Questions tagged [tls-intercept]
The tls-intercept tag has no usage guidance.
178
questions
2
votes
0
answers
108
views
Couldn't establish a secure connection
NordVPN popped up with
"Couldn't establish a secure connection." "We couldn't validate this
TLS certificate and ensure a secure connection required for NordVPN to
run. It looks like ...
- 21
0
votes
1
answer
75
views
Connect to corporate wifi with personal phone - decrypt https?
Someone asked regarding wifi yesterday but can't find the post anymore.
When connecting to corporate wifi with my personal iPhone for first time, I am asked to trust a "Root CA". However, I ...
14
votes
1
answer
3k
views
SSL issue captures Facebook app send out traffic
I tried to capture the send-out traffic of the Android app (Google Drive, Facebook, etc.). This is my security thesis.
I succeed capture send-out traffic on the Google Drive app with Mitmproxy but ...
- 243
1
vote
0
answers
82
views
Central Web Proxy vs Endpoint Protection
Imagine the following imaginary scenarios:
In order to browse the Internet, users must go through a central web proxy. It is authenticated and can enforce rules about who can access which URLs or ...
1
vote
1
answer
1k
views
Is SSL pinning bypass considered a vulnerability? If yes, what are the tightening/solution suggestions?
I'm a pentester and this is my first question here. I've managed to circumvent the ssl certificate pinning implementation on a few mobile apps.
Frankly, the applications I test are critical bank ...
- 15
1
vote
1
answer
670
views
Can messages be intercepted when in airplane mode?
Recently started turning my phone on airplane mode and it got me curious. Airplane mode is supposed to turn off all radio signals. So, I won’t be able to receive or send messages (emails aswell, and ...
- 27
0
votes
0
answers
67
views
Check insecure connection with script
I'm checking connections that traffic data in plain text, example: **http://**site.com
but I'd like to check with some script.
Does anyone know any scripts or how I can use openssl to find out if a ...
2
votes
1
answer
737
views
Can a HTTP proxy see HTTPS traffic?
I was checking some things with the (Chromium) inspect tool and I saw that if you go to the 'Network' section the IP address wasn't the actual DNS A (IPv4) or AAAA (IPv6) IP address but the Proxy IP ...
- 31
4
votes
1
answer
191
views
x509 certificates are still exposed even with Encrypted Client hello?
Encrypted Client Hello hides Server Name Indication (SNI). However, looking at the TLS Handshake (https://tls12.ulfheim.net/). Wouldn't it be possible for a middle-man to inspect the TLS Handshake and ...
- 141
1
vote
2
answers
5k
views
How is man-in-the-middle attack prevented in TLS? [duplicate]
As I understand the original master key, which is used to encrypt the application data is never transmitted over the wire and it is calculated on both client and server individually using a hashing-...
- 111
0
votes
0
answers
67
views
Is it possible that data is still encrypted even when you intercept TLS? [duplicate]
I've recently set up a mitmproxy on my phone and it seems to work fine. It intercepts that request for https websites and I can view their content.
But I'm trying to intercept data from a banking app ...
- 101
0
votes
0
answers
4k
views
Couldn't validate TLS certificate - Nord VPN
I received this notification from Nord randomly. Should I be worried? Is there something I can do? Am I being hacked?
P.S. clicked Don't trust
EDIT: I tried connecting from mobile data and am ...
0
votes
0
answers
1k
views
How some mobile apps prevent http traffic from being intercepted through a proxy like BurpSuite?
I noticed more and more times that some mobile apps are able to block requests, and they don't forward those requests to the server if they're going to be intercepted with a proxy like BurpSuite. This ...
- 154
0
votes
1
answer
326
views
Prevent TLS inspection by using TLS nested inside of TLS
Say that I have a program that needs to communicate with my own server.
I use TLS to secure the connection, however the program is running within a network, which sends all TLS traffic through a TLS ...
- 157
0
votes
1
answer
70
views
What's injected interception?
I was reading this pdf and at slide number 23 and 24 I read "injected interception". What's that means ?
in my mind it should be a type of interception that are made by injection. I mean I ...
- 105
4
votes
3
answers
560
views
Are TLS v1.3 connections over open Wi-Fi secure?
If a non-compromised device is connected to the internet via open Wi-Fi, anyone can view the traffic.
But if all the connections to the servers use a reasonably secure cryptographic protocol (such as ...
2
votes
2
answers
4k
views
How to dump SSL key log for non-browser applications?
I have a game, and I want to know its api request endpoints. But since it is encrypted, I need to get its key log file to decrypt it in wireshark. I tried to run my application with the command --ssl-...
11
votes
1
answer
2k
views
If a WAF is compromised, can the adversary view all the traffic in clear text provided WAF uses SSL cert to decrypt it?
I understand Web Application Layer Firewall (WAF) uses an SSL cert to decrypt and inspect the traffic before passing to the backend server. If an attacker could gain admin access to both the WAF ...
- 115
0
votes
1
answer
142
views
How Does SSL Orchestrator Work? [duplicate]
My organization recently added F5 SSL Orchestrator to our network that ended up breaking one of our SSL certs. There is an explanation of how SSL Orchestrator works from F5 here. The description ...
2
votes
2
answers
835
views
What strategies exist for decrypting and inspecting TLS 1.3 traffic?
TLS 1.3 is a large departure from TLS 1.2 in many ways. Relevant to this question are the fact that all TLS 1.3 ciphers provide Forward Secrecy -- which means strategies used in TLS 1.2 and prior to ...
- 122
1
vote
0
answers
307
views
Needing help intercepting local SSL traffic on a difficult Android app
I'm trying to intercept traffic from an Andriod app.
I've forwarded ports 80, 443, 6699 and 6698 on Kali to a listener port and set up arp-spoofing. I'm using BurpSuite on the same computer to listen ...
- 11
0
votes
3
answers
338
views
Nextgen firewalls - encrypted traffic inspection
I read recently about next generation firewalls that use deep-packet-inspection, intrusion-prevention and something the manufacturers call encrypted-traffic-inspection, encrypted-traffic-analytics.
...
- 111
2
votes
1
answer
221
views
Tor for confidentiality on corporate network
I work in gov organization and recently I learned they set up a MITM, by installing some certificates - so when I visit any web site and then check the certificate info it shows the certificate ...
- 21
-1
votes
1
answer
285
views
Preventing MITM Attack with Squid
There are two options, what is the best approach?
I want to either
Create a squid proxy server that detects MITM attacks
or
Create a python UI application to detect differences between local ...
- 442
0
votes
2
answers
835
views
Prevent ssl pinning bypasses
I want to understand if end user is doing MITM attack on my app and i want my API server to receive this. Is there any way i can hook an SDK or some listener that tracks which certificate is being ...
- 41
1
vote
1
answer
662
views
Can't log in into Twitter for Android app after SSL Bypass
I don't know if this is the right forum for this kind of question.
I was trying to intercept traffic from Twitter for Android app and for that I needed to bypass the SSL pin they implemented. ...
- 21
6
votes
1
answer
715
views
Exactly why is it not possible to "drop-out" of TLS 1.3 proxy inspection?
I have been reading a number of articles that state it is not possible for an inspection proxy to simply drop-out/disengage from a TLS 1.3 connection in the same way that is possible in TLS 1.2.
Such ...
- 75
1
vote
1
answer
157
views
How can a site preemptively notify browsers to enforce an SSL on their domain?
I learned about this years ago and don't remember enough of the keywords to search for it appropriately.
Its where sites can tell the browser that the site must not allow the site to be downgraded to ...
- 1,515
1
vote
1
answer
2k
views
How to decrypt TLS traffic originating from a Windows service on my Windows 10 PC?
Some months ago I bought a peripheral device for my Windows 10 computer (think of something like a game controller). My home router has a function that allows it to capture all incoming and outgoing ...
- 141
1
vote
1
answer
85
views
What are the limitation on encrpyting proxy
i would like to know if i encrypt a proxy server communication with TLS v1.3 is it still possible for a firewall censor to a deep packet scanning to decrypt. Also, what can be done to make the ...
- 15
2
votes
1
answer
468
views
Error in intercepting the request of an Android application
I'm trying to analyze my flutter app's network traffic so I used burp suite for intercepting. First, I'm using the proxy option of burpsuite. I set my PC's IP address and port as 8080. Also in my ...
- 121
1
vote
1
answer
3k
views
need an Alternative to ssl pinning for web applications
I am developing a web app and while testing it on burpsuite I found that it is vulnerable to the proxy SSL certificate.
I did some research and found that it was handled by a technique called SSL ...
- 175
30
votes
6
answers
6k
views
As a contractor how do I work on multiple client networks without data leakage?
I am a contractor who does development for more than one client. Let's call them Client A, Client B, and Client X.
I use my own laptop for all 3 clients.
Throughout the day, I have to work on and ...
- 401
2
votes
3
answers
3k
views
Intercept HTTP Traffic of an android app?
I was trying to test and intercept traffic from an app developed on Rhodes open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can ...
- 131
0
votes
0
answers
21
views
authenication of client in one way ssl [duplicate]
In below ssl diagram :
I have one doubt with 1-way ssl. If there is an interceptor in-between client and server who can alter in following way :
In step 8, when client is sending his symetric key to ...
- 101
2
votes
1
answer
276
views
Why does a firewall reencrypt https traffic
I have a Sophos XG firewall. I use it at home (to play around with) This firewall is capable to scan HTTPS traffic.
It decrypts the traffic and re-encrypts the traffic again. For the re-encryption of ...
- 23
0
votes
0
answers
180
views
Manual TLS decryption with master secret
Assuming I have the master secret from SSLKEYLOGFILE client random, and server random, can I decrypt any tls traffic captured? I've started from Golang's TLS implementation, pulled the connection ...
- 1
4
votes
2
answers
11k
views
Is there no way to bypass certificate pinning without patching apps?
Can you do anything other than patching apps' compiled-code/cert-files (which is app-specific, requires manual analysis and patching + super-user/root) to intercept TLS traffic of apps that use ...
- 143
0
votes
0
answers
619
views
Monitor HTTPS URL logging of a specific device of a Network
Goal
The main goal is to monitor all the URL logging (HTTPS) of a specific device in my Network. So I’m decided to buy a Security tool WifiPineApple from Hak5 store.
Ex. Alexa, Chromecast, and maybe ...
- 125
2
votes
1
answer
286
views
How can one detect and mainly bypass TLS inspection as a user with an enterprise managed device?
Let's assume Alice is an employee of the Chuck company.
Alice likes to communicate with Bob, a server somewhere in the internet.
Chuck, being a security orientated company, inspects all TLS ...
- 1,144
0
votes
2
answers
232
views
Reasons not to preserve the certification path on an intercepting HTTPS proxy
In this environment an intercepting HTTPS proxy is used for legitimate purposes and its CA root certificate is installed on all clients. Every HTTPS proxy solution I've seen so far simply signs a new ...
- 18.4k
2
votes
0
answers
744
views
BURP SSL connection failing on Genymotion Virtual Device - Android 8.0 API 26
Everything earlier used to work fine. However, recently I downloaded a newer virtual device on Genymotion, which is an Android 8.0 API 26. I have been struggling to get HTTPS traffic intercepted on ...
- 1,522
0
votes
0
answers
102
views
Authentication Message in TLS
I was reading RFC8446-TLS13 and a tls visualization and could not grasp some concepts.
I have all the tls connection data (client hello etc.) and SSL Logs (server_traffic_handshake_secret)
I see that ...
- 101
1
vote
2
answers
713
views
PKCS12 password stolen - what's the security impact?
I want to know that what the security impact is if someone leaks the password of a PKCS12 certificate. I am referring to the password which is required when we export the certificate.
1
vote
1
answer
195
views
How to display HTTPS contents [Using Proxy]
I'm a beginner at proxy traffic stuff and I'm struggling here with Charles Proxy
I'm trying to 'intercept traffic'. I have an HTTPS page and I want to display the data from the content (inside ...
- 11
0
votes
0
answers
20
views
SSL stripping - initiate HTTPS or HTTP first? [duplicate]
I am quite confused. I have been reading about SSL stripping and what I have found is that
The client (victim) has to initiate the first connection via HTTP
The server will redirect to HTTPS - here ...
5
votes
1
answer
732
views
How to mitigate credential disclosure in man in the middle attack
I have the followin scenario and looking for a secure solution.
There is a web application, hosted on IIS. The connection is established over TLS 1.2 and is encrypted.
So the steps are
Client ...
1
vote
0
answers
2k
views
Charles Proxy intercepting SSL Pinning enabled traffic
An Android application that has SSL Pinning was successfully tested on a mobile device running Android 6 (with the certificates installed) using Burp proxy and OWASP ZAP Proxy. As expected the ...
- 11
1
vote
1
answer
260
views
Which certificate on my computer is used to make a SSL/TLS handshake
When connecting to a specific website(www.test.yyy.com) inside of an organisation SSL/TLS handshake is performed.
From my understanding, I would say that one of my personal certificates on computer is ...
- 13
0
votes
0
answers
231
views
Is it safe to use HTTPS websites over an unknown PPTP VPN? [duplicate]
I want to create e.g a Gmail account while connected to an unknown PPTP VPN. Is it safe, or can the owner of the PPTP VPN see my Gmail web page information, such as username or password, at all? Can ...
- 1