Using a Proxy to Take Raw Socket data

NorthenQueen · 26-06-2006 05:04PM #1

Hi all,

I am currently working in the area of ssl and learning as much as I can about sockets and data transfer. I am currently working on a presentation on ssl vs raw sockets and I have created a raw socket based application that transfers information from one computer to another. I would like to use a proxy to take a look at the packets going from the client to the server and decipher it so I can look at the clear text message for the demonstration. Could you point me in the direction of some free ware applications that would do that? I've heard of fragrouter but I'm not sure how it works. A general introduction would be great! thanks,

NordieQueen

Capt'n Midnight · 26-06-2006 05:22PM

Not sure exactly what you are looking for
have a look at tcpdump ( windump for windows users ) and ethereal for packet capture and display

if you can't capture the packets at either end then
a hub will forward all packets to all network cards connected to it all the time.
a managed switch can usually be configured to forward all traffic of one port to another port where it can be monitored

NutJob · 26-06-2006 06:52PM

One thing you may want to note is under xpsp2 raw sockets are chopped out of the os to stop malware using them so linux/Unix is the way to go.

Have a look at ssl decryption proxys if its traffic ur after pre/post crypto

openssl might be worh a look two

TimTim · 26-06-2006 07:27PM

Can't you use winpcap to get around that?

And isn't there mods floating around that add's raw sockets back in for xp sp2?

NutJob · 27-06-2006 10:02AM

Sorry concider myself slapped!!:D Looks like you can with winlibpcap sorry i just use linux for my network stuff i find it strangely enough easy under linux.:eek:

Martyr · 27-06-2006 05:46PM

Can't you use winpcap to get around that?

And isn't there mods floating around that add's raw sockets back in for xp sp2?

winpcap is a driver that operates at the NDIS level (kernel)
there possibly is some mods to add it for user level access.

NutJob · 27-06-2006 07:01PM

It looks like a port of libpcap but not sure what it would take to port stuff across as ported libs can be fun at times.

Screaming Monkey · 27-06-2006 08:51PM

you may not need a proxy if you have access to the ssl private keys,
ssldump will decrypt SSL traffic captured with tcpdump/ethereal or on the network. http://www.rtfm.com/ssldump/

I have'nt come across a windows version, but there is one somewhere, have mainly run it on linux and bsd

NutJob · 28-06-2006 12:46PM

Screaming Monkey wrote:

you may not need a proxy if you have access to the ssl private keys,
ssldump will decrypt SSL traffic captured with tcpdump/ethereal or on the network. http://www.rtfm.com/ssldump/

I have'nt come across a windows version, but there is one somewhere, have mainly run it on linux and bsd

hate to say this in case of script kiddies but its on the auditor cd.;)

Using a Proxy to Take Raw Socket data

Comments