0

I have a program which communicates with a server via an JSON-API. Basically what it is doing is sending POST requests to https: // myserver / json with a json-file within the POST body.

I need a way to look inside this body (the url will always be /json). However, as it is a https-request wireshark and other tools cannot help me with my encrypted body.

Is there any way to see the post-request BEFORE it is getting encrypted? Someone pointed me to https://github.com/socsieng/capture-proxy but I don't know how to use this tool with my application

  • What are you really trying to do? If your posting you created the body. If you want to look at the response that is something that cURL already does (or wget or what ever). If it's not your program then we need to know what program it is. – coteyr Sep 30 '15 at 18:08
  • If an HTTPS connection uses a "plain-RSA" ciphersuite (in particular NOT DHE or ECDHE which are usually preferred/recommended) and you have a copy of the server privatekey, wireshark can decrypt it. If "my" server means it is under your control (rather than just the server you are using) you should be able to get the privatekey, and probably set the ciphersuite selection to use "plain-RSA". That said, getting plaintext in the client or server may be easier. – dave_thompson_085 Sep 30 '15 at 19:56
  • Well, the server is within our local network but not in my access. I'm just trying to figure out a REST-API which lacks on documentation. There is a program which shows data based on post-requests and I want to receive this data without having to use the program but using post-requests instead – Frame91 Sep 30 '15 at 20:41
1

Not enough details about your client, so it is hard to answer the question is it possible to see request before encryption at all. In my opinion you need capturing proxy software that allows capturing HTTPS communication. Basically it works like this:

  1. you start capturing-proxy and it starts to listen on some local port - lets say 8080,
  2. you configure your client to use proxy localhost:8080 for HTTP i HTTPS communication,
  3. you do your job, client sends some requests to your proxy which forwards it to the server through HTTPS,
  4. server respond through HTTPS to the proxy, and proxy forwards respond to your client.

In result all actual communication is logged and you can analyze it.

As far as I know not all capturing proxy supports HTTPS proxying. For sure Burp Suite supports it and it is great tool, although can look a bit complicated at first. And it has free version which will be more than enough for your task. I do not know what your client is but, for example in the browsers you need to add Burp CA to its configuration.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.