full-disclosure - MiTM with https there are any tools ?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <440C3FCA.4060706@immunityinc.com>
Date: Mon Mar  6 15:46:52 2006
From: dave at immunityinc.com (Dave Aitel)
Subject: MiTM with https there are any tools ?

SPIKE Proxy does this and is Open Source and written in Python. You can 
get it off of our Resources page on www.immunityinc.com.

I've tested it against most of the webmail solutions as a stress 
test...it's a lot harder to write a http proxy than you might think. :>

As a side note, we've integrated it into our CANVAS product now, 
although minus the SSL functionality temporarily.
-dave


Vincent Archer wrote:
> On Mon, Mar 06, 2006 at 08:34:11AM -0300, Alehandro Dias wrote:
>   
>>    I need to conduct a test to get the unencrypted https traffic from a
>>    source, but dont know if there are any tools to do that.
>>    I am able to fake a dns entry, so he thinks i am [1]www.hotmail.com
>>    (example).
>>    There are tools to setup a fake weserver (or proxy) that will redirect
>>    the queries to the true website, storing the clear data ?
>>    I imagine ettercap dont help in this situation.
>>    Thnx
>>     
>
> Standard tools, not to my knowledge.
>
> We do have a web proxy that does MITM for https traffic (with re-signing
> of site certificates once validated with our own CA which is added to
> local browsers), but that's not a publically available tool (it is still
> in beta, and will be added to our product catalog fairly soon).
>
> If you control the destination, and have access to the SSL key used by the
> server, you can use the ssldump utility ( http://www.rtfm.com/ssldump/ )
> to decrypt a tcpdump capture of the SSL traffic.
>
> Ettercap looks like it has the ssldump feature integrated, but, again, you
> do need to have the SSL key of the server to decipher the session.
>
>