tags:

views:

39

answers:

2

How can i catch https data(for example email) from browser before they are encrypted with ssl and send to the network? does anyone have idea?

I am looking for programmatical solution. How it works. I am not looking for any program,want to make my own.

Thx.

A: 

If you need it for debugging, use Firebug or Fiddler.

Firebug

You can watch requests and responses in the "Network" panel, HTTPS traffic too.

Fiddler

Fiddler allows you to watch traffic from any application, but you need to install a fake certificate in order to watch HTTPS traffic.

leoluk
i eddited my question, i dont want tp use any program. I am interested in how it really works to make my own program
Rampage
+1  A: 

The author of Fiddler has written an article about how they implemented the HTTPS capturing and decryption in Fiddler itself that will most likely be useful to you. Here's an excerpt:

Q: The HTTPS protocol was designed to prevent traffic viewing and tampering. Given that, how can Fiddler2 debug HTTPS traffic?

A: Fiddler2 relies on a "man-in-the-middle" approach to HTTPS interception. To your web browser, Fiddler2 claims to be the secure web server, and to the web server, Fiddler2 mimics the web browser. In order to pretend to be the web server, Fiddler2 dynamically generates a HTTPS certificate [...]

bzlm
aa, thats what i am looking for,thx, can you fix the link on that article?
Rampage
if you have any other idea instead of proxy, please let me know :P
Rampage
@Dun Sorry about the link; it's fixed now. I think it will be easier with *some* kind of proxy, perhaps not just a full-fledged interactive proxy with a GUI. Writing a sniffer will be too much hassle IMHO. If you write a proxy, the browser will do all the hard work for you.
bzlm