layers:

TLS: cipher suites, curves, signature algorithms, ALPN, GREASE, extension ordering, certificate compression, OCSP, SCT, session tickets, ALPS, ECH and other TLS parameters.

HTTP/2: SETTINGS values and ordering, flow-control windows, priority frames, pseudo-header ordering, HTTP header ordering and values.

HTTP/1.1: configurable upstream header ordering and rewriting.

TCP: SYN fingerprint rewriting through Linux NFQUEUE, including TTL, window size, MSS, window scale, DF and TCP option ordering.

Everything is driven by YAML profiles, and profiles can be overridden per domain based on SNI.

One of the things I specifically wanted to solve was keeping the different layers under the same configuration model. For example, the proxy negotiates TLS with the upstream server first and then uses the selected ALPN when setting up the browser-facing connection. HTTP/2 and TCP fingerprinting are configured for the same upstream connection as well.

The project is written in Rust using Tokio and BoringSSL via btls/tokio-btls. TCP fingerprinting currently requires Linux because it uses NFQUEUE/iptables.

The project is primarily about privacy, experimentation, and giving the user control over their own network behavior rather than trying to provide a fixed "browser impersonation" profile.

There is more detail in the repository, including separate documentation for the TLS, HTTP/2 and TCP layers, configuration examples, and implementation notes.

Feedback, especially from people who have worked with TLS/HTTP/2 fingerprinting, traffic analysis, or network privacy, would be very welcome.

We're building CarbonIt Labs, a nonprofit open-source community where people with different skills and interests can come together to build real projects.

And you don't have to be a cybersecurity expert or even a programmer to contribute.

A successful project needs much more than code.

We need people who can:

💻 Build the software

🎨 Design the UI/UX and graphics

🖌️ Create logos and branding

🧠 Research and explore new ideas

🔐 Work on cybersecurity and privacy

📝 Write documentation and tutorials

🧪 Test and improve software

📢 Help with communication and community

📦 Package and release projects

🚀 Help take an idea all the way from concept to a finished product

The goal is to create a community where different people bring different strengths, form teams, learn from each other, and contribute to open-source projects.

You might be a developer, designer, student, researcher, writer, tester, artist, cybersecurity enthusiast, or simply someone with an idea and the motivation to learn.

There should be a place for every kind of builder.

If you'd like to learn, contribute, collaborate, or build something from scratch with others, join us at:

👉 r/CarbonItLabs

Let's build projects together — from the first idea and first sketch to the final release.

Build. Collaborate. Open Source. 🚀

Hi, i am in an internship that teaches cybersecurity,Now i am in penetration testing track i need to make a project to me to graduate i know network exploitation and web exploitation what good ideas i can make we are team of 4 we dont know what good ideas we can make or should we make a tool i dont know if anyone can give me ideas to make i would be thankful.

I am looking at AI SOC and agentic SOC tools because our queue has become a part time lifestyle choice. Every vendor demo has the AI investigate alerts, enrich evidence, and resolve the obvious stuff while humans focus on the exciting task of explaining budget cuts. The part I'm stuck on is autonomous resolution. I'm fine with deduping, enrichment, and maybe blocking a known malicious IP. I'm less comfortable with agents taking high-impact actions like disabling accounts or isolating production, even at high confidence, without a human in the loop. How are people setting approval gates, audit trails, and rollback for this without turning the AI into another ticket queue with better branding? Would love real experiences, especially from teams that let it act in prod. From what I've seen, the better setups run investigation fully automated against a context graph, close confirmed false positives automatically with a documented rationale, and still require a human to approve consequential actions like isolation or account disablement. The guardrails are defined before anything runs, not bolted on after something goes wrong. If anyone has actually run it that way. thnxx..