7

When I use browser or wget to access another site, some sites will only use HTTPS / SSL automatically. When a site doesn't provide content without encryption, how do I capture what my computer sends for analysis? Is it possible for me to disable SSL with my browser or wget?

I'm running Linux, and would like to use tcpdump or other Linux tools for this.

0

3 Answers 3

8

Tools such as this SSL MITM proxy from Stanford can automatically generate certificates and provide an SSL-to-SSL cutover. You'll need to set the key used by the proxy to be trusted by your browser, but that will provide you with the ability to see the cleartext traffic that is leaving from your machine.

While you can try to rewrite any HTTPS redirect requests to have HTTP, many website that provide HTTPS support will only provide content over the encrypted channel; the unencrypted channel provides nothing but redirects.

Moxie Marlinspike's SSL Strip will probably also fulfill your goal by transiting the HTTPS traffic, but only speaking with your client using HTTP and rewriting redirects.

2
  • I got the Stanford proxy to work using java -cp iaik_jce.jar:. mitm.MITMProxyServer -localPort 8888 -keyStore FakeCAStore -keyStorePassword passphrase after quite some tinkering.
    – sehe
    Nov 26, 2013 at 22:44
  • I've got the mitm-proxy running, but it never gets a connection... it always crashes with javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake any ideas? Jan 11, 2014 at 5:54
4

If you are on Windows, try using Fiddler2. It has an SSL proxy that will strip SSL for you so that you can see the packets going to and from your machine.

2
  • I'm on linux and I want to use tcpdump or other tools to capture the packets
    – wenzi
    Dec 19, 2012 at 17:39
  • Wenzi- I have added that into the question as that will really help people answer you.
    – Rory Alsop
    Dec 19, 2012 at 17:59
0

when you browse to http://plus.coogle.com - it responds with a HTTP 301 response "moved permanently" and redirects to https://plus.google.com

If you use an intercept proxy, use an environment variable to set the proxy name and set proxy parameters on the wget cmdline.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .