2

I'd like to investigate some SSL (https?) traffic coming from one of my computers. The problem is that I don't know for sure which program it comes from, and I most likely can't make it use a proxy (so tools like Fiddler or Charles won't work). However, I believe the program creating the traffic does not check the validity of the certificates. Even if it does, there is a good chance it respects the system certificate store, so I could put my own root in there.

Can I make wireshark (or any similar tool) somehow accept each SSL connection with a fake certificate, unpack and show me the data, and then open another SSL connection to the remote host? Preferably this technique should work on Windows.

(Similar other questions on this site assume that I can either configure the program to be MITMed (by setting a proxy) or that I can capture some secrets from the SSL sessions. I want to inject fake certificates into all outgoing SSL connections, live.)

  • Maybe try sslstrip and ARP spoofing? – Tobi Nary Apr 8 '16 at 18:50
4

Wireshark alone does not do that, it can only watch the traffic if you already have knowledge of the keys/certificates in order for it to decrypt the traffic in the TLS connection. There is a type of proxy, a transparent proxy, that applications have to use because they sit on port 80/443 of the gateway and simply intercept all traffic. This would be the approach you need if you want to be privy to the traffic involved in your mystery application.

If you wanted to stick with Wireshark, you could use a simple transparent proxy (with something like Squid) to hand it your own certificate and then watch the traffic and let wireshark decrypt it. There are tutorials but it is slightly complex.

What you want is encompassed by a single product called Burp Suite, it will let you intercept the traffic (acting as a transparent proxy which the application cannot ignore) inject your own certificate, watch the resulting conversations, etc.

See the product page for more info: https://portswigger.net/burp/

  • Alternatively, instead of Burp Suite, mitmproxy is very nice as well. – multithr3at3d Apr 8 '16 at 22:37
1

To circumvent the proxy problem, there is ARP spoofing available.

MiTM the ssl, there's sslstrip.

There are loads of tutorials on how that works.

If however the certificate gets validated, you will be out of luck.

As Steffen pointed out in the comments, there is no way to make wireshark - being a passive sniffer- sniff active.

Yet, the tutorial I linked uses another sniffer that'll work just as well, probably.

  • wireshark itself cannot be used by its own because it is just passive sniffing. But for this task you need active man in the middle. – Steffen Ullrich Apr 8 '16 at 19:42
  • @SteffenUllrich I thought about custom wireshark plugins when saying it might work. – Tobi Nary Apr 8 '16 at 19:43
  • I think you can only do dissection plugins in wireshark but not change the general behavior, i.e. wireshark will still only do passive sniffing and not active traffic modification. – Steffen Ullrich Apr 8 '16 at 19:46
  • That's where the might comes into play,@SteffenUllrich. Thanks for the clarification, I'll edit it in. – Tobi Nary Apr 8 '16 at 19:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.