I'm trying to inspect the traffic of a program (which is running on my computer) that uses SSL over TCP to a non-standard port. The traffic may or may not be HTTP traffic, likely isn't. Neither Charles nor Fiddler2 are able to detect the connection. How can I view the unencrypted traffic? Solution needs to work on windows 7.
Wireshark should be able to do it. However, the process is not as straightforward as you would have to scan the memory for the master secret.
Here is a tutorial on how to decrypt SSL without access to the master private key.
- Identify the master secret and corresponding session key. This can be found in the "Server Hello" portion of the SSL handshake.
- Configure Wireshark to use the master secret. Save the master key to a text file and configure wireshark to use the master secret file.
- Decrypt the encrypted malware SSL session. Open the pcap file, right click on the session and select "Follow SSL Stream".
Burp Suite can do this to MITM HTTP and HTTPS traffic.
This is very easy via Invisible proxy mode:
Normally, web proxies need to receive the full URL in the first line of the request in order to determine which destination host to forward the request to (they do not look at the Host header to determine the destination). If invisible proxying is enabled, when Burp receives any non-proxy-style requests, it will by parse out the contents of the Host header, and use that as the destination host for that request.
When using HTTPS with a proxy, clients send a CONNECT request identifying the destination host they wish to connect to, and then perform SSL negotiation. However, non-proxy-aware clients will proceed directly to SSL negotiation, believing they are communicating directly with the destination host. If invisible proxying is enabled, Burp will tolerate direct negotiation of SSL by the client, and again will parse out the contents of the Host header from the decrypted request.
Of course the application would need to trust Burp's root CA, and the certificate that is automatically generated by it (i.e. the application is not using pinning and it is using trusted roots from the OS level, not its own).