Did you know that python's urllib module supports connecting to web servers over HTTPS? It's easy!
data = urllib.urlopen("https://www.google.com").read()
Did you also know that it provides absolutely zero guarantees that your "secure" data isn't being observed by a man-in-the-middle?
from paste import httpserver
def app(environ, start_response):
start_response("200 OK", )
return "Thanks for your secrets!"
httpserver.serve(app, host='127.0.0.1', port='8080', ssl_pem='*')
This little web app will generate a random SSL certificate for you each time it's run. A self-signed, completely untrustworthy certificate.
Now modify your first script to look at https://localhost:8080 instead. Or, for more fun, keep it pointing at google and mess with your IP routing to redirect google.com:443 to localhost:8080.
iptables -t nat -A OUTPUT -d google.com -p tcp --dport 443 -j DNAT --to-destination 127.0.0.1:8080
Run your script again, and see what it says.
Instead of the raw HTML of google.com, you now get "Thanks for your secrets!". That's right, python will happily accept without complaint or warning the random certificate generated this little python app pretending to be google.com.
Sometimes you want to know who you're talking to, you know?
import httplib, socket, ssl, urllib2
# overrides the version in httplib so that we do
# certificate verification
sock = socket.create_connection((self.host, self.port),
self.sock = sock
# wrap the socket using verification with the root
# certs in trusted_root_certs
self.sock = ssl.wrap_socket(sock,
# wraps https connections with ssl certificate verification
def __init__(self, connection_class=VerifiedHTTPSConnection):
self.specialized_conn_class = connection_class
def https_open(self, req):
return self.do_open(self.specialized_conn_class, req)
https_handler = VerifiedHTTPSHandler()
url_opener = urllib2.build_opener(https_handler)
opener = buildValidatingOpener("/usr/lib/ssl/certs/ca-certificates.crt")
req = urllib2.Request("https://www.google.com")
Using the this new validating url opener, we can make sure we're talking to someone with a validly signed certificate. With our IP redirection in place, or pointing at localhost:8080 explicitly we get a certificate invalid error. We still don't know for sure that it's google (could be some other site with a valid ssl certificate), but maybe we'll tackle that in a future post!