diff --git a/README.md b/README.md
index 2cfb21c8..f6b8aa7e 100644
--- a/README.md
+++ b/README.md
@@ -1,2 +1,69 @@
-# HolyUB
- A website that can be used to bypass web filters; both online and firewall.
+# Alloy Proxy
+
+A node.js proxy that features URL encoding, and amazing compatablity!
+
+[](https://heroku.com/deploy?template=https://github.com/titaniumnetwork-dev/alloyproxy/)
+
+# How to install and use:
+
+`git clone https://github.com/titaniumnetwork-dev/alloyproxy.git`
+
+`cd alloyproxy`
+
+`npm install`
+
+`npm start`
+
+The default place for the proxy when its started is `http://localhost:8080` but feel free to change it in config.json!
+
+# How the proxy works:
+
+The proxy works by using node-fetch (Basically Window.fetch ported to Node-js).
+Basically what the app is doing is node-fetch is sending the request to the server then
+the app sends the response back to the server with the modifactions made to the attributes and elements.
+
+When a attribute is rewritten, depending on the contents inside. It will turn:
+
+`href="/assets/js/main.js"` into `href="/fetch/websiteURL/assets/js/main.js"`.
+
+A porition of its rewriting is in client-side JS so `Element.setAttribute`, `window.fetch()`, XMLHttpRequest, and more are rewritten.
+
+# Extra information:
+
+If your gonna have an external website redirect to this proxy. Then we recommend you have the value base64 encoded and redirected to `/alloy?url=` then value.
+
+# Deploying to Heroku:
+
+If your gonna be hosting this on something like Heroku. You need to make sure SSL mode is turned off so this will work.
+
+# Known websites that work
+
+- Google Search
+
+- Discord
+
+- LittleBigSnake
+
+- Surviv.io
+
+- Youtube
+
+- Y8
+
+- 1v1.LOL
+
+- Old Reddit
+
+and plenty more!
+
+# Known issues that need to be fixed
+
+- Better POST body parsing instead of using body-parser.
+
+- Cookie header rewriting
+
+# Updates to come in the future
+
+- Full URL encoding / encryption mode
+
+- Websocket proxing
diff --git a/alloy/assets/error.html b/alloy/assets/error.html
new file mode 100644
index 00000000..3577583a
--- /dev/null
+++ b/alloy/assets/error.html
@@ -0,0 +1,88 @@
+
+
+
+
+
+
+
+
+
+
AlloyProxy
+
+
%ERROR%
+
+
\ No newline at end of file
diff --git a/alloy/assets/inject.js b/alloy/assets/inject.js
new file mode 100644
index 00000000..76c28bac
--- /dev/null
+++ b/alloy/assets/inject.js
@@ -0,0 +1,209 @@
+// Ajax Rewriting
+
+let apData = document.getElementById('alloyData');
+let urlData = apData.getAttribute('data-alloyURL');
+
+
+function rewriteURL(url, encoding) {
+ var websiteURL
+ if (encoding == 'base64') {
+ websiteURL = btoa(url.split('/').splice(0, 3).join('/'))
+ } else {
+ websiteURL = url.split('/').splice(0, 3).join('/')
+ }
+ const path = '/' + url.split('/').splice(3).join('/')
+ var rewritten
+ if (path == '/') {
+ rewritten = '/fetch/' + websiteURL
+ } else {
+ rewritten = `/fetch/${websiteURL}${path}`
+ }
+ return rewritten
+}
+let ajaxRewrite = window.XMLHttpRequest.prototype.open;window.XMLHttpRequest.prototype.open = function(method, url, async, user, password) {
+ if (url.startsWith(`${window.location.protocol}//${window.location.hostname}`) && !url.startsWith(`${window.location.protocol}//${window.location.hostname}/fetch/`)) {
+ url = `/fetch/${urlData}/` + url.split('/').splice(3).join('/')
+ } else if (url.startsWith('http')) {
+ const hostname = url.split('/').slice(0, 3).join('/')
+ const path = url.split('/').slice(3).join('/')
+ const encodedHost = btoa(hostname)
+ const fullURL = encodedHost + '/' + path
+ url = '/fetch/' + fullURL
+ } else if (url.startsWith('//')) {
+ const encodedURL = btoa('http:' + url)
+ url = '/alloy/?url=' + encodedURL
+ } else if (url.startsWith('/')) {
+ if (url.startsWith('/fetch')) {
+ url = url
+ } else if (url.startsWith('/alloy')) {
+ url = url
+ } else {
+ let apData = document.getElementById('alloyData');
+ let urlData = apData.getAttribute('data-alloyURL');
+ url = '/fetch/' + urlData + url
+ }
+ }
+
+
+ return ajaxRewrite.apply(this, arguments);
+ }
+
+ let windowFetchRewrite = window.fetch;window.fetch = function(url) {
+ if (url.startsWith(`https://${window.location.hostname}`)) {
+ url = url
+ } else if (url.startsWith('http')) {
+ const hostname = url.split('/').slice(0, 3).join('/')
+ const path = url.split('/').slice(3).join('/')
+ const encodedHost = btoa(hostname)
+ const fullURL = encodedHost + '/' + path
+ url = '/fetch/' + fullURL
+ } else if (url.startsWith('//')) {
+ const encodedURL = btoa('http:' + url)
+ url = '/alloy/?url=' + encodedURL
+ } else if (url.startsWith('/')) {
+ if (url.startsWith('/fetch')) {
+ url = url
+ } else if (url.startsWith('/alloy')) {
+ url = url
+ } else {
+ let apData = document.getElementById('alloyData');
+ let urlData = apData.getAttribute('data-alloyURL');
+ url = '/fetch/' + urlData + url
+ }
+ }
+ return windowFetchRewrite.apply(this, arguments);
+ }
+
+
+
+ //Create Element rewriting
+ var original = document.createElement;
+ document.createElement = function (tag) {
+ var element = original.call(document, tag);
+ if (tag.toLowerCase() === 'script') {
+ Object.defineProperty(element.__proto__, 'src', {
+ set: function(newValue) {
+ if (newValue.startsWith('/fetch/')) {
+ element.setAttribute('src', newValue)
+ } else if (newValue.startsWith('/alloy/')) {
+ element.setAttribute('src', newValue)
+ } else if (newValue.startsWith(`https://${window.location.hostname}`)) {
+ element.setAttribute('src', newValue)
+ } else if (newValue.startsWith('//')) {
+ const encodedURL = btoa('http:' + newValue)
+ element.setAttribute('src', '/alloy/?url=' + encodedURL)
+ } else if (newValue.startsWith('https://')) {
+ const encodedURL = btoa(newValue)
+ element.setAttribute('src', '/alloy/?url=' + encodedURL)
+ } else if (newValue.startsWith('http://')) {
+ const encodedURL = btoa(newValue)
+ element.setAttribute('src', '/alloy/?url=' + encodedURL)
+ } else if (newValue.startsWith('/')) {
+ element.setAttribute('src', '/fetch/' + urlData + newValue)
+ } else {
+ element.setAttribute('src', newValue)
+ }
+ }
+ });
+ } else if (tag.toLowerCase() === 'iframe') {
+ Object.defineProperty(element.__proto__, 'src', {
+ set: function(newValue) {
+ if (newValue.startsWith('/fetch/')) {
+ element.setAttribute('src', newValue)
+ } else if (newValue.startsWith('/alloy/')) {
+ element.setAttribute('src', newValue)
+ } else if (newValue.startsWith(`https://${window.location.hostname}`)) {
+ element.setAttribute('src', newValue)
+ } else if (newValue.startsWith('//')) {
+ const encodedURL = btoa('http:' + newValue)
+ element.setAttribute('src', '/alloy/?url=' + encodedURL)
+ } else if (newValue.startsWith('https://')) {
+ const encodedURL = btoa(newValue)
+ element.setAttribute('src', '/alloy/?url=' + encodedURL)
+ } else if (newValue.startsWith('http://')) {
+ const encodedURL = btoa(newValue)
+ element.setAttribute('src', '/alloy/?url=' + encodedURL)
+ } else if (newValue.startsWith('/')) {
+ element.setAttribute('src', '/fetch/' + urlData + newValue)
+
+ } else {
+ element.setAttribute('src', newValue)
+ }
+ }
+ });
+ }
+ else if (tag.toLowerCase() === 'link') {
+ Object.defineProperty(element.__proto__, 'href', {
+ set: function(newValue) {
+ if (newValue.startsWith('/fetch/')) {
+ element.setAttribute('href', newValue)
+ } else if (newValue.startsWith('/alloy/')) {
+ element.setAttribute('href', newValue)
+ } else if (newValue.startsWith(`https://${window.location.hostname}`)) {
+ element.setAttribute('href', newValue)
+ } else if (newValue.startsWith('//')) {
+ const encodedURL = btoa('http:' + newValue)
+ element.setAttribute('href', '/alloy/?url=' + encodedURL)
+ } else if (newValue.startsWith('https://')) {
+ const encodedURL = btoa(newValue)
+ element.setAttribute('href', '/alloy/?url=' + encodedURL)
+ } else if (newValue.startsWith('http://')) {
+ const encodedURL = btoa(newValue)
+ element.setAttribute('href', '/alloy/?url=' + encodedURL)
+ } else if (newValue.startsWith('/')) {
+ element.setAttribute('href', '/fetch/' + urlData + newValue)
+
+ } else {
+ element.setAttribute('href', newValue)
+ }
+ }
+ });
+ }
+ return element;
+ }
+
+
+ let setAttributeRewrite = window.Element.prototype.setAttribute;window.Element.prototype.setAttribute = function(name, value) {
+ switch(name) {
+ case 'src':
+ if (value.startsWith('/fetch/')) {
+ value = value
+ } else if (value.startsWith('/alloy/')) {
+ value = value
+ } else if (value.startsWith('//')) {
+ value = rewriteURL('http:' + value, 'base64')
+ } else if (value.startsWith('/')) {
+ value = rewriteURL(urlData + value)
+ break;
+ } else if (value.startsWith('https://') || value.startsWith('http://')) {
+ value = rewriteURL(value, 'base64')
+ } else {
+ value = value
+ }
+ break;
+ case 'href':
+ if (value.startsWith('/fetch/')) {
+ value = value
+ } else if (value.startsWith('//')) {
+ value = rewriteURL('http:' + value, 'base64')
+ } else if (value.startsWith('/')) {
+ value = rewriteURL(urlData + value)
+ break;
+ } else if (value.startsWith('https://') || value.startsWith('http://')) {
+ value = rewriteURL(value, 'base64')
+ } else {
+ value = value
+ }
+ break;
+ }
+
+
+ return setAttributeRewrite.apply(this, arguments);
+ }
+
+ var previousState = window.history.state;
+ setInterval(function() {
+ if (!window.location.pathname.startsWith(`/fetch/${urlData}/`)) {
+ history.replaceState('', '', `/fetch/${urlData}/${window.location.href.split('/').splice(3).join('/')}`);
+ }
+ }, 0.1);
\ No newline at end of file
diff --git a/app.js b/app.js
index 3814769e..08442b89 100644
--- a/app.js
+++ b/app.js
@@ -1,79 +1,334 @@
-/***************
- * node-unblocker: Web Proxy for evading firewalls and content filters,
- * similar to CGIProxy or PHProxy
- *
- *
- * This project is hosted on github: https://github.com/nfriedly/nodeunblocker.com
- *
- * By Nathan Friedly - http://nfriedly.com
- * Released under the terms of the Affero GPL v3
- */
-
-var url = require('url');
-var querystring = require('querystring');
+var https = require('https');
+var http = require('http');
+var fetch = require('node-fetch');
var express = require('express');
-var unblocker = require('unblocker');
-var Transform = require('stream').Transform;
-
+var fs = require('fs');
var app = express();
+var cookieParser = require('cookie-parser');
+var session = require('express-session');
-var google_analytics_id = process.env.GA_ID || null;
+var config = JSON.parse(fs.readFileSync('config.json', 'utf-8')),
+ httpsAgent = new https.Agent({
+ rejectUnauthorized: false,
+ keepAlive: true,
+ }),
+ httpAgent = new http.Agent({
+ rejectUnauthorized: false,
+ keepAlive: true,
+ }),
+ ssl = { key: fs.readFileSync('ssl/default.key', 'utf8'), cert: fs.readFileSync('ssl/default.crt', 'utf8') },
+ server,
+ port = process.env.PORT || config.port,
+ ready = (() => {
+ var a = 'http://', b = config.listenip;
+ if (config.ssl) a = 'https://';
+ if (b == '0.0.0.0' || b == '127.0.0.1') b = 'localhost';
+ console.log('AlloyProxy is now running at', a + b + ':' + port);
+ });
-function addGa(html) {
- if (google_analytics_id) {
- var ga = [
- ""
- ].join("\n");
- html = html.replace("
", ga + "\n\n");
- }
- return html;
-}
+http.globalAgent.maxSockets = Infinity;
+https.globalAgent.maxSockets = Infinity;
-function googleAnalyticsMiddleware(data) {
- if (data.contentType == 'text/html') {
+if (config.ssl) server = https.createServer(ssl, app).listen(port, config.listenip, ready);
+else server = http.createServer(app).listen(port, config.listenip, ready);
- // https://nodejs.org/api/stream.html#stream_transform
- data.stream = data.stream.pipe(new Transform({
- decodeStrings: false,
- transform: function(chunk, encoding, next) {
- this.push(addGa(chunk.toString()));
- next();
- }
- }));
- }
-}
+app.use(cookieParser());
+app.use(session({
+secret: 'alloy',
+saveUninitialized: true,
+resave: true
+}));
-var unblockerConfig = {
- prefix: '/call/',
- responseMiddleware: [
- googleAnalyticsMiddleware
- ]
-};
-
-
-
-// this line must appear before any express.static calls (or anything else that sends responses)
-app.use(unblocker(unblockerConfig));
-
-// serve up static files *after* the proxy is run
-app.use('/', express.static(__dirname + '/public'));
-
-// this is for users who's form actually submitted due to JS being disabled or whatever
-app.get("/b", function(req, res) {
- // grab the "url" parameter from the querystring
- var site = querystring.parse(url.parse(req.url).query).url;
- // and redirect the user to /proxy/url
- res.redirect(unblockerConfig.prefix + site);
+app.use((req, res, next)=>{
+ // nice bodyparser alternative that wont cough up errors
+
+ req.setEncoding('utf8');
+ req.raw_body = ''
+ req.body = new Object()
+
+ req.on('data', chunk=>{ req.raw_body += chunk });
+
+ req.on('end', ()=>{
+ req.str_body = req.raw_body.toString('utf8');
+
+ try{
+ var result = new Object();
+
+ req.str_body.split('&').forEach((pair)=>{
+ pair = pair.split('=');
+ req.body[pair[0]] = decodeURIComponent(pair[1] || '');
+ });
+ }catch(err){
+ req.body = {}
+ }
+
+ return next();
+ });
});
-// for compatibility with gatlin and other servers, export the app rather than passing it directly to http.createServer
-module.exports = app;
\ No newline at end of file
+function base64Encode(data) {
+ return new Buffer.from(data).toString('base64')
+}
+
+// How to use: base64Decode('string') will return any input base64 decoded
+function base64Decode(data) {
+ return new Buffer.from(data, 'base64').toString('ascii')
+}
+
+// How to use: rewritingURL('https://example.org/assets/main.js') will rewrite any external URL. Output: aHR0cHM6Ly9leGFtcGxlLm9yZw==/assets/main.js
+function rewriteURL(dataURL, option) {
+ var websiteURL
+ var websitePath
+ if (option == 'decode') {
+ websiteURL = base64Decode(dataURL.split('/').splice(0, 1).join('/'))
+ websitePath = '/' + dataURL.split('/').splice(1).join('/')
+ } else {
+ websiteURL = base64Encode(dataURL.split('/').splice(0, 3).join('/'))
+ websitePath = '/' + dataURL.split('/').splice(3).join('/')
+ }
+ if (websitePath == '/') {
+ return `${websiteURL}`
+ } else return `${websiteURL}${websitePath}`
+}
+
+// To be used with res.send() to send error. Example: res.send(error('404', 'No valid directory or file was found!'))
+function error(statusCode, info) {
+ if (statusCode && info) {
+ return fs.readFileSync('alloy/assets/error.html', 'utf8').toString().replace('%ERROR%', `Error ${statusCode}: ${info}`)
+ }
+ if (info && !statusCode) {
+ return fs.readFileSync('alloy/assets/error.html', 'utf8').toString().replace('%ERROR%', `Error: ${info}`)
+ }
+ if (statusCode && !info) {
+ return fs.readFileSync('alloy/assets/error.html', 'utf8').toString().replace('%ERROR%', `Error ${statusCode}`)
+ }
+ return fs.readFileSync('public/assets/error.html', 'utf8').toString().replace('%ERROR%', `An error has occurred!`)
+}
+
+app.post('/createSession', async (req, res) => {
+ if (req.body.url.startsWith('//')) {
+ req.body.url = 'http:' + req.body.url;
+ } else if (req.body.url.startsWith('https://') || req.body.url.startsWith('http://')) {
+ req.body.url = req.body.url;
+ } else {
+ req.body.url = 'http://' + req.body.url;
+ }
+ if (req.body.rv) {
+ req.session.rvURL = String(req.body.url).split('/').splice(0, 3).join('/')
+ return res.redirect('/fetch/rv/' + String(req.body.url).split('/').splice(3).join('/'))
+ } else {
+ return res.redirect('/fetch/' + rewriteURL(String(req.body.url)))
+ }
+})
+
+var prefix = '/fetch';
+
+app.use(prefix, async (req, res, next) => {
+ var location = rewriteURL(req.url.slice(1), 'decode');
+ if (req.url.startsWith('/rv') && !req.session.rvURL) {
+ res.send(error('400', 'No valid session URL for reverse proxy mode was found!'))
+ }
+ if (req.url.startsWith('/rv') && req.session.rvURL) {
+ location = req.session.rvURL + req.url.slice(3)
+ }
+ location = {
+ href: location,
+ hostname : location.split('/').splice(2).splice(0, 1).join('/'),
+ origin : location.split('/').splice(0, 3).join('/'),
+ origin_encoded : base64Encode(location.split('/').splice(0, 3).join('/')),
+ path : '/' + location.split('/').splice(3).join('/'),
+ protocol : location.split('\:').splice(0, 1).join(''),
+ }
+ var httpAgent = new http.Agent({
+ keepAlive: true
+ });
+ var httpsAgent = new https.Agent({
+ keepAlive: true
+ });
+
+ var fetchHeaders = req.headers
+ fetchHeaders['referer'] = location.href
+ fetchHeaders['origin'] = location.origin
+ fetchHeaders['host'] = location.hostname
+ if (fetchHeaders['cookie']) {
+ delete fetchHeaders['cookie']
+ }
+ var options = {
+ method: req.method,
+ headers: fetchHeaders,
+ redirect: 'manual',
+ agent: function(_parsedURL) {
+ if (_parsedURL.protocol == 'http:') {
+ return httpAgent;
+ } else {
+ return httpsAgent;
+ }
+ }
+ };
+
+ if (req.method == 'POST') {
+ // Have to do try catch for this POST data parser until we create our own one that won't have a syntax error sometimes.
+ try {
+ // str_body is a string containing the requests body
+ options['body'] = req.str_body;
+ }catch(err){
+ return;
+ }
+ }
+ if (req.url.startsWith('/rv')) {
+ location.origin_encoded = 'rv'
+ }
+ if (!req.url.startsWith(`/${location.origin_encoded}/`)) {
+ try{
+ return res.redirect(307,`/fetch/${location.origin_encoded}/`)
+ }catch(err){
+ return;
+ }
+ }
+ if (location.href == 'https://discord.com' || location.href == 'https://discord.com/new') {
+ return res.redirect(307, `/fetch/${location.origin_encoded}/login`)
+ }
+ if (location.origin == 'https://www.reddit.com') {
+ if (req.url.startsWith('/rv') && req.session.rvURL) {
+ req.session.rvURL = 'https://old.reddit.com'
+ return res.redirect(307, '/fetch/rv' + location.path)
+ }
+ return res.redirect(307, '/fetch/' + base64Encode('https://old.reddit.com') + location.path)
+ }
+ const response = await fetch(location.href, options).catch(err => res.send(error('404', `"${location.href}" was not found!`)));
+ if(typeof response.buffer != 'function')return;
+ var resbody = await response.buffer();
+ var contentType = 'text/plain'
+
+ response.headers.forEach((e, i, a) => {
+ if (i == 'content-type') contentType = e;
+ });
+ if (contentType == null || typeof contentType == 'undefined') ct = 'text/html';
+ var serverHeaders = Object.fromEntries(
+ Object.entries(JSON.parse(JSON.stringify(response.headers.raw())))
+ .map(([key, val]) => [key, val[0]])
+ );
+ if (serverHeaders['location']) {
+ if (req.url.startsWith('/rv') && req.session.rvURL) {
+ req.session.rvURL = String(serverHeaders['location']).split('/').splice(0, 3).join('/')
+ return res.redirect(307, '/fetch/rv/' + String(serverHeaders['location']).split('/').splice(3).join('/'))
+ } else return res.redirect(307, '/fetch/' + rewriteURL(String(serverHeaders['location'])))
+ }
+ delete serverHeaders['content-encoding']
+ delete serverHeaders['x-frame-options']
+ delete serverHeaders['strict-transport-security']
+ delete serverHeaders['content-security-policy']
+ delete serverHeaders['location']
+ res.status(response.status)
+ res.set(serverHeaders)
+ res.contentType(contentType)
+ if (response.redirected == true) {
+ if (req.url.startsWith('/rv') && req.session.rvURL) {
+ req.session.rvURL = response.url.split('/').splice(0, 3).join('/')
+ return res.redirect(307, '/fetch/rv/' + response.url.split('/').splice(3).join('/'))
+ } else return res.redirect(307, '/fetch/' + rewriteURL(response.url))
+ }
+ if (contentType.startsWith('text/html')) {
+ req.session.fetchURL = location.origin_encoded
+ resbody = resbody.toString()
+ .replace(/integrity="(.*?)"/gi, '')
+ .replace(/nonce="(.*?)"/gi, '')
+ .replace(/(href|src|poster|data|action)="\/\/(.*?)"/gi, `$1` + `="http://` + `$2` + `"`)
+ .replace(/(href|src|poster|data|action)='\/\/(.*?)'/gi, `$1` + `='http://` + `$2` + `'`)
+ .replace(/(href|src|poster|data|action)="\/(.*?)"/gi, `$1` + `="/fetch/${location.origin_encoded}/` + `$2` + `"`)
+ .replace(/(href|src|poster|data|action)='\/(.*?)'/gi, `$1` + `='/fetch/${location.origin_encoded}/` + `$2` + `'`)
+ .replace(/'(https:\/\/|http:\/\/)(.*?)'/gi, function(str) {
+ str = str.split(`'`).slice(1).slice(0, -1).join(``);
+ return `'/fetch/${rewriteURL(str)}'`
+ })
+ .replace(/"(https:\/\/|http:\/\/)(.*?)"/gi, function(str) {
+ str = str.split(`"`).slice(1).slice(0, -1).join(``);
+ return `"/fetch/${rewriteURL(str)}"`
+ })
+ .replace(/(window|document).location.href/gi, `"${location.href}"`)
+ .replace(/(window|document).location.hostname/gi, `"${location.hostname}"`)
+ .replace(/(window|document).location.pathname/gi, `"${location.path}"`)
+ .replace(/location.href/gi, `"${location.href}"`)
+ .replace(/location.hostname/gi, `"${location.hostname}"`)
+ .replace(/location.pathname/gi, `"${location.path}"`)
+ .replace(/