RE: Https sniffer

["Asaf Wexler" <Asaf.Wexler () breach com>]

Hi Kashmira,

I assume what you are asking for is the ability to *decrypt* the SSL
traffic, in addition to the ability to sniff in promiscuous mode.

All network sniffers today sniff in promiscuous mode, regardless of the
traffic type (http,https,etc.). However, almost none of them can do a
good job (if at all) in decrypting SSL traffic (given the server private
key, of course).

<Marketing Plug>

If you are looking for commercial solutions and not only open source
solutions, you can take a look at BreachView SSL (which I was
responsible for implementing).
BreachView SSL is a passive SSL decryption engine that can work with any
network sniffer (or NIDS), and it will feed the sniffer of your choice
with a stream of decrypted TCP packets.

</Marketing Plug>


HTH,
Asaf Wexler, Project Manager, R&D
Breach Security, Inc.

-----Original Message-----
From: Lyal Collins [mailto:lyal.collins () key2it com au] 
Sent: Wednesday, July 20, 2005 11:52 AM
To: 'Hugo Fortier'; 'Phalak, Kashmira Vijay'
Cc: vuln-dev () securityfocus com; webappsec () securityfocus com
Subject: RE: Https sniffer

I've tried ssldump recently but only obtained decrypts with a very
restricted set of SSL parameters - RSA and 3DES in my case.
I don't have the coding skills to approach this in order to resolve the
issues either, sorry.
Your mileage may vary...

Lyal


-----Original Message-----
From: Hugo Fortier [mailto:hfortier () recon cx] 
Sent: Wednesday, 20 July 2005 1:22 PM
To: Phalak, Kashmira Vijay
Cc: vuln-dev () securityfocus com; webappsec () securityfocus com
Subject: Re: Https sniffer


Hi Kashmira,

There is ssldump, it's not a HTTP Analyser but a SSL analyser you can  
find it at http://www.rtfm.com/ssldump/. ssldump will decrypt the  
data if provided with the good private key.

Hugo

On 19-Jul-05, at 8:58 PM, Phalak, Kashmira Vijay wrote:

> Hi All,
>
> Does anybody know a good https sniffer which can sniff in promiscuous 
> mode? I tried HTTP Analyzer and it works great, but it does not have 
> support for promiscuous mode.
>
> Thanks,
> Kashmira.