[javierpena]

I was configuring burp yet again on a fresh VM and this got me thinking about HTTPS certs. How exactly do they work? Can I craft my own cert and "incert" (no pun intended 😁) into a victim browser, so I can decrypt the data I receive when performing MiTM without the need for SSL strip

Honestly I don't really know much about these things and this is just an idea. Can it be done? How to make my own certificate and decrypt data passed through SSL?

I will appreciate any help including resources to read or if anyone has already done it and can speak from experience

Thanks!

[Its1234]

In my opinion, mitm is not that useful because it takes too much effort and it's not worth it in the end. the only thing I can think of that Mitm is good for is when you're on someone else's network and you want to see what websites they always visit
Don't break your head trying to figure out how to do it just focus on something else like DNS poisoning and redirecting and all that

[javierpena]

In my opinion, mitm is not that useful because it takes too much effort and it's not worth it in the end. the only thing I can think of that Mitm is good for is when you're on someone else's network and you want to see what websites they always visit
Don't break your head trying to figure out how to do it just focus on something else like DNS poisoning and redirecting and all that

Thanks for your input but I am interested in this specific method

[Dread.Reaper]

I mean there is always self signed SSL certs....

[javierpena]

I mean there is always self signed SSL certs....

why all experts always talk in riddles 😆

[Dread.Reaper]

why all experts always talk in riddles 😆

https://stackoverflow.com/questions/2129...-authority

You can sign your own SSL certificates for this purpose. (Keeping in mind it can still cause warnings on some browsers that is not a Certificate authority issued one)

[javierpena]

https://stackoverflow.com/questions/2129...-authority

You can sign your own SSL certificates for this purpose. (Keeping in mind it can still cause warnings on some browsers that is not a Certificate authority issued one)

Thanks I will check this out ✌

[Dread.Reaper]

Thanks I will check this out ✌

✌

Also...

why all experts always talk in riddles 😆

I could ask why all newbies are trying to do things with stuff they dont understand. 🙃

You gotta understand how the tech works before you can go messing about with it 😎

[javierpena]

✌

Also...

I could ask why all newbies are trying to do things with stuff they dont understand. 🙃

You gotta understand how the tech works before you can go messing about with it 😎

I am a wild card more commonly known as a joker 😁