Intercepting and Collecting Web Evidence in the Times of TLS1.3 and HTTP 3.0

web scraping, TLS/SSL, MitM, HTTP

The presentation introduces methods addressing both of these phenomena - intercepting TLS/SSL connections with the help of man-in-the-middle attack employing proxy and automatically creating snapshots of problematic web pages.  Speakers outline necessary theory (including news about TLS 1.3, HSTS, HTTP3.0),  well-known attacks (e.g., renegotiation, downgrade, cipherspec change,  and others), and industry-standard tools for traffic analysis (such as Wireshark, Fiddler proxy, SSL-Split) and decoding (e.g., Selenium, Scrapy).