0

There is such a windows application that communications with the server through https protocol, it is an auction tool and works only several hours per month. I have captured network packets (by windows network monitor) during one auction.

I am wondering whether it is possible to mimic this client, by analyzing the the packets I collected (or any packets I could collect in future auctions). I know from this wireshark artical "Secure Socket Layer (SSL)" that it should be possible (and without much effort) to descypt the entrypted messages from server, but how? And is it possible to dectrypt the messages sent by client to server, too?

Improve this question

1 Answer 1

Reset to default
0

Yes, all these things are possible provided that you can ignore/bypass/trick client side authentication if any. CURL provides the ability to script to do the mimicking, and there is even a Windows version available.

If you need to intercept a session, you might try SSLSniff.

If you can provide further details we might be able to help a bit more - for example is this a public site which anyone can use? Does it require the client present a cert to the server ?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .