The Stack Overflow podcast is back! Listen to an interview with our new CEO.
14

TLS by itself protects the sniffing and modification of traffic between two endpoints, i.e. client and server. TLS interception just makes two TLS connections where only one was, i.e. client to interception device and interception device to server. This will still work with future TLS versions. TLS interception is only possible if the validation of the ...


12

No. AFAIK there is nothing inside the TLS 1.3 Draft about that. And I don't think there's a technical solution to this either. If you allow somebody to install an additional root CA on your computer, then all bets are off.


8

SSL/TLS is a protocol providing an end-to-end encrypted communication between two parties each having one of the keys in private/public key pair. Typically a browser and a web server. In normal circumstances any device between the two endpoints cannot decrypt the communication. That includes firewalls. It is however possible (and used in organizations) to ...


6

In case of legal SSL interception the proxy CA which is used to issue the certificates for the intercepted connections gets explicitly imported into the browser/OS as trusted. In such a case browser will ignore both the builtin pinning and also the pinning done with HPKP header. This is explicitly done this way to make legal SSL interception (in firewalls, ...


5

There are four ways an IPS can deal with encrypted traffic: An IPS can act as a TLS interception proxy, where it becomes a man-in-the-middle for the TLS connection. This requires you add a root certificate created by the IPS software to your root trust store, or every encrypted website you try to visit will give a connection error. This allows an IPS to ...


5

Take a look at these instructions for how to make Fiddler decrypt TLS traffic. It tells you to install Fiddlers root certificate into the OS trust store. This implies that they are doing classic TLS interception - there is one TLS connection between the browser and Fiddler, and another between Fiddler and the server. The first one uses a certificate ...


5

First of all, just because you use CloudFlare does not mean that the traffic will pass through the US. CloudFlare currently has 102 edges, and requests will be sent to the nearest one. This is what is called "anycast". So if someone in Europe requests your page the request will go from them to an edge somewhere in Europe, and from there to your origin. In ...


4

If you are using fiddler to intercept the HTTPS connection with a self installed certificate then you are conducting an active, self induced, 'man in the middle' on your connection. This means fiddler is intercepting and decrypting and reencrypting the traffic between the phone and the web server, allowing you to 'see' into the packet.


4

While mutual TLS and certificate pinning are intended for different problems they can be used to solve the specific problem of detecting active MITM too. Only, with mutual TLS it is the server which detects the MITM (client certificate not as expected) while with certificate pinning it is the client (server certificate not as expected). Implementation ...


3

Based on your question I assume that you understand how SSL interception works in general, i.e. that the SSL intercepting process (the antivirus in this case) essentially replaces the original end-to-end encrypted connection with an encrypted connection from proxy to server and with another connection from client to proxy - where the last one does not use ...


3

The literal answer is no: TLS does not accept unencrypted messages. However, your colleague's worries are not unfounded. I don't know whether he's confused but accidentally stumbled onto a real concern, or he understands the issues but explained them very confusingly. A TLS connection is always encrypted (so a man-in-the-middle cannot read the data that is ...


2

Due to the security built into TLS this can not be done by changing the existing TLS handshake in the proxy. Instead a TLS connection between the target server and the proxy and another TLS connection between the proxy and the client must be created. The latter connection cannot get the original certificate from the server, but the proxy must create a new ...


2

As the system proxy settings seem to affect the application, you can run any intercepting HTTP proxy (I'd recommend Burp proxy, but you can use mitmproxy, too) on your mac. Set your system proxy settings to 127.0.0.1 and port 8080 and start the application. To decrypt TLS, you also need to import the root certificate of the proxy into your trusted ...


2

You may want to try this with frida: import frida import sys session = frida.attach("firefox.exe") script = session.create_script(""" "use strict"; const PR_Read = Module.findExportByName("nss3.dll", "PR_Read"); Interceptor.attach(PR_Read, { onEnter: function (args) { let length = args[2].toInt32(); let buffer = Memory.readByteArray(...


2

CloudFlare isn't promising anything they're not delivering. Any service provider decrypts the data at the cloud end; they have to in order to perform their service. CloudFlare's architecture simply decrypts it at the point of entry, instead of at each and every service endpoint. This offers a couple advantages to their clients: they don't have to do ...


2

You may want to take a look to ReverseEngineering.SE as there may be some more practical information there. I also recommend you to check your product license and get some legal advise: while reverse engineering is usually considered a fair practice (from a legal perspective) when it comes to ensuring software compatibility, it is often a grey area and you ...


2

You should be able to add any certificates that you need to use via the ZAP Options / Certificate screen (https://github.com/zaproxy/zap-core-help/wiki/HelpUiDialogsOptionsCertificate).


2

Since the TLS connection will be terminated by the TLS proxy the authentication of the client via client certificates will be terminated there too. Since the TLS proxy does not have the private key of the client it will not be able to use the original certificate of the client when connecting with TLS to the final server. The only way to pass the clients ...


1

I figured it out! The app was using a service called Approov, which was a third party service generating a new token every five minutes to prevent third party apps from accessing a protected ressource. Took a while to get around it, but at least i learned something new.


1

If you are using vanilla OpenSSL, you will pass Common Criteria TLS traffic modification tests. If you are using something else and is unsure, you will have to write your own client to send modified packets. Generally, it will be up to a CC lab to run these tests to certify your product. They will have their own tools and methods. Keep in mind, NIAP ...


1

The server is configured to accept only certain ciphers and the NULL ciphers are only configured in test or broken configuration. And even if they would be configured the client must offers these ciphers too which is also only done in test or broken configuration. And even then these ciphers must be considered by the server as the best ciphers client and ...


1

You are typically trying to perform a Man in the Middle. There are many ways to do it. easy way is by using Wireshark - refer blownie55's answer Web Browsers these days come with Developer Tools Which show a lot. (Press F12 in Chrome) Packet Dump at your Gateway. - Collect Packets from Client and then decrypt them using the Private Key (pretty hard, but ...


1

Is there another way to get around this problem? Yes, you can configure your SSL interception tool to delete any HPKP headers in responses. You'll need all users to start with a dedicated browser profile, that's only ever used under SSL interception. If the same browser profile is ever used without SSL interception, the real server may pin their ...


1

I don't think it is a good idea to let users decide which certificates are nice and which are not or to accept self-signed or invalid certificates at all on a general basis. At least I do not believe that most users understand the underlying problems and would be able to make the proper decision. But maybe all your users have a deeper understanding of the ...


Only top voted, non community-wiki answers of a minimum length are eligible