Full Disclosure mailing list archives
Re: MiTM with https there are any tools ?
From: Mark Coleman <markc () uniontown com>
Date: Mon, 06 Mar 2006 09:15:21 -0500
Just discovered that last link for Achilles was a bad link, but here's a description of what it does (or did)...
"Achilles is a tool designed for testing the security of web applications. Achilles is a proxy server, which acts as a man-in-the-middle during an HTTP session. A typical HTTP proxy will relay packets to and from a client browser and a web server. Achilles will intercept an HTTP session’s data in either direction and give the user the ability to alter the data before transmission. For example, during a normal HTTP SSL connection a typical proxy will relay the session between the server and the client and allow the two end nodes to negotiate SSL. In contrast, when in intercept mode, Achilles will pretend to be the server and negotiate two SSL sessions, one with the client browser and another with the web server. As data is transmitted between the two nodes, Achilles decrypts the data and gives the user the ability to alter and/or log the data in clear text before
transmission." -Mark C. Vincent Archer wrote:
On Mon, Mar 06, 2006 at 08:34:11AM -0300, Alehandro Dias wrote:I need to conduct a test to get the unencrypted https traffic from a source, but dont know if there are any tools to do that. I am able to fake a dns entry, so he thinks i am [1]www.hotmail.com (example). There are tools to setup a fake weserver (or proxy) that will redirect the queries to the true website, storing the clear data ? I imagine ettercap dont help in this situation. ThnxStandard tools, not to my knowledge. We do have a web proxy that does MITM for https traffic (with re-signing of site certificates once validated with our own CA which is added to local browsers), but that's not a publically available tool (it is still in beta, and will be added to our product catalog fairly soon). If you control the destination, and have access to the SSL key used by the server, you can use the ssldump utility ( http://www.rtfm.com/ssldump/ ) to decrypt a tcpdump capture of the SSL traffic. Ettercap looks like it has the ssldump feature integrated, but, again, you do need to have the SSL key of the server to decipher the session.
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- MiTM with https there are any tools ? Alehandro Dias (Mar 06)
- Re: MiTM with https there are any tools ? Vincent Archer (Mar 06)
- Re: MiTM with https there are any tools ? Rik Bobbaers (Mar 06)
- Re: MiTM with https there are any tools ? Dave Aitel (Mar 06)
- Re: MiTM with https there are any tools ? Mark Coleman (Mar 06)
- Re: MiTM with https there are any tools ? Security Lists (Mar 06)
- Re: MiTM with https there are any tools ? Brendan Dolan-Gavitt (Mar 06)
- RE: MiTM with https there are any tools ? Rui Pereira (WCG) (Mar 06)
- Re: MiTM with https there are any tools ? Brendan Dolan-Gavitt (Mar 06)
- Re: MiTM with https there are any tools ? Francisco Amato (Mar 06)
- Re: MiTM with https there are any tools ? Claes Nyberg (Mar 07)
- Re: MiTM with https there are any tools ? Fósforo (Mar 08)
- Re: MiTM with https there are any tools ? Vincent Archer (Mar 06)