0

I am trying to decrypt HTTPs communications in a binary that I know has been statically linked with cURL. How can I force curl to not verify SSL certificates for fiddler to intercept? I am using the environment variable "all_proxy" for cURL to make it use the fiddler proxy, but it won't accept the self-signed cert from fiddler. I have the fiddler cert trusted in my certificate store.

Improve this question
2
  • Look into curl's source where this can be patched, locate that function in the binary and patch it. Some tools than can help you are IDA Pro, a decent IDE, compiler used by the binary and FLIRT signatures.
    – sudhackar
    Oct 21 '20 at 8:08
  • Also check out github.com/DavidBuchanan314/libleakmydata for ideas
    – sudhackar
    Oct 21 '20 at 13:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.