5 ms·
mitmproxy is great! I wish there was a way to conveniently look at non-HTTP TLS traffic, though. I saw a few documented "TCP mode" options but they don't seem t
by cjbprime 6y ago
mitmproxy is great! I wish there was a way to conveniently look at non-HTTP TLS traffic, though. I saw a few documented "TCP mode" options but they don't seem to get me access to plaintext. Any ideas?
- H4sh3 6y agoCan you even do this if the client hasn't installed your cert?
- colechristensen 6y agoIt depends on how the client will treat an untrusted cert.
- dewey 6y agoNo, only works if there's a way to install custom certificates on the device you are monitoring. Otherwise that would defeat the whole purpose of https (If there are no bugs in the implementation or other security issues of course). For mitmproxy that would be achieved like this: https://docs.mitmproxy.org/stable/concepts-certificates/ https://docs.mitmproxy.org/stable/concepts-certificates/
- H4sh3 6y agoThought so i played around with this and my phone, self hacking ;) It's also very nice to intercept app traffic. Some use cert pinning, so the custom certificate won't work.
- capableweb 6y agoThink there are a few tools for getting around the certificate pinning, projects like sensepost/objection
- feanaro 6y agoIn most cases you can get away with simply connecting to the application with `objection` (mentioned in a sibling post) and running `android sslpinning disable`. This will fail in some cases when the application is obfuscated or uses a non-standard pinning mechanism. In this case you can decompile the application to determine the methods used to accomplish the pinning and use frida (https://frida.re https://frida.re) directly in order to manually override them.
- arkadiyt 6y agoWireshark might be a better tool for this
- cjbprime 6y agoWireshark doesn't natively decrypt TLS traffic, though. And SSLKEYLOGFILE is not supported by many network apps.
- smilliken 6y agomitmproxy will generate a certificate for you to install on the client.
- mhils 6y agoYou can view TCP contents in the mitmproxy UI since a few months (thanks to some excellent community contributions). Minimal example: mitmproxy --mode reverse:http://example.com --tcp-hosts example.com curl http://localhost:8080/ There's still quite a bit we want to improve on (e.g., our protocol detection currently fails for protocols that start with a server-side greeting), but the basic TCP viewing functionality is there. :)
- e12e 6y agoIf you just need to look at the traffic, maybe wireshark in combination with SSLKEYLOGFILE can help, if your client supports that option (eg: libssl): https://gitlab.com/wireshark/wireshark/-/wikis/TLS#using-the-pre-master-secret https://gitlab.com/wireshark/wireshark/-/wikis/TLS#using-the...