How to get the SSL key of a https:// C# HttpWebRequest? (similar to browser environment variable SSLKEYLOGFILE)

问题

Currently I am working on a custom HTTP publisher for the Peach Fuzzing framework.

In order to determine if the server responed in an unusual way I need to examine the decrypted incoming / outgoing packages with Wireshark (or the PcapMonitor that is included in the Peach Framework) - to do that I need the SSL keys that are being generated by the C# HttpWebRequest (similar to the content of the SSLKEYLOGFILE) since I am trying to fuzz an SSL protected RESTful webservice.

If it is not possible to get the keys or if it is very difficult - is there any other way to see the raw HTTP request / response?

Thanks!

回答1:

Just found a way to get the decrypted packages:

1. Create a loopback interface that can be monitored with Wireshark

2. Create a reverse proxy (I used nginx) and redirect all traffic from "localhost" to the target URL (https://)

3. Tell your application not to send the requests to target (https://) but to localhost (http://localhost/)

4. Start listening on the loopback interface and start your application

Hope this is helpful for somebody in a similar situation

来源：https://stackoverflow.com/questions/32997908/how-to-get-the-ssl-key-of-a-https-c-sharp-httpwebrequest-similar-to-browser