Re: [Full-disclosure] MiTM with https there are any tools ?



Just discovered that last link for Achilles was a bad link, but here's a description of what it does (or did)...

"Achilles is a tool designed for testing the security of web applications. Achilles is a proxy
server, which acts as a man-in-the-middle during an HTTP session. A typical HTTP
proxy will relay packets to and from a client browser and a web server. Achilles will
intercept an HTTP session’s data in either direction and give the user the ability to alter
the data before transmission. For example, during a normal HTTP SSL connection a
typical proxy will relay the session between the server and the client and allow the two
end nodes to negotiate SSL. In contrast, when in intercept mode, Achilles will pretend to
be the server and negotiate two SSL sessions, one with the client browser and another
with the web server. As data is transmitted between the two nodes, Achilles decrypts the
data and gives the user the ability to alter and/or log the data in clear text before
transmission."

-Mark C.




Vincent Archer wrote:
On Mon, Mar 06, 2006 at 08:34:11AM -0300, Alehandro Dias wrote:
I need to conduct a test to get the unencrypted https traffic from a
source, but dont know if there are any tools to do that.
I am able to fake a dns entry, so he thinks i am [1]www.hotmail.com
(example).
There are tools to setup a fake weserver (or proxy) that will redirect
the queries to the true website, storing the clear data ?
I imagine ettercap dont help in this situation.
Thnx

Standard tools, not to my knowledge.

We do have a web proxy that does MITM for https traffic (with re-signing
of site certificates once validated with our own CA which is added to
local browsers), but that's not a publically available tool (it is still
in beta, and will be added to our product catalog fairly soon).

If you control the destination, and have access to the SSL key used by the
server, you can use the ssldump utility ( http://www.rtfm.com/ssldump/ )
to decrypt a tcpdump capture of the SSL traffic.

Ettercap looks like it has the ssldump feature integrated, but, again, you
do need to have the SSL key of the server to decipher the session.


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



Relevant Pages

  • Re: RPC Over HTTP (External)
    ... Oh Ok no SSL ... causing the RPC proxy server not to trust the connection. ... i set use HTTP first for fast connection. ...
    (microsoft.public.exchange.admin)
  • Re: ModSSL - Knoppix 3.3
    ... NameVirtualHosts and SSL don't mix. ... This automatically pushes an incorrect http request to the secure host over ... > I create some server key & crt. ...
    (Focus-Linux)
  • Re: Security of IIS - Secure Intranet web site on SBS2003 box
    ... > take two days to rebuild their server and return everything to normal. ... > Before 'Code Red' IIS was considered reasonably secure. ... >> over HTTP via SSL for OUTLOOK-EXCHANGE links to users operating in the ...
    (microsoft.public.windows.server.sbs)
  • Re: Installing Certificates - Pulling My Hair Out
    ... Why would you do HTTP over ... the internet to the ISA Server then doe SSL tot he internal Web Server? ...
    (microsoft.public.isa.publishing)
  • RPC over HTTP
    ... Have setup another server sans SharePoint and am getting ... Get to login prompt, enter password, and login prompt ... Find several articles which say that SSL is ... but nothing specific to actually using HTTP ...
    (microsoft.public.exchange.connectivity)