Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Capturing HTTPS traffic in the clear?

Tags:

I've got a local application (which I didn't write, and can't change) that talks to a remote web service. It uses HTTPS, and I'd like to see what's in the traffic.

Is there any way I can do this? I'd prefer a Windows system, but I'm happy to set up a proxy on Linux if this makes things easier.

What I'm considering:

  1. Redirecting the web site by hacking my hosts file (or setting up alternate DNS).
  2. Installing an HTTPS server on that site, with a self-signed (but trusted) certificate.
  3. Apparently, WireShark can see what's in HTTPS if you feed it the private key. I've never tried this.
  4. Somehow, proxy this traffic to the real server (i.e. it's a full-blown man-in-the-middle "attack").

Does this sound sensible? Can WireShark really see what's in HTTPS traffic? Can anyone point me at a suitable proxy (and configuration for same)?

like image 426
Roger Lipscombe Avatar asked Jul 02 '09 08:07

Roger Lipscombe


People also ask

How does Fiddler intercept HTTPS?

A: Fiddler2 relies on a "man-in-the-middle" approach to HTTPS interception. To your web browser, Fiddler2 claims to be the secure web server, and to the web server, Fiddler2 mimics the web browser. In order to pretend to be the web server, Fiddler2 dynamically generates a HTTPS certificate.

Is it possible to sniff HTTPS traffic?

If you are talking about an external attacker which does only have access to the encrypted data packets (e.g. the internet access provider) the answer is NO. You can always redirect HTTPS traffic through a decrypting proxy which records all request and response data.

Can HTTPS traffic be decrypted?

You can define policies to decrypt HTTPS traffic from selected Web categories. While decrypted, data is treated the same way as HTTP traffic to which URL filtering and scanning rules can be applied. In addition, decrypted data is completely secure since it is still in the IWSVA server's memory.

Can Wireshark capture HTTPS traffic?

Wireshark has the ability to use SSLKEYLOGFILE to decrypt https traffic. This file is a feature provided by the web browser. When a Web Browser is configured to create and use this file all of the encryption keys created for that session are logged. This allows Wireshark to decrypt the traffic.


2 Answers

Does Fiddler do what you want?

What is Fiddler?

Fiddler is a Web Debugging Proxy which logs all HTTP(S) traffic between your computer and the Internet. Fiddler allows you to inspect all HTTP(S) traffic, set breakpoints, and "fiddle" with incoming or outgoing data. Fiddler includes a powerful event-based scripting subsystem, and can be extended using any .NET language.

Fiddler is freeware and can debug traffic from virtually any application, including Internet Explorer, Mozilla Firefox, Opera, and thousands more.

like image 69
AakashM Avatar answered Oct 30 '22 04:10

AakashM


Wireshark can definitely display TLS/SSL encrypted streams as plaintext. However, you will definitely need the private key of the server to do so. The private key must be added to Wireshark as an SSL option under preferences. Note that this only works if you can follow the SSL stream from the start. It will not work if an SSL connection is reused.

For Internet Explorer this (SSL session reuse) can be avoided by clearing the SSL state using the Internet Options dialog. Other environments may require restarting a browser or even rebooting a system (to avoid SSL session reuse).

The other key constraint is that an RSA cipher must be used. Wireshark can not decode TLS/SSL stream that use DFH (Diffie-Hellman).

Assuming you can satisfy the constraints above, the "Follow SSL Stream" right-click command works rather well.

like image 30
Peter Schaeffer Avatar answered Oct 30 '22 04:10

Peter Schaeffer