Questions tagged [tls-intercept]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
18 views

what do these assembly code doing? [migrated]

I tried to reverse engineer an apk app, and it was loading a native code. I have observed that the app was using the native code like this public static String v = sUQWWyTBEs().toString().substring(32,...
-1
votes
1answer
64 views

Preventing MITM Attack with Squid

There are two options, what is the best approach? I want to either Create a squid proxy server that detects MITM attacks or Create a python UI application to detect differences between local ...
0
votes
2answers
137 views

Prevent ssl pinning bypasses

I want to understand if end user is doing MITM attack on my app and i want my API server to receive this. Is there any way i can hook an SDK or some listener that tracks which certificate is being ...
1
vote
1answer
60 views

Can't log in into Twitter for Android app after SSL Bypass

I don't know if this is the right forum for this kind of question. I was trying to intercept traffic from Twitter for Android app and for that I needed to bypass the SSL pin they implemented. ...
6
votes
1answer
162 views

Exactly why is it not possible to “drop-out” of TLS 1.3 proxy inspection?

I have been reading a number of articles that state it is not possible for an inspection proxy to simply drop-out/disengage from a TLS 1.3 connection in the same way that is possible in TLS 1.2. Such ...
1
vote
1answer
112 views

How can a site preemptively notify browsers to enforce an SSL on their domain?

I learned about this years ago and don't remember enough of the keywords to search for it appropriately. Its where sites can tell the browser that the site must not allow the site to be downgraded to ...
0
votes
1answer
215 views

How to decrypt TLS traffic originating from a Windows service on my Windows 10 PC?

Some months ago I bought a peripheral device for my Windows 10 computer (think of something like a game controller). My home router has a function that allows it to capture all incoming and outgoing ...
1
vote
1answer
47 views

What are the limitation on encrpyting proxy

i would like to know if i encrypt a proxy server communication with TLS v1.3 is it still possible for a firewall censor to a deep packet scanning to decrypt. Also, what can be done to make the ...
1
vote
1answer
132 views

Error in intercepting the request of an Android application

I'm trying to analyze my flutter app's network traffic so I used burp suite for intercepting. First, I'm using the proxy option of burpsuite. I set my PC's IP address and port as 8080. Also in my ...
0
votes
1answer
860 views

need an Alternative to ssl pinning for web applications

I am developing a web app and while testing it on burpsuite I found that it is vulnerable to the proxy SSL certificate. I did some research and found that it was handled by a technique called SSL ...
30
votes
6answers
6k views

As a contractor how do I work on multiple client networks without data leakage?

I am a contractor who does development for more than one client. Let's call them Client A, Client B, and Client X. I use my own laptop for all 3 clients. Throughout the day, I have to work on and ...
1
vote
3answers
2k views

Intercept HTTP Traffic of an android app?

I was trying to test and intercept traffic from an app developed on Rhodes open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can ...
0
votes
0answers
21 views

authenication of client in one way ssl [duplicate]

In below ssl diagram : I have one doubt with 1-way ssl. If there is an interceptor in-between client and server who can alter in following way : In step 8, when client is sending his symetric key to ...
1
vote
1answer
78 views

Why does a firewall reencrypt https traffic

I have a Sophos XG firewall. I use it at home (to play around with) This firewall is capable to scan HTTPS traffic. It decrypts the traffic and re-encrypts the traffic again. For the re-encryption of ...
0
votes
0answers
74 views

Manual TLS decryption with master secret

Assuming I have the master secret from SSLKEYLOGFILE client random, and server random, can I decrypt any tls traffic captured? I've started from Golang's TLS implementation, pulled the connection ...
5
votes
2answers
4k views

Is there no way to bypass certificate pinning without patching apps?

Can you do anything other than patching apps' compiled-code/cert-files (which is app-specific, requires manual analysis and patching + super-user/root) to intercept TLS traffic of apps that use ...
0
votes
0answers
258 views

Monitor HTTPS URL logging of a specific device of a Network

Goal The main goal is to monitor all the URL logging (HTTPS) of a specific device in my Network. So I’m decided to buy a Security tool WifiPineApple from Hak5 store. Ex. Alexa, Chromecast, and maybe ...
1
vote
1answer
80 views

How can one detect and mainly bypass TLS inspection as a user with an enterprise managed device?

Let's assume Alice is an employee of the Chuck company. Alice likes to communicate with Bob, a server somewhere in the internet. Chuck, being a security orientated company, inspects all TLS ...
0
votes
0answers
710 views

Force third party app to trust Charles Root Certificate

I downloaded two different third-party apps (running on Windows) in order to figure what HTTP calls does it make to an external server on the internet. Both apps are calling the same server as far ...
0
votes
2answers
94 views

Reasons not to preserve the certification path on an intercepting HTTPS proxy

In this environment an intercepting HTTPS proxy is used for legitimate purposes and its CA root certificate is installed on all clients. Every HTTPS proxy solution I've seen so far simply signs a new ...
2
votes
0answers
301 views

BURP SSL connection failing on Genymotion Virtual Device - Android 8.0 API 26

Everything earlier used to work fine. However, recently I downloaded a newer virtual device on Genymotion, which is an Android 8.0 API 26. I have been struggling to get HTTPS traffic intercepted on ...
0
votes
0answers
58 views

Authentication Message in TLS

I was reading RFC8446-TLS13 and a tls visualization and could not grasp some concepts. I have all the tls connection data (client hello etc.) and SSL Logs (server_traffic_handshake_secret) I see that ...
0
votes
2answers
225 views

PKCS12 password stolen - what's the security impact?

I want to know that what the security impact is if someone leaks the password of a PKCS12 certificate. I am referring to the password which is required when we export the certificate.
1
vote
1answer
95 views

How to display HTTPS contents [Using Proxy]

I'm a beginner at proxy traffic stuff and I'm struggling here with Charles Proxy I'm trying to 'intercept traffic'. I have an HTTPS page and I want to display the data from the content (inside ...
0
votes
0answers
18 views

SSL stripping - initiate HTTPS or HTTP first? [duplicate]

I am quite confused. I have been reading about SSL stripping and what I have found is that The client (victim) has to initiate the first connection via HTTP The server will redirect to HTTPS - here ...
5
votes
1answer
653 views

How to mitigate credential disclosure in man in the middle attack

I have the followin scenario and looking for a secure solution. There is a web application, hosted on IIS. The connection is established over TLS 1.2 and is encrypted. So the steps are Client ...
1
vote
0answers
978 views

Charles Proxy intercepting SSL Pinning enabled traffic

An Android application that has SSL Pinning was successfully tested on a mobile device running Android 6 (with the certificates installed) using Burp proxy and OWASP ZAP Proxy. As expected the ...
0
votes
1answer
91 views

Which certificate on my computer is used to make a SSL/TLS handshake

When connecting to a specific website(www.test.yyy.com) inside of an organisation SSL/TLS handshake is performed. From my understanding, I would say that one of my personal certificates on computer is ...
0
votes
0answers
98 views

Is it safe to use HTTPS websites over an unknown PPTP VPN? [duplicate]

I want to create e.g a Gmail account while connected to an unknown PPTP VPN. Is it safe, or can the owner of the PPTP VPN see my Gmail web page information, such as username or password, at all? Can ...
1
vote
1answer
159 views

How to listen on all encrypted (SSL/TLS) traffic of a (Windows) system under your control?

On one of my Windows machines (so I am admin and basically can do whatever I want with it) I'd like to analyse traffic which obviously is directed to a malware C&C server. The traffic is TLS ...
1
vote
0answers
124 views

How does HTTP Catcher (iOS app) work on SSL/TLS? [duplicate]

From the official description: HTTP Catcher is a web debugging proxy. It can be used to intercept, inspect, modify and replay web traffic. Can someone explain to me how HTTP Catcher manages to do ...
0
votes
2answers
374 views

private key of SSL certificate

To create a certificate, first we need to fill a CSR and in CSR we have to place our public key and that key pair can be generated by different ways in different devices. To do ssh, we run command (...
0
votes
2answers
245 views

Is there any Security issue if we not used SSL between AWS Cloudfront and AWS ALB?

I have an application that is hosted on AWS. It has an Application Load Balancer in its front and it is also attached to the Cloudfront to handle a heavy load. In my case, I have enabled SSL only on ...
0
votes
1answer
149 views

Why is subject verification an effective means to detect MitM attacks in TLS? [duplicate]

Say, an attacker fakes an original server certificate by a trusted CA using a another certificate from the same CA in a Man-in-the-middle attack. Why can this be detected using subject verification on ...
1
vote
1answer
87 views

MitM to intercept SSL/TLS based on network traffic alone?

Say, an attacker wants to perform a MitM but all he has available is the network traffic between a client and a server. He has no further information about the data or certificates than what's being ...
0
votes
1answer
104 views

Need for additional verification in mutual TLS authentication with own CA

Say, the goal is to facilitate secure communication between two parties. The definition of secure is that both parties can be sure that they are actually talking to a trusted party, not somebody else ...
0
votes
1answer
76 views

Format of finshed message when the cipher selected is “TLS_ECDH_ECDSA_WITH_NULL_SHA”

i wanted to understand difference in the "Finished message" when different cipher site selected with encryption and with out encryption. I am able to find the format of Finished message when the ...
2
votes
2answers
727 views

Mutual TLS and Cert Pinning solving the same problem?

To prevent MITM from my app I will use cert pinning. To prevent having not approved parties communicate to my server I can use Mutal TLS, which actually accepting communication from trusted sources. ...
2
votes
1answer
248 views

How effective is Expect-CT against content inspection in an enterprise context?

HPKP was used to ensure that a browser accepts to connect to a site only if the public key he has on file is the one presented by the target site. I saw it as a way to make deep content inspection ...
2
votes
1answer
735 views

How does client authentication work when using a TLS Proxy?

We're using a load balancer, which implements TLS interception for a server, which in turn uses TLS Client authentication. Since TLS interception implies that the client will make the connection to ...
0
votes
2answers
846 views

Intercepting Android 9 app-traffic

I used MitMproxy until recently I switched from the Samsung Galaxy S5 to the S9+ which runs Android 9... and suddenly I can't intercept apptraffic anymore. Looks like the proxy in the wifi-settings is ...
2
votes
0answers
125 views

Identification of Unknown Potential MITM/Malware involving SSL Connections

On my server one of the services is a Discord bot. It was down which prompted me to look into why. In my syslogs I noticed three increasingly concerning items: do-agent[1066]: 2019/08/25 08:50:21 ...
1
vote
1answer
139 views

Is connection established with two way SSL as secure as SSH?

If we establish the connections between two peers using two way SSL with strict configuration(TLS1.3 ,strict cipher etc..) and disabling client initiated re-negotiation. And likewise we establish the ...
1
vote
0answers
350 views

mitmproxy request URL redirection does not work

I need to redirect the user's request in such a way when a user enters: https://a.com the mitmproxy redirect it to: https://www.newsite.com/?somepage From a previous post, I found this script in the ...
3
votes
2answers
2k views

Not able to intercept traffic from nike.com login request

I'm using BurpSuite to intercept the HTTP/HTTPS requests sent when logging in on https://www.nike.com/. I'm trying to achieve this with the following step: Opening BurpSuite and Firefox Turning on ...
0
votes
0answers
2k views

Intercept mobile traffic using burp

I'm trying to intercept a mobile traffic of an android app I built using burp suite. I connect the mobile device to burp proxy, and install the CA. But I get a protocol error message, and couldn't see ...
-1
votes
1answer
1k views

mitmproxy: Error starting proxy server: OSError(98, 'Address already in use') [closed]

I just installed mitmproxy tool. I want to run it. Once I type: sudo mitmproxy I get this error: Error starting proxy server: OSError(98, 'Address already in use') I searched and found some ...
0
votes
0answers
63 views

TLS connection - Detecting data breach / manipulation [duplicate]

I need some help in creating a secure connection using TLS. I have a downloadable software that connects to our server using TLS connection. We want to ensure that the data sent by client to the ...
2
votes
1answer
617 views

Does SSL inspection break applications utilizing certificate pinning?

A number of popular mobile apps utilize certificate pinning, such as Facebook. Does this mean that these applications cease to function completely on corporate and academic networks that utilize SSL ...
0
votes
2answers
1k views

Why does pinning a CA root certificate not present a security risk?

AWS recommends pinning their root certificate when implementing SSL pinning. My understanding is that SSL pinning for mobile applications mitigates a situation where an attacker has installed a ...