Nginx/Lua MITM Proxy with DNS Interception

Overview

A Dockerized nginx/OpenResty proxy with Lua scripting and a bundled DNS resolver (dnsmasq), built to intercept and rewrite HTTP traffic at the request/response/log phases, a network-security research setup.

Why It Exists

Understanding and building with man-in-the-middle traffic handling, capturing, rewriting, and logging requests, is foundational network-security R&D. Combining a programmable HTTP layer with local DNS control allows transparent redirection of clients to the proxy.

What We Built

An nginx configuration enabling Lua at multiple lifecycle hooks, with per-phase scripts: init.lua, access.lua, rewrite.lua, content.lua, and log.lua, plus per-site config under sites/. A run.sh boots dnsmasq (for DNS interception/redirection) and nginx together inside the container; gzip and MIME handling are configured for transparent passthrough.

Technologies & Approach

OpenResty-style nginx + Lua for fully programmable request handling at each phase; dnsmasq to steer DNS so clients resolve targets to the proxy; Docker to package the whole interception stack reproducibly.

Outcome / Impact

A self-contained MITM/interception lab, demonstrating hands-on understanding of HTTP proxying internals, Lua scripting in the nginx request lifecycle, and DNS-level redirection. Archived R&D.

Capabilities Demonstrated

• Programmable HTTP interception and rewriting via nginx + Lua phases
• DNS-based traffic redirection with dnsmasq
• Containerized security/networking research environments