Collaborate Disseminate
I’ve recently become a fan of MITM attacks and had some fun hacking some manipulating HTTPS requests and responses.
I did this using mitmproxy and installing the certificate on my phone.
I would like to be able to decrypt t… Continue reading Generic SSL/TLS decryptor [on hold]
TLS problems are blocking my access to the internet. Why? I am having a problem browsing the web. I am using Firefox.
This happened to all my web browsers and all major websites that I have been using. Facebook, Google, et… Continue reading Security Connection Failed when accessing web pages from the internet. I think the TLS handshake failed. How can I solve this? [on hold]
A server with IP address a.b.c.d is hosting multiple SSL websites.
When connecting to each website, a proper browser sends a request which include the destination host in an uncrypted clear text known as SNI, such as example.com.
We’re running a web service in Europe, secured with TLS and we’re using private keys generated on our private hardware.
We would like to use CloudFlare for DDoS protection and caching reverse proxy.
However, putting my tinfoil hat on, I’m … Continue reading Can I use CloudFlare if I want to avoid NSA and FISA secret orders?
Chrome specifies that it maintains a internal “hard-coded” list of root certificates that are “EV-Qualified”.
https://www.chromium.org/Home/chromium-security/root-ca-policy#TOC-Extended-Validation-Certificates
Is there any … Continue reading Chrome Internal Certificate Authority List for SSL + EV
Previously I have been able to bypass SSL Pinning by using the program JustTrustMe with the Xposed framework for nearly every app.
https://github.com/Fuzion24/JustTrustMe
However it has started to fail on more and more apps recently. Th… Continue reading Disable or bypass SSL Pinning/Certificate Pinning on Android 6.0.1
I’m currently setting up a pfSense firewall in my lab. It supports SSL Inception which works pretty well for most sites.
But there are some sites which use HTTP Public Key Pinning to prevent MitM attacks and this is a real … Continue reading Is SSL Interception possible without disabling Public Key Pinning on the client side?
Here are the steps I’ve been through until I hit a problem.
I have a website that runs on an HTTPS protocol serving the Android application
I generally debug requests / responses via Wireshark running on Windows operating system.
I reques… Continue reading TLS interception on an Android phone
I was wondering if the firewall has the ability to decrypt the SSL traffic.
If so, the network admin is able to read the data in clear text at transit.
Nowadays it is possible to inspect (unencrypt) TLS (HTTPS) traffic inside an organization. The mechanism consists in using a root CA that is configured in the web client and a network device that receives the HTTPS connection… Continue reading Are future TLS versions going to prevent traffic inspection?