Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to MiTM a device on my network and having some problems.

SSLstrip doesn't work because the URL is https://, and I can't use something like Fiddler because the device has no configurable proxy settings for me to direct traffic with.

What other attack vectors do I have?

share|improve this question
ARP spoofing/poisoning? – Adi Nov 22 '13 at 15:19
I already have access to the traffic using a rogue access point. The problem is TLS. SSLstrip can't get in because the outbound request is https:// and I can't point the device at Fiddler because there are no proxy options in the device config. – Scott Helme Nov 22 '13 at 15:21

I believe there must be some sort of confusion here. You seem to think that Fiddler is some attack/hack/magical tool. To decrypt SSL traffic with Fiddler you either need to possess the session key or you need to install Fiddler's certificate on the device.

Asking for an attack vector and talking about using Fiddler in the same question sounds silly. You're saying you already have access to the traffic, you're already an MiTM. All you need to do is use the session key and or get the device to trust your fake certificate.

I highly recommend that you read up on the topic.

share|improve this answer
Ok, perhaps I didn't explain myself very well. If I could change the device settings to proxy through Fiddler, I would either get a cert warning/it wouldn't work, or, the device wouldn't verify the cert and continue on, happy with https://. As the outbound request is https://, SSLstrip is a no go. What other tool can I use to access the traffic in clear text? – Scott Helme Nov 22 '13 at 15:38
I should mention, it's not a browser on the other end so there is no reason to expect that it wouldn't be happy with a forged SSL cert. I don't have any info at this point. I've also just come across SSLsniff, which seems like it could be what I need, perhaps. – Scott Helme Nov 22 '13 at 15:40
@ScottHelme Aha. So you're question is in fact a tool recommendation question masqueraded as a legitimate question by saying "What other attack vectors do I have?" instead of "What other tools I can use?". Clever. You're not looking for attacks, you simply want us to find you a tool that let's you pass a fake cert to the client. – Adi Nov 22 '13 at 15:46
You're comment seems to imply there was some form of intentional misdirection. I have a problem, I'm looking for help in resolving it. Perhaps what I want to do is possible with the tools I mentioned, perhaps not. Is there some kind of problem? – Scott Helme Nov 22 '13 at 16:04
@ScottHelme Answer: Since you already have access to the connection channel and you can intercept the connection, this can easily be done by serving the client your own public key and hope the client trusts it (ignore the warning either manually or programmatically) and have the client connect to you. In turn, you'd connect to the server and thus see the connection in plaintext. Proxy configurations are irrelevant as they're only needed to channel the traffic to certain address, but you already have the traffic. – Adi Nov 22 '13 at 16:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.