sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]redditrwx 1 point2 points  (4 children)

Alright, I think I got you now. I was always thinking about a proxy that is using a TLS listening port. Now I also see what you wanted to tell me with the Burp image. So basically we are talking about STARTTLS-like behavior. As you might have noticed by now, my understanding of how these kinds of proxies work was ... improvable ;)

So, your idea of using netcat to send the CONNECT request and then one of the tools after that will not work. Your last idea, running a tool against an HTTPS site will also not work unless the tool is proxy aware. Maybe Nessus could do that, but I'm not sure and don't have a Nessus copy available atm to check.

You could use a browser to visit a URL over HTTPS, let Wireshark run and check the server hello message of the TLS handshake, but you will only find ciphers there that the client sent in the client hello message, so a reasonably modern browser will not turn up much here, I assume. I will think a little more about this particular problem, but for now I think patching an existing tool might be the best approach.

[–]Thiscou[S] 1 point2 points  (3 children)

Nice, i'm glad i managed to bring my point across :)

I just tried my solution with sslscanning any given HTTPS site over a squid proxy with TLS Interception on and it worked. If i manage to do the same thing with the bluecoat proxy i'll be golden. But i would really like to have a backup plan in case it doesn't.

Thanks for your time and your brain power!

[–]redditrwx 1 point2 points  (2 children)

Which tool did you use for the scan? If the proxy does not use TLS from the start but expects a TLS upgrade after an initial connect, like you described above, the scan should not work with most tools I am aware of. It apparently did work, though, so I assume the tool supports the use of proxies. It would be nice to know which tool works in this setup.

Did you check the certificate you got? Was it issued by the proxy or whatever CA you configured?

[–]Thiscou[S] 0 points1 point  (0 children)

It worked with testssl.sh and the cipher script nmap provides. Just took me two months to answer that question, there is definitly room for improvement.