On Tue, Jan 27, 2004 at 08:27:41AM +0100, Daniel Stenberg wrote:
> On Mon, 26 Jan 2004, Keith E Junker wrote:
>
> > Trying to reverse engineer an https: transaction would turn into a piece of
> > cake if there were such a browser. Because of the frames in our problem
> > management thin client, saving pages and changing POSTs to GETs just takes
> > too long and it's too error-prone when I'm trying to do it during work
> > hours - it's sort of "peripheral" work, you know.
>
> I don't know why you would need to try GET vs POST. You should get the first
> page with curl, then read the HTML and adjust the curl command for the
> following page(s).

If you replace POST with GET, you can see the formdata that the browser
sends, appended to the URL.

> The tricky parts are usually things like javascript fiddling, cookies and
> weird redirect attempts in order to detect browser versions and javascript
> compliance.

Indeed...

> > Another approach would be to do packet capture and use OpenSSL to decrypt a
> > session.
>
> ssldump (http://www.rtfm.com/ssldump/) might help you do just that.

But that requires that you know the servers keys, doesn't it?

Some time ago i wrote a very simple proxy server that logs all requests.
It was written in perl and didn't work for https. I rewrote it in C using
libcurl to connect to the server, and this gives it the ability to talk http
with the client and https with the server. You can download it from:
http://www.koblenz-net.de/~horn/download.html or (direct link):
http://www.koblenz-net.de/~horn/export/sws.tgz
Just untar the archive and look at the files README and INSTALL...

The program is still very experimental and possibly full of bugs, but
it works for me and perhaps it's usefull for someone else...

Bye,
Georg

-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
Received on 2004-01-28