0

I'm using an application connecting to a server over HTTPS and HTTP , I already monitor the HTTP traffic, but the I want to see the HTTPS traffic and decrypt it. I use Kali Linux & Windows 7.

3

First we need to address the elephant in the room. Unless you have permission to test these systems or own the devices, applications, and systems you are testing, this activity may be illegal. Now, with that out of the way:

In order to decrypt SSL (HTTPS) traffic, you'll need to either have a copy of the server's private key or generate your own cert / private key and use it while MitM'ing the traffic. Note that the second option will result in cert errors for the client that he/she will need to [by default] accept in order to continue interacting with the site/application.

Your title says from your iPhone but your question says using Win7 and Kali. I'll stick with Kali for this answer because it's the easiest thing to get you started.

One Approach with Kali

By default, Kail comes installed with a web proxy known as Burp Suite. <-- That link will take you to setting Burp up to intercept SSL traffic. You can MitM traffic by configuring your browser to proxy through the localhost (usually on TCP/8080 by default). Then you can browse to the site (accept the SSL warning) and see your traffic decrypted in Burp.

A More Complicated Approach - Will Work for Smartphones Too

You'll need to generate a certificate and install it on your devices to be able to decrypt the traffic later. You then need to proxy the traffic through a device capable of doing the packet decryption/inspection. A better overview of the process can be found here. That link is for a specific program/setup, but the process is pretty much the same no matter what the specific implementation is.

  • Apple Transport Security (ATS) is on for apps since iOS 9.0 . ATS verifies server certificates by default. Intercepting a modern iOS app's HTTPS traffic with burp will result in a failed connection unless the author took steps to explicitly allow untrusted certificate authorities to ignore the CN of the cert -- unless you install burp's CA cert manually. – Eric Sep 11 '16 at 12:02
  • what i mean < i use the application on my i phone , and i want capture it by my PC i tried Burp Suite and it's can't get the https requests i running IOS 8 . – S.niper Sep 12 '16 at 0:21
  • You'll need to install the portswigger (Burp Mftr) CA cert on your phone so that it can connect without SSL issues and then use your kali box as the gateway/proxy for your traffic. – HashHazard Sep 12 '16 at 16:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.