search

CERT-Polska / drakvuf-sandbox

DRAKVUF Sandbox - automated hypervisor-level malware analysis system
https://drakvuf-sandbox.readthedocs.io/
Other
1.03k stars 143 forks source link

Routing HTTPS over proxy #622

Closed kaboreka closed 2 months ago

kaboreka commented 3 years ago

Hi How can we route vm https traffic over proxy? I tried with mitmproxy (https://docs.mitmproxy.org/stable/howto-transparent-vms/) but i cant route. Is there any plan to support https inspection?

chivay commented 3 years ago

Hi, If your goal is to decrypt HTTPS traffic, we've already got support for that via tlsmon plugin that dumps crypto keys in Wireshark format. Live request interception/modification during analysis is currently of of scope.

However if you'd like to experiment with it, you should be able to do this by adding appropriate iptables rules, similarly to https://docs.mitmproxy.org/stable/howto-transparent-vms/#3-redirect-traffic-to-mitmproxy