up vote -1 down vote favorite
share [g+] share [fb]

A lot of tools allow us to view HTTPS traffic. Is there any tool out there which will decrypt TLS and allow me to see the network traffic for applications like Gtalk?

link|improve this question
71% accept rate
-1 Since you are not asking about a particular tool or method, this is, at best, a question related to ethical hacking. See meta.stackoverflow.com/questions/8401/… – Jano Apr 20 '11 at 21:24
@Jano: I agree. I don't believe this question belongs on Serverfault, especially with the comments that the Bruce is asking. – Scrivener Apr 21 '11 at 14:40
@Jana@Scrivener: I am not a hacker (far from it) and don't hold any ambitions to become one in the near future. I am just curious to know how to decrypt the traffic and understand how Gtalk uses Jabber. Once I learn how to do this I can apply the same technique to other apps and find out what they are doing behind the scene. – Bruce Apr 21 '11 at 17:16
feedback

migrated from stackoverflow.com Apr 21 '11 at 14:35

This question came from our site for professional and enthusiast programmers.

closed as off topic by Zypher♦ Apr 21 '11 at 15:37

Questions on Server Fault are expected to generally relate to servers, networking, or desktop infrastructure, within the scope defined in the faq.

2 Answers

up vote 2 down vote

The standard way to do this is to use a proxy that will offer its own TLS certificate to your browser in place of the legitimate one (Google in this case). If your browser trusts that cert, then the website should function normally; however, the proxy will be transparently decrypting the traffic from the browser, displaying and logging it, then re-encrypting it with the correct Google certificate to transmit to the Gmail server. This is really an exercise in conducting an intentional Man in the Middle attack against yourself.

Two popular proxies that will do this are Burp and Paros; I like them both.

Here's how to do this with Burp:

  1. Install Burp
  2. Follow the directions in the Burp help to install the PortSwiggerCA cert as a trusted Root certificate; this will allow Burp to create "valid" certs for any site you browse to (and, this is important for GChat, will allow XHR requests to succeed with the Burp cert). For Firefox the Export is similar, but the relevant area to import the certificate is: Tools>Options>Advanced>Encryption Tab>View Certificates>Import Button.
  3. Fire up Burp and set your browser proxy to match your Burp settings (typically localhost:8080)
  4. Sign into Gmail (you might want a throwaway account for this ;)
  5. Send some GChat messages. You will see them appear in your Burp logs (look in the Proxy Tab/History sub-tab; You'll have to click Forward on the Intercept sub-tab to make the request actually go through. Just play with it, it'll make sense)

Example Decrypted GChat data:

POST /mail/channel/bind?VER=8&<redacted> HTTP/1.1
Host: mail.google.com
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:2.0) Gecko/20100101 Firefox/4.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: https://mail.google.com/mail/?<redacted>
Cookie: <redacted>
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 167

count=1&ofs=82&req0_type=m&req0_to=example%40gmail.com&req0_id=C96E78D465862AEC_1&req0_text=testing%20proxy....&req0_chatstate=active&req0_iconset=classic&req0__sc=c

I highly suggest you set up a specific browser profile, or even a separate browser entirely for this work since your browser is completely trusting these proxy root certificates for any purpose.

link|improve this answer
1  
@coffeetocode: I have already done this using Fiddler but it does not work with Googletalk application. It does decode a few HTTP requests and responses but then throws a error that the packet format is incorrect. Did you have any luck with using Burp with Gtalk? If not, do you know how to go about it? – Bruce Apr 18 '11 at 11:04
feedback
up vote 0 down vote

you can do this with wireshark (http://wiki.wireshark.org/SSL) but it relies on you having access to the browser and server keys.

link|improve this answer
and I don't have the server key :-) – Bruce Apr 14 '11 at 16:38
Then you can't easily sniff traffic - unless you can crack the server key. – cbz Apr 14 '11 at 16:57
and how can I crack the server key? – Bruce Apr 14 '11 at 17:00
feedback

Not the answer you're looking for? Browse other questions tagged or ask your own question.