I want to see what personal information a flash application is sending back to its servers. Wireshark shows that the app is using SSL, so I'm trying to figure out how to decrypt the traffic between the app and the remote server. I found these instructions on Wireshark's site http://wiki.wireshark.org/SSL, but they seemed to be incomplete and I co开发者_如何学运维uldn't get it to work. Has anybody had success accomplishing this?
Try this: http://www.charlesproxy.com/
It works because it acts as a man-in-the-middle (and therefore, your browser will warn you as the root certificate isn't trusted).
If you don't have access to the private key for the server with which the Flash application is communicating, and the Flash app is properly designed, you will not be able to decrypt the traffic.
The only chance you have is something malicious: spoofing a certificate for the site. The certificate you produce will be invalid, so you'll have to manually add it to your browser/OS's trust store before loading the page. Once you've done this, set up a transparent proxy and sniff away.
精彩评论