[B! è¨¼æ˜Žæ›¸][TLS] steropeã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

sterope id:sterope

è¨¼æ˜Žæ›¸ã¨TLSã«é–¢ã™ã‚‹steropeã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (5)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ãƒ¢ãƒã‚¤ãƒ«ã‚¢ãƒ—ãƒªé–‹ç™ºè€…ã®ãŸã‚ã® mitmproxy å…¥é–€ - Qiita
ã¯ã˜ã‚ã« ãƒ¢ãƒã‚¤ãƒ«ã‚¢ãƒ—ãƒªã‚’é–‹ç™ºã—ã¦ã„ã‚‹ã¨ãã«ã€ã‚¢ãƒ—ãƒªã¨ã‚µãƒ¼ãƒãƒ¼é–“ã®é€šä¿¡ã‚’ç¢ºèªã—ãŸã„ã¨ããŒã‚ã‚Šã¾ã™ã€‚ãŸã¨ãˆã°ã€æœŸå¾…é€šã‚Šã® HTTP ãƒªã‚¯ã‚¨ã‚¹ãƒˆãŒé€ã‚‰ã‚Œã¦ã„ã‚‹ã‹èª¿ã¹ãŸã‚Šã€ã‚µãƒ¼ãƒãƒ¼ã‹ã‚‰ã®ãƒ¬ã‚¹ãƒãƒ³ã‚¹ãŒé–“é•ã£ã¦ã„ãªã„ã‹ç¢ºèªã—ãŸã‚Šã™ã‚‹å¿…è¦ãŒç”Ÿã˜ã¾ã™ã€‚ ãã‚“ãªã¨ãã«ã€ã„ã¡ã„ã¡ãƒ‡ãƒãƒƒã‚¬ã§æ¢ã‚ã¦ã‚‚è‰¯ã„ã®ã§ã™ãŒã€ãƒ—ãƒã‚ã‚·ã‚’ã¯ã•ã‚ã°ç°¡å˜ã«é€šä¿¡ã‚’è¦—ãã“ã¨ãŒã§ãã¾ã™ã€‚ã—ã‹ã‚‚ã€ãƒ¬ã‚¹ãƒãƒ³ã‚¹ã‚’æ”¹ç«„ã—ã¦ã€ã‚ã–ã¨ä¸æ£ãªãƒ¬ã‚¹ãƒãƒ³ã‚¹ã«ã—ã¦ã‚¢ãƒ—ãƒªãŒã‚¯ãƒ©ãƒƒã‚·ãƒ¥ã—ãªã„ã‹ãƒ†ã‚¹ãƒˆã—ãŸã‚Šã€ç‰¹å®šã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆã ã‘ãƒ–ãƒãƒƒã‚¯ã—ã¦ã‚µãƒ¼ãƒãƒ¼éšœå®³ã‚’æ“¬ä¼¼çš„ã«å†ç¾ã™ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ mitmproxy ã¨ã¯ mitmproxy ã¯ man-in-the-middle åž‹ã®ãƒ—ãƒã‚ã‚·ã‚µãƒ¼ãƒãƒ¼ã®ãƒ„ãƒ¼ãƒ«ã§ã™ã€‚OS X ã‚„ Windowsã€Linux ä¸Šã§å‹•ä½œã—ã€å¯¾è©±å¼ã® CUI ã‚’æŒã¡ã¾ã™ã€‚SSL ã‚µãƒãƒ¼ãƒˆã‚’ã—ã¦ã„ã‚‹ç‚¹ãŒç‰¹é•·ã«ãªã‚Šã¾ã™ã€‚ å…¬å¼ã‚µã‚¤ãƒˆ: http:/
sterope 2019/12/20
android

HTTPS

SSL

TLS

proxy

è¨¼æ˜Žæ›¸

MITM
ãƒªãƒ³ã‚¯
Android ã‚¨ãƒŸãƒ¥ãƒ¬ãƒ¼ã‚¿ä¸Šã§å‹•ã„ã¦ã„ã‚‹ã‚¢ãƒ—ãƒªã® HTTP / HTTPS é€šä¿¡ã®ä¸èº«ã‚’è¦‹ã‚‹æ–¹æ³• - horolog
ä»Šå›žã¯ Android ã‚¨ãƒŸãƒ¥ãƒ¬ãƒ¼ã‚¿ã§ã‚¢ãƒ—ãƒªã‚’å‹•ã‹ã—ã¦ã€ã‚¢ãƒ—ãƒªãŒè¡Œã† HTTP / HTTPS é€šä¿¡ã®ä¸èº«ã‚’è¦—ã„ã¦ã¿ã¾ã™ã€‚ ç’°å¢ƒ&ãƒ„ãƒ¼ãƒ« Windows 10 Android Studio ã®ã‚¨ãƒŸãƒ¥ãƒ¬ãƒ¼ã‚¿ (v3.2.1) mitmproxy (v4.0) æº–å‚™ ãƒ„ãƒ¼ãƒ«ã®ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ« Android Studio ã¨ mitmproxy ã‚’ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã—ã¦ãã ã•ã„ã€‚ ä»®æƒ³ãƒ‡ãƒã‚¤ã‚¹ã®ä½œæˆ ç§ã¯ä»¥ä¸‹ã®æ§‹æˆã§ä»®æƒ³ãƒ‡ãƒã‚¤ã‚¹ã‚’ä½œæˆã—ã¾ã—ãŸã€‚ ãƒãƒ¼ãƒ‰ã‚¦ã‚§ã‚¢ Pixel 2 ã‚·ã‚¹ãƒ†ãƒ ã‚¤ãƒ¡ãƒ¼ã‚¸ API Level : 28 ABI : x86 Target : Android9.0 (Google APIs) â€» Android9.0 (Google Play) ã¨æ›¸ã‹ã‚ŒãŸã‚¤ãƒ¡ãƒ¼ã‚¸ã ã¨ adb root ãŒä½¿ãˆãªã„ã§ã€ Android9.0 (Google APIs) ã¨æ›¸ã‹ã‚ŒãŸã‚¤ãƒ¡ãƒ¼ã‚¸ã‚’é¸æŠžã—ã¦ãã ã•ã„
sterope 2019/12/20
android

HTTPS

SSL

TLS

proxy

è¨¼æ˜Žæ›¸

MITM
ãƒªãƒ³ã‚¯
Mozillaã€SymantecãŒç™ºè¡Œã—ãŸè¨¼æ˜Žæ›¸ã®ä¿¡é ¼æ€§å›žå¾©ã«é–¢ã™ã‚‹è°è«–ã«å‚æˆ¦ | ã‚¹ãƒ©ãƒ‰ IT
Google Chromeã§SymantecãŒç™ºè¡Œã—ãŸSSLè¨¼æ˜Žæ›¸ã®æœ‰åŠ¹æœŸé™çŸç¸®ã‚„EVã‚¹ãƒ†ãƒ¼ã‚¿ã‚¹ç„¡åŠ¹åŒ–ã‚’ææ¡ˆã™ã‚‹ [security.srad.jp] ãªã©ã€å¤§æ‰‹èªè¨¼å±€ã®å•é¡Œç‚¹ã‚’æŒ‡æ‘˜ã—ã¦ã„ã‚‹ã“ã¨è‡ªä½“ã¯ã€Google è‡ªèº«ã‚‚ãƒ«ãƒ¼ãƒˆèªè¨¼å±€ [mynavi.jp] ãªã“ã¨ã‹ã‚‰ä¸ç«‹æ€§ã«ç–‘å•ã¯ã‚ã‚‹ã‚‚ã®ã®ã€æŒ‡æ‘˜ã®å†…å®¹ã¯ä»Šã®ã¨ã“ã‚ã¯è©•ä¾¡ã§ãã¾ã™ã€‚ ã—ã‹ã—ã€ãã®ä¸€æ–¹ã§ã€ã“ã“æœ€è¿‘ï¼ˆæ•°ã‹æœˆï½ž1å¹´å‰ãã‚‰ã„?ï¼‰ã®ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã§ã€Google Chrome (Windows ç‰ˆ) ã‹ã‚‰ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒèªè¨¼å±€åï¼ˆè¨¼æ˜Žæ›¸ï¼‰ã‚’ç¢ºèªã™ã‚‹ãŸã‚ã® UI ãŒå‰Šé™¤ã•ã‚Œã¦ã—ã¾ã„ã¾ã—ãŸã€‚ ã©ã®èªè¨¼å±€ã‚’ä¿¡é ¼ã™ã‚‹ã‹ã®æ±ºå®šæ¨©ã¯ã€ãƒ–ãƒ©ã‚¦ã‚¶ãƒ™ãƒ³ãƒ€ãƒ¼ã§ã¯ãªãã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ã«ã‚ã‚‹ã¹ãã§ã™ã€‚ã«ã‚‚é–¢ã‚ã‚‰ãšã€ã‚ã–ã‚ã–ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã§ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒèªè¨¼å±€åã‚’ç°¡å˜ã«ç¢ºèªã§ããªãã—ãŸ Google ã®å¯¾å¿œã«ã¯å¤§ããªå•é¡ŒãŒã‚ã‚‹ã¨æ€ã„ã¾ã™ã€‚ãƒ–ãƒ©ã‚¦ã‚¶ãƒ™ãƒ³ãƒ€ãƒ¼ã§ã‚ã‚Šã€è‡ªèº«ã‚‚ãƒ«ãƒ¼ãƒˆèª
sterope 2017/05/06
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ssl

è¨¼æ˜Žæ›¸

TLS
ãƒªãƒ³ã‚¯
Symantecã®è¨¼æ˜Žæ›¸ç™ºè¡Œã«ä¸æ‰‹éš›ã€GoogleãŒå¯¾å¿œã‚’è¦æ±‚
ç±³Symantecã®èªè¨¼å±€ãŒæ‰‹é•ã„ã«ã‚ˆã‚Šã€ã€Œgoogle.comã€ãªã©ã®ãƒ‰ãƒ¡ã‚¤ãƒ³å‘ã‘ã®ãƒ†ã‚¹ãƒˆè¨¼æ˜Žæ›¸ã‚’ãƒ‰ãƒ¡ã‚¤ãƒ³æ‰€æœ‰è€…ãŒçŸ¥ã‚‰ãªã„ã†ã¡ã«ç™ºè¡Œã—ã¦ã„ãŸã“ã¨ãŒåˆ†ã‹ã‚Šã€ç±³Googleã¯10æœˆ28æ—¥ã€åŒç¤¾ã«å¯¾ã—ã¦å¯¾å¿œã‚’è¦æ±‚ã—ãŸã€‚Symantecã®å¯¾å¿œæ¬¡ç¬¬ã§ã¯ã€Googleè£½å“ã§Symantecã®è¨¼æ˜Žæ›¸ãŒå®‰å…¨ã¨ã¿ãªã•ã‚Œãªããªã‚‹å¯èƒ½æ€§ã‚‚ã‚ã‚‹ã¨è¦å‘Šã—ã¦ã„ã‚‹ã€‚ SymantecãŒ10æœˆ2æ—¥ã«ç™ºè¡¨ã—ãŸã‚¤ãƒ³ã‚·ãƒ‡ãƒ³ãƒˆå ±å‘Šæ›¸ã§ã€Googleã‚„Operaãªã©5çµ„ç¹”å‘ã‘ã®ãƒ†ã‚¹ãƒˆè¨¼æ˜Žæ›¸23ä»¶ãŒãƒ‰ãƒ¡ã‚¤ãƒ³æ‰€æœ‰è€…ã®çŸ¥ã‚‰ãªã„ã†ã¡ã«ç™ºè¡Œã•ã‚Œã¦ã„ãŸã¨å ±å‘Šã—ãŸã€‚ã“ã‚Œã«å¯¾ã—ã¦Googleã¯ã€ä¸å¯©ãªè¨¼æ˜Žæ›¸ã¯ãã‚Œä»¥å¤–ã«ã‚‚å˜åœ¨ã™ã‚‹ã¨æŒ‡æ‘˜ã€‚ãã®å¾Œã€Symantecã¯10æœˆ12æ—¥ã«å‡ºã—ãŸæ›´æ–°ç‰ˆã®å ±å‘Šæ›¸ã§ã€ã•ã‚‰ã«76ãƒ‰ãƒ¡ã‚¤ãƒ³å‘ã‘ã®è¨¼æ˜Žæ›¸164ä»¶ã¨ã€æœªç™»éŒ²ãƒ‰ãƒ¡ã‚¤ãƒ³å‘ã‘ã®è¨¼æ˜Žæ›¸2458ä»¶ãŒè¦‹ã¤ã‹ã£ãŸã¨ç™ºè¡¨ã—ãŸã€‚ Googleã¯ã“ã†ã—ãŸSymantecã®å¯¾å¿œ
sterope 2017/03/26
google

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

TLS

SSL

è¨¼æ˜Žæ›¸
ãƒªãƒ³ã‚¯
ä¸å›½æœ€å¤§ç´šã®èªè¨¼å±€ã€ŒWoSignã€ãŒãƒ‹ã‚»ã®è¨¼æ˜Žæ›¸ã‚’ç™ºè¡Œã—ã¦ã„ãŸã“ã¨ãŒåˆ¤æ˜Ž
by Barney Moss ç„¡æ–™ã§SSLè¨¼æ˜Žæ›¸ã‚’ç™ºè¡Œã—ã¦ãã‚Œã‚‹ã“ã¨ã§ã€å¤šãã®è‡ªå®…ã‚µãƒ¼ãƒãƒ¼ãƒ¦ãƒ¼ã‚¶ãƒ¼ã«é‡å®ã•ã‚Œã¦ã„ã‚‹ä¸å›½æœ€å¤§ç´šã®èªè¨¼å±€ã€Œæ²ƒé€š(WoSign)ã€ãŒã€ã€Œå½ç‰©ã®è¨¼æ˜Žæ›¸ã€ã‚’å¤§é‡ã«ç™ºè¡Œã—ã¦ã„ãŸã“ã¨ãŒæ˜Žã‚‰ã‹ã«ãªã‚Šã¾ã—ãŸã€‚ The story of how WoSign gave me an SSL certificate for GitHub.com | Schrauger.com https://www.schrauger.com/the-story-of-how-wosign-gave-me-an-ssl-certificate-for-github-com Thoughts and Observations: Chinese CA WoSign faces revocation after possibly issuing fake certificates of Github,
sterope 2016/09/02
è¨¼æ˜Žæ›¸

ssl

TLS
ãƒªãƒ³ã‚¯
1