Home page logo
/

pen-test logo Penetration Testing mailing list archives

Re: [PEN-TEST] Scanning through SSL proxies.
From: matt lind <sixthsense () lycos com>
Date: Sat, 16 Sep 2000 17:48:41 -0700

 SSl proxing can be done through a combination of techniques. First connect to the target machine using stunnel or some 
similar app. Next use a port redirector on you local machine to funnel any port 80 traffic through the stunnel'd port.
cha ching. security? hmm. i don't think so.
--

On Fri, 8 Sep 2000 09:24:01
 van Eeden, Stieler wrote:
Since everybody is starting to realise that SSL is a more secure protocol
than HTTP  ..heh.. A lot of clients is running SSL based webservers.
Unfortunately most make the mistake by thinking if they implement SSL they
are secure and cant be hacked. But they are actually just secured from
sniffing etc.  and then dont bother to harden the OS or review their cgi
scripts.  The attacks can still be automated through a SSL  proxy. Go and
check you could still be vulnerable to RDS :P

Up to now I've done all the checks manually, damn it takes long! In the
whisker documentation RFP says that it is possible to use an SSL proxy. I
quote from his documentation (
http://www.wiretrip.net/rfp/p/doc.asp?id=21&iface=2 )

"<> SSL support is officially to be had by using sslproxy by Christian
 Starkjohann <cs () obdev at>, at http://www.obdev.at/Products/. It
 runs on both Win and Unix, so life is good. Copies are available
 from my site just in case you can't find them. RTFM for usage."

I also noted that a few paragraphes before that he stated -

"<> Proxy support has been removed until version v2.0. The previous proxy
                              commandline options have been re-used into
other v1.4 features."

I assume he is talking about normal proxy support.

I had a look at SSLproxy and had a few problems to get it to work in Linux,
I could be missing a few Libs.  I have OpenSSH and OpenSSL installed.  ;/
Apparently there is a win32 port of sslproxy, the link to the win32 port is
dead. :(
Anyone got a copy ?

Have anybody got this to work successfully ? I need some help, please give
me some light ! Is there any other SSL Proxies that can be used to simulate
webscan's ? Up to now whisker look like the only worth while tool with ssl
proxy support for the job.

Thanx!
//Stieler van Eeden


WARNING:  this e-mail contains confidential information and any
unauthorised use or interception is illegal.  If this e-mail is not
intended for you, you may not copy, distribute or disclose the contents to
anyone nor take any action in reliance on the content.  If you receive this
in error, please contact the sender and delete the material from any computer



Get your FREE Email and Voicemail at Lycos Communications at
http://comm.lycos.com


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]