3

I have to analyse SSL traffic of an executable under Windows 10. This sounds trivial really, why not just use Burp suite?

Using Burp

Using Burp I setup an invisible proxy listenning on port 443 and redirecting to target host's IP. Then in Windows hosts file I add the line "127.0.0.1 ex.host.com". After adding Burp CA into Windows Trusted CA store it works well when I navigate to ex.host.com with Chrome.

But the application I have to analyse doesn't seem to take into account the computer trusted CA and I have the error "unknown_ca" in burp.

The app use OpenSSL and the OpenSSL code is embed in the exe (no DLL). Meaning that I also have no way to locate through the code in a debugger for instance.

What I need is to force the application to trust my Burp CA but I need a hint to do that.

Using oSpy

I tried using oSpy but after attaching oSpy to the target process It's stuck with the splash "Waiting for logging agent."

Improve this question

1 Answer 1

Reset to default
1

I'm not sure if this will solve your issue, but have you tried using Charles Proxy with SSL Proxying enabled? Charles can perform a man-in-the-middle attack and get the contents of the applications's web request if the application is not using certificate pinning.

I've only used the Mac version, but generally what you would do is install the Charles root certificate, enable SSL proxying for the host you want to listen to, and then begin recording network traffic and run the application.

If the host rejects the request, even after installing the root certificate and enabling SSL proxying, the server uses certificate pinning and the traffic cannot be intercepted with Charles.

I'm not familiar with Burp or the "unknown_ca" error. It's possible that you are setting up your SSL proxy properly with the application and the server is just rejecting the Burp certificate.

Improve this answer
2
  • 1
    It looks like the app (client side) is using certificate pinning. In this case how do I intercept packets ? I could use hooks but as I said oSpy isn't working and OpenSSL is bundled inside the app so I can't hook exported symbols of a dll for instance.
    – TinyMan
    Nov 19, 2016 at 17:27
  • 1
    @TinyMan thats bad luck. Did you have any success locating the pinned certificate? Maybe you can replace it.
    – Nordwald
    Apr 19, 2017 at 5:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.