Sesame Secure Tunnel for BugBuster

BugBuster is a Web Application testing service. It provides a WebKit based browser capable of automatically exploring Web Applications (by typing, clicking,...) and uncovering bugs along the way.

This repository contains the reference implementation of Sesame, the secure tunneling protocol used by BugBuster to access firewalled applications. It enables BugBuster users to test any applications hosted within their firewalled network.

Architecture

Sesame is a client-server protocol implemented over secure WebSocket. The two main components of the protocol are the following:

The Server

The Sesame Server is hosted on https://sesame.bugbuster.com. It accepts connections from the Clients and from BugBuster.

When a BugBuster session is started all network traffic coming from BugBuster is tunneled through to the Sesame Client over an encrypted WebSocket secure connection.

The Client

The Sesame Client connects to the Server and acts as a network proxy for all traffic requests coming from the Server.

When BugBuster wants to connect to a TCP endpoint, the Server asks the Client to make the connection. Once established, all network traffic between BugBuster and the endpoint is tunneled through the Server and emitted by the Client.

This repository contains the reference implementation of the Sesame Client written in pure JavaScript. For an executable implementation of the Client, please install the bugbuster npm nodule:

npm install -g bugbuster

Example

Assume a BugBuster user wants to test a Web Application hosted on its laptop at the URL http://localhost. Here is how to make it happen with Sesame:

• The user starts the Sesame Client on its laptop via the BugBuster npm module:

    bugbuster --apiKey USER_API_KEY --tenant USER_TENANT_ID
  

  The USER_API_KEY and USER_TENANT_ID are available from BugBuster's settings panel.

• The user creates a new BugBuster scenario connecting to http://localhost and starts a new testing session

• BugBuster requests connection to http://localhost to the Sesame Server

• The Sesamer Server forwards the request to the Client via the encrypted WebSocket connection

• The Sesame Client running on the user's laptop opens a connection to localhost on port 80

• The tunnel is established and BugBuster can now freely talk to the application running on the user's laptop. All the traffic between BugBuster and the Sesame Client is securly encrypted.

The previous sequence works for any host within the reach of the machine running the Sesame Client. For instance, if the user has access to http://192.168.20.10, which is a application hosted privately within the user's network, using the Sesame Client will enable BugBuster to connect to this application.