0

I have been trying to inspect all the traffic going through my machine. I have a server directly connected to Internet. And I would like to log all the youtube request made on internet with the URL.

As youtube is based on SSL, so I must need to inspect the HTTPS traffic. I have read it somewhere that I must need to create MITM attack on my own server in order to view the HTTPS request. I have followed following steps in order to create a certificate I own.

1 - Generate a 2048 bit RSA Key: openssl genrsa -des3 -out private.pem 2048

2 - Export the RSA Public Key to a File: openssl rsa -in private.pem -outform PEM -pubout -out public.pem

3 - Check The public key File (Certificate) Now: less public.pem

4 - Export the RSA Public Key to a File: openssl rsa -in private.pem -out private_unencrypted.pem -outform PEM -pubout

5 - Check The Private File Now: less private.pem

6 - Copied certificate into certificate directory

7 - Configure certificate by using following command: sudo dpkg-reconfigure ca-certificates

In the end executed all the possible ways available:

mitmproxy -T

Above command open a console application and I accessed all the HTTPs sites but no effect on this window. And

 sudo ssldump -Ad -k cert.pem -p password -i wlo1

This command just printed some handshake stuff in console and after that terminated. But, nothing is related to URL.

And 

sudo  iptables -t nat -A PREROUTING -p tcp --destination-port 443 -j REDIRECT --to-port 1024
sudo sslstrip -l 1024

This commands keep on listening but, nothing comes out as a result in sslstrip.log file.

I am using all these things with Ubuntu 15 and want to dump ssl request in transparent mode i.e. without setting up proxy on client's machine.

Jonathan Leffler
  • 730,956
  • 141
  • 904
  • 1,278
Wasif Kirmani
  • 1,277
  • 3
  • 22
  • 43
  • A Man in the middle attack will only work if the clients connecting to your server have your servers CA in its keystore repository. This will require installing it on every computer that accesses your network. Failure to do this step will invalidate the SSL/TLS connection and the browser will alert the user "self signed cert" – Steven Carlson Mar 01 '16 at 11:25
  • So what am I doing wrong here? I have already stored the certificate at my server. – Wasif Kirmani Mar 01 '16 at 11:31
  • I am not sure about your logging issue, but if you have not installed your CA Cert on the client computer, your process will not work. – Steven Carlson Mar 01 '16 at 11:32
  • If it's requesting for raising an exception to accept by the client I am fine. As I am not worried about adding an exception on the client. But, I want to add a ssl inspection. – Wasif Kirmani Mar 01 '16 at 11:37

0 Answers0