Sniffing IMAPS traffic! Are there any tools for this?

Question

I've got a problem where someone has implemented a custom IMAP Server. I need to write a custom application to get a list of emails, and fetch messages. Problem is, every library I've tried to use fails with exceptions - BAD commands, etc. But using thunderbird, it retrieves the list of messages and can fetch messages. I would like to see what thunderbird is transmitting to make it work... The problem is, that this IMAP server is actually SSL secured so I can't just use wireshark to see the commands being sent.

I've tried to use thunderbird's logging mechanism, except its so verbose, and it looks like some of the commands are getting truncated - still can't make it work from these commands.

I've also tried to use sslh and sslstrip, but it seems these tools only work for HTTPS.

I've tried all day but still can't work it out! Aaaaghh!

How can I please find a way to log the requests and responses in an IMAPS session?

Answer 1

The answer is stunnel! Fantastic! So to make this work.....

In the config file make a new section:

 [imaps-server]
 client = yes
 accept = 127.0.0.1:143
 connect = sslencryptedimapserver.com:993

Open thunderbird, change the account to standard IMAP without SSL and change the host server to localhost Log with wireshark and you'll be able to see the commands!