Tag Info

New answers tagged


You may not have the proper decoder in Burpsuite to perform testing. What "application-type" are you seeing with the requests? E.g., JSON, AJAX, etc., Burpsuite has separate decoders for JSON, and this does not mean your bank's API is using JSON. In order to properly analyze what is going on, you need the right tool for the job. What you can try to do, for ...


This may or may not even be possible depending on what checks Nintendo does. If Nintendo only trusts their own certificate, signed by them, then you will be unable to make a key pair for the proxy that your DS will trust. Normal SSL/TLS MITM proxies require that the client trust the certificate used by the proxy as a root cert, that way the proxy can make ...


In the diagram above, the encryption exists between you and the VPN server. Past the VPN server it is no longer encrypted. A VPN is a way to send traffic over a public connection and still have a reasonable expectation of privacy. The typical use case for them is either protecting your privacy or thwarting geoIP based filtering. However, like with any ...


If the software is using a fixed port and an hostname rather than IP to connect you could redirect the traffic to your local computer and use, e.g. ncat to remove and readd ssl, then inspect the traffic in between. Comment if you need more details.


Wireshark should be able to do it. However, the process is not as straightforward as you would have to scan the memory for the master secret. Here is a tutorial on how to decrypt SSL without access to the master private key. http://www.cloudshield.com/blog/advanced-malware/how-to-decrypt-openssl-sessions-using-wireshark-and-ssl-session-identifiers/

Top 50 recent answers are included