Copying SSL traffic

LinuxGeek · 03-17-2007, 10:14 AM

Hi,
I was wondering if there was any open-source product similar to "BreachView SSL". "BreachView SSL decrypts SSL traffic on the fly without terminating the SSL session and delivers clear text to the IDS sensor, for the first time eliminating the blind spot in most IDSs and extending IDS protection to SSL traffic on the network." Is there any way to get the same effect using open source software? Thank you for your help.

Matir · 03-17-2007, 01:52 PM

Breachview SSL requires that you have the private keys of the site whose traffic is to be inspected. There are several similar techniques with ettercap and similar open source applications. Wireshark has a "follow SSL stream" that seems to work exactly the same as BreachView SSL.

LinuxGeek · 03-18-2007, 03:37 PM

Thank you for your feedback. I do have the private key (it's my site after all). What I'm trying to do is:

a. copy the SSL stream [so that I have one stream that I can inspect with the IDS and the default stream goes to the web server]

b.allow the IDS to inspect the traffic.

From my understanding, using ettercap or Ethereal/Wireshark aren't really useful if I want to automate the stream copying and relaying.

LinuxGeek · 03-18-2007, 03:39 PM

Actually, I take that back. ettercap might be helpful (still investigating).