Analyzing HTTP/S traffic with ssldump ===================================== 2006-11-07 support@frank4dd.com Software used: 1:) ssldump 0.9b3 http://www.rtfm.com/ssldump/ by Eric Rescorla Limitation: works only on the webserver 2.) sslsniffer 1.21 http://crypto.stanford.edu/~eujin/sslsniffer/ by Eu-Jin Goh andi Dan Boneh from Stanford University Limitation: doesn't show encrypted html data 3.) Example using ssldump DDM1307811:~ # ssldump -i eth0 host 172.20.203.72 or host 172.20.203.73 or host 172.20.203.74 and port 74 -d New TCP connection #1: DDM1307811.frank4dd.com(2318) <-> n30prxy2.frank4dd.com(74) 0.0006 (0.0006) C>S --------------------------------------------------------------- CONNECT n30clf1:443 HTTP/1.0 User-Agent: Mozilla/5.0 (compatible; Konqueror/3.4; Linux) KHTML/3.4.2 (like Gecko) Host: n30clf1 --------------------------------------------------------------- 0.0026 (0.0020) S>C --------------------------------------------------------------- HTTP/1.0 200 Connection established --------------------------------------------------------------- 1 1 0.0064 (0.0037) C>S SSLv2 compatible client hello Version 3.0 cipher suites SSL_RSA_WITH_RC4_128_MD5 SSL2_CK_RC4 SSL_RSA_WITH_RC4_128_SHA SSL_RSA_WITH_3DES_EDE_CBC_SHA SSL2_CK_RC2 SSL2_CK_3DES SSL_DHE_RSA_WITH_AES_256_CBC_SHA SSL_DHE_DSS_WITH_AES_256_CBC_SHA SSL_RSA_WITH_AES_256_CBC_SHA SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA SSL_DHE_RSA_WITH_AES_128_CBC_SHA SSL_DHE_DSS_WITH_AES_128_CBC_SHA SSL_RSA_WITH_AES_128_CBC_SHA SSL_DHE_DSS_WITH_RC4_128_SHA SSL2_CK_RC464 SSL2_CK_DES SSL_DHE_DSS_WITH_RC2_56_CBC_SHA SSL_RSA_EXPORT1024_WITH_RC4_56_SHA SSL_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA SSL_RSA_EXPORT1024_WITH_DES_CBC_SHA SSL_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 SSL_RSA_EXPORT1024_WITH_RC4_56_MD5 SSL_DHE_RSA_WITH_DES_CBC_SHA SSL_DHE_DSS_WITH_DES_CBC_SHA SSL_RSA_WITH_DES_CBC_SHA 1 2 0.0092 (0.0028) S>C Handshake ServerHello Version 3.0 session_id[32]= 1e 91 7c 13 27 49 07 b0 73 d6 8f fe 5a bf a6 8e b3 b1 11 f7 37 31 8b 25 25 96 2d 2e ed 83 05 75 cipherSuite SSL_RSA_WITH_RC4_128_MD5 compressionMethod NULL 1 3 0.0092 (0.0000) S>C Handshake Certificate 1 4 0.0092 (0.0000) S>C Handshake ServerHelloDone 1 5 0.0097 (0.0005) C>S Handshake ClientKeyExchange 1 6 0.0097 (0.0000) C>S ChangeCipherSpec 1 7 0.0097 (0.0000) C>S Handshake 1 8 0.0238 (0.0140) S>C ChangeCipherSpec 1 9 0.0238 (0.0000) S>C Handshake 1 10 0.0503 (0.0265) C>S application_data 1 11 0.1212 (0.0708) S>C application_data 1 16.1616 (16.0403) C>S TCP FIN 1 17.6403 (1.4787) S>C TCP FIN 3.1. Use keys to follow the encrypted traffic --------------------------------------------- openssl x509 -in test.pem -pubkey -noout > testpubkey.pem DDM1307811:~ # cat testpubkey.pem -----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr7bH5JmLVmnsU3Y22sOq TxuhLbjVv7km33l06QLxWglT0HPwJt69dME9A2cAAo1tIjIJAZI6ViDKUI9SyI8p uybCcrb123lxVyTgaA+uNZmyLKW91TNFM84esTc+9/gB36/FEmK8LvYAmRHSpsF4 NzwCdLzFRL6K0FoqGxkGNNmvh5FNd9CMWVRUzdZ3Sczs9XTfDROJ9Sq1f0BFTuVL LGpbzM88p00451AOhZiHzlDD9CRGFtas3BgoBEYM81UM6uvQhc+kw12iuEjRG2E8 lFvvZogkhaeZeZ+kkS8JgeQ2FW6onwlWZojllOfy8YPtYurc1eenbLj04oexmjT0 gQIDAQAB -----END PUBLIC KEY----- 3.2. ON THE SERVER: =================== n30clf1:/etc/apache-ssl# ssldump -d -k /etc/apache-ssl/apache.pem -i eth0 port 443 New TCP connection #1: n30prxy2.frank4dd.com(36041) <-> n30clf1(443) 1 1 0.0059 (0.0059) C>S SSLv2 compatible client hello Version 3.0 cipher suites SSL_RSA_WITH_RC4_128_MD5 SSL2_CK_RC4 SSL_RSA_WITH_RC4_128_SHA SSL_RSA_WITH_3DES_EDE_CBC_SHA SSL2_CK_RC2 SSL2_CK_3DES Unknown value 0x39 Unknown value 0x38 Unknown value 0x35 SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA Unknown value 0x33 Unknown value 0x32 Unknown value 0x2f SSL_DHE_DSS_WITH_RC4_128_SHA SSL2_CK_RC464 SSL2_CK_DES SSL_DHE_DSS_WITH_RC2_56_CBC_SHA SSL_RSA_EXPORT1024_WITH_RC4_56_SHA SSL_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA SSL_RSA_EXPORT1024_WITH_DES_CBC_SHA SSL_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 SSL_RSA_EXPORT1024_WITH_RC4_56_MD5 SSL_DHE_RSA_WITH_DES_CBC_SHA SSL_DHE_DSS_WITH_DES_CBC_SHA SSL_RSA_WITH_DES_CBC_SHA 1 2 0.0061 (0.0001) S>C Handshake ServerHello Version 3.0 session_id[32]= 1f c8 11 c9 46 92 8b ae 3b 9f 4f 0d f4 ab f6 bf aa fc dd 64 bc d4 90 98 c7 35 45 4e 28 16 34 a1 cipherSuite SSL_RSA_WITH_RC4_128_MD5 compressionMethod NULL 1 3 0.0061 (0.0000) S>C Handshake Certificate 1 4 0.0061 (0.0000) S>C Handshake ServerHelloDone 1 5 0.0092 (0.0031) C>S Handshake ClientKeyExchange 1 6 0.0092 (0.0000) C>S ChangeCipherSpec 1 7 0.0092 (0.0000) C>S Handshake Finished 1 8 0.0216 (0.0124) S>C ChangeCipherSpec 1 9 0.0216 (0.0000) S>C Handshake Finished 1 10 0.0518 (0.0301) C>S application_data --------------------------------------------------------------- GET /cert.shtml HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (compatible; Konqueror/3.4; Linux) KHTML/3.4.2 (like Gecko) Referer: https://n30clf1/ Accept: text/html, image/jpeg, image/png, text/*, image/*, */* Accept-Encoding: x-gzip, x-deflate, gzip, deflate Accept-Charset: utf-8, utf-8;q=0.5, *;q=0.5 Accept-Language: en, de, ja Host: n30clf1 Authorization: Basic Zm1pZ2dlOnRlc3QxMjMh --------------------------------------------------------------- 1 11 0.1399 (0.0881) S>C application_data --------------------------------------------------------------- HTTP/1.1 200 OK Date: Tue, 07 Nov 2006 09:43:54 GMT Server: Apache/1.3.33 Ben-SSL/1.55 (Debian GNU/Linux) mod_python/2.7.10 Python/2.3.4 PHP/4.3.10-16 mod_auth_pam/1.1.1 mod_perl/1.29 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=iso-8859-1 9ed HTML Index Page

My WebSite Remote Howtos

Central Logging Facility Root Certificate

The Local Root Certificate


Here is how to install the root certificate on your machine. Please click here to install the root certificate. Depending on your browser will be presented an import dialouge. Follow it to install. Here are some details you might want to check:

MD Fingerprint: 2C:4C:5C:2F:31:DD:F1:1C:B2:A6:A1:9E:95:1D:86:54
SHA1 Fingerprint: C3:A5:BB:AB:38:2F:A2:BB:0C:02:3D:D6:4E:A9:EE:54:57:B2:46:D0
Valid from: (2004-04-08 15:39:09 GMT)
Valid to: (2004-04-07 15:39:09 GMT)
Issuer /C=DE/ST=Saxony/L=Dresden/O=Frank4DD/OU=Support/CN=www.frank4dd.com/Email=public@frank4dd.com


Last modified 2006-06-06, 16:20 CEST . Please report errors to your friendly Webmaster. Thanx.

[Administration]