Writing email sniffer

Question

I am interested in writing an email sniffer that saves all emails sent via web based clients to hd, but I can't work out how to do this. How can I catch HTTPS mail before it is encrypted?

I would really appriciate some useful info. I cannot find anything information on the web. There's a program called HTTP Analyzer V5 that does the exact thing I want to make.

How should I start?

If I make a packet sniffer, it's useless because all data is encrypted.

Is there any other option?

Answer 1

You can't decrypt HTTPS, however, you can use man-in-the-middle programs to catch the HTTPS connection before it's created, and change the website's certificate with your own, which you WOULD be able to decrypt. Look up ettercap, and man-in-the-middle attacks.

Answer 2

Do you have control over the machines on which you intend to do this?

I used "The Grinder" before to capture HTTP requests for performance testing purposes, and it comes with a TCP Proxy component which logs all HTTP requests routed through it.

This includes the plain text content of form fields which are POSTed, which I assume would cover web mail "Send" buttons.

This may be a bit of a convoluted solution, but you could theoretically have the TCP Proxy running as a service on the client machine and have the connection pointed at the appropriate port on localhost.

I only ever took this as far as capturing my username and password as I logged into a web mail website (it worked), but nothing springs to mind immediately that would stop this from working on entire email messages.