IO::Socket::SSL::Intercept.3pm - Online Linux Manual Page

IO::Socket::SSL::Intercept - Online Linux Manual PageSection : 3
Updated : 2023-01-25
Source : perl v5.36.0
Note : User Contributed Perl Documentation

NAMEIO::Socket::SSL::Intercept −− SSL interception (man in the middle)

SYNOPSIS use IO::Socket::SSL::Intercept; # create interceptor with proxy certificates my $mitm = IO::Socket::SSL::Intercept−>new( proxy_cert_file => 'proxy_cert.pem', proxy_key_file => 'proxy_key.pem', ... ); my $listen = IO::Socket::INET−>new( LocalAddr => .., Listen => .. ); while(1) { # TCP accept new client my $client = $listen−>accept or next; # SSL connect to server my $server = IO::Socket::SSL−>new( PeerAddr => .., SSL_verify_mode => ..., ... ) or die "ssl connect failed: $!,$SSL_ERROR"; # clone server certificate my ($cert,$key) = $mitm−>clone_cert( $server−>peer_certificate ); # and upgrade client side to SSL with cloned certificate IO::Socket::SSL−>start_SSL($client, SSL_server => 1, SSL_cert => $cert, SSL_key => $key ) or die "upgrade failed: $SSL_ERROR"; # now transfer data between $client and $server and analyze # the unencrypted data ... }

DESCRIPTIONThis module provides functionality to clone certificates and sign them with a proxy certificate, thus making it easy to intercept SSL connections (man in the middle). It also manages a cache of the generated certificates.

How Intercepting SSL WorksIntercepting SSL connections is useful for analyzing encrypted traffic for security reasons or for testing. It does not break the end-to-end security of SSL, e.g. a properly written client will notice the interception unless you explicitly configure the client to trust your interceptor. Intercepting SSL works the following way: • Create a new CA certificate, which will be used to sign the cloned certificates. This proxy CA certificate should be trusted by the client, or (a properly written client) will throw error messages or deny the connections because it detected a man in the middle attack. Due to the way the interception works there no support for client side certificates is possible. Using openssl such a proxy CA certificate and private key can be created with: openssl genrsa −out proxy_key.pem 1024 openssl req −new −x509 −extensions v3_ca −key proxy_key.pem −out proxy_cert.pem # export as PKCS12 for import into browser openssl pkcs12 −export −in proxy_cert.pem −inkey proxy_key.pem −out proxy_cert.p12 • Configure client to connect to use intercepting proxy or somehow redirect connections from client to the proxy (e.g. packet filter redirects, ARP or DNS spoofing etc). • Accept the TCP connection from the client, e.g. don't do any SSL handshakes with the client yet. • Establish the SSL connection to the server and verify the servers certificate as usually. Then create a new certificate based on the original servers certificate, but signed by your proxy CA. This is the step where IO::Socket::SSL::Intercept helps. • Upgrade the TCP connection to the client to SSL using the cloned certificate from the server. If the client trusts your proxy CA it will accept the upgrade to SSL. • Transfer data between client and server. While the connections to client and server are both encrypted with SSL you will read/write the unencrypted data in your proxy application.

METHODSIO::Socket::SSL::Intercept helps creating the cloned certificate with the following methods: $mitm = IO::Socket::SSL::Intercept−>new(%args) This creates a new interceptor object. %args should be proxy_cert X509 | proxy_cert_file filename This is the proxy certificate. It can be either given by an X509 object from Net::SSLeays internal representation, or using a file in PEM format. proxy_key EVP_PKEY | proxy_key_file filename This is the key for the proxy certificate. It can be either given by an EVP_PKEY object from Net::SSLeays internal representation, or using a file in PEM format. The key should not have a passphrase. pubkey EVP_PKEY | pubkey_file filename This optional argument specifies the public key used for the cloned certificate. It can be either given by an EVP_PKEY object from Net::SSLeays internal representation, or using a file in PEM format. If not given it will create a new public key on each call of \*(C`new\*(C'\fR. serial INTEGER|CODE This optional argument gives the starting point for the serial numbers of the newly created certificates. If not set the serial number will be created based on the digest of the original certificate. If the value is code it will be called with \*(C`serial(original_cert,CERT_asHash(original_cert))\*(C'\fR and should return the new serial number. cache HASH | SUBROUTINE This optional argument gives a way to cache created certificates, so that they don't get recreated on future accesses to the same host. If the argument ist not given an internal HASH ist used. If the argument is a hash it will store for each generated certificate a hash reference with \*(C`cert\*(C'\fR and \f(CW\*(C`atime\*(C'\fR in the hash, where \f(CW\*(C`atime\*(C'\fR is the time of last access (to expire unused entries) and \*(C`cert\*(C'\fR is the certificate. Please note, that the certificate is in Net::SSLeays internal X509 format and can thus not be simply dumped and restored. The key for the hash is an \*(C`ident\*(C'\fR either given to \f(CW\*(C`clone_cert\*(C'\fR or generated from the original certificate. If the argument is a subroutine it will be called as \*(C`$cache\->(ident,sub)\*(C'\fR. This call should return either an existing (cached) \*(C`(cert,key)\*(C'\fR or call \*(C`sub\*(C'\fR without arguments to create a new \f(CW\*(C`(cert,key)\*(C'\fR, store it and return it. If called with $cache−>('type') the function should just return 1 to signal that it supports the current type of cache. If it reutrns nothing instead the older cache interface is assumed for compatibility reasons. ($clone_cert,$key) = $mitm−>clone_cert($original_cert,[ $ident ]) This clones the given certificate. An ident as the key into the cache can be given (like \*(C`host:port\*(C'\fR), if not it will be created from the properties of the original certificate. It returns the cloned certificate and its key (which is the same for alle created certificates). $string = $mitm−>serialize This creates a serialized version of the object (e.g. a string) which can then be used to persistantly store created certificates over restarts of the application. The cache will only be serialized if it is a HASH. To work together with Storable the \*(C`STORABLE_freeze\*(C'\fR function is defined to call \*(C`serialize\*(C'\fR. $mitm = IO::Socket::SSL::Intercept−>unserialize($string) This restores an Intercept object from a serialized string. To work together with Storable the \*(C`STORABLE_thaw\*(C'\fR function is defined to call \*(C`unserialize\*(C'\fR.

AUTHORSteffen Ullrich 0

Johanes Gumabo

Data Size : 18,773 byte
man-IO::Socket::SSL::Intercept.3pmBuild : 2024-12-05, 20:55 :
Visitor Screen : x
Visitor Counter ( page / site ) : 4 / 170,986
Visitor ID : :
Visitor IP : 3.146.37.242 :
Visitor Provider : AMAZON-02 :
Provider Position ( lat x lon ) : 39.962500 x -83.006100 : x
Provider Accuracy Radius ( km ) : 1000 :
Provider City : Columbus :
Provider Province : Ohio , : ,
Provider Country : United States :
Provider Continent : North America :
Visitor Recorder : Version :
Visitor Recorder : Library :
Online Linux Manual Page : Version : Online Linux Manual Page - Fedora.40 - march=x86-64 - mtune=generic - 24.12.05
Online Linux Manual Page : Library : lib_c - 24.10.03 - march=x86-64 - mtune=generic - Fedora.40
Online Linux Manual Page : Library : lib_m - 24.10.03 - march=x86-64 - mtune=generic - Fedora.40
Data Base : Version : Online Linux Manual Page Database - 24.04.13 - march=x86-64 - mtune=generic - fedora-38
Data Base : Library : lib_c - 23.02.07 - march=x86-64 - mtune=generic - fedora.36

Very long time ago, I have the best tutor, Wenzel Svojanovsky . If someone knows the email address of Wenzel Svojanovsky , please send an email to johanes_gumabo@yahoo.co.id .

If error, please print screen and send to johanes_gumabo@yahoo.co.id
Under development. Support me via PayPal.

ERROR : Need New Coding : (parse_manual_page_|249|IO::Socket::SSL::Intercept.3pm|24/25|el══─{─══.|.el══─{─══. ds C` ) (htmlprn|149|IO::Socket::SSL::Intercept.3pm|24/25|.el══─{─══. ds C` |.el══─{─══. ds C` ) (parse_manual_page_|249|IO::Socket::SSL::Intercept.3pm|27|br══─}─══|'br══─}─══ ) (htmlprn|149|IO::Socket::SSL::Intercept.3pm|27|'br══─}─══ |'br══─}─══ ) (rof_escape_sequence|91|IO::Socket::SSL::Intercept.3pm|171|\*(C`new\*(C'\fR. |If not given it will create a new public key on each call of \f(CW\*(C`new\*(C'\fR. ) (rof_escape_sequence|91|IO::Socket::SSL::Intercept.3pm|177|\*(C`serial(original_cert,CERT_asHash(original_cert))\*(C'\fR and should |called with \f(CW\*(C`serial(original_cert,CERT_asHash(original_cert))\*(C'\fR and should ) (rof_escape_sequence|91|IO::Socket::SSL::Intercept.3pm|186|\*(C`cert\*(C'\fR and \f(CW\*(C`atime\*(C'\fR in the hash, where \f(CW\*(C`atime\*(C'\fR is the time of |reference with \f(CW\*(C`cert\*(C'\fR and \f(CW\*(C`atime\*(C'\fR in the hash, where \f(CW\*(C`atime\*(C'\fR is the time of ) (rof_escape_sequence|91|IO::Socket::SSL::Intercept.3pm|187|\*(C`cert\*(C'\fR is the certificate. Please |last access (to expire unused entries) and \f(CW\*(C`cert\*(C'\fR is the certificate. Please ) (rof_escape_sequence|91|IO::Socket::SSL::Intercept.3pm|190|\*(C`ident\*(C'\fR either given to \f(CW\*(C`clone_cert\*(C'\fR or generated |The key for the hash is an \f(CW\*(C`ident\*(C'\fR either given to \f(CW\*(C`clone_cert\*(C'\fR or generated ) (rof_escape_sequence|91|IO::Socket::SSL::Intercept.3pm|193|\*(C`$cache\->(ident,sub)\*(C'\fR. |If the argument is a subroutine it will be called as \f(CW\*(C`$cache\->(ident,sub)\*(C'\fR. ) (rof_escape_sequence|91|IO::Socket::SSL::Intercept.3pm|194|\*(C`(cert,key)\*(C'\fR or |This call should return either an existing (cached) \f(CW\*(C`(cert,key)\*(C'\fR or ) (rof_escape_sequence|91|IO::Socket::SSL::Intercept.3pm|195|\*(C`sub\*(C'\fR without arguments to create a new \f(CW\*(C`(cert,key)\*(C'\fR, store it |call \f(CW\*(C`sub\*(C'\fR without arguments to create a new \f(CW\*(C`(cert,key)\*(C'\fR, store it ) (rof_escape_sequence|91|IO::Socket::SSL::Intercept.3pm|207|\*(C`host:port\*(C'\fR), if not it |An ident as the key into the cache can be given (like \f(CW\*(C`host:port\*(C'\fR), if not it ) (rof_escape_sequence|91|IO::Socket::SSL::Intercept.3pm|217|\*(C`STORABLE_freeze\*(C'\fR function is defined to |To work together with Storable the \f(CW\*(C`STORABLE_freeze\*(C'\fR function is defined to ) (rof_escape_sequence|91|IO::Socket::SSL::Intercept.3pm|218|\*(C`serialize\*(C'\fR. |call \f(CW\*(C`serialize\*(C'\fR. ) (rof_escape_sequence|91|IO::Socket::SSL::Intercept.3pm|223|\*(C`STORABLE_thaw\*(C'\fR function is defined to |To work together with Storable the \f(CW\*(C`STORABLE_thaw\*(C'\fR function is defined to ) (rof_escape_sequence|91|IO::Socket::SSL::Intercept.3pm|224|\*(C`unserialize\*(C'\fR. |call \f(CW\*(C`unserialize\*(C'\fR. )