Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I want to reverse engineer an application using HTTPS to communicate.
I need a tool that performs a man in the middle attack and send it's own SSL certificate to the application, so I can decrypt the HTTPS connection it makes by passing the RSA private key to WireShark.
By the way, I have heard about a tool called stunnel, but the documentations I found about how to configure it just confused me. :|
If you can make the application use a proxy, check Fiddler.
I used stunnel recently to do the same with an android application - used the dextojar suite to take the application apart, replace the https://game.server.com URL with a http://game.server.com URL in the .dex file, re-create the .dex checksum, re-create and sign the apk, install the apk.
Use this iptables entry on my router:
iptables -t nat -A PREROUTING -i eth0 -p tcp -s 192.168.178.100 -d game.server.com --dport 80 -j DNAT --to 192.168.2.2:80
where 192.168.178.100 is my android device, and 192.168.2.2 is where i run the stunnel. (Alternativeely, you can probably fiddle with the DNS entries/hosts file of your client to make game.server.com == 192.168.2.2)
Then, use this stunnel.conf:
[game]
client = yes
accept = 80
connect=game.server.com:443
You could possibly use stunnel if you set up two tunnels if you can't patch the client - one stunnel https server to connect your client to, which forwards to an stunnel http server, which forwards to the real https server, but i've never done that.
The third possibilty is mitmproxy, which might be even closer to what you need. I gave up on getting it to work on my Centos 5 system, but if you have a newer linux, it might be the easiest way to get what you want.
Myself I've made a backdoord openssl.so file that writes everything it encrypts to a file so I can tail it in a different terminal. And ignore issues like certificate pinning.
An alternative approach might be to use panda to extract the key from a trace as documented in the panda ssl tutorial. That said, the usual mitm approach is probably a bit easier to get going unless you're dealing with certificate pinning.
An alternative approach would be to use the browser tools or a browser extension, such as Google Developer Tools for Chrome or Web Console for Firefox. These tools will show you the entire request, response, and body of all network traffic and timeline of when connections are made. In Chrome, you can even edit the page content and review how it affects the page. These are very powerful tools for reverse engineering the DOM and request structure.
If the application in question doesn't verify SSL encryption then you can strip SSL using an intercepting proxy. However, if the application does verify SSL and throws an error if encryption is stripped, one option is to create your own SSL certificate pair and add it to your OS certificate trust store like so:
If the application checks the authenticity of an SSL certificate against your OS certificate trust store and forces encrypted traffic, you can spoof the endpoint while retaining a non-stripped, 'valid' encrypted session between the application and a proxy which receives a SSL encrypted session from your host using the self-signed certificate and reencrypts using a non self-signed certificate. Thereby you have an encrypted session that appears valid and non-stripped to both ends of the session with a man-in-the-middle attack.
stunnel. And what documentation you already browsed through.