Is is possible to inspect the outbound https traffic?

Question

So, the situation is: I want to know what path is a program sending the request to. With Wireshark, I can only know that it is sending https request and the corresponding domain but not the path.

I think there could be a way to at least inspect the outbound https traffic even without hacking the program.

Let's say if I run a fake website and redirect the connection to the real site to my local fake site. So the request will be sent to my fake site, and I can create a self-signed fake key pair for my fake site. Install the private key on the fake site, and install the public key on my local machine. Then the handshake should be approved.

But I have several problems:

1. How to launch a fake https server in the simplest way? Nginx? Or is there a simple solution in Python?
2. How can I install the public key on my local machine? I'm using Linux Mint 19 which is based on Ubuntu 18.04.

Any help is appreciated!

Answer 1

You may want to check Charles proxy . This a proxy with which you can inspect the outbound traffic (including HTTPS).

In order to inspect HTTPS traffic, it will be required to enable SSL Proxy which means that Charles will dynamically generate a certificate and become man-in-the-middle for HTTPS connections.

Charles signs these dynamic certificates with it's own which has to be added to the trusted storage of the application you use. Various instructions are available here .