Sesame tunneling protocol for BugBuster
BugBuster is a Web Application testing service. It provides a WebKit based browser capable of automatically exploring Web Applications (by typing, clicking,...) and uncovering bugs along the way.
This repository contains the reference implementation of Sesame, the secure tunneling protocol used by BugBuster to access firewalled applications. It enables BugBuster users to test any applications hosted within their firewalled network.
Sesame is a client-server protocol implemented over secure WebSocket. The two main components of the protocol are the following:
The Sesame Server is hosted on https://sesame.bugbuster.com. It accepts connections from the Clients and from BugBuster.
When a BugBuster session is started all network traffic coming from BugBuster is tunneled through to the Sesame Client over an encrypted WebSocket secure connection.
The Sesame Client connects to the Server and acts as a network proxy for all traffic requests coming from the Server.
When BugBuster wants to connect to a TCP endpoint, the Server asks the Client to make the connection. Once established, all network traffic between BugBuster and the endpoint is tunneled through the Server and emitted by the Client.
npm install -g bugbuster
Assume a BugBuster user wants to test a Web Application hosted on its laptop at the URL
http://localhost. Here is how to make it happen with Sesame:
The user starts the Sesame Client on its laptop via the BugBuster npm module:
bugbuster --apiKey USER_API_KEY --tenant USER_TENANT_ID
USER_TENANT_ID are available from BugBuster's settings panel.
The user creates a new BugBuster scenario connecting to
http://localhost and starts a new testing session
BugBuster requests connection to
http://localhost to the Sesame Server
The Sesamer Server forwards the request to the Client via the encrypted WebSocket connection
The Sesame Client running on the user's laptop opens a connection to
localhost on port 80
The tunnel is established and BugBuster can now freely talk to the application running on the user's laptop. All the traffic between BugBuster and the Sesame Client is securly encrypted.
The previous sequence works for any host within the reach of the machine running the Sesame Client. For instance, if the user has access to
http://192.168.20.10, which is a application hosted privately within the user's network, using the Sesame Client will enable BugBuster to connect to this application.