Questions tagged [tls-intercept]
The tls-intercept tag has no usage guidance.
184
questions
2
votes
2
answers
622
views
Are my internal systems susceptible to MitM if the root/chain is shared amongst all customers?
Suppose that my certificate authority issues private certificates using the same chain for all of their customers. Does this mean that a malicious actor who happens to be another one of their ...
- 2,289
2
votes
3
answers
3k
views
Intercept HTTP Traffic of an android app?
I was trying to test and intercept traffic from an app developed on Rhodes open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can ...
CommunityBot
- 1
5
votes
4
answers
3k
views
Company decrypting SSL, is it common?
We've just implemented a proxy that decrypts all SSL traffic in order to classify and scan it. Naturally a lot of our users feel concerned. We're a small company (100 users) owned by a big company (...
- 55.1k
1
vote
1
answer
106
views
How exactly do corporate companies decrypt employee SSL/HTTPS traffic on company owned corporate devices? [duplicate]
I understand that corporate companies can/do decrypt employee SSL/HTTPs traffic because the company owned device has a company owned SSL certifiate.
I thought the first certificate would encrypt the ...
- 155
0
votes
0
answers
5k
views
Couldn't validate TLS certificate - Nord VPN
I received this notification from Nord randomly. Should I be worried? Is there something I can do? Am I being hacked?
P.S. clicked Don't trust
EDIT: I tried connecting from mobile data and am ...
- 1
1
vote
1
answer
179
views
Can a VPN company perform a MiTM attack if SSL Pinning is in place?
Recently, I read news about Facebook acquired the Onavo VPN company to monitor Snapchat users' traffic. It seems they executed a Man-in-the-Middle attack by replacing the certificate. But could they ...
- 36
0
votes
3
answers
243
views
Does TLS interception necessarily require a self-signed certificate? Please explain why
A brief schema of a TLS intercepting proxy - the Client connects to the Host via the Proxy in a way which allows the Proxy to perform a (consensual) MITM.
[Client] -> [Proxy] -> [Host]
It's ...
- 511
1
vote
0
answers
95
views
Triple handshake (TLS) EMS protection against attacks
In TLS we have such an extension as EMS (extended master secret).
It has been applied to protect the master secret. But I don't understand how it helps against triple handshake attack.
I assume that ...
- 1,633
1
vote
2
answers
285
views
How can I enhance the security of SSL pinning in my mobile app to prevent certificate exposure?
For example, let's say my backend address is api.xyz.com, and I have a mobile application. This application sends requests to api.xyz.com. The application employs SSL pinning, where it pins the ...
- 32.9k
2
votes
0
answers
1k
views
Couldn't establish a secure connection
NordVPN popped up with
"Couldn't establish a secure connection." "We couldn't validate this
TLS certificate and ensure a secure connection required for NordVPN to
run. It looks like ...
- 132k
0
votes
1
answer
176
views
Connect to corporate wifi with personal phone - decrypt https?
Someone asked regarding wifi yesterday but can't find the post anymore.
When connecting to corporate wifi with my personal iPhone for first time, I am asked to trust a "Root CA". However, I ...
- 281
6
votes
0
answers
627
views
Why are banks largely absent from the HSTS preload list?
There seems to be widespread support for the idea that election-related websites, of all things, should be resistant to man-in-the-middle attacks. The secret ballot makes detecting and recovering from ...
- 132k
2
votes
1
answer
2k
views
Can a HTTP proxy see HTTPS traffic?
I was checking some things with the (Chromium) inspect tool and I saw that if you go to the 'Network' section the IP address wasn't the actual DNS A (IPv4) or AAAA (IPv6) IP address but the Proxy IP ...
CommunityBot
- 1
13
votes
1
answer
4k
views
SSL issue captures Facebook app send out traffic
I tried to capture the send-out traffic of the Android app (Google Drive, Facebook, etc.). This is my security thesis.
I succeed capture send-out traffic on the Google Drive app with Mitmproxy but ...
- 12.5k
1
vote
0
answers
219
views
Central Web Proxy vs Endpoint Protection
Imagine the following imaginary scenarios:
In order to browse the Internet, users must go through a central web proxy. It is authenticated and can enforce rules about who can access which URLs or ...
4
votes
1
answer
280
views
x509 certificates are still exposed even with Encrypted Client hello?
Encrypted Client Hello hides Server Name Indication (SNI). However, looking at the TLS Handshake (https://tls12.ulfheim.net/). Wouldn't it be possible for a middle-man to inspect the TLS Handshake and ...
CommunityBot
- 1
6
votes
0
answers
6k
views
How does TLS 1.3 break inspection?
The latest research seems to indicate that TLS 1.3 completely breaks the MITM/proxy model of many current security tools.
I don't fully understand how it does that and if there are ways around this. ...
- 1
7
votes
1
answer
39k
views
Disable or bypass SSL Pinning/Certificate Pinning on Android 6.0.1
Previously I have been able to bypass SSL Pinning by using the program JustTrustMe with the Xposed framework for nearly every app.
https://github.com/Fuzion24/JustTrustMe
However it has started to ...
2
votes
2
answers
2k
views
What strategies exist for decrypting and inspecting TLS 1.3 traffic?
TLS 1.3 is a large departure from TLS 1.2 in many ways. Relevant to this question are the fact that all TLS 1.3 ciphers provide Forward Secrecy -- which means strategies used in TLS 1.2 and prior to ...
2
votes
1
answer
3k
views
Is SSL pinning bypass considered a vulnerability? If yes, what are the tightening/solution suggestions?
I'm a pentester and this is my first question here. I've managed to circumvent the ssl certificate pinning implementation on a few mobile apps.
Frankly, the applications I test are critical bank ...
2
votes
2
answers
4k
views
Session ID in the very First Client Hello
Is it normal to have Session ID in the first Client Hello, and then the server picks it up and accepts the same Session ID and uses it in all further TLS traffic. That is the "Client or Browser" tells ...
- 141
1
vote
1
answer
831
views
Can messages be intercepted when in airplane mode?
Recently started turning my phone on airplane mode and it got me curious. Airplane mode is supposed to turn off all radio signals. So, I won’t be able to receive or send messages (emails aswell, and ...
- 11.6k
1
vote
1
answer
4k
views
TLS interception on an Android phone
Here are the steps I've been through until I hit a problem.
I have a website that runs on an HTTPS protocol serving the Android application
I generally debug requests / responses via Wireshark ...
- 132k
2
votes
3
answers
409
views
Is this threat in SSL for real?
I was talking with a friend about how SSL can be Man-in-the-Middled with relative ease. He claimed this:
Anyone can compromise the DNS request authority chain (true).
Anyone can generate a custom ...
0
votes
0
answers
124
views
Check insecure connection with script
I'm checking connections that traffic data in plain text, example: **http://**site.com
but I'd like to check with some script.
Does anyone know any scripts or how I can use openssl to find out if a ...
1
vote
0
answers
7k
views
Failed to connect to www.google.co.in:443 error in burp suite?
I am trying to intercept the https request, but I getting this error while searching anything in URL.it's hitting my burp, but I can't get any response after clicking forward button,it comes with this ...
2
votes
2
answers
2k
views
iOS traffic not shown in proxy when SSL pinning enabled
I have and iOS application to test. As per the latest security fix SSL pinning is enabled in the app. But now I am not able to see any traffic related to the application in my proxy tool. But ...
- 50.3k
3
votes
2
answers
10k
views
How is man-in-the-middle attack prevented in TLS? [duplicate]
As I understand the original master key, which is used to encrypt the application data is never transmitted over the wire and it is calculated on both client and server individually using a hashing-...
- 5,507
0
votes
0
answers
67
views
Is it possible that data is still encrypted even when you intercept TLS? [duplicate]
I've recently set up a mitmproxy on my phone and it seems to work fine. It intercepts that request for https websites and I can view their content.
But I'm trying to intercept data from a banking app ...
- 132k
0
votes
0
answers
2k
views
How some mobile apps prevent http traffic from being intercepted through a proxy like BurpSuite?
I noticed more and more times that some mobile apps are able to block requests, and they don't forward those requests to the server if they're going to be intercepted with a proxy like BurpSuite. This ...
- 12.5k
4
votes
3
answers
1k
views
Are TLS v1.3 connections over open Wi-Fi secure?
If a non-compromised device is connected to the internet via open Wi-Fi, anyone can view the traffic.
But if all the connections to the servers use a reasonably secure cryptographic protocol (such as ...
- 11.6k
0
votes
1
answer
629
views
Prevent TLS inspection by using TLS nested inside of TLS
Say that I have a program that needs to communicate with my own server.
I use TLS to secure the connection, however the program is running within a network, which sends all TLS traffic through a TLS ...
- 205k
0
votes
1
answer
113
views
What's injected interception?
I was reading this pdf and at slide number 23 and 24 I read "injected interception". What's that means ?
in my mind it should be a type of interception that are made by injection. I mean I ...
- 205k
2
votes
1
answer
579
views
Error in intercepting the request of an Android application
I'm trying to analyze my flutter app's network traffic so I used burp suite for intercepting. First, I'm using the proxy option of burpsuite. I set my PC's IP address and port as 8080. Also in my ...
CommunityBot
- 1
3
votes
2
answers
7k
views
How to dump SSL key log for non-browser applications?
I have a game, and I want to know its api request endpoints. But since it is encrypted, I need to get its key log file to decrypt it in wireshark. I tried to run my application with the command --ssl-...
- 351
11
votes
1
answer
2k
views
If a WAF is compromised, can the adversary view all the traffic in clear text provided WAF uses SSL cert to decrypt it?
I understand Web Application Layer Firewall (WAF) uses an SSL cert to decrypt and inspect the traffic before passing to the backend server. If an attacker could gain admin access to both the WAF ...
- 65.7k
4
votes
2
answers
3k
views
Preventing a Burp and Intercept
I have created an authentication API to manage user sessions and the works. To log a user in, the user send their credentials to my API endpoint and it returns “true” or “false” based on their login. ...
1
vote
2
answers
1k
views
Android application interception issue
I'm a newbie to android pen testing and started off with an application.
The app uses HTTPS and works fine without configuring any proxy.
When a proxy like a burp suite is configured, the app ...
CommunityBot
- 1
0
votes
1
answer
238
views
How Does SSL Orchestrator Work? [duplicate]
My organization recently added F5 SSL Orchestrator to our network that ended up breaking one of our SSL certs. There is an explanation of how SSL Orchestrator works from F5 here. The description ...
- 132k
2
votes
4
answers
7k
views
Number of bytes in a TLS handshake
How can I identify precisely the exact number of bytes the ClientHello and ServerHello in a TLS traffic needs? this is for traffic analysis purpose to capture the TLS bytes of interest (client hello ...
CommunityBot
- 1
4
votes
1
answer
18k
views
How can police get someone's search history?
Sometimes I see news articles saying that someone was suspected of a crime so the police got their search history and found various google search terms etc.
What are the possible ways they can do ...
- 2,275
1
vote
0
answers
427
views
Needing help intercepting local SSL traffic on a difficult Android app
I'm trying to intercept traffic from an Andriod app.
I've forwarded ports 80, 443, 6699 and 6698 on Kali to a listener port and set up arp-spoofing. I'm using BurpSuite on the same computer to listen ...
- 132k
0
votes
3
answers
493
views
Nextgen firewalls - encrypted traffic inspection
I read recently about next generation firewalls that use deep-packet-inspection, intrusion-prevention and something the manufacturers call encrypted-traffic-inspection, encrypted-traffic-analytics.
...
- 4,798
2
votes
1
answer
260
views
Tor for confidentiality on corporate network
I work in gov organization and recently I learned they set up a MITM, by installing some certificates - so when I visit any web site and then check the certificate info it shows the certificate ...
- 21
17
votes
3
answers
42k
views
My school wifi asks to 'trust' a certificate on iPhones. Does this allow them to view SSL traffic?
There is a lot of confusion around this on here, so I am making this post to be sure to understand it correctly. My school uses Aruba networks wifi, and after I type my Active Directory username and ...
- 147
7
votes
3
answers
5k
views
Can firewalls decrypt SSL packets?
I was wondering if the firewall has the ability to decrypt the SSL traffic.
If so, the network admin is able to read the data in clear text at transit.
- 132k
-1
votes
1
answer
406
views
Preventing MITM Attack with Squid
There are two options, what is the best approach?
I want to either
Create a squid proxy server that detects MITM attacks
or
Create a python UI application to detect differences between local ...
- 205k
0
votes
2
answers
1k
views
Prevent ssl pinning bypasses
I want to understand if end user is doing MITM attack on my app and i want my API server to receive this. Is there any way i can hook an SDK or some listener that tracks which certificate is being ...
- 55.1k
1
vote
1
answer
981
views
Can't log in into Twitter for Android app after SSL Bypass
I don't know if this is the right forum for this kind of question.
I was trying to intercept traffic from Twitter for Android app and for that I needed to bypass the SSL pin they implemented. ...
- 21
6
votes
1
answer
906
views
Exactly why is it not possible to "drop-out" of TLS 1.3 proxy inspection?
I have been reading a number of articles that state it is not possible for an inspection proxy to simply drop-out/disengage from a TLS 1.3 connection in the same way that is possible in TLS 1.2.
Such ...
CommunityBot
- 1