Hot answers tagged

19

If you want to use curl, this should work: curl -D - https://www.google.com/ Note, however, that this is not exactly the raw response. For instance chunked transfer encoding will not be visible in the response. Using --raw solves this, also verbose mode (-v) is useful, too and -i shows the headers before the response body: curl -iv --raw ...


11

There is. You need to install the package apt-transport-https. Then you can use lines like deb https://some.server.com/debian stable main in your sources.list file. But usually that's not necessary, since the entire content is public anyway and it adds encryption overhead and latency. Since you don't trust an attackers public key, even http traffic is ...


8

Here's a simple way that comes to mind echo 'GET / HTTP/1.1 Host: google.com ' | openssl s_client -quiet -connect google.com:443 2>/dev/null


8

Try mitmproxy. mitmproxy is an SSL-capable man-in-the-middle proxy for HTTP. It provides a console interface that allows traffic flows to be inspected and edited on the fly. mitmdump is the command-line version of mitmproxy, with the same functionality but without the user interface. Think tcpdump for HTTP. Features Intercept HTTP requests and ...


7

Your assumption is wrong: you can use HTTPS downloads. You just have to find a mirror that supports it, and put its URL in your list of sources. You'll need to install the apt-transport-https package. Debian doesn't make HTTPS downloads easy because there is very little benefit. Debian package distribution already includes a mechanism to verify packages: ...


7

Because you have DocumentRoot /var/www/html/teampass in your https virtual host definition the URL https://teampass.urban.org/teampass is actually trying to serve the file /var/www/html/teampass/teampass/index.php which doesn't exist. Either change the DocumentRoot in the https virtual host or move where your files are saved so that they're in the right ...


6

When running apt-get update for a https mirror without apt-transport-https installed, you probably invalidated your cached (sources) data, as a side effect invalidating the signatures - this should fix itself after running "apt-get update" again (you might have to revert to a non-https mirror temporarily).


6

The session information is probably saved in a cookie to allow you to navigate to other pages after you have logged in. If this is the case, you could do this in two steps : Use wget's --save-cookies mycookies.txt and --keep-session-cookies options on the login page of the website along with your --username and --password options Use wget's --load-cookies ...


5

You should install the package apt-transport-https. You might need to temporarily edit that sources.list to read http instead of https: if you have to download that package.


4

This might not work under every circumstance, but try openssl s_client -connect google.com:443 2>&1 | openssl x509 -text | grep DNS


4

As I said in a comment, the netrw plugin, which handles http://, doesn't handle https:// (this from looking at the plugin code). I went into the code and got https:// working (no guarantees it's bug-free, but it worked for the couple sites I tried). I've created a pair of patches, for netrw.vim and netrwPlugin.vim. Here's how to apply them, keeping the ...


4

You can use lsof and watch to do this, like so: $ watch -n1 lsof -i TCP:80,443 Example output dropbox 3280 saml 23u IPv4 56015285 0t0 TCP greeneggs.qmetricstech.local:56003->snt-re3-6c.sjc.dropbox.com:http (ESTABLISHED) thunderbi 3306 saml 60u IPv4 56093767 0t0 TCP ...


4

One specific script, no, but there is a way to get that information. Several ways, probably. I would start with netstat -tuln, which will tell you what ports have listening services associated with them. You can then look at things like fuser -n tcp <port num> to tell what PID(s) is/are listening to a given port, which can then tell you what daemon / ...


4

Why are you playing around with wget? Better use some headless browser to automate this task. What is a headless browser, you ask? A headless browser is a web browser without a graphical user interface. They provide automated control of a web page in an environment similar to popular web browsers, but are executed via a command line interface or ...


4

There is a website that offers curl cipher requestion detection as a service: curl https://www.howsmyssl.com/a/check However, it does not accept all ciphers - if one of the ciphers they accept is not on the list that your curl is sending, then you will not be able to get a response at all.


3

What you are asking for is called a proxy http server. The software receives http requests and passes them on or rejects them (logging too) It needn't sit on your embeded device, however your device would need to be configured to access the proxy instead of going directly to the internet. apache nginx are two examples of web servers that can act as proxy ...


3

What you are looking for is called Mutual SSL Authentication. In the case of a commonly deployed web server as Apache, and an also commonly deployed SSL/TLS implementation as OpenSSL, the steps would be as follows: There is a handy script distributed alongside openssl, CA.sh to do most of this stuff. Its location is distribution specific. In Debian and ...


3

No. You can't know it's a HTTPS handshake until the connection is open. At that point, it's too late to redirect it. The SYN packet doesn't tell you what's going to be transmitted; that's why we have port numbers to begin with.


3

I mailed the author (drchip) here is his answer : Hello, Netrw v144b already supports https (you may get it from http://drchip.0sites.net/astronaut/vim/index.html#NETRW). Thank you, Charles Campbell The website has since moved and can currently be found at http://www.drchip.org/astronaut/vim/index.html#NETRW To install it, I just had to ...


3

Okay so I solved this myself. Unfortunately most of the common documentation on the internet says "As your host to request the CSR". Of course my host is myself so I had to register the code myself on my server. I established a SSH connection to my server and ran the following command. openssl req -nodes -newkey rsa:2048 -keyout myserver.key -out ...


3

Try using 'curl' curl --data "j_username=value1&j_password=value2" https://idp2.civ.cvut.cz/idp/Authn/UserPassword You may need to look at the response type and set the 'content-type' header to match; i.e: XML, json etc


3

Solution Verify your wget binary is compiled with SSL support enabled. My output when I try the command you gave: $ wget https://www.facebook.com --2015-07-19 15:27:17-- https://www.facebook.com/ Resolving www.facebook.com (www.facebook.com)... 31.13.66.1, 2a03:2880:f013:1:face:b00c:0:1 Connecting to www.facebook.com (www.facebook.com)|31.13.66.1|:443... ...


3

You can use netstat: # netstat -tlnp | grep httpd # netstat -tlnp | grep apache # netstat -tlnp | grep nginx # netstat -tlnp | grep ... Then check that you get a line for each IP protocol version (tcp and tcp6). #!/bin/bash ns=$(netstat -tlnp | grep httpd) if grep 'tcp ' <<< "$ns" >/dev/null; then echo "httpd has a listening IPv4 ...


3

lsof is also useful. You can see all listening addresses and established connections of nginx using IPv4 and IPv6 respectively as follows (run as root): lsof -c nginx -a -i4 lsof -c nginx -a -i6 Show all connections of Google Chrome on the client host, both v4 and v6: lsof -c chrome -a -i


2

It's not curl, but it should be available on almost all Unices: wget -S --spider https://encrypted.site If the status messages bother you: wget -S --spider https://encrypted.site 2>&1 | awk '/^ /' If you want CRLF line endings: wget -S --spider https://encrypted.site 2>&1 | awk '/^ / { sub(/$/,"\r"); print }'


2

curl -v --trace-time https://www.google.de 21:50:34.054955 * About to connect() to www.google.de port 443 21:50:34.056574 * Trying 74.125.39.104... connected 21:50:34.104587 * Connected to www.google.de (74.125.39.104) port 443 21:50:34.313259 * successfully set certificate verify locations: 21:50:34.313349 * CAfile: /etc/pki/tls/certs/ca-bundle.crt ...


2

You want to block any and all HTTPS sites? You need to do this with a firewall on your router. Blocking it in Squid won't prevent people from circumventing it unless the firewall on your router also blocks it. If your router blocks it than what squid does is irrelevant. Better yet, set the firewall to block all outgoing TCP connections except for port 80 ...


2

Yes, it is called "Client Certificate Authentication" and is oft used with Smart Cards and the like. It can be complicated to get running well, depending on what your desired product is.


2

Just recently I came over the issue with my Company's apt repository. The problem was that if we use standard http transport anybody else can get package easily. As Company is packaging its own proprietary software and does not want to share it with everybody, http transport becomes a problem. Not a tragedy but a problem. There is couple of ways how to ...


2

What @stuart-p-bentley wrote got me thinking and I came up with this way of getting a comma delimited list of "Subject Alternative Names" using openssl, awk and tr. The sed line in his answer does not work on FreeBSD per example. openssl s_client -connect google.com:443 2>&1 | openssl x509 -text | awk '/X509v3 Subject Alternative Name/ ...



Only top voted, non community-wiki answers of a minimum length are eligible