Transparent IMAPs proxy

Question

I would like to implement a transparent IMAPS (SSL/TLS) proxy from zero using python (pySocks and imaplib).

The user and the proxy are in the same network and the mail server is outside (example: gmail servers). All the traffic on port 993 is redirected to the proxy. The user should retrieve his emails using his favorite email application (example: thunderbird). The proxy should receive the commands and transmit it to the user/server and should be able to read the content of the retrieved emails.

However, as the traffic is encrypted, I don't know how to get the account and the password of the user (without using a database) OR how to read the content of the emails without knowing the account and the password of the user.

After few days looking for a solution, I still don't have any track. Maybe it is not possible ? If you have any track, I would be happy to read it.

Thank you.

Answer 1

You must implement your proxy as a Man In The Middle attack. That means that there are two different SSL/TLS encrypted communication channels: one between the client and the proxy, one between the the proxy and the server. That means that either:

• the client explicitely sets the proxy as its mail server (if only few servers are to be used with one name/address per actual server)
• the proxy has a certificate for the real mail server that will be trusted by the client. A common way is to use a dummy CA: the proxy has a private certificate trusted by the client that can be used to sign certificates for any domains like antivirus softwares do.

Once this is set up, the proxy has just to pass all commands and responses, and process the received mails on the fly.

I acknowledge that this is not a full answer, but a full answer would be far beyond the scope of SO and I hope it could a path to it. Feel free to ask more precise questions here if you are later stuck in actual implementation.