Hacker News new | ask | show | jobs
by umurkontaci 4125 days ago
Simple. Put up an SSL interceptor proxy and see what's going through.
1 comments

Would this really work? I would expect the SSL certificate of Dropbox's servers to be hardcoded in the client, so the client would refuse to connect to an interceptor.
The Dropbox client is running with normal user privileges on a computer that you have root access to. It should be possible to use reverse engineering/debugging tools to either bypass SSL checks or analyze the dropbox client binary to see what is being sent/recvd.
Sure, I'm just saying it would be less straightforward than mitmproxy. I wonder if there are tools to hook into whatever SSL library is being used (OpenSSL?) and intercept traffic before it gets encrypted and after it gets decrypted? (probably using LD_PRELOAD, like tsocks)