Questions tagged [tls-intercept]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
41
votes
3answers
6k views

Why is the issuer certificate different at my workplace and at home?

I have viewed Gmail's certificate chain at my workplace, and I realised it's different. It looks like this: Root CA Operative CA1 ___________.net mail.google.com When I get the ...
30
votes
6answers
6k views

As a contractor how do I work on multiple client networks without data leakage?

I am a contractor who does development for more than one client. Let's call them Client A, Client B, and Client X. I use my own laptop for all 3 clients. Throughout the day, I have to work on and ...
24
votes
5answers
10k views

Can a VPN Provider MitM my SSL traffic without me noticing?

If I connect to lets say gmail over a VPN. How does the provider forward the traffic without exposing my IP, but also without breaking the SSL. Shouldn't gmail know my real IP if the traffic just gets ...
15
votes
3answers
16k views

My school wifi asks to 'trust' a certificate on iPhones. Does this allow them to view SSL traffic?

There is a lot of confusion around this on here, so I am making this post to be sure to understand it correctly. My school uses Aruba networks wifi, and after I type my Active Directory username and ...
9
votes
3answers
3k views

Are future TLS versions going to prevent traffic inspection?

Nowadays it is possible to inspect (unencrypt) TLS (HTTPS) traffic inside an organization. The mechanism consists in using a root CA that is configured in the web client and a network device that ...
8
votes
1answer
2k views

Hooking into firefox memory

I am trying to learn how to hook into the browser memory. The Frida tool is a good start to this. My goal is to extract the client-random, server-random and symmetric session keys established at the ...
7
votes
3answers
3k views

Hide clear SNI when using https

A server with IP address a.b.c.d is hosting multiple SSL websites. When connecting to each website, a proper browser sends a request which include the destination host in an uncrypted clear text ...
7
votes
3answers
3k views

Can firewalls decrypt SSL packets?

I was wondering if the firewall has the ability to decrypt the SSL traffic. If so, the network admin is able to read the data in clear text at transit.
7
votes
2answers
635 views

What happens if my VPN drops momentarily while using an SSL connection?

The Situation I am in an office with a connection that is routed through a BigIP firewall, with SSL interception; our computers have a root certificate to permit the intercept certs. If I browse to a ...
6
votes
2answers
2k views

Can the network administrator of my university see what I have searched on Google?

Before you mark this one as a duplicate, I have indeed seen similar questions here but they do not provide the direct answer I'm seeking. Here are a few details: I've taken google as an example ...
6
votes
1answer
171 views

Exactly why is it not possible to “drop-out” of TLS 1.3 proxy inspection?

I have been reading a number of articles that state it is not possible for an inspection proxy to simply drop-out/disengage from a TLS 1.3 connection in the same way that is possible in TLS 1.2. Such ...
5
votes
1answer
654 views

How to mitigate credential disclosure in man in the middle attack

I have the followin scenario and looking for a secure solution. There is a web application, hosted on IIS. The connection is established over TLS 1.2 and is encrypted. So the steps are Client ...
5
votes
1answer
1k views

Can I use CloudFlare if I want to avoid NSA and FISA secret orders?

We're running a web service in Europe, secured with TLS and we're using private keys generated on our private hardware. We would like to use CloudFlare for DDoS protection and caching reverse proxy. ...
5
votes
2answers
4k views

Is there no way to bypass certificate pinning without patching apps?

Can you do anything other than patching apps' compiled-code/cert-files (which is app-specific, requires manual analysis and patching + super-user/root) to intercept TLS traffic of apps that use ...
5
votes
1answer
30k views

Disable or bypass SSL Pinning/Certificate Pinning on Android 6.0.1

Previously I have been able to bypass SSL Pinning by using the program JustTrustMe with the Xposed framework for nearly every app. https://github.com/Fuzion24/JustTrustMe However it has started to ...
5
votes
3answers
2k views

Is it acceptable for an employer to install a self-signed root certificate on employees personal devices at home?

At work, my employer uses a self-signed root certificate to MITM all of our SSL/TLS traffic. Many of our internal certificates used by various micro-services and internal websites are also signed by ...
5
votes
1answer
483 views

Client requiring our SSL Private Key to configure the Load Balancer that reaches our server. Makes sense?

I'm facing an unusual situation, I hope you can clarify this for me. We manage some applications that are accessible through HTTPS requests on port 443 of our server X. We have a new client that is ...
4
votes
1answer
12k views

How can police get someone's search history?

Sometimes I see news articles saying that someone was suspected of a crime so the police got their search history and found various google search terms etc. What are the possible ways they can do ...
4
votes
3answers
614 views

Is implementing an SSL proxy server considered a good practice?

There are many questions on this site from users finding out that their employer has a certificate proxy in place, essentially implementing a man-in-the-middle attack so that all traffic is able to be ...
4
votes
3answers
2k views

Is SSL Interception possible without disabling Public Key Pinning on the client side?

I'm currently setting up a pfSense firewall in my lab. It supports SSL Inception which works pretty well for most sites. But there are some sites which use HTTP Public Key Pinning to prevent MitM ...
4
votes
1answer
4k views

How come I can see a full HTTPS requests via Fiddler?

I am testing a C# web API hosted on a remote server, and I am monitoring HTTPS traffic using Fiddler. What confuses me is that via Fiddler I can see all of the POST payload, headers and host URL ...
4
votes
1answer
1k views

Preventing a Burp and Intercept

I have created an authentication API to manage user sessions and the works. To log a user in, the user send their credentials to my API endpoint and it returns “true” or “false” based on their login. ...
4
votes
2answers
704 views

Certificate Pinning vs E2E Encryption

I see that there are some APIs which exchange some sort public keys to secure the content of https connection using asymmetric encryption. Is there any added benefit to this? As far as I know, it ...
4
votes
0answers
383 views

Why are banks largely absent from the HSTS preload list?

There seems to be widespread support for the idea that election-related websites, of all things, should be resistant to man-in-the-middle attacks. The secret ballot makes detecting and recovering from ...
4
votes
0answers
5k views

How does TLS 1.3 break inspection?

The latest research seems to indicate that TLS 1.3 completely breaks the MITM/proxy model of many current security tools. I don't fully understand how it does that and if there are ways around this. ...
4
votes
1answer
105 views

Is filtering flash based on the mimetype enough to keep it out?

As flash is a real security mess I started blacklisting flash at our proxy by blocking any content with the mime type application/x-shockwave-flash which works pretty well as far as I can tell. The ...
3
votes
1answer
7k views

How can I intercept Android application's SSL traffic where SSL pinning is used?

I want to capture the SSL traffic of an Android Application which I think uses SSL pinning. I've tried running an app which says it uses VPN Tunneling and a Root Certificate to capture the SSL ...
3
votes
2answers
935 views

Is this possible with SSLsplit?

SSLsplit supports plain TCP, plain SSL, HTTP and HTTPS connections over both IPv4 and IPv6. For SSL and HTTPS connections, SSLsplit generates and signs forged X509v3 certificates on-the-fly, based on ...
3
votes
1answer
1k views

Is it secure to rely on websocket connection?

In a client-server communication scenario over secure websocket, client is authorized securely and from there on, I have two choices: Assign a unique random ID (session) and check that on subsequent ...
3
votes
1answer
650 views

Detect SSL Interception

To my knowledge my company performs SSL Interception. Still if I visit a website I host, that uses a Let´s Encrypt certificate, the browser shows me my legit Let´s Encrypt cert. To my understanding ...
3
votes
2answers
2k views

Not able to intercept traffic from nike.com login request

I'm using BurpSuite to intercept the HTTP/HTTPS requests sent when logging in on https://www.nike.com/. I'm trying to achieve this with the following step: Opening BurpSuite and Firefox Turning on ...
3
votes
1answer
7k views

Is is possible to intercept Guest VM traffic on the host machine's Burpsuite

I'm running Kali on Windows 7 via VMWare, and would like to be able to access private network websites, which i can't seem to be able to do. So I tried to forward the system traffic to the host ...
3
votes
1answer
943 views

Self-signed certs on LAN shared with others [duplicate]

My WiFi is shared with my family, and my siblings have friends come over sharing the WiFi password carelessly. Anyone of those guests could have a rogue device and not even know it. My brother has ...
2
votes
1answer
264 views

Can a man in the middle hear half the HTTPS conversation

Given a conversation is occurring using HTTPS, during the handshake, can the man in the middle interpret all communication from the server to the client? Assuming that the man in the middle can ...
2
votes
3answers
272 views

Is this threat in SSL for real?

I was talking with a friend about how SSL can be Man-in-the-Middled with relative ease. He claimed this: Anyone can compromise the DNS request authority chain (true). Anyone can generate a custom ...
2
votes
1answer
937 views

Securing a Web application using HSTS

Background I am developing a Web application using ASP.Net MVC. I deployed the application in IIS(V8) and now doing the Web app hardening process. I configured the SSL in IIS and the Web app is ...
2
votes
1answer
644 views

Does SSL inspection break applications utilizing certificate pinning?

A number of popular mobile apps utilize certificate pinning, such as Facebook. Does this mean that these applications cease to function completely on corporate and academic networks that utilize SSL ...
2
votes
2answers
794 views

Mutual TLS and Cert Pinning solving the same problem?

To prevent MITM from my app I will use cert pinning. To prevent having not approved parties communicate to my server I can use Mutal TLS, which actually accepting communication from trusted sources. ...
2
votes
2answers
10k views

Understanding SSL man-in-the-middle and its limitations

I’m trying to develop a good sense of how an SSL man-in-the-middle(s) (MITM) works. As I understand it, MITMs do their work in one of two ways: Decrypt the SSL by having a copy of the server’s ...
2
votes
1answer
268 views

How effective is Expect-CT against content inspection in an enterprise context?

HPKP was used to ensure that a browser accepts to connect to a site only if the public key he has on file is the one presented by the target site. I saw it as a way to make deep content inspection ...
2
votes
1answer
4k views

How does IPS terminate/decrypt encrypted traffic?

With regards to IPS, I am not completely across how they are supposed to terminate or decrypt encrypted traffic? It makes absolutely sense to deploy them inline, but how is traffic supposed to be ...
2
votes
2answers
179 views

Must TLS also accept unencrypted messages?

A co-worker insists that TLS can't be configured to insist upon messages encrypted with known keys/cyphers -- ie, that plaintext requests will always be accepted. This would leave TLS unable to reject ...
2
votes
1answer
776 views

How does client authentication work when using a TLS Proxy?

We're using a load balancer, which implements TLS interception for a server, which in turn uses TLS Client authentication. Since TLS interception implies that the client will make the connection to ...
2
votes
1answer
868 views

Inducing TLS renegotiation

Is it possible to induce ssl renegotiation for a browser via command line / a curl request. I know it is possible to rate limit ssl renegotiation but do not know how to do it the other way around. I ...
2
votes
1answer
139 views

Tor for confidentiality on corporate network

I work in gov organization and recently I learned they set up a MITM, by installing some certificates - so when I visit any web site and then check the certificate info it shows the certificate ...
2
votes
2answers
150 views

Man-In-The-Middle (SSL) attack in my case

I am taking a course in a school about network security. In a experimental exercise, I was asked to install a Man-In-The-Middle (SSL) app to a mobile phone, and install a certificate(with private key ...
2
votes
1answer
77 views

Content Blockers decrypting SSL

I have heard about some content blockers decrypting SSL/HTTPS connections at the gateway and selectively blocking based on the content. What are the privacy concerns about this? Is there a way for ...
2
votes
3answers
906 views

SSL interception with client certificate

I want to intercept a ssl-encrypted tcp-stream. I have the privat key and the certificat of the server and of the client. But how can I intercept the connection. Is there a intercepting-proxy with ...
2
votes
0answers
322 views

BURP SSL connection failing on Genymotion Virtual Device - Android 8.0 API 26

Everything earlier used to work fine. However, recently I downloaded a newer virtual device on Genymotion, which is an Android 8.0 API 26. I have been struggling to get HTTPS traffic intercepted on ...
2
votes
0answers
126 views

Identification of Unknown Potential MITM/Malware involving SSL Connections

On my server one of the services is a Discord bot. It was down which prompted me to look into why. In my syslogs I noticed three increasingly concerning items: do-agent[1066]: 2019/08/25 08:50:21 ...