Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am doing some research on man-in-the-middle focusing on SSL in particular.

I have been looking into generating a certificate on request when a client connects and requests a secured page.

Assuming that;

  • Client is connected to AP controlled by me and ignoring cert validation
  • AP is running airmon-ng and airbas-ng with DHCP.
  • OS is Debian on a Rasp Pi, that then forwards to the real WWW

Is it feasible to generate a certificate per request, and if so, are tools available for this, or would the request have to be scripted to sign a cert via OpenSSL, and logging the event.

Cheers

share|improve this question
add comment

2 Answers

I use mitmproxy (and HoneyProxy a graphical interface to it) at work to do that. Works perfectly.

Relevant part of the documentation about SSL: http://mitmproxy.org/doc/ssl.html

share|improve this answer
add comment

Yes, it's possible.

10 seconds of googling gives you a link to the dynamic SSl generation feature of Squid and that links to the (necessary) SSLBump feature that implements the MITM attack itself.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.