Extract SSL/TLS certificate from Burp Suite Proxy for implanting Konstantinos Xynos Saturday, April 01, 2017

Sometimes you want to include that certificate that Burp Suite generates and place it somewhere, (e.g., into a mobile app. to bypass Certificate pinning).

Here is how to extract the certificate using Kali 2016 Rolling.

proxytunnel -p LOCAL_IP_BURP_LISTENING_ON:LOCAL_PORT_BURP_LISTENING_ON -d DOMAIN_YOU_WANT:443 -a 7000 & openssl s_client -connect localhost:7000 -showcerts </dev/null 2>/dev/null | openssl x509 -outform der > mycert.der

Options are :

• LOCAL_IP_BURP_LISTENING_ON is the IP address that Burp Suite Proxy is set to listen on.
• LOCAL_PORT_BURP_LISTENING_ON is the port  that Burp Suite Proxy is set to listen on.
• DOMAIN_YOU_WANT is the domain you want to spoof. This can also include subdomains and a wildcard (e.g., test.myuni.ac.uk or *.myuni.ac.uk)
• mycert.der is the DER file generated. Don't forget to rename it to what the application is expecting. 

For example:

proxytunnel -p 127.0.0.1:8080 -d *.myUni.ac.uk:443 -a 7000 & openssl s_client -connect localhost:7000 -showcerts </dev/null 2>/dev/null | openssl x509 -outform der > mycert.der

Here my Burp Suite proxy is listening on 127.0.0.1 and 8080, *.myUni.ac.uk is the example domain I want on my cert and it is name mycert.der. 

P.S: Don't forget if you are working with team mates, you can easily query their Burp Suite proxy. 

-- 

If you want to check your results, you will need to convert from the one format to the other. So convert DER to PEM : 

openssl x509 -inform der -in mycert.der -out mycert.pem

And then check your results. 

openssl x509 -in mycert.pem -text -noout

Stonesoft Firewall/IPS: expired certificate errors Konstantinos Xynos Wednesday, April 29, 2015

If you have a Stonesoft Firewall or IPS and you are having issues with connecting to the Management and/or Log Server then it is highly possible that the certificates have expired. There is a way to fix it.

Try the following:

On the Management Server in the Stonegate folder ../stonegate/bin there are a number of scripts to re-issue the required certificates.

Shutdown Management Server (first shutdown the service, if it is running):

sudo -u sgadmin sgStopMgtSrv.sh

Reset Certificate for Management Server:

sudo -u sgadmin sgCertifyMgtSrv.sh

Start up the service again, either reboot or :

sudo -u sgadmin sgStartMgtSrv.sh &

On the Log Server in the Stonegate folder ../stonegate/bin there are a number of scripts to re-issue the required certificates.

Shutdown Log Server (first shutdown the service, if it is running):

sudo -u sgadmin sgStopLogSrv.sh

Reset Certificate for Log Server:

sudo -u sgadmin sgCertifyLogSrv.sh

Start up the service again, either reboot or :

sudo -u sgadmin sgStartLogSrv.sh &

And that is it. Start up your Management console via ./sgClient.sh & and you should be able to connect.

Your Firewall/IPS wont be able to connect anymore since the fingerprint would have changed. This means the new settings have to be pulled by the systems. The way I sorted it out was to SSH into the Firewall and issue a sg-reconfigure command.

One of the things needed now is the need to have a one-time password from the Management Console. This can be retrieved by selecting the device under Firewalls or IPS and right clicking on it then in the menu select, Configuration-> Save Initial Configuration. In the new window named Save Initial Configuration a new one-time password will be generated and the SSL Fingerprint will also be shown.

So once you have the one time password, move over to the sg-reconfigure command on the Firewall/IPS and skip all the bits until you reach the need for the one-time password (select Next->). You want to select Contact Management Server or the equivalent, enter the one-time password that is provided by the Management Center and you can enter the new fingerprint key or remove it as it is not required by default.


Errors usually include:
Log Server doesn't have any usable certificate.
Caused by: java.security.cert.CertificateExpiredException: NotAfter: date_here