This article describes a novel Firefox extension, "Electric Eye," designed to detect Adversary-in-the-Middle (AitM) phishing proxies in real time by analyzing anomalies across DNS, HTTP headers, TLS certificates, and DOM content mismatches. The detection engine is written in Rust and compiled to WebAssembly for performance and security, with a minimal JavaScript interface. The tool has demonstrated high efficacy in testing against live Evilginx deployments with zero false positives on major legitimate sites, though it currently flags some CDN-heavy sites due to proxy-like headers.
I built a Firefox extension to detect Adversary-in-the-Middle attacks in real time. The core idea: instead of chasing blacklists (a losing game when domains cost $3), look at what the proxy cannot easily hide. Detection runs across four layers: - DNS: entropy, punycode/homograph, typosquatting, subdomain anomalies - HTTP headers: missing CSP/HSTS, proxy header signatures - TLS: certificate age anomalies - DOM: MutationObserver scanning for domain mismatch between the current URL and page content — this is the killer signal against Evilginx-style kits The engine is pure Rust compiled to WASM. JS is a deliberately thin interface layer only — a conscious security decision. Tested against a live Evilginx deployment: 1.00 CRITICAL. Zero false positives on 10+ legitimate sites including Google, Apple, PayPal, and several EU banks. There is a grey area — CDN-heavy sites (Amazon, PayPal) trigger ProxyHeaderDetected via CloudFront. Still working on a neater model for that. Full writeup: https://bytearchitect.io/network-security/Bypassing-MFA-with-Reverse-Proxies-Building-a-Rust-based-Firefox-Extension-to-Kill-AitM-Phishing/ Submitted to Mozilla Add-ons — pending review. Happy to discuss the detection model or the Rust/WASM architecture. submitted by /u/Reversed-Engineer-01 [link] [comments]