2

I want to intercept a ssl-encrypted tcp-stream. I have the privat key and the certificat of the server and of the client. But how can I intercept the connection.

Is there a intercepting-proxy with such a feature?

1

You are typically trying to perform a Man in the Middle. There are many ways to do it.

  1. easy way is by using Wireshark - refer blownie55's answer
  2. Web Browsers these days come with Developer Tools Which show a lot. (Press F12 in Chrome)
  3. Packet Dump at your Gateway. - Collect Packets from Client and then decrypt them using the Private Key (pretty hard, but doable).
  4. Port Cloning or Port mirroring at your Gateway - Your Gateway simply forwards all traffic from a particular Port(say port A) in your router/switch to another Port of your choice(say port B) - you decrypt traffic from Port B using the Private Key.
  5. Web Proxy -You can achieve this by:

    • setting up a Web Proxy with the Private Keys of both the Server and Client, so the Proxy appears to be the Server to the Client and Vice Versa.
    • Then you have to Route the traffic through the Web Proxy.(like using a Host file at the Client). - If your Gateway is also the web proxy, then don't bother with this step.
0

You need to create a new certificate that claims to be for any end point and that is trusted by the browser. Your proxy then delivers that certificate instead of the genuine one creating a man-in-the-middle.

Traffic is encrypted using your false cert between the browser and the proxy then re-encrypted using the genuine cert between the proxy and the end point.

There certainly are services that will do this, Sophos for example have one.

0

WireShark supports intercepting ssl traffic when using RSA for key exchange but now with people using Perfect Forward Secrecy, you will need the session key which can be obtained if you are using Firefox or Chrome. See this link on how to obtain that and use wireshark to decrypt the traffic.

If you are not using Perfect Forward Secrecy then it should be straight forward. If you are using it and your client is something other than Chrome or Firefox then you will have to do some further digging in how to get the session key from your client (if you have control over it)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.