RE: Https sniffer

[Garth Somerville <therealgarth () yahoo com>]

Hi Kashmira:

Perhaps you are referring to this product or something
similar?

http://www.ieinspector.com/httpanalyzer/

What this product does, hooking into IE, is not
normally called "sniffing" which is, I think, what the
rest of us were responding to.  

If you only need to analyze HTTPS traffic from your
own computer you would have several options in
addition to the above tool ranging from simply using
liveHttpHeaders for Firefox or IEWatch for IE to a
proxy like Paros.

If you need to intercept and decrypt SSL conversations
on the network, you cannot do it without the server's
private key and the ability to capture all the
packets. And even then there are cases where it still
cannot be done (ephemeral keying).

If there were a way to intercept and decrypt SSL
traffic without the server's private key, it would not
be much of a "secure" socket layer and no one would be
using it.

-Garth


--- "Phalak, Kashmira Vijay" <kphalak () verisign com>
wrote:

>  
> Hi All,
>
> Thanks for your suggestions! But most of these
> products suggested need
> the private key to be supplied for decrypting the
> SSL traffic. The HTTP
> Analyzer which I initially tried, does not need the
> private key to be
> supplied and does a good job of decrytping SSL
> traffic. Can anyone
> explain to me how this works? But the HTTP analyzer
> only sniffs the
> traffic in the current user session. This behavior
> is different from
> that of ethereal when I set it in promiscuous mode.
> Here, I can see
> traffic from other machines on the same ether
> segment. I may be wrong
> here, but I don't see this in either
> ClearWatch,ssldump or ngrep. 
>
> Thanks,
> Kashmira.
>
>
> -----Original Message-----
> From: Garth Somerville
> [mailto:therealgarth () yahoo com] 
> Sent: Wednesday, July 20, 2005 6:43 AM
> To: webappsec () securityfocus com
> Cc: Phalak, Kashmira Vijay
> Subject: Re: Https sniffer
>
> Hi Kashmira:
>
> ClearWatch is a free tool from Covelight that will
> work great as an
> HTTPS sniffer.  You will need to provide the
> server's private key to
> decrypt SSL traffic.
>
> You can find it here:
>
> http://www.covelight.com/downloads.php
>
> Cheers,
> -Garth Somerville
>
> __________________________________________________
> Do You Yahoo!?
> Tired of spam?  Yahoo! Mail has the best spam
> protection around
> http://mail.yahoo.com 


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com