1

There are gazillions of internet resources discussing how to use Frida to hook and otherwise mess around with SSL connections of Java programs running under Android, but seemingly (as far as my google-fu allows at least?) not a single one discussing how to do this same successfully for Java programs running under Windows (which I would really need to do!).

Even the go-to ssl_logger Frida-based Python script in the Google Github repository lacks support for Windows (without mentioning why), but rather only contains hooks for Linux and macOS, which makes me wonder even more - is this "impossible" (== very hard) on Windows, contrary to on most other platforms, and in that case why?

If not, what would be the recommended way to do it with Frida?

PS. This Oracle resource hints of a DLL named "njssl8.dll" being used as a back-end for the Java SSL functionality on Windows, but frida-trace does not detect any modules containing the substring "ssl" at all when running with option -I "*ssl*" on my test target Burp Suite Community Edition (which I used because I had it handy and because it is very fitting for these kinds of tests).

Improve this question
3
  • Fiddler is commonly used for intercepting http/https traffic (not java specific): telerik.com/fiddler
    – Remko
    Commented Sep 16, 2019 at 22:15
  • 1
    A simple approach would be to just record the pre-master secrets and then use it to decrypt the data captured by Wireshark. See stackoverflow.com/a/62060488/150978 for details on Java and pre-master secret extraction.
    – Robert
    Commented May 8, 2021 at 16:41
  • Unless you have a requirement to use Frida, you can go with Fiddler to intercept SSL traffic. I use it and it's perfect.
    – ifexploit
    Commented Jan 3, 2022 at 7:53

2 Answers 2

Reset to default
2

That requires some research on your end.

Find out what API functions (not Java level) are used on a system level to deal with SSL. I could imagine that the Java runtime on Windows uses the Internet API or WinHttp or something comparable, or brings its own SSL implementation (I couldn't find out what njssl is with a quick search).

Assuming it's the Internet API, you'd be able to read unencrypted data by hooking HttpSendRequest(Ex)[A/W] for example, and the SSL stuff then is handled from there and finally it uses regular sockets but at this point the data is encrypted.

I'd try to run the application, attach to the right Java runtime (I guess some java.exe will be running somewhere) and either look through loaded DLLs, or maybe put a breakpoint on standard low-level socket calls (socket, send, recv, WSASend etc.) and look at the call stack to maybe figure out what upper layers the call came from.

Improve this answer
-2

You have to make a windows driver that will proxy the data on the SSL port. windows filtering platform can do it with a callout driver. You have to use openssl to do all of the SSL handshake steps, and send encrypted data yourself to the destination.

https://docs.microsoft.com/en-us/windows-hardware/drivers/network/windows-filtering-platform-callout-drivers2

But you may can hook into the openssl functions.

Improve this answer
1
  • 1
    What you are mentioning as a side-note in your last sentence ("but you may can hook into the openssl functions") is actually what the entire question is about. Implementing some kind of Man-in-the-Middle-attack (either before or after the encrypted packet leaves the network interface) is only possible if server certificates are not validated by the client program, which is why the question rather was about hooking code BEFORE the encryption occurs to begin with. Thanks anyway though.
    – QuestionOverflow
    Commented Dec 22, 2018 at 23:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.