<story><title>SSLsplit – Transparent and scalable SSL/TLS interception</title><url>http://www.roe.ch/SSLsplit</url></story><parent_chain></parent_chain><comment><author>bitexploder</author><text>A few things for everyone to think about. This tool seems to be aimed more on the non-interactive side. There are several other good tools out there which do this, but most of them are not oriented towards performing software assessments. Webmitm does good for HTTP&amp;#x2F;HTTPS, as does Burp Suite (transparent non-proxy aware stuff). There are a lot of tools in this space. There are very few that will let you interactively debug non-HTTP(s) TCP and SSL.&lt;p&gt;I released a tool with a colleague back in 2010 designed for assessing non-proxy aware (mostly non-HTTP(S)) applications. It was aimed at getting those hard to reach TCP and SSL wrapped TCP apps that other proxies don&amp;#x27;t let you work with interactively. Mallory does the exact same on the fly cert generation etc. As does Burp Suite a professional grade HTTP proxy, that can operate in transparent mode. I much prefer Burp to webmitm for day to day work.&lt;p&gt;SSL Split also supports more NAT mechanisms than Mallory and most other tools (which just tend to be iptables&amp;#x2F;Linux aware). That is one of the real nice pieces of this code.&lt;p&gt;We did add in a few neat things into Mallory. SSH MiTM that, when it works, lets you open up your own PTYs on the back of the user&amp;#x27;s SSH session. A GUI that lets you do binary level regex to play with traffic on the fly. HTTP plugins along with a Chrome extension for hijacking sessions and some other fun things, which were mostly just for demonstration of what a MiTM proxy can do and be. Making a MiTM proxy protocol aware can be very powerful. Mallory is still a little buggy and tricky to use, but it has served me well in performing blackbox app assessments for many years.&lt;p&gt;&lt;a href=&quot;http://bitexploder.com/BlackHat-USA-2010-Umadas-Allen-Network-Stream_Debugging-with-Mallory-wp.pdf&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;bitexploder.com&amp;#x2F;BlackHat-USA-2010-Umadas-Allen-Networ...&lt;/a&gt; (Check this out if you want an overview of how to configure a system to support a tool like SSLSplit or Mallory)&lt;p&gt;&lt;a href=&quot;https://bitbucket.org/IntrepidusGroup/mallory&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;bitbucket.org&amp;#x2F;IntrepidusGroup&amp;#x2F;mallory&lt;/a&gt; (reasonably up to date code, its not the easiest thing to set up, though).</text></comment>
<story><title>SSLsplit – Transparent and scalable SSL/TLS interception</title><url>http://www.roe.ch/SSLsplit</url></story><parent_chain></parent_chain><comment><author>atmosx</author><text>Isn&amp;#x27;t way easier to hijack the DNS requests of the victim, redirect the connection to a similar unknown domain which replicates the HTML code and fields offered by the originally requested website[1]? I think Metasploit can do something similar.&lt;p&gt;I mean once you&amp;#x27;re in a position where using SSlstrip of SSLsplit or whatever, means that you gained access to the victim&amp;#x27;s LAN.&lt;p&gt;That&amp;#x27;s why programs like DNSSEC or DNSCrypt should be installed by default on laptops who use often Free WiFi&amp;#x2F;Internet Caffes, etc.&lt;p&gt;Funny thing is that, after all these years there&amp;#x27;s no way to implement an ARP poisoning mitigation policy that will protect all your clients no matter what OS they run (iOs&amp;#x2F;OSX, Linux&amp;#x2F;Android, BSD, Windows, Embedded, etc.).&lt;p&gt;[1] What comes in mind is a ruby Sinatra application which reads the targeted website&amp;#x27;s output and creates css&amp;#x2F;haml output on-the-fly.</text></comment>