2

I've got a proprietary windows-only application that uses HTTPS to speak with a (also proprietary, undocumented) web service.

To ultimately be able to use the web service's functionality on my linux machines, I want to reverse-engineer the web service API by analyzing the requests sent by the application.

Now the question: How can I decrypt and log the HTTPS traffic?


I know of several solutions which don't apply in my case:

  • Fiddler is a man-in-the-middle HTTPS proxy which I cannot use since the application doesn't support proxies. Also, I do not (yet) know if it works with self-signed server certificates, which I doubt.
  • Wireshark is able to decrypt SSL streams if you have the server's private certificate, which I don't have.
  • any browser extension since the application is not a browser

If I remember correctly, there have been some trojans that capture online banking information by hooking into/replacing the window's crypto API. Since the machine is mine, low level changes are possible. Maybe there is a non-trojan (white-hat) network log application out there which does the same?

There is a blackhat presentation with some details available to read. They refer to Microsoft Research Detours for easy API hooking. See an Detours hooking example.


Related questions:

0

4 Answers 4

4

If the application comes with its own staticallly linked HTTPS implementation, you won't be able to hack into anything that easily, since you'll only be able to witness the encrypted traffic. Man-in-the-middle is your best bet, but you better pray that the application doesn't check the certificate.

About "cannot use": Usually you don't need an application to be "man-in-the-middle enabled" in order to mount a MITM attack. The whole point of such an attack is that you rig the network environment in such a way that your proxy takes the place in which the app expects its peer. Since you control the environment, that should be pretty easy.

Finally, if you cannot eavesdrop on the traffic, you could run your app through a memory debugger and see if you can find the clear text somewhere.

2
  • This. The only way to see the encrypted traffic is to feed the application your own certificate so you can decrypt it in the middle. Then you need to re-encrypt it for transmission to the https server. Hopefully the client doesn't check that the certificate is not valid, or is not the same certificate it expects. But this will be the only way - short of attaching a debugger to the app and watching it send/receive traffic before it's encrypted.
    – Ian Boyd
    Jun 30, 2011 at 3:05
  • I was lucky and the application did not check the server certficate. Using Fiddler worked, and I have the dumps of the HTTPS traffic now.
    – cweiske
    Jul 3, 2011 at 0:16
1

Ironically, just this afternoon I was a reading a chapter of Greg Hoglund’s Rootkits that mentioned logging and decrypting SSL with ettercap.

1
  • Although the last release of ettercap is from 2005, I'll try it. It looks like a MITM proxy as fiddler is one - but for Linux :)
    – cweiske
    Jun 30, 2011 at 5:07
0

ospy is a tool specifically made to reverse-engineer proprietary windows application communications, with support for SSL/HTTPS. Seems that's the most easy tool for my task. Found through the API Monitoring tools list.

There is also a visualization script to analyze the dumps on a linux machine :)

Update: I tried to use ospy, but it worked on one WindowsXP VM only, not on the other one which I wanted to use for testing. The bug is known and needs to be fixed, but ospy seems to be dead since 2009, with no hope that the bugs will be fixed. I basically could not use it at all.

2
  • Cool, please do post if you succeed with this!
    – Kerrek SB
    Jun 30, 2011 at 9:44
  • Update: I failed with ospy, but fiddler worked.
    – cweiske
    Jul 3, 2011 at 11:51
-1

If you download SSLStrip, you can setup port forwarding (e.g., HTTP traffic from port 80 to port 10000 where SSL strip picks it up, decrypts it, and puts it on its way) that will decrypt SSL encrypted packets before the rest of your system receives them (like Ettercap).

1
  • 1
    SSLStrip only removes HTTPS links from HTTP traffic, which does not help here - because the communication uses HTTPS from the beginning. It does not decrypt the traffic.
    – cweiske
    Jul 18, 2011 at 8:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .