Questions tagged [tls-intercept]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
0 answers
23 views

x509 certificates are still exposed even with Encrypted Client hello?

Encrypted Client Hello hides Server Name Indication (SNI). However, looking at the TLS Handshake (https://tls12.ulfheim.net/). Wouldn't it be possible for a middle-man to inspect the TLS Handshake and ...
user avatar
  • 111
0 votes
0 answers
18 views

TLS Interception basics [closed]

I am trying to perform TLS interception in which I was given 2 containers: Host01 and Attacker with a br-intercept bridge. So every HTTP/HTTPS request from Host01 to the Internet passes through the ...
user avatar
0 votes
2 answers
120 views

How is man-in-the-middle attack prevented in TLS? [duplicate]

As I understand the original master key, which is used to encrypt the application data is never transmitted over the wire and it is calculated on both client and server individually using a hashing-...
user avatar
  • 101
0 votes
0 answers
66 views

Is it possible that data is still encrypted even when you intercept TLS? [duplicate]

I've recently set up a mitmproxy on my phone and it seems to work fine. It intercepts that request for https websites and I can view their content. But I'm trying to intercept data from a banking app ...
user avatar
  • 1
0 votes
0 answers
189 views

Couldn't validate TLS certificate - Nord VPN

I received this notification from Nord randomly. Should I be worried? Is there something I can do? Am I being hacked? P.S. clicked Don't trust EDIT: I tried connecting from mobile data and am ...
user avatar
0 votes
0 answers
302 views

How some mobile apps prevent http traffic from being intercepted through a proxy like BurpSuite?

I noticed more and more times that some mobile apps are able to block requests, and they don't forward those requests to the server if they're going to be intercepted with a proxy like BurpSuite. This ...
user avatar
  • 54
0 votes
1 answer
101 views

Prevent TLS inspection by using TLS nested inside of TLS

Say that I have a program that needs to communicate with my own server. I use TLS to secure the connection, however the program is running within a network, which sends all TLS traffic through a TLS ...
user avatar
  • 157
0 votes
1 answer
59 views

What's injected interception?

I was reading this pdf and at slide number 23 and 24 I read "injected interception". What's that means ? in my mind it should be a type of interception that are made by injection. I mean I ...
user avatar
  • 105
3 votes
3 answers
220 views

Are TLS v1.3 connections over open Wi-Fi secure?

If a non-compromised device is connected to the internet via open Wi-Fi, anyone can view the traffic. But if all the connections to the servers use a reasonably secure cryptographic protocol (such as ...
user avatar
1 vote
2 answers
607 views

How to dump SSL key log for non-browser applications?

I have a game, and I want to know its api request endpoints. But since it is encrypted, I need to get its key log file to decrypt it in wireshark. I tried to run my application with the command --ssl-...
user avatar
11 votes
1 answer
2k views

If a WAF is compromised, can the adversary view all the traffic in clear text provided WAF uses SSL cert to decrypt it?

I understand Web Application Layer Firewall (WAF) uses an SSL cert to decrypt and inspect the traffic before passing to the backend server. If an attacker could gain admin access to both the WAF ...
user avatar
  • 113
0 votes
1 answer
92 views

How Does SSL Orchestrator Work? [duplicate]

My organization recently added F5 SSL Orchestrator to our network that ended up breaking one of our SSL certs. There is an explanation of how SSL Orchestrator works from F5 here. The description ...
user avatar
1 vote
1 answer
229 views

What strategies exist for decrypting and inspecting TLS 1.3 traffic?

TLS 1.3 is a large departure from TLS 1.2 in many ways. Relevant to this question are the fact that all TLS 1.3 ciphers provide Forward Secrecy -- which means strategies used in TLS 1.2 and prior to ...
user avatar
  • 50
1 vote
0 answers
178 views

Needing help intercepting local SSL traffic on a difficult Android app

I'm trying to intercept traffic from an Andriod app. I've forwarded ports 80, 443, 6699 and 6698 on Kali to a listener port and set up arp-spoofing. I'm using BurpSuite on the same computer to listen ...
user avatar
  • 11
0 votes
3 answers
208 views

Nextgen firewalls - encrypted traffic inspection

I read recently about next generation firewalls that use deep-packet-inspection, intrusion-prevention and something the manufacturers call encrypted-traffic-inspection, encrypted-traffic-analytics. ...
user avatar
2 votes
1 answer
198 views

Tor for confidentiality on corporate network

I work in gov organization and recently I learned they set up a MITM, by installing some certificates - so when I visit any web site and then check the certificate info it shows the certificate ...
user avatar
-1 votes
1 answer
156 views

Preventing MITM Attack with Squid

There are two options, what is the best approach? I want to either Create a squid proxy server that detects MITM attacks or Create a python UI application to detect differences between local ...
user avatar
  • 442
0 votes
2 answers
524 views

Prevent ssl pinning bypasses

I want to understand if end user is doing MITM attack on my app and i want my API server to receive this. Is there any way i can hook an SDK or some listener that tracks which certificate is being ...
user avatar
1 vote
1 answer
305 views

Can't log in into Twitter for Android app after SSL Bypass

I don't know if this is the right forum for this kind of question. I was trying to intercept traffic from Twitter for Android app and for that I needed to bypass the SSL pin they implemented. ...
user avatar
  • 21
6 votes
1 answer
393 views

Exactly why is it not possible to "drop-out" of TLS 1.3 proxy inspection?

I have been reading a number of articles that state it is not possible for an inspection proxy to simply drop-out/disengage from a TLS 1.3 connection in the same way that is possible in TLS 1.2. Such ...
user avatar
  • 75
1 vote
1 answer
149 views

How can a site preemptively notify browsers to enforce an SSL on their domain?

I learned about this years ago and don't remember enough of the keywords to search for it appropriately. Its where sites can tell the browser that the site must not allow the site to be downgraded to ...
user avatar
  • 1,495
0 votes
1 answer
795 views

How to decrypt TLS traffic originating from a Windows service on my Windows 10 PC?

Some months ago I bought a peripheral device for my Windows 10 computer (think of something like a game controller). My home router has a function that allows it to capture all incoming and outgoing ...
user avatar
  • 41
1 vote
1 answer
81 views

What are the limitation on encrpyting proxy

i would like to know if i encrypt a proxy server communication with TLS v1.3 is it still possible for a firewall censor to a deep packet scanning to decrypt. Also, what can be done to make the ...
user avatar
2 votes
1 answer
349 views

Error in intercepting the request of an Android application

I'm trying to analyze my flutter app's network traffic so I used burp suite for intercepting. First, I'm using the proxy option of burpsuite. I set my PC's IP address and port as 8080. Also in my ...
user avatar
  • 121
0 votes
1 answer
2k views

need an Alternative to ssl pinning for web applications

I am developing a web app and while testing it on burpsuite I found that it is vulnerable to the proxy SSL certificate. I did some research and found that it was handled by a technique called SSL ...
user avatar
  • 165
30 votes
6 answers
6k views

As a contractor how do I work on multiple client networks without data leakage?

I am a contractor who does development for more than one client. Let's call them Client A, Client B, and Client X. I use my own laptop for all 3 clients. Throughout the day, I have to work on and ...
user avatar
  • 401
2 votes
3 answers
2k views

Intercept HTTP Traffic of an android app?

I was trying to test and intercept traffic from an app developed on Rhodes open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can ...
user avatar
  • 121
0 votes
0 answers
21 views

authenication of client in one way ssl [duplicate]

In below ssl diagram : I have one doubt with 1-way ssl. If there is an interceptor in-between client and server who can alter in following way : In step 8, when client is sending his symetric key to ...
user avatar
2 votes
1 answer
158 views

Why does a firewall reencrypt https traffic

I have a Sophos XG firewall. I use it at home (to play around with) This firewall is capable to scan HTTPS traffic. It decrypts the traffic and re-encrypts the traffic again. For the re-encryption of ...
user avatar
  • 23
0 votes
0 answers
138 views

Manual TLS decryption with master secret

Assuming I have the master secret from SSLKEYLOGFILE client random, and server random, can I decrypt any tls traffic captured? I've started from Golang's TLS implementation, pulled the connection ...
user avatar
  • 1
5 votes
2 answers
8k views

Is there no way to bypass certificate pinning without patching apps?

Can you do anything other than patching apps' compiled-code/cert-files (which is app-specific, requires manual analysis and patching + super-user/root) to intercept TLS traffic of apps that use ...
user avatar
  • 153
0 votes
0 answers
406 views

Monitor HTTPS URL logging of a specific device of a Network

Goal The main goal is to monitor all the URL logging (HTTPS) of a specific device in my Network. So I’m decided to buy a Security tool WifiPineApple from Hak5 store. Ex. Alexa, Chromecast, and maybe ...
user avatar
  • 125
2 votes
1 answer
150 views

How can one detect and mainly bypass TLS inspection as a user with an enterprise managed device?

Let's assume Alice is an employee of the Chuck company. Alice likes to communicate with Bob, a server somewhere in the internet. Chuck, being a security orientated company, inspects all TLS ...
user avatar
  • 1,134
0 votes
0 answers
1k views

Force third party app to trust Charles Root Certificate

I downloaded two different third-party apps (running on Windows) in order to figure what HTTP calls does it make to an external server on the internet. Both apps are calling the same server as far ...
user avatar
0 votes
2 answers
171 views

Reasons not to preserve the certification path on an intercepting HTTPS proxy

In this environment an intercepting HTTPS proxy is used for legitimate purposes and its CA root certificate is installed on all clients. Every HTTPS proxy solution I've seen so far simply signs a new ...
user avatar
  • 15.9k
2 votes
0 answers
517 views

BURP SSL connection failing on Genymotion Virtual Device - Android 8.0 API 26

Everything earlier used to work fine. However, recently I downloaded a newer virtual device on Genymotion, which is an Android 8.0 API 26. I have been struggling to get HTTPS traffic intercepted on ...
user avatar
  • 1,472
0 votes
0 answers
97 views

Authentication Message in TLS

I was reading RFC8446-TLS13 and a tls visualization and could not grasp some concepts. I have all the tls connection data (client hello etc.) and SSL Logs (server_traffic_handshake_secret) I see that ...
user avatar
  • 101
0 votes
2 answers
430 views

PKCS12 password stolen - what's the security impact?

I want to know that what the security impact is if someone leaks the password of a PKCS12 certificate. I am referring to the password which is required when we export the certificate.
user avatar
1 vote
1 answer
156 views

How to display HTTPS contents [Using Proxy]

I'm a beginner at proxy traffic stuff and I'm struggling here with Charles Proxy I'm trying to 'intercept traffic'. I have an HTTPS page and I want to display the data from the content (inside ...
user avatar
  • 11
0 votes
0 answers
18 views

SSL stripping - initiate HTTPS or HTTP first? [duplicate]

I am quite confused. I have been reading about SSL stripping and what I have found is that The client (victim) has to initiate the first connection via HTTP The server will redirect to HTTPS - here ...
user avatar
5 votes
1 answer
705 views

How to mitigate credential disclosure in man in the middle attack

I have the followin scenario and looking for a secure solution. There is a web application, hosted on IIS. The connection is established over TLS 1.2 and is encrypted. So the steps are Client ...
user avatar
1 vote
0 answers
1k views

Charles Proxy intercepting SSL Pinning enabled traffic

An Android application that has SSL Pinning was successfully tested on a mobile device running Android 6 (with the certificates installed) using Burp proxy and OWASP ZAP Proxy. As expected the ...
user avatar
  • 11
0 votes
1 answer
177 views

Which certificate on my computer is used to make a SSL/TLS handshake

When connecting to a specific website(www.test.yyy.com) inside of an organisation SSL/TLS handshake is performed. From my understanding, I would say that one of my personal certificates on computer is ...
user avatar
0 votes
0 answers
162 views

Is it safe to use HTTPS websites over an unknown PPTP VPN? [duplicate]

I want to create e.g a Gmail account while connected to an unknown PPTP VPN. Is it safe, or can the owner of the PPTP VPN see my Gmail web page information, such as username or password, at all? Can ...
user avatar
1 vote
1 answer
314 views

How to listen on all encrypted (SSL/TLS) traffic of a (Windows) system under your control?

On one of my Windows machines (so I am admin and basically can do whatever I want with it) I'd like to analyse traffic which obviously is directed to a malware C&C server. The traffic is TLS ...
user avatar
  • 203
1 vote
0 answers
216 views

How does HTTP Catcher (iOS app) work on SSL/TLS? [duplicate]

From the official description: HTTP Catcher is a web debugging proxy. It can be used to intercept, inspect, modify and replay web traffic. Can someone explain to me how HTTP Catcher manages to do ...
user avatar
  • 715
0 votes
2 answers
785 views

private key of SSL certificate

To create a certificate, first we need to fill a CSR and in CSR we have to place our public key and that key pair can be generated by different ways in different devices. To do ssh, we run command (...
user avatar
1 vote
2 answers
536 views

Is there any Security issue if we not used SSL between AWS Cloudfront and AWS ALB?

I have an application that is hosted on AWS. It has an Application Load Balancer in its front and it is also attached to the Cloudfront to handle a heavy load. In my case, I have enabled SSL only on ...
user avatar
0 votes
1 answer
228 views

Why is subject verification an effective means to detect MitM attacks in TLS? [duplicate]

Say, an attacker fakes an original server certificate by a trusted CA using a another certificate from the same CA in a Man-in-the-middle attack. Why can this be detected using subject verification on ...
user avatar
  • 1,118
1 vote
1 answer
137 views

MitM to intercept SSL/TLS based on network traffic alone?

Say, an attacker wants to perform a MitM but all he has available is the network traffic between a client and a server. He has no further information about the data or certificates than what's being ...
user avatar
  • 1,118