-1

A lot of tools allow us to view HTTPS traffic. Is there any tool out there which will decrypt TLS and allow me to see the network traffic for applications like Gtalk?

3
  • -1 Since you are not asking about a particular tool or method, this is, at best, a question related to ethical hacking. See meta.stackexchange.com/questions/8401/…
    – Jano
    Apr 20, 2011 at 21:24
  • @Jano: I agree. I don't believe this question belongs on Serverfault, especially with the comments that the Bruce is asking.
    – Scrivener
    Apr 21, 2011 at 14:40
  • @Jana@Scrivener: I am not a hacker (far from it) and don't hold any ambitions to become one in the near future. I am just curious to know how to decrypt the traffic and understand how Gtalk uses Jabber. Once I learn how to do this I can apply the same technique to other apps and find out what they are doing behind the scene.
    – Bruce
    Apr 21, 2011 at 17:16

2 Answers 2

2

The standard way to do this is to use a proxy that will offer its own TLS certificate to your browser in place of the legitimate one (Google in this case). If your browser trusts that cert, then the website should function normally; however, the proxy will be transparently decrypting the traffic from the browser, displaying and logging it, then re-encrypting it with the correct Google certificate to transmit to the Gmail server. This is really an exercise in conducting an intentional Man in the Middle attack against yourself.

Two popular proxies that will do this are Burp and Paros; I like them both.

Here's how to do this with Burp:

  1. Install Burp
  2. Follow the directions in the Burp help to install the PortSwiggerCA cert as a trusted Root certificate; this will allow Burp to create "valid" certs for any site you browse to (and, this is important for GChat, will allow XHR requests to succeed with the Burp cert). For Firefox the Export is similar, but the relevant area to import the certificate is: Tools>Options>Advanced>Encryption Tab>View Certificates>Import Button.
  3. Fire up Burp and set your browser proxy to match your Burp settings (typically localhost:8080)
  4. Sign into Gmail (you might want a throwaway account for this ;)
  5. Send some GChat messages. You will see them appear in your Burp logs (look in the Proxy Tab/History sub-tab; You'll have to click Forward on the Intercept sub-tab to make the request actually go through. Just play with it, it'll make sense)

Example Decrypted GChat data:

POST /mail/channel/bind?VER=8&<redacted> HTTP/1.1
Host: mail.google.com
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:2.0) Gecko/20100101 Firefox/4.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: https://mail.google.com/mail/?<redacted>
Cookie: <redacted>
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 167

count=1&ofs=82&req0_type=m&req0_to=example%40gmail.com&req0_id=C96E78D465862AEC_1&req0_text=testing%20proxy....&req0_chatstate=active&req0_iconset=classic&req0__sc=c

I highly suggest you set up a specific browser profile, or even a separate browser entirely for this work since your browser is completely trusting these proxy root certificates for any purpose.

1
  • 1
    @coffeetocode: I have already done this using Fiddler but it does not work with Googletalk application. It does decode a few HTTP requests and responses but then throws a error that the packet format is incorrect. Did you have any luck with using Burp with Gtalk? If not, do you know how to go about it?
    – Bruce
    Apr 18, 2011 at 11:04
0

you can do this with wireshark (http://wiki.wireshark.org/SSL) but it relies on you having access to the browser and server keys.

3
  • and I don't have the server key :-)
    – Bruce
    Apr 14, 2011 at 16:38
  • Then you can't easily sniff traffic - unless you can crack the server key.
    – cbz
    Apr 14, 2011 at 16:57
  • and how can I crack the server key?
    – Bruce
    Apr 14, 2011 at 17:00

Not the answer you're looking for? Browse other questions tagged .