Skip to main content

Questions tagged [tls-intercept]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
42 votes
3 answers
7k views

Why is the issuer certificate different at my workplace and at home?

I have viewed Gmail's certificate chain at my workplace, and I realised it's different. It looks like this: Root CA Operative CA1 ___________.net mail.google.com When I get the ...
ampika's user avatar
  • 665
30 votes
6 answers
6k views

As a contractor how do I work on multiple client networks without data leakage?

I am a contractor who does development for more than one client. Let's call them Client A, Client B, and Client X. I use my own laptop for all 3 clients. Throughout the day, I have to work on and ...
duggulous's user avatar
  • 401
26 votes
5 answers
13k views

Can a VPN Provider MitM my SSL traffic without me noticing?

If I connect to lets say gmail over a VPN. How does the provider forward the traffic without exposing my IP, but also without breaking the SSL. Shouldn't gmail know my real IP if the traffic just gets ...
Kenny Blankenship's user avatar
16 votes
3 answers
40k views

My school wifi asks to 'trust' a certificate on iPhones. Does this allow them to view SSL traffic?

There is a lot of confusion around this on here, so I am making this post to be sure to understand it correctly. My school uses Aruba networks wifi, and after I type my Active Directory username and ...
BusinessGuy's user avatar
13 votes
1 answer
4k views

SSL issue captures Facebook app send out traffic

I tried to capture the send-out traffic of the Android app (Google Drive, Facebook, etc.). This is my security thesis. I succeed capture send-out traffic on the Google Drive app with Mitmproxy but ...
ThanhLam112358's user avatar
11 votes
1 answer
2k views

If a WAF is compromised, can the adversary view all the traffic in clear text provided WAF uses SSL cert to decrypt it?

I understand Web Application Layer Firewall (WAF) uses an SSL cert to decrypt and inspect the traffic before passing to the backend server. If an attacker could gain admin access to both the WAF ...
sxmad's user avatar
  • 115
9 votes
3 answers
3k views

Are future TLS versions going to prevent traffic inspection?

Nowadays it is possible to inspect (unencrypt) TLS (HTTPS) traffic inside an organization. The mechanism consists in using a root CA that is configured in the web client and a network device that ...
Eloy Roldán Paredes's user avatar
8 votes
1 answer
2k views

Hooking into firefox memory

I am trying to learn how to hook into the browser memory. The Frida tool is a good start to this. My goal is to extract the client-random, server-random and symmetric session keys established at the ...
user avatar
7 votes
3 answers
4k views

Hide clear SNI when using https

A server with IP address a.b.c.d is hosting multiple SSL websites. When connecting to each website, a proper browser sends a request which include the destination host in an uncrypted clear text ...
David Refoua's user avatar
7 votes
3 answers
5k views

Can firewalls decrypt SSL packets?

I was wondering if the firewall has the ability to decrypt the SSL traffic. If so, the network admin is able to read the data in clear text at transit.
IanCool's user avatar
  • 101
7 votes
1 answer
39k views

Disable or bypass SSL Pinning/Certificate Pinning on Android 6.0.1

Previously I have been able to bypass SSL Pinning by using the program JustTrustMe with the Xposed framework for nearly every app. https://github.com/Fuzion24/JustTrustMe However it has started to ...
Ogglas's user avatar
  • 777
7 votes
2 answers
850 views

What happens if my VPN drops momentarily while using an SSL connection?

The Situation I am in an office with a connection that is routed through a BigIP firewall, with SSL interception; our computers have a root certificate to permit the intercept certs. If I browse to a ...
Doktor J's user avatar
  • 324
6 votes
2 answers
2k views

Can the network administrator of my university see what I have searched on Google?

Before you mark this one as a duplicate, I have indeed seen similar questions here but they do not provide the direct answer I'm seeking. Here are a few details: I've taken google as an example ...
ticktock's user avatar
6 votes
1 answer
873 views

Exactly why is it not possible to "drop-out" of TLS 1.3 proxy inspection?

I have been reading a number of articles that state it is not possible for an inspection proxy to simply drop-out/disengage from a TLS 1.3 connection in the same way that is possible in TLS 1.2. Such ...
rlon134's user avatar
  • 75
6 votes
0 answers
603 views

Why are banks largely absent from the HSTS preload list?

There seems to be widespread support for the idea that election-related websites, of all things, should be resistant to man-in-the-middle attacks. The secret ballot makes detecting and recovering from ...
prhymethyme's user avatar
6 votes
0 answers
6k views

How does TLS 1.3 break inspection?

The latest research seems to indicate that TLS 1.3 completely breaks the MITM/proxy model of many current security tools. I don't fully understand how it does that and if there are ways around this. ...
RussM's user avatar
  • 61
5 votes
1 answer
761 views

How to mitigate credential disclosure in man in the middle attack

I have the followin scenario and looking for a secure solution. There is a web application, hosted on IIS. The connection is established over TLS 1.2 and is encrypted. So the steps are Client ...
Athanasios Kataras's user avatar
5 votes
2 answers
13k views

Is there no way to bypass certificate pinning without patching apps?

Can you do anything other than patching apps' compiled-code/cert-files (which is app-specific, requires manual analysis and patching + super-user/root) to intercept TLS traffic of apps that use ...
Wis's user avatar
  • 153
5 votes
1 answer
2k views

Can I use CloudFlare if I want to avoid NSA and FISA secret orders?

We're running a web service in Europe, secured with TLS and we're using private keys generated on our private hardware. We would like to use CloudFlare for DDoS protection and caching reverse proxy. ...
Mikko Rantalainen's user avatar
5 votes
3 answers
865 views

Is implementing an SSL proxy server considered a good practice?

There are many questions on this site from users finding out that their employer has a certificate proxy in place, essentially implementing a man-in-the-middle attack so that all traffic is able to be ...
Nacht's user avatar
  • 925
5 votes
3 answers
3k views

Is it acceptable for an employer to install a self-signed root certificate on employees personal devices at home?

At work, my employer uses a self-signed root certificate to MITM all of our SSL/TLS traffic. Many of our internal certificates used by various micro-services and internal websites are also signed by ...
0xDEAD_BEEF's user avatar
5 votes
1 answer
599 views

Client requiring our SSL Private Key to configure the Load Balancer that reaches our server. Makes sense?

I'm facing an unusual situation, I hope you can clarify this for me. We manage some applications that are accessible through HTTPS requests on port 443 of our server X. We have a new client that is ...
vinicius.olifer's user avatar
4 votes
1 answer
17k views

How can police get someone's search history?

Sometimes I see news articles saying that someone was suspected of a crime so the police got their search history and found various google search terms etc. What are the possible ways they can do ...
user avatar
4 votes
1 answer
9k views

How can I intercept Android application's SSL traffic where SSL pinning is used?

I want to capture the SSL traffic of an Android Application which I think uses SSL pinning. I've tried running an app which says it uses VPN Tunneling and a Root Certificate to capture the SSL ...
user avatar
4 votes
2 answers
4k views

Mutual TLS and Cert Pinning solving the same problem?

To prevent MITM from my app I will use cert pinning. To prevent having not approved parties communicate to my server I can use Mutal TLS, which actually accepting communication from trusted sources. ...
Filipon's user avatar
  • 1,294
4 votes
2 answers
3k views

Preventing a Burp and Intercept

I have created an authentication API to manage user sessions and the works. To log a user in, the user send their credentials to my API endpoint and it returns “true” or “false” based on their login. ...
shane's user avatar
  • 143
4 votes
3 answers
3k views

Is SSL Interception possible without disabling Public Key Pinning on the client side?

I'm currently setting up a pfSense firewall in my lab. It supports SSL Inception which works pretty well for most sites. But there are some sites which use HTTP Public Key Pinning to prevent MitM ...
davidb's user avatar
  • 4,323
4 votes
3 answers
1k views

Are TLS v1.3 connections over open Wi-Fi secure?

If a non-compromised device is connected to the internet via open Wi-Fi, anyone can view the traffic. But if all the connections to the servers use a reasonably secure cryptographic protocol (such as ...
End Antisemitic Hate's user avatar
4 votes
1 answer
5k views

How come I can see a full HTTPS requests via Fiddler?

I am testing a C# web API hosted on a remote server, and I am monitoring HTTPS traffic using Fiddler. What confuses me is that via Fiddler I can see all of the POST payload, headers and host URL ...
mko's user avatar
  • 179
4 votes
1 answer
2k views

Is it secure to rely on websocket connection?

In a client-server communication scenario over secure websocket, client is authorized securely and from there on, I have two choices: Assign a unique random ID (session) and check that on subsequent ...
Xaqron's user avatar
  • 306
4 votes
1 answer
272 views

x509 certificates are still exposed even with Encrypted Client hello?

Encrypted Client Hello hides Server Name Indication (SNI). However, looking at the TLS Handshake (https://tls12.ulfheim.net/). Wouldn't it be possible for a middle-man to inspect the TLS Handshake and ...
Hmmm's user avatar
  • 141
4 votes
2 answers
966 views

Certificate Pinning vs E2E Encryption

I see that there are some APIs which exchange some sort public keys to secure the content of https connection using asymmetric encryption. Is there any added benefit to this? As far as I know, it ...
Rowanto's user avatar
  • 121
4 votes
1 answer
176 views

Is filtering flash based on the mimetype enough to keep it out?

As flash is a real security mess I started blacklisting flash at our proxy by blocking any content with the mime type application/x-shockwave-flash which works pretty well as far as I can tell. The ...
davidb's user avatar
  • 4,323
3 votes
2 answers
3k views

Why does pinning a CA root certificate not present a security risk?

AWS recommends pinning their root certificate when implementing SSL pinning. My understanding is that SSL pinning for mobile applications mitigates a situation where an attacker has installed a ...
Prime's user avatar
  • 514
3 votes
2 answers
7k views

How to dump SSL key log for non-browser applications?

I have a game, and I want to know its api request endpoints. But since it is encrypted, I need to get its key log file to decrypt it in wireshark. I tried to run my application with the command --ssl-...
ßiansor Å. Ålmerol's user avatar
3 votes
2 answers
1k views

Is this possible with SSLsplit?

SSLsplit supports plain TCP, plain SSL, HTTP and HTTPS connections over both IPv4 and IPv6. For SSL and HTTPS connections, SSLsplit generates and signs forged X509v3 certificates on-the-fly, based on ...
user6769219's user avatar
3 votes
2 answers
9k views

How is man-in-the-middle attack prevented in TLS? [duplicate]

As I understand the original master key, which is used to encrypt the application data is never transmitted over the wire and it is calculated on both client and server individually using a hashing-...
Hemanth's user avatar
  • 131
3 votes
1 answer
562 views

How effective is Expect-CT against content inspection in an enterprise context?

HPKP was used to ensure that a browser accepts to connect to a site only if the public key he has on file is the one presented by the target site. I saw it as a way to make deep content inspection ...
WoJ's user avatar
  • 9,058
3 votes
1 answer
3k views

How does client authentication work when using a TLS Proxy?

We're using a load balancer, which implements TLS interception for a server, which in turn uses TLS Client authentication. Since TLS interception implies that the client will make the connection to ...
IMenePs's user avatar
  • 73
3 votes
1 answer
1k views

Detect SSL Interception

To my knowledge my company performs SSL Interception. Still if I visit a website I host, that uses a Let´s Encrypt certificate, the browser shows me my legit Let´s Encrypt cert. To my understanding ...
architekt's user avatar
  • 1,006
3 votes
1 answer
2k views

Inducing TLS renegotiation

Is it possible to induce ssl renegotiation for a browser via command line / a curl request. I know it is possible to rate limit ssl renegotiation but do not know how to do it the other way around. I ...
user avatar
3 votes
2 answers
3k views

Not able to intercept traffic from nike.com login request

I'm using BurpSuite to intercept the HTTP/HTTPS requests sent when logging in on https://www.nike.com/. I'm trying to achieve this with the following step: Opening BurpSuite and Firefox Turning on ...
Fozoro's user avatar
  • 81
3 votes
1 answer
11k views

Is is possible to intercept Guest VM traffic on the host machine's Burpsuite

I'm running Kali on Windows 7 via VMWare, and would like to be able to access private network websites, which i can't seem to be able to do. So I tried to forward the system traffic to the host ...
Hrishabh Sobti's user avatar
3 votes
1 answer
2k views

Self-signed certs on LAN shared with others [duplicate]

My WiFi is shared with my family, and my siblings have friends come over sharing the WiFi password carelessly. Anyone of those guests could have a rogue device and not even know it. My brother has ...
m0p3r's user avatar
  • 41
2 votes
3 answers
406 views

Is this threat in SSL for real?

I was talking with a friend about how SSL can be Man-in-the-Middled with relative ease. He claimed this: Anyone can compromise the DNS request authority chain (true). Anyone can generate a custom ...
Luis Masuelli's user avatar
2 votes
1 answer
344 views

Can a man in the middle hear half the HTTPS conversation

Given a conversation is occurring using HTTPS, during the handshake, can the man in the middle interpret all communication from the server to the client? Assuming that the man in the middle can ...
David Colwell's user avatar
2 votes
4 answers
7k views

Number of bytes in a TLS handshake

How can I identify precisely the exact number of bytes the ClientHello and ServerHello in a TLS traffic needs? this is for traffic analysis purpose to capture the TLS bytes of interest (client hello ...
user avatar
2 votes
2 answers
11k views

Understanding SSL man-in-the-middle and its limitations

I’m trying to develop a good sense of how an SSL man-in-the-middle(s) (MITM) works. As I understand it, MITMs do their work in one of two ways: Decrypt the SSL by having a copy of the server’s ...
The_Glidd's user avatar
2 votes
1 answer
1k views

Securing a Web application using HSTS

Background I am developing a Web application using ASP.Net MVC. I deployed the application in IIS(V8) and now doing the Web app hardening process. I configured the SSL in IIS and the Web app is ...
user3496510's user avatar
  • 1,307
2 votes
1 answer
12k views

Intercepting JSON responses on BurpSuite [closed]

By default, Burp Suite is able to intercept the request from the page, but not getting the JSON response. What rule should be added in the 'Intercept server responses' menu (in the 'Proxy > Options' ...
user avatar