Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I created a Squid proxy and a self-signed SSL certificate. The SSL certificate on the server is a private certificate linked to the ssl-bump feature. I am using tshark to dump the SSL traffic, but I can't sniff with tshark. For example my tshark command is:

tshark -o "ssl.desegment_ssl_records: TRUE" -o "ssl.desegment_ssl_application_data: TRUE" -o "ssl.keys_list: 209.190.x.x,443,http,/etc/squid/ssl/file/squid.key" -o "ssl.debug_file: /tmp/.wireshark-log" -i eth0 -R "http.request.method==GET or http.request.method==POST"

I know that squid works (and I can sniff all data from http), and I can see the log of https site in /var/log/squid/access.log but I can't sniff full data of https. I also know Squid becomes a man-in-the-middle in this scenario and makes 2 SSL keys. One between the client and squid, the other between squid and the server. I can't sniff the data between the client and squid but I think I can sniff data between server (me) and squid.
How can I sniff it? Is there any alternative for tshark?

share|improve this question
    
Have you tried just using Wireshark? –  hololeap Oct 6 '13 at 0:22
    
Have you tried SSLStrip? XD –  DarkMantis Oct 10 '13 at 9:06

2 Answers 2

With SSL Bump, Squid runs a Man-in-the-Middle attack between the client and the server; it poses as a fake server with a fake certificate when talking to the client, and as a fake client when talking to the true SSL server. Squid thus obtains all the data. If you want to see what Squid sees, then it seems that the best option would be to simply ask Squid to send you a copy. Apparently, this is at least theoretically feasible through the ICAP feature: it is a way for Squid to do just that. Antivirus software links to Squid through ICAP, and inspect both the HTTP message contents and the headers.

Otherwise, if you do not have the help of Squid, then you must understand what occurs at the SSL level. In particular, tools ssldump can decrypt captured SSL traffic only if the following conditions are all true:

  • The decrypting tool is given a copy of the server private key.
  • The decrypting tool supports the cryptographic algorithms used for the connection.
  • The cipher suite selected by the server (based upon what the client supports and prefers) uses an RSA-based key exchange. With "DHE" cipher suites, the actual key exchange uses ephemeral Diffie-Hellman keys, and the server private key is used only for signatures; having a copy of that private key would not help here.

In your case, there are two SSL connections, one between the client and Squid, the other between Squid and the genuine server. If you have a copy of the server key, then you can concentrate on the latter, and forget everything about SSL Bump and Squid. However, in a more general case, as the sysadmin of Squid you control Squid, not the target server.

With SSL Bump, Squid generates a fake server certificate when talking to the client. If you can get a copy of the private key for that fake certificate, then you should be able to apply ssldump on the client-to-Squid connection. As described here, the tool that Squid uses to generate fake certificates is configurable, so you could use your own, which generates the certificate (e.g. with OpenSSL) and records the private key somewhere, so that a captured trace can be decrypted later on.

For the cipher suite, this seems to be doable with the Squid https_port directive, which accepts a "cipher=" parameter. As said here, the value of that parameter is passed directly to the underlying SSL library that Squid uses, and that's OpenSSL.

See also this forum thread where someone is apparently trying to do the same thing as you.

share|improve this answer

If I were you I would get SSLStrip (http://www.thoughtcrime.org/software/sslstrip/). It is really a superior tool, but it only works on linux. If you don't have Linux, this is actually good! Kali Linux (http://www.kali.org/) is a free tool that can be run off of a VM or a USB drive with minimal effort. You will still have to get SSLStrip, but Kali comes with Python installed, so just use "python setup.py" and it will just about work itself. There is no GUI for SSLStrip, but it is easy to use. Kali also comes with goodies like Wireshark (for http) and aircrack-ng (for breaking into WEP and WPA/WPA2 secured networks).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.