Lying to the Attacker Before They Ever Reach You

Every attack starts with reconnaissance, and reconnaissance starts with a question: what is this thing built on? A response header naming the web server, a cookie that betrays the framework, a forgotten HTML comment left by a developer three years ago. From those fragments an attacker assembles a picture of the target and selects the exploits worth trying. CLay, short for Concealment Layer, is built on a simple and mischievous premise. If attackers will believe what your server tells them, tell them something else.

CLay is a reverse proxy that sits in front of a web application and rewrites what it reveals about itself. It strips the informative response headers and HTML comments that leak implementation details, then goes further than conventional hardening by actively fabricating a false identity. A Django application can be made to answer like PHP running on Nginx. A Flask service can present itself as Microsoft ASP.NET behind Apache. The proxy adds decoy headers, plants dummy HTML comments, issues decoy cookies, and swaps error templates so that even a stack trace tells the wrong story. Currently it can impersonate PHP, Laravel, Microsoft ASP.NET, Flask, and Django, served by Nginx or Apache HTTP Server, and it can filter requests by user agent along the way.

The value is not that this stops an attack. It does not, and no serious practitioner would claim otherwise. What it does is corrupt the attacker’s intelligence at the very first step. Someone who believes they are facing ASP.NET will spend their time on exploits that were never going to work, and every failed attempt against a framework that isn’t there is noise in your logs that looks nothing like a legitimate user. That is the logic of deception technology in miniature, imposing cost and uncertainty on the adversary rather than trying to build a wall high enough to stop them.

Technically it is approachable. CLay is written in Python and built on mitmproxy, the intercepting proxy that handles HTTP/1, HTTP/2, and WebSockets, with Jinja driving its templating. Installation is a pip install, configuration is generated interactively into a JSON file, and it runs as a systemd service or a Docker container, with TLS supported through a PEM certificate. It was featured at Black Hat Asia Arsenal in 2024.

Where This Meets the Curriculum

CLay is best understood by students who have already done reconnaissance themselves. Network Penetration Testing teaches information gathering and enumeration, the exact phase this tool is designed to poison, and there is no faster way to appreciate why banner grabbing matters than to watch a target lie to you convincingly. Server and Network Administration covers the deployment and reverse proxy layer where a tool like this lives, while its log output feeds directly into the detection work a SOC analyst does. It is also worth studying as a lesson in defense in depth: deception is a layer, not a substitute for patching, and a beautifully disguised vulnerable application is still a vulnerable application.

Explore CLay

Repository: github.com/kisanakkkkk/CLay
User Guide: Usage.md