sslsniff written by Moxie Marlinspike is a pretty nice tool to do SSL analysis. It has two modes of operation:
- Authority mode
- Dynamically generates certificates and signs them with the specified CA
- Targeted mode
- Uses pre-generated certificates to attack specific sites
Like most (if not all) tools there is always a situation where you want to look at the decrypted data in wireshark. So yes, for that you would use the ‘targeted mode’, but then again wouldn’t it be nice if you could also do that using the Authority mode? Since I’ve never really messed with reversing and hooking on linux I chose to make a solution that wouldn’t require source code changes to sslsniff. Since the source code is available it helped me to cheat and be able to understand things better. Most of the information I had to read, to actually understand what I was doing can be found at the end of this post under the heading ‘references’. It’s fun to see what you can manage in a short amount of time if you stick to it.
The TL;DR version can be grabbed from my gihub it contains the source code and scripts you need to dump the temporary SSL key. For the ones wondering how I approached his, please keep reading.
DiabloHorn 