These are good for certain specific tests, but they're too inconsistent to trust for professional testing. There's always the chance that you're hooking the wrong thing (or nothing at all, in the case of a statically linked OpenSSL in a version you don't know/have FLIRT-ish symbols for).
I used to use this technique a whole lot, but I've gone to 100% MITMing via cert spoofing/replacement.
Ironically, it has been a week of not being able to do that, and instead surreptitiously patching binaries and (in one case) a kernel, here at the shop. I read the parent comment earlier and thought "man, I miss Pai Mei."
Yeah, there are definitely cases where you can't swap out certs and all that, but in those cases the automated tools just fall down anyway. I don't miss the days of manually compiling OpenSSL with specific flags to generate just the right FLIRT symbols to find the methods I needed to hook.
Though, so is using a SOCKS or HTTP proxy. To be consistent, the tool should really be reading PCAP dumps. Too many applications either don't support proxies, or only use them for some things.
The best exception to this that I can think of is Chrome, which even tunnels Silverlight and Flash through its defined proxy.
Comments
These are good for certain specific tests, but they're too inconsistent to trust for professional testing. There's always the chance that you're hooking the wrong thing (or nothing at all, in the case of a statically linked OpenSSL in a version you don't know/have FLIRT-ish symbols for).
I used to use this technique a whole lot, but I've gone to 100% MITMing via cert spoofing/replacement.
Ironically, it has been a week of not being able to do that, and instead surreptitiously patching binaries and (in one case) a kernel, here at the shop. I read the parent comment earlier and thought "man, I miss Pai Mei."
Yeah, there are definitely cases where you can't swap out certs and all that, but in those cases the automated tools just fall down anyway. I don't miss the days of manually compiling OpenSSL with specific flags to generate just the right FLIRT symbols to find the methods I needed to hook.
Though, so is using a SOCKS or HTTP proxy. To be consistent, the tool should really be reading PCAP dumps. Too many applications either don't support proxies, or only use them for some things.
The best exception to this that I can think of is Chrome, which even tunnels Silverlight and Flash through its defined proxy.