Man-in-the-middling SSL / TLS on Windows

"Is there a lock in the URL bar?"

Funny how the proliferation of commercial CA's led to this question to become the hallmark of Internet security circa 2001. I'll keep that rant for another day. Thumbs up to EFF and Mozilla for finally doing something about it.

When debugging issues with network connections or reverse engineering products, you might find the need to take the gloves off and find out exactly what an application is doing on the wire.

You'll need a man in the middle. (instantcsi)

Providing the application you're targeting uses a web protocol, you'll be in with some luck- there are heaps of web debugging proxies and tools you can use on any platforms.

If you have physical access to the network (i.e. a non-corporate environment), or you have a Linux machine on the network that IT security approve of- the conversation effectively ends here:
Use MITMproxy.

Unfortunately I don't have either physical access or a Linux machine on the network I can use that is suitable for MITMing. Additionally, the particular application I was targeting was not proxy aware, thus the solution needed to be network-layer. I get that's a specific circumstance, but that's the point of this blog.

So you're stuck on Windows. Let's run through your options:

• Fiddler
• Burp
• HoneyProxy / mitmproxy
• Charles

Fiddler was first cab off the rank. I think I'll leave my review of it short and simple: If you're not debugging something running in your web browser, forget it. It does all weird shit with injecting and automagicking around with system proxy settings, and requires you to restart the entire application to make minor changes. Not suitable for hardcore application debugging.

Burp was next. Burp I found to be a very robust, easy to understand solution with plenty of good features without getting in your way. I've used it for web debugging before, and have found it extremely effective.

But it couldn't cut it for application debugging. The particular application I was troubleshooting somehow knew its response was being tampered with and killed the connection (mind you, only post authentication it noticed this. I still haven't worked that out- may have to do with keep-alives).


HoneyProxy gets an honorable mention because of its ease of use, a fork of the powerful mitmproxy for Linux that includes a micro webserver. Slight problem, no transparent proxy support. No use for debugging applications that are not proxy-aware.

Charles looks like it belongs on the Mac App Store debugging iPhone apps, not on a Windows corporate desktop. However, it was the only application I found capable of serving the purpose of a lower-layer transparent proxy that could go undetected by my desktop application. Charles doesn't specifically have a "transparent proxy" mode of operation- but does have a reverse proxy which works all the same.

tldr, use charles, awkward-looking but it works.



Notes
At a later stage, the age-old Cain & Able came to mind. It sets off a lot of enterprise anti-virus solutions, so I'll stick with my recommendation for Charles, but it's not any less of a viable solution by the sounds of it.