间谍Java安全套接字

Question

I would like to know if there is an easy (or hard) way to spy the secure sockets from a java applet ? (without having the source code)

The goal here is to know exactly what for informations send an (very good obfuscated) applet.

I thought i can simply compile myself a modified java version with a log function but the full source code from java is not available for security reasons...

Answer 1

Set up a proxy server with a security certificate that the applet accepts. Afterwards, you just have to configure your browser to use that proxy and the applet should use the same config.

See Does https prevent man in the middle attacks by proxy server? for how it works technically.

Some things you will need: A proxy than can act as a web server and which is probably reachable with the name of the real server from your browser. You will need to create a valid certificate for this combination which isn't trivial unless the applet is configured to accept certificates from untrusted sources (no CA authority will issue a certificate for, say, "google.com" so that you can feed that to your proxy).

Googling for "man in the middle attack ssl proxy" turns up many links that should be useful.

This article seems to describe an out-of-the-box solution: Understanding Man-In-The-Middle Attacks - Part 4: SSL Hijacking

It doesn't mention applets but Fiddler might fit the bill (from Capturing HTTPS traffic in the clear? )

Answer 2

Just set -Djavax.net.debug=all in the JVM properties. You will get all kinds of output from different layers of the network stack, including the pre-encrypted SSL traffic.

Answer 3

如果您谈论的是SSL，那么这将是不安全的，而且它是安全的，因此不是。