I am trying to decrypt HTTPs communications in a binary that I know has been statically linked with cURL. How can I force curl to not verify SSL certificates for fiddler to intercept? I am using the environment variable "all_proxy" for cURL to make it use the fiddler proxy, but it won't accept the self-signed cert from fiddler. I have the fiddler cert trusted in my certificate store.
2
-
Look into curl's source where this can be patched, locate that function in the binary and patch it. Some tools than can help you are IDA Pro, a decent IDE, compiler used by the binary and FLIRT signatures. – sudhackar Oct 21 '20 at 8:08
-
Also check out github.com/DavidBuchanan314/libleakmydata for ideas – sudhackar Oct 21 '20 at 13:09
Add a comment
|
