Re: MiTM with https there are any tools ?

[Vincent Archer <varcher () denyall com>]

On Mon, Mar 06, 2006 at 08:34:11AM -0300, Alehandro Dias wrote:
>    I need to conduct a test to get the unencrypted https traffic from a
>    source, but dont know if there are any tools to do that.
>    I am able to fake a dns entry, so he thinks i am [1]www.hotmail.com
>    (example).
>    There are tools to setup a fake weserver (or proxy) that will redirect
>    the queries to the true website, storing the clear data ?
>    I imagine ettercap dont help in this situation.
>    Thnx

Standard tools, not to my knowledge.

We do have a web proxy that does MITM for https traffic (with re-signing
of site certificates once validated with our own CA which is added to
local browsers), but that's not a publically available tool (it is still
in beta, and will be added to our product catalog fairly soon).

If you control the destination, and have access to the SSL key used by the
server, you can use the ssldump utility ( http://www.rtfm.com/ssldump/ )
to decrypt a tcpdump capture of the SSL traffic.

Ettercap looks like it has the ssldump feature integrated, but, again, you
do need to have the SSL key of the server to decipher the session.

-- 
Vincent ARCHER
varcher () denyall com

Tel : +33 (0)1 40 07 47 17
Fax : +33 (0)1 40 07 47 27
Deny All - 23, rue Notre Dame des Victoires - 75002 Paris - France
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/