SSLSniff - Revision history

Admin: /* In Plain English */

2017-12-15T15:52:24Z

In Plain English

← Older revision		Revision as of 15:52, 15 December 2017
Line 21:		Line 21:
	There is not an off-the-shelf attack to just automatically strip out SSL - modern sites and modern browsers are hip to that jive. You'll need to obtain a trusted certificate, or you'll have to make your own and install it in the client's browser's list of trusted certificates. This tool leads to the wonderful and wide world of certificates, certificate authorities, and the many ways of tricking browsers into trusting and accepting your certificates.		There is not an off-the-shelf attack to just automatically strip out SSL - modern sites and modern browsers are hip to that jive. You'll need to obtain a trusted certificate, or you'll have to make your own and install it in the client's browser's list of trusted certificates. This tool leads to the wonderful and wide world of certificates, certificate authorities, and the many ways of tricking browsers into trusting and accepting your certificates.

	~~Also see:~~		===Real World Application===
	* [[MITM Labs/Decrypting HTTPS Traffic with Stolen Private Key]]
	* [[MITM Labs/Decrypting HTTPS Traffic by Compromising Browser SSL Keys]]

	As a common example of how this happens (legitimately) in everyday life, hop onto any web browser in a public library, or at your workplace, or at a university. Open the list of trusted certificates in the browser. You are almost guaranteed to find one that is issued and signed by the institution itself, and not by a certificate authority. That allows these institutions to strip out the SSL and decrypt all of your HTTPS traffic, examine it to make sure you aren't looking at naughty things or sending emails with nuclear secrets, and then bundle the traffic back up and ship it on out to the other end.		As a common example of how this happens (legitimately) in everyday life, hop onto any web browser in a public library, or at your workplace, or at a university. Open the list of trusted certificates in the browser. You are almost guaranteed to find one that is issued and signed by the institution itself, and not by a certificate authority. That allows these institutions to strip out the SSL and decrypt all of your HTTPS traffic, examine it to make sure you aren't looking at naughty things or sending emails with nuclear secrets, and then bundle the traffic back up and ship it on out to the other end.

	The fact that the certificate is trusted by your browser means neither end of the "encrypted" conversation will complain when an attacker tampers with the traffic and re-encrypts it, because the institution can use that certificate to masquerade as YOU.		The fact that the certificate is trusted by your browser means neither end of the "encrypted" conversation will complain when an attacker tampers with the traffic and re-encrypts it, because the institution can use that certificate to masquerade as YOU.

			===Carrying Out SSL Sniff Attacks in Practice===

			These two [[MITM]] (man in the middle) labs cover how to sniff encrypted traffic and decrypt it offline using Wireshark or SSLSniff by using either the .pem private key file, or the SSL key information dumped to a file:

			* [[MITM Labs/Decrypting HTTPS Traffic with Stolen Private Key]]
			* [[MITM Labs/Decrypting HTTPS Traffic by Compromising Browser SSL Keys]]

	==Building==		==Building==

Admin: /* In Plain English */

2017-12-15T15:50:40Z

In Plain English

← Older revision		Revision as of 15:50, 15 December 2017
Line 20:		Line 20:

	There is not an off-the-shelf attack to just automatically strip out SSL - modern sites and modern browsers are hip to that jive. You'll need to obtain a trusted certificate, or you'll have to make your own and install it in the client's browser's list of trusted certificates. This tool leads to the wonderful and wide world of certificates, certificate authorities, and the many ways of tricking browsers into trusting and accepting your certificates.		There is not an off-the-shelf attack to just automatically strip out SSL - modern sites and modern browsers are hip to that jive. You'll need to obtain a trusted certificate, or you'll have to make your own and install it in the client's browser's list of trusted certificates. This tool leads to the wonderful and wide world of certificates, certificate authorities, and the many ways of tricking browsers into trusting and accepting your certificates.

			Also see:
			* [[MITM Labs/Decrypting HTTPS Traffic with Stolen Private Key]]
			* [[MITM Labs/Decrypting HTTPS Traffic by Compromising Browser SSL Keys]]

	As a common example of how this happens (legitimately) in everyday life, hop onto any web browser in a public library, or at your workplace, or at a university. Open the list of trusted certificates in the browser. You are almost guaranteed to find one that is issued and signed by the institution itself, and not by a certificate authority. That allows these institutions to strip out the SSL and decrypt all of your HTTPS traffic, examine it to make sure you aren't looking at naughty things or sending emails with nuclear secrets, and then bundle the traffic back up and ship it on out to the other end.		As a common example of how this happens (legitimately) in everyday life, hop onto any web browser in a public library, or at your workplace, or at a university. Open the list of trusted certificates in the browser. You are almost guaranteed to find one that is issued and signed by the institution itself, and not by a certificate authority. That allows these institutions to strip out the SSL and decrypt all of your HTTPS traffic, examine it to make sure you aren't looking at naughty things or sending emails with nuclear secrets, and then bundle the traffic back up and ship it on out to the other end.

Admin: /* In Plain English */

2017-09-05T11:30:01Z

In Plain English

← Older revision		Revision as of 11:30, 5 September 2017
Line 19:		Line 19:
	==In Plain English==		==In Plain English==

	There is not an off-the-shelf attack to just automatically strip out SSL - modern sites and modern browsers are hip to that jive. You'll need to obtain a trusted certificate, or you'll have to make your own. This tool ~~allows you~~ to ~~explore~~ the world of certificates, certificate authorities, and the many ways of tricking browsers into trusting and accepting your certificates.		There is not an off-the-shelf attack to just automatically strip out SSL - modern sites and modern browsers are hip to that jive. You'll need to obtain a trusted certificate, or you'll have to make your own and install it in the client's browser's list of trusted certificates. This tool leads to the wonderful and wide world of certificates, certificate authorities, and the many ways of tricking browsers into trusting and accepting your certificates.

			As a common example of how this happens (legitimately) in everyday life, hop onto any web browser in a public library, or at your workplace, or at a university. Open the list of trusted certificates in the browser. You are almost guaranteed to find one that is issued and signed by the institution itself, and not by a certificate authority. That allows these institutions to strip out the SSL and decrypt all of your HTTPS traffic, examine it to make sure you aren't looking at naughty things or sending emails with nuclear secrets, and then bundle the traffic back up and ship it on out to the other end.

			The fact that the certificate is trusted by your browser means neither end of the "encrypted" conversation will complain when an attacker tampers with the traffic and re-encrypts it, because the institution can use that certificate to masquerade as YOU.

	==Building==		==Building==

Admin: /* Errors */

2016-08-29T10:53:37Z

Errors

← Older revision		Revision as of 10:53, 29 August 2016
Line 65:		Line 65:

	<pre>		<pre>
	# make		$ make
	g++ -ggdb -g -O2 -o sslsniff -lssl -lboost_filesystem -lpthread -lboost_thread -llog4cpp SSLConnectionManager.o Destination.o FirefoxUpdater.o Logger.o SessionCache.o SSLBridge.o HTTPSBridge.o sslsniff.o FingerprintManager.o AuthorityCertificateManager.o TargetedCertificateManager.o CertificateManager.o HttpBridge.o HttpConnectionManager.o HttpHeaders.o UpdateManager.o OCSPDenier.o FirefoxAddonUpdater.o
			g++ -ggdb -g -O2 -o sslsniff -lssl -lboost_filesystem -lpthread -lboost_thread -llog4cpp \
			SSLConnectionManager.o Destination.o FirefoxUpdater.o Logger.o SessionCache.o SSLBridge.o HTTPSBridge.o sslsniff.o FingerprintManager.o AuthorityCertificateManager.o \
			TargetedCertificateManager.o CertificateManager.o HttpBridge.o HttpConnectionManager.o HttpHeaders.o UpdateManager.o OCSPDenier.o FirefoxAddonUpdater.o
	/usr/bin/ld: AuthorityCertificateManager.o: undefined reference to symbol 'X509_gmtime_adj@@OPENSSL_1.0.2d'		/usr/bin/ld: AuthorityCertificateManager.o: undefined reference to symbol 'X509_gmtime_adj@@OPENSSL_1.0.2d'
	//usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.2: error adding symbols: DSO missing from command line		//usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.2: error adding symbols: DSO missing from command line
Line 77:		Line 80:

	<pre>		<pre>
	# readelf -Ws /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.2 \| grep gmtime		$ readelf -Ws /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.2 \| grep gmtime
	31: 0000000000000000 0 FUNC GLOBAL DEFAULT UND gmtime_r@GLIBC_2.2.5 (5)		31: 0000000000000000 0 FUNC GLOBAL DEFAULT UND gmtime_r@GLIBC_2.2.5 (5)
	93: 0000000000000000 0 FUNC GLOBAL DEFAULT UND gmtime@GLIBC_2.2.5 (5)		93: 0000000000000000 0 FUNC GLOBAL DEFAULT UND gmtime@GLIBC_2.2.5 (5)
Line 88:		Line 91:

	<pre>		<pre>
	g++ -ggdb -g -O2 -o sslsniff -lboost_filesystem -lpthread -lboost_thread -llog4cpp -lssl SSLConnectionManager.o Destination.o FirefoxUpdater.o Logger.o SessionCache.o SSLBridge.o HTTPSBridge.o sslsniff.o FingerprintManager.o AuthorityCertificateManager.o TargetedCertificateManager.o CertificateManager.o HttpBridge.o HttpConnectionManager.o HttpHeaders.o UpdateManager.o OCSPDenier.o FirefoxAddonUpdater.o		$ g++ -ggdb -g -O2 -o sslsniff -lboost_filesystem -lpthread -lboost_thread -llog4cpp -lssl \
			SSLConnectionManager.o Destination.o FirefoxUpdater.o Logger.o SessionCache.o SSLBridge.o HTTPSBridge.o sslsniff.o FingerprintManager.o AuthorityCertificateManager.o \
			TargetedCertificateManager.o CertificateManager.o HttpBridge.o HttpConnectionManager.o HttpHeaders.o UpdateManager.o OCSPDenier.o FirefoxAddonUpdater.o
			/usr/bin/ld: /usr/lib/gcc/x86_64-linux-gnu/6/../../../x86_64-linux-gnu/libboost_filesystem.so: undefined reference to symbol '_ZN5boost6system15system_categoryEv'
			//usr/lib/x86_64-linux-gnu/libboost_system.so.1.61.0: error adding symbols: DSO missing from command line
			collect2: error: ld returned 1 exit status
	</pre>		</pre>

Line 94:		Line 102:

	<pre>		<pre>
	# readelf -Ws /usr/lib/gcc/x86_64-linux-gnu/6/../../../x86_64-linux-gnu/libboost_filesystem.so \| grep ZN5boost6system15system		$ readelf -Ws /usr/lib/gcc/x86_64-linux-gnu/6/../../../x86_64-linux-gnu/libboost_filesystem.so \| grep ZN5boost6system15system
	47: 0000000000000000 0 FUNC GLOBAL DEFAULT UND _ZN5boost6system15system_categoryEv		47: 0000000000000000 0 FUNC GLOBAL DEFAULT UND _ZN5boost6system15system_categoryEv
	</pre>		</pre>

Admin: /* Errors */

2016-08-29T10:52:05Z

Errors

← Older revision		Revision as of 10:52, 29 August 2016
Line 66:		Line 66:
	<pre>		<pre>
	# make		# make
	g++ -ggdb -g -O2 -lssl -lboost_filesystem -lpthread -lboost_thread -llog4cpp ~~-o sslsniff~~ SSLConnectionManager.o Destination.o FirefoxUpdater.o Logger.o SessionCache.o SSLBridge.o HTTPSBridge.o sslsniff.o FingerprintManager.o AuthorityCertificateManager.o TargetedCertificateManager.o CertificateManager.o HttpBridge.o HttpConnectionManager.o HttpHeaders.o UpdateManager.o OCSPDenier.o FirefoxAddonUpdater.o		g++ -ggdb -g -O2 -o sslsniff -lssl -lboost_filesystem -lpthread -lboost_thread -llog4cpp SSLConnectionManager.o Destination.o FirefoxUpdater.o Logger.o SessionCache.o SSLBridge.o HTTPSBridge.o sslsniff.o FingerprintManager.o AuthorityCertificateManager.o TargetedCertificateManager.o CertificateManager.o HttpBridge.o HttpConnectionManager.o HttpHeaders.o UpdateManager.o OCSPDenier.o FirefoxAddonUpdater.o
	/usr/bin/ld: AuthorityCertificateManager.o: undefined reference to symbol 'X509_gmtime_adj@@OPENSSL_1.0.2d'		/usr/bin/ld: AuthorityCertificateManager.o: undefined reference to symbol 'X509_gmtime_adj@@OPENSSL_1.0.2d'
	//usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.2: error adding symbols: DSO missing from command line		//usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.2: error adding symbols: DSO missing from command line
Line 84:		Line 84:

	So what gives?		So what gives?

			I tried re-ordering the library flags, and got this:

			<pre>
			g++ -ggdb -g -O2 -o sslsniff -lboost_filesystem -lpthread -lboost_thread -llog4cpp -lssl SSLConnectionManager.o Destination.o FirefoxUpdater.o Logger.o SessionCache.o SSLBridge.o HTTPSBridge.o sslsniff.o FingerprintManager.o AuthorityCertificateManager.o TargetedCertificateManager.o CertificateManager.o HttpBridge.o HttpConnectionManager.o HttpHeaders.o UpdateManager.o OCSPDenier.o FirefoxAddonUpdater.o
			</pre>

			but again, I checked the library file and saw that that symbol is, in fact, defined:

			<pre>
			# readelf -Ws /usr/lib/gcc/x86_64-linux-gnu/6/../../../x86_64-linux-gnu/libboost_filesystem.so \| grep ZN5boost6system15system
			47: 0000000000000000 0 FUNC GLOBAL DEFAULT UND _ZN5boost6system15system_categoryEv
			</pre>

	==Getting Help==		==Getting Help==

Admin: /* Errors */

2016-08-29T10:29:34Z

Errors

← Older revision		Revision as of 10:29, 29 August 2016
Line 62:		Line 62:
	libcrypto:		libcrypto:

	On compile I was seeing some missing symbol errors about openssl stuff ~~from the certificate manager~~:		On compile I was seeing some missing symbol errors about openssl stuff:

	<pre>		<pre>
			# make
	g++ -ggdb -g -O2 -lssl -lboost_filesystem -lpthread -lboost_thread -llog4cpp -o sslsniff SSLConnectionManager.o Destination.o FirefoxUpdater.o Logger.o SessionCache.o SSLBridge.o HTTPSBridge.o sslsniff.o FingerprintManager.o AuthorityCertificateManager.o TargetedCertificateManager.o CertificateManager.o HttpBridge.o HttpConnectionManager.o HttpHeaders.o UpdateManager.o OCSPDenier.o FirefoxAddonUpdater.o		g++ -ggdb -g -O2 -lssl -lboost_filesystem -lpthread -lboost_thread -llog4cpp -o sslsniff SSLConnectionManager.o Destination.o FirefoxUpdater.o Logger.o SessionCache.o SSLBridge.o HTTPSBridge.o sslsniff.o FingerprintManager.o AuthorityCertificateManager.o TargetedCertificateManager.o CertificateManager.o HttpBridge.o HttpConnectionManager.o HttpHeaders.o UpdateManager.o OCSPDenier.o FirefoxAddonUpdater.o
	/usr/bin/ld: AuthorityCertificateManager.o: undefined reference to symbol 'X509_gmtime_adj@@OPENSSL_1.0.2d'		/usr/bin/ld: AuthorityCertificateManager.o: undefined reference to symbol 'X509_gmtime_adj@@OPENSSL_1.0.2d'
	//usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.2: error adding symbols: DSO missing from command line		//usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.2: error adding symbols: DSO missing from command line
	collect2: error: ld returned 1 exit status		collect2: error: ld returned 1 exit status
	Makefile:388: recipe for target '~~sslsni~~		Makefile:388: recipe for target 'sslsniff' failed
			make: *** [sslsniff] Error 1
	</pre>		</pre>

	~~Resolved by running~~ <~~code~~>~~apt~~-~~get install~~ libcrypto~~++-dev~~</~~code~~>		I checked this library file (.so) to see if that symbol was, in fact, defined, and it was:

			<pre>
			# readelf -Ws /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.2 \| grep gmtime
			31: 0000000000000000 0 FUNC GLOBAL DEFAULT UND gmtime_r@GLIBC_2.2.5 (5)
			93: 0000000000000000 0 FUNC GLOBAL DEFAULT UND gmtime@GLIBC_2.2.5 (5)
			179: 000000000016acb0 7 FUNC GLOBAL DEFAULT 13 X509_gmtime_adj@@OPENSSL_1.0.2d
			</pre>

			So what gives?

	==Getting Help==		==Getting Help==

Admin: /* From Source */

2016-08-29T10:04:21Z

From Source

@@ Line 38: / Line 38: @@
 <pre>
-apt-get install autotools-dev libboost1.61-dev libboost-filesystem-dev liblog4cpp5-dev
+apt-get install autotools-dev libboost1.61-dev libboost-filesystem-dev libboost-thread-dev liblog4cpp5-dev
 </pre>
@@ Line 57: / Line 57: @@
 If you run make install, it will install it over the system sslsniff. For me, that came from the Kali apt repositories, and that program crashed, which is why I had to work out the song and dance to get sslsniff to compile. Additionally, there are some really, really stale (5+ year old) issues on the sslsniff repo on Github, so this tool has been dead for a looooong time.
 ==Getting Help==

Admin: /* From Source */

2016-08-29T10:02:14Z

From Source

← Older revision		Revision as of 10:02, 29 August 2016
Line 38:		Line 38:

	<pre>		<pre>
	apt-get install autotools-dev libboost1.61-dev liblog4cpp5-dev		apt-get install autotools-dev libboost1.61-dev libboost-filesystem-dev liblog4cpp5-dev
	</pre>		</pre>

Admin: /* From Source */

2016-08-29T09:56:57Z

From Source

← Older revision		Revision as of 09:56, 29 August 2016
Line 32:		Line 32:

	===From Source===		===From Source===

			TLDR: Use my fork: http://github.com/charlesreid1/sslsniff

	ooookay, first you need autotools, and boost, and log4cpp:		ooookay, first you need autotools, and boost, and log4cpp:

Admin: /* From Source */

2016-08-29T09:54:52Z

From Source

← Older revision		Revision as of 09:54, 29 August 2016
Line 53:		Line 53:
	make		make
	</pre>		</pre>

			If you run make install, it will install it over the system sslsniff. For me, that came from the Kali apt repositories, and that program crashed, which is why I had to work out the song and dance to get sslsniff to compile. Additionally, there are some really, really stale (5+ year old) issues on the sslsniff repo on Github, so this tool has been dead for a looooong time.

	==Getting Help==		==Getting Help==