so I have this architecture in VirtualBox :

Client <--> IDS <--> server

where all of the machines are implemented in Kali Linux and I am currently hosting a website on the Server which is configured to use HTTPS. I have all the certificates created using OpenSSL.

Now how can I use the IDS machine to: 1- intercept And decrypt HTTPS traffics 2- pass the traffics to IDS (snort) 3- re encrypt traffic and send it to the destination

Is there any specific tool will help ?

New contributor
Adam Tr. is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

You can use PolarProxy to intercept, decrypt and re-encrypt the TLS traffic. PolarProxy exports the decrypted HTTP traffic as PCAP by default, which you can ingest into Snort. However, if you really want to let Snort "sniff" the traffic then I'd suggest piping the PCAP output from PolarProxy to tcpreplay in order to push the captured traffic as "live" packets on a network interface.

Disclaimer: I'm the lead developer of PolarProxy, so I'd be happy to answer any questions you might have about the tool.

Your Answer

Adam Tr. is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.