Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When I use browser or wget to access another site, some sites will only use HTTPS / SSL automatically. When a site doesn't provide content without encryption, how do I capture what my computer sends for analysis? Is it possible for me to disable SSL with my browser or wget?

I'm running Linux, and would like to use tcpdump or other Linux tools for this.

share|improve this question
add comment

3 Answers

Tools such as this SSL MITM proxy from Stanford can automatically generate certificates and provide an SSL-to-SSL cutover. You'll need to set the key used by the proxy to be trusted by your browser, but that will provide you with the ability to see the cleartext traffic that is leaving from your machine.

While you can try to rewrite any HTTPS redirect requests to have HTTP, many website that provide HTTPS support will only provide content over the encrypted channel; the unencrypted channel provides nothing but redirects.

Moxie Marlinspike's SSL Strip will probably also fulfill your goal by transiting the HTTPS traffic, but only speaking with your client using HTTP and rewriting redirects.

share|improve this answer
    
I got the Stanford proxy to work using java -cp iaik_jce.jar:. mitm.MITMProxyServer -localPort 8888 -keyStore FakeCAStore -keyStorePassword passphrase after quite some tinkering. –  sehe Nov 26 '13 at 22:44
    
I've got the mitm-proxy running, but it never gets a connection... it always crashes with javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake any ideas? –  José Lecaros Jan 11 at 5:54
add comment

If you are on Windows, try using Fiddler2. It has an SSL proxy that will strip SSL for you so that you can see the packets going to and from your machine.

share|improve this answer
    
I'm on linux and I want to use tcpdump or other tools to capture the packets –  wenzi Dec 19 '12 at 17:39
    
Wenzi- I have added that into the question as that will really help people answer you. –  Rory Alsop Dec 19 '12 at 17:59
add comment

when you browse to http://plus.coogle.com - it responds with a HTTP 301 response "moved permanently" and redirects to https://plus.google.com

If you use an intercept proxy, use an environment variable to set the proxy name and set proxy parameters on the wget cmdline.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.