3 ms·
Frankly, I can't think of any way to proxy or decrypt it that would result in the packets still being destined for the same Microsoft IP, but with port 80 inste
by jfrunyon 5y ago
Frankly, I can't think of any way to proxy or decrypt it that would result in the packets still being destined for the same Microsoft IP, but with port 80 instead of 443.
The only explanation I could think of was that it falls back to HTTP if HTTPS is unavailable and they blocked port 443, which not only would be bat**** insane, but I tested and that does not occur.
- zamadatix 5y ago"Many also interpreted the screen shot as if the traffic was sent in clear text. That is not the case, whatever you type on the Win start menu is sent using HTTPS over TCP 443. We used a TLS proxy to decrypt the TLS traffic in order to show what is being sent to Microsoft." https://twitter.com/netresec/status/1440298939509399553 https://twitter.com/netresec/status/1440298939509399553
- jfrunyon 5y agoYeah, turns out their capturing proxy just creates inaccurate pcaps. Who woulda thunk.