SSLsplit

SSLsplit 네트워크 연결을 암호화 SSL / TLS에 대한 man-in-the-middle 공격하기위한 도구입니다.

  주소 변환 엔진을 통해 차단하여 SSLsplit로 리디렉션됩니다. 

SSLsplit는 SS L / TLS를 종료하고 전송 된 모든 데이터를 기록 할 때 원래의 목적지 주소에 새로운 SSL / TLS 연결을 시작합니다. 

SSLsplit는 공개 키 핀 고정을 방지하기 위해 HPKP 응답 헤더를 제거합니다.

도움말

root@kali:~# sslsplit -h
Usage: sslsplit [options...] [proxyspecs...]
  -c pemfile  use CA cert (and key) from pemfile to sign forged certs
  -k pemfile  use CA key (and cert) from pemfile to sign forged certs
  -C pemfile  use CA chain from pemfile (intermediate and root CA certs)
  -K pemfile  use key from pemfile for leaf certs (default: generate)
  -t certdir  use cert+chain+key PEM files from certdir to target all sites
              matching the common names (non-matching: generate if CA)
  -O          deny all OCSP requests on all proxyspecs
  -P          passthrough SSL connections if they cannot be split because of
              client cert auth or no matching cert and no CA (default: drop)
  -g pemfile  use DH group params from pemfile (default: keyfiles or auto)
  -G curve    use ECDH named curve (default: secp160r2 for non-RSA leafkey)
  -Z          disable SSL/TLS compression on all connections
  -s ciphers  use the given OpenSSL cipher suite spec (default: ALL:-aNULL)
  -e engine   specify default NAT engine to use (default: netfilter)
  -E          list available NAT engines and exit
  -u user     drop privileges to user (default if run as root: nobody)
  -j jaildir  chroot() to jaildir (default if run as root: /var/empty)
  -p pidfile  write pid to pidfile (default: no pid file)
  -l logfile  connect log: log one line summary per connection to logfile
  -L logfile  content log: full data to file or named pipe (excludes -S)
  -S logdir   content log: full data to separate files in dir (excludes -L)
  -d          daemon mode: run in background, log error messages to syslog
  -D          debug mode: run in foreground, log debug messages on stderr
  -V          print version information and exit
  -h          print usage information and exit
  proxyspec = type listenaddr+port [natengine|targetaddr+port|"sni"+port]
  e.g.        http 0.0.0.0 8080 www.roe.ch 80  # http/4; static hostname dst
              https ::1 8443 2001:db8::1 443   # https/6; static address dst
              https 127.0.0.1 9443 sni 443     # https/4; SNI DNS lookups
              tcp 127.0.0.1 10025              # tcp/4; default NAT engine
              ssl 2001:db8::2 9999 pf          # ssl/6; NAT engine 'pf'

exam

root@kali:~# sslsplit -D -l connections.log -j /tmp/sslsplit/ -S /tmp/ -k ca.key -c ca.crt ssl 0.0.0.0 8443 tcp 0.0.0.0 8080
Generated RSA key for leaf certs.
SSLsplit 0.4.6 (built 2013-06-06)
Copyright (c) 2009-2013, Daniel Roethlisberger <daniel@roe.ch>
http://www.roe.ch/SSLsplit
Features: -DDISABLE_SSLV2_SESSION_CACHE -DHAVE_NETFILTER
NAT engines: netfilter* tproxy
netfilter:  IP_TRANSPARENT SOL_IPV6 !IPV6_ORIGINAL_DST
compiled against OpenSSL 1.0.1e 11 Feb 2013 (1000105f)
rtlinked against OpenSSL 1.0.1e 11 Feb 2013 (1000105f)
TLS Server Name Indication (SNI) supported
OpenSSL is thread-safe with THREADID