News for hackers. Stuff that matters.
Re:Decrypting TLS Browser Traffic with Wireshark by theatraine on Thursday February 12, 2015 @05:19PM (#9041746)
I meant that Fiddler switches the original certificates with certificates that it generates. It's not a big deal if you trust them (on Windows Chrome and IE work automatically since it adds them to the trusted root store) and for Firefox you just have to trust the Fiddler issued certificate. However, if you inspect the certificate of an HTTPS site when Fiddler is running you see the CA is "DO_NOT_TRUST_FiddlerRoot".
Re:Decrypting TLS Browser Traffic with Wireshark by platz on Friday February 13, 2015 @12:48AM (#9043091)
I believe mitmproxy also sniffs HTTPS, but I think it uses a different method by dynamically generating a cert based on the true one http://mitmproxy.org/doc/howmitmproxy.html (bottom)