0

I'm currently dealing with a "Sniffy" java application. Well I can see it connecting to some kind of server using HTTPS. I would like to see what its sending or getting over HTTPS. i have read some stuff about decoding HTTPS but the problem is I dont have there private SSL Certificate.

I was thinking, is it possible to add a own SSL Root Certificate and add it to my system. So I then can decode the HTTPS?

First off all what software would I need other then wireshark? And How can I then decode the traffic in wireshark?

Im useing windows,

Regards Janniek

Improve this question
1
  • What would be the point of using SSL if it could be circumvented that easily? If you're interested in seeing encryption/decryption at work, however, set up a root CA on a browser of your choice and allocate your own CAs, thus effectively hijacking certificates on your machine. This will allow you to set certificates for random sites as you see fit, which will allow you to see both ends of the system.
    – Sébastien Renauld
    Commented May 14, 2013 at 19:26

1 Answer 1

Reset to default
1

Try using Fiddler2. It is free and has a built in HTTPS stripping proxy for exactly the kind of thing you are trying to do. The one trick is that the application will know that the certificate doesn't match so it may or may not complain, but something like Fiddler2 is your best bet at trying to see what's on the HTTPS connection. (You may also be able to add Fiddler's root cert to your trusted certificates to make it think it is valid, but it depends if they are looking for a particular cert or just one the system sees as valid.)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .