BYTE.com > Tangled in the Threads > 2001 > February
A Window Into Encrypted Client/Server Conversations
By Jon Udell
February 14, 2001
(SSL Proxying
: Page 2 of 3 )
To watch SSL traffic in Proxomitron, configure your browser to also proxy secure traffic.
In Netscape, that's Edit->Preferences->Advanced->Proxies->Manual Configuration->View->Security. In MSIE, if you established 8080 for normal Web traffic, you're already proxying secure traffic as well (and, indeed, you have to use Tools->Internet Options->Connections->LAN Settings->Proxy Server->Use a Proxy Server->Advanced to disable SSL proxying).
Here's that same POST request, on the secure side of my Apache server, with the only difference being the bolded SSL cipher signature:
SSL cipher SSLv3 EXP-RC4-MD5 (128 bits)
POST /cgi-bin/test HTTP/1.0
Connection: keep-alive
Referer: http://udell.test/test.html
User-Agent: Mozilla/4.5 [en] (WinNT; I)
Host: udell.test
Content-type: application/x-www-form-urlencoded
Content-length: 7
Posting 7 bytes...
foo=bar
That's all there is to it! Now, the browser's secure traffic flows to Proxomitron. It decrypts that traffic, so you can see it in the log window, and then re-encrypts it to the destination server. Coming back the other way, it decrypts the server's responses, so you can see them in the log window, then re-encrypts them to complete the secure loop back to the browser.
It's really quite amazing, and amazingly useful. Automation tasks that used to look like more trouble than they were worth -- for example, driving a HotMail or E*Trade account from a script -- suddenly look easy.
Does this make a mockery of the notion of a secure channel? I don't think so. Your browser only connects to an SSL proxy if you tell it to. And when it does, the process is not seamless -- nor should it be. If you use the default certificate that comes with Proxomitron, your browser will challenge you for two reasons. First, because that certificate is self-signed, not signed by one of the certification authorities (e.g. VeriSign, Thawte) your browser is hardwired to trust. Second, because the name in that certificate won't match the name of the secure site you're going through Proxomitron to get to.
BYTE.com > Tangled in the Threads > 2001 > February
|
