WebApp Sec mailing list archives
RE: Security tool for monitoring HTTPS traffic?
From: "John Floyd" <john.floyd () us-kavado com>
Date: Thu, 26 Feb 2004 12:23:31 -0800
There are Application Layer firewalls which can inspect HTTPS traffic to assure that the communications coming in are not maliscious attacks via the web browser. These types of solutions will decrypt the traffic, inspect it, and then either re-encrypt or not, and send back to your web server. http://www.infoworld.com/article/04/02/06/06FEsecureapp_1.html Cheers John -----Original Message----- From: Altheide, Cory B. (IARC) [mailto:AltheideC () nv doe gov] Sent: Thursday, February 26, 2004 11:23 AM To: webappsec () securityfocus com Subject: RE: Security tool for monitoring HTTPS traffic?
-----Original Message----- From: John Reilly [mailto:JReilly () eSpatial com] Sent: Wednesday, February 25, 2004 2:19 AM To: webappsec () securityfocus com Subject: RE: Security tool for monitoring HTTPS traffic?I have a similar question too! Are they products they can look inside HTTPS traffic? Some customers
doesn't trust HTTPS traffic going inside the company over the proxy!There is no way to look at the plain text content inside the https traffic - that would defeat the whole purpose of https. Regards, John
This is false. If there were no way to look at the plain text content inside of HTTPS traffic it would be exceedingly difficult for the intended recipient to do anything useful with said HTTPS traffic (ie, one-way encryption). Cory Altheide Senior Network Forensics Specialist NNSA Information Assurance Response Center (IARC) altheidec () nv doe gov
Current thread:
- RE: Security tool for monitoring HTTPS traffic? John Reilly (Feb 26)
- Re: Security tool for monitoring HTTPS traffic? Thomas Chiverton (Feb 26)
- Re: Security tool for monitoring HTTPS traffic? lists AT dawes DOT za DOT net (Feb 26)
- <Possible follow-ups>
- RE: Security tool for monitoring HTTPS traffic? Altheide, Cory B. (IARC) (Feb 26)
- RE: Security tool for monitoring HTTPS traffic? John Reilly (Feb 26)
- Re: Security tool for monitoring HTTPS traffic? dd (Feb 26)
- RE: Security tool for monitoring HTTPS traffic? Glyn (Feb 26)
- RE: Security tool for monitoring HTTPS traffic? Satish Chandra Prasad (Feb 26)
- RE: Security tool for monitoring HTTPS traffic? John Floyd (Feb 26)
- Re: Security tool for monitoring HTTPS traffic? Imre Kertesz (Feb 26)
- Re: Security tool for monitoring HTTPS traffic? lists AT dawes DOT za DOT net (Feb 28)
- Re: Security tool for monitoring HTTPS traffic? Gary Flynn (Feb 28)
- Re: Security tool for monitoring HTTPS traffic? Imre Kertesz (Feb 26)
- RE: Security tool for monitoring HTTPS traffic? najeeb . hatami (Feb 28)
- RE: Security tool for monitoring HTTPS traffic? Amichai Shulman (Mar 07)
- RE: Security tool for monitoring HTTPS traffic? Yoram Zahavi (Mar 10)
- Re: Security tool for monitoring HTTPS traffic? Romain Vergniol (Mar 10)
- RE: Security tool for monitoring HTTPS traffic? David Wong (Mar 10)