Wireshark SSL stripping

Question

well this question could be asked in Wireshark forums or Stackoverflow forums but, I think the question invloves development and security factors as well so i find the Information Security forum is the suitable place for asking this question. Well straight to the point. Here's the steps I've been through until I hit a problem.

1. I have a website that runs on an HTTPS protocol serving the Android application
2. I generally debug requests / responses via Wireshark running on Windows operating system.
3. I requested the private key to the server programmer so that I can attach it to Wireshark.
4. The server programmer said he doesn't know where the key is now since the key is in a Docker image, but he will look for it soon.
5. I still needed to debug my app rather than copy-pasting Log.d() all over my Android app.
6. found out there was an app called "SSL" in Google Playstore and I downloaded it and tried it.
7. it installs a "packet capture certificate" (which Android is pretty suspicious because it's a third party certificate)
8. installed it anyways cause my testing phone is a dummy phone
9. started capturing HTTPS packets that are decrypted

How can this actually work?? this application obviously knows how to retrieve packets heading to other apps. But how can it decrypt the ssl? or is it the other way around? are the apps reporting the decrypted HTTP packets to this app? Finally, is Wireshark able to decrypt packets just like the main app by exchanging keys with the server?

Answer 1

To begin with - I won't go into too much detail for this answer. Read more about HTTPS and the certificate system if you're curious ;-)

---

HTTPS needs certificates to work. These certificates are meant to be a guarantee that you're talking to the right server (and not to the server of an intruder). Encryption only (without this authentication) would be pretty useless, because it would be trivial to intercept and decrypt traffic.

To manage all this certification stuff, we use a Public key infrastructure. Your phone trusts only certificates signed by a certificate authority.

By installing the app, you mentioned in step 7 that you imported a "packet capture certificate". Now your phone trusts everything it trusted before - plus all certificates signed by the "packet capture certificate".

Now the app can act as a proxy between your device and your web application. It decrypts your traffic so that it can display the packet contents, and then re-encrypts it with its own secure connection to the web application. This is similar to a Man-in-the-middle attack. This only works because you trusted the certificate. (If you wouldn't trust the certificate, your phone would most likely throw a connection error.)

But how does the app get the packets? It probably uses the Android VPN API and presents itself to the Android system as a VPN tunnel. Therefore, Android forwards all packets to the app.

---

Wireshark can't be used as a proxy because wireshark only listens to traffic and does not alter or insert new requests. If you want another tool which can intercept HTTPS, then try OWASP ZAP, Burp Suite or mitmproxy.