There are gazillions of internet resources discussing how to use Frida to hook and otherwise mess around with SSL connections of Java programs running under Android, but seemingly (as far as my google-fu allows at least?) not a single one discussing how to do this same successfully for Java programs running under Windows (which I would really need to do!).

Even the go-to ssl_logger Frida-based Python script in the Google Github repository lacks support for Windows (without mentioning why), but rather only contains hooks for Linux and macOS, which makes me wonder even more - is this "impossible" (== very hard) on Windows, contrary to on most other platforms, and in that case why?

If not, what would be the recommended way to do it with Frida?

PS. This Oracle resource hints of a DLL named "njssl8.dll" being used as a back-end for the Java SSL functionality on Windows, but frida-trace does not detect any modules containing the substring "ssl" at all when running with option -I "*ssl*" on my test target Burp Suite Community Edition (which I used because I had it handy and because it is very fitting for these kinds of tests).

  • Fiddler is commonly used for intercepting http/https traffic (not java specific): telerik.com/fiddler – Remko Sep 16 '19 at 22:15

That requires some research on your end.

Find out what API functions (not Java level) are used on a system level to deal with SSL. I could imagine that the Java runtime on Windows uses the Internet API or WinHttp or something comparable, or brings its own SSL implementation (I couldn't find out what njssl is with a quick search).

Assuming it's the Internet API, you'd be able to read unencrypted data by hooking HttpSendRequest(Ex)[A/W] for example, and the SSL stuff then is handled from there and finally it uses regular sockets but at this point the data is encrypted.

I'd try to run the application, attach to the right Java runtime (I guess some java.exe will be running somewhere) and either look through loaded DLLs, or maybe put a breakpoint on standard low-level socket calls (socket, send, recv, WSASend etc.) and look at the call stack to maybe figure out what upper layers the call came from.

| improve this answer | |

You have to make a windows driver that will proxy the data on the SSL port. windows filtering platform can do it with a callout driver. You have to use openssl to do all of the SSL handshake steps, and send encrypted data yourself to the destination.


But you may can hook into the openssl functions.

| improve this answer | |
  • What you are mentioning as a side-note in your last sentence ("but you may can hook into the openssl functions") is actually what the entire question is about. Implementing some kind of Man-in-the-Middle-attack (either before or after the encrypted packet leaves the network interface) is only possible if server certificates are not validated by the client program, which is why the question rather was about hooking code BEFORE the encryption occurs to begin with. Thanks anyway though. – QuestionOverflow Dec 22 '18 at 23:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.