3 votes

Using Stunnel to packet capture HTTPS connection

Myself I've made a backdoord openssl.so file that writes everything it encrypts to a file so I can tail it in a different terminal. And ignore issues like certificate pinning.
user avatar
  • 2,265
2 votes

Using Stunnel to packet capture HTTPS connection

An alternative approach would be to use the browser tools or a browser extension, such as Google Developer Tools for Chrome or Web Console for Firefox. These tools will show you the entire request, ...
user avatar
2 votes
Accepted

Using Stunnel to packet capture HTTPS connection

If you can make the application use a proxy, check Fiddler. I used stunnel recently to do the same with an android application - used the dextojar suite to take the application apart, replace the ...
user avatar
2 votes

Using Stunnel to packet capture HTTPS connection

An alternative approach might be to use panda to extract the key from a trace as documented in the panda ssl tutorial. That said, the usual mitm approach is probably a bit easier to get going unless ...
user avatar
  • 1,561
2 votes

Android (4.4+) SSL wireless sniffing without certificate changing

(Copy of an answer I gave on Stack Overflow) You could try injecting code into the Android app to sniff and dump SSL traffic. Take a look at https://github.com/5alt/ssl_logger (5alt's fork works with ...
user avatar
  • 141
2 votes

Android (4.4+) SSL wireless sniffing without certificate changing

iSEC Partner's Android SSL TrustKiller utilizes hooks that Cydia substrate can provide in order to defeat certificate pinning.
user avatar
  • 21
2 votes

How to verify if Firefox is actually sending zlib data over SPDY?

I managed to decompress it in Python by specifying the decompression dictionary: #!/usr/bin/python3 import zlib import base64 header = ("783fe3c6a7c2003b01c4fe00000009000000073a6d6574686f" "...
user avatar
  • 287
2 votes
Accepted

Need help understanding "garbage" data in https request

The content is encoded with gzip per the Content-encoding header. You can use the decoder in Burp proxy (if that is what you are currently using) to decode the data or by using for intance gunzip in ...
user avatar
  • 46
2 votes

fakenet for apps using SSL

I am using burpsuite for HTTPS inspection. Need to install its root cert on the phone. Most apps does not verify cert, or uses phone cert store. Windows users often use Fiddler. These tools generate ...
user avatar
  • 41
1 vote
Accepted

finding rest api urls after decompiling apk

They might be stored encoded/encrypted and decoded/decrypted in runtime, you can validate this if you can capture any API calls in runtime (Not sure if you tried this, but maybe give it a try, in that ...
user avatar
1 vote

Charles TLS Proxy for Android device with root access

I will answer my own question because I figured out what was wrong. The app was not functioning correctly for a number of reasons that frustrated the analysis. For one, there were many advertising ...
user avatar
  • 161
1 vote

fakenet for apps using SSL

It seems that most of the people are better using the mitmproxy tool (see docs) together with SSLsplit for this kind of usage. Just for the sake of completeness, here are a few pages explaining how ...
user avatar
  • 18.1k
1 vote

WebSocket debugging in Javascript app gives "401 Unauthorized"

Ok, I figured it out. The websocket-client library I use for python writes its own Origin header by default and I was ending up with two Origin headers, which may have been tipping off the server. I ...
user avatar
1 vote

Sniffing https traffic of an android app

If you're a Windows user, as a matter of dynamic analysis, you could try using an emulator like BlueStacks, then inspect your system network traffic with a program like Fiddler or WireShark. ...
user avatar
  • 2,154
1 vote
Accepted

How to sniff HTTPS traffic of apps that ignore system proxy setting?

If you can install an extra CA, it shouldn't be a problem. Mitmproxy has documentation on how to set up transparent intercepting. http://docs.mitmproxy.org/en/stable/transparent.html
user avatar
  • 156
1 vote

Lutron Caseta Protocol over HTTPS

This isn't a complete answer but I don't have enough rep to comment yet. First off, giving us binary data with all the non-printable characters presented as ? doesn't help. Try piping it through xxd (...
user avatar
  • 36
1 vote

Reverse-engineer digest http authentication

So finally, I used Cycript and attached to the running app process, and consequently intercepted the private key in runtime.
user avatar
1 vote

Extracting HTTPS packets before encryption

Since you are want to bypass HTTPS encryption, why not use Fiddler? Fiddler is a web debugging proxy that auto-sets itself as the system proxy. It also offers the option to install a self-signed root ...
user avatar
1 vote

Extracting HTTPS packets before encryption

Maybe some of the following tools may help you: "SSLHOOK is a Win32 DLL that allows hooking of the OpenSSL functions SSL_read and SSL_write" https://github.com/strobejb/sslhook Immunity Debugger (...
user avatar
1 vote

Using Stunnel to packet capture HTTPS connection

If the application in question doesn't verify SSL encryption then you can strip SSL using an intercepting proxy. However, if the application does verify SSL and throws an error if encryption is ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible