SungHoon_Kim

DUMPIO module on Apache

Blog Post created by SungHoon_Kim Employee on Apr 3, 2017

There are situations where you need to get the HTTP traffic in clear-text.

Decrypting HTTPS traffic from wireshark is not as convenient as it was in the SSLv3 era.

And at times, fiddler just does not pick up the transaction.

 

What do you do?

 

If you are using IIS, you can enable FailedRequestTrace(yeah, I know. not the most convenient way when you have flooding requests).

 

If you are using Apache, you can make use of dumpio module.

If you are using CA Access Gateway, this method still applies as the dumpio module is bundled out of the box.

 

Locate the httpd.conf file and add the following entries.

At the LoadModule section:

LoadModule dumpio_module modules/mod_dumpio.so

 

At the LogLevel section:

LogLevel error dumpio:trace7

Let's say your existing LogLevel was "error".

You just need to add a space followed by "dumpio:trace7"

This will enable "trace7" loglevel only for "dumpio" module.

Other modules will only log at "error" loglevel.

 

After the LogLevel:

DumpIOInput On

DumpIOOutput On

 

Once you have this added to your httpd.conf file, you must restart your apache web server.

 

You will find log entries like below sample with "dumpio:trace7".

Apache error_log

[Thu Mar 23 18:19:32.657465 2017] [dumpio:trace7] [pid 3508:tid 1752] mod_dumpio.c(135): [client 101.164.90.60:50863] mod_dumpio: dumpio_in [getline-blocking] 0 readbytes

[Thu Mar 23 18:19:32.684467 2017] [dumpio:trace7] [pid 3508:tid 1752] mod_dumpio.c(58): [client 101.164.90.60:50863] mod_dumpio:  dumpio_in (data-TRANSIENT): 31 bytes

[Thu Mar 23 18:19:32.684467 2017] [dumpio:trace7] [pid 3508:tid 1752] mod_dumpio.c(100): [client 101.164.90.60:50863] mod_dumpio:  dumpio_in (data-TRANSIENT): POST /kimlabs365/mex HTTP/1.0\r\n

[Thu Mar 23 18:19:32.684467 2017] [dumpio:trace7] [pid 3508:tid 1752] mod_dumpio.c(135): [client 101.164.90.60:50863] mod_dumpio: dumpio_in [getline-blocking] 0 readbytes

[Thu Mar 23 18:19:32.684467 2017] [dumpio:trace7] [pid 3508:tid 1752] mod_dumpio.c(58): [client 101.164.90.60:50863] mod_dumpio:  dumpio_in (data-TRANSIENT): 24 bytes

[Thu Mar 23 18:19:32.684467 2017] [dumpio:trace7] [pid 3508:tid 1752] mod_dumpio.c(100): [client 101.164.90.60:50863] mod_dumpio:  dumpio_in (data-TRANSIENT): Connection: Keep-Alive\r\n

[Thu Mar 23 18:19:32.684467 2017] [dumpio:trace7] [pid 3508:tid 1752] mod_dumpio.c(135): [client 101.164.90.60:50863] mod_dumpio: dumpio_in [getline-blocking] 0 readbytes

[Thu Mar 23 18:19:32.684467 2017] [dumpio:trace7] [pid 3508:tid 1752] mod_dumpio.c(58): [client 101.164.90.60:50863] mod_dumpio:  dumpio_in (data-TRANSIENT): 36 bytes

[Thu Mar 23 18:19:32.684467 2017] [dumpio:trace7] [pid 3508:tid 1752] mod_dumpio.c(100): [client 101.164.90.60:50863] mod_dumpio:  dumpio_in (data-TRANSIENT): Content-Type: application/soap+xml\r\n

[Thu Mar 23 18:19:32.684467 2017] [dumpio:trace7] [pid 3508:tid 1752] mod_dumpio.c(135): [client 101.164.90.60:50863] mod_dumpio: dumpio_in [getline-blocking] 0 readbytes

[Thu Mar 23 18:19:32.684467 2017] [dumpio:trace7] [pid 3508:tid 1752] mod_dumpio.c(58): [client 101.164.90.60:50863] mod_dumpio:  dumpio_in (data-TRANSIENT): 13 bytes

[Thu Mar 23 18:19:32.684467 2017] [dumpio:trace7] [pid 3508:tid 1752] mod_dumpio.c(100): [client 101.164.90.60:50863] mod_dumpio:  dumpio_in (data-TRANSIENT): Accept: */*\r\n

[Thu Mar 23 18:19:32.684467 2017] [dumpio:trace7] [pid 3508:tid 1752] mod_dumpio.c(135): [client 101.164.90.60:50863] mod_dumpio: dumpio_in [getline-blocking] 0 readbytes

[Thu Mar 23 18:19:32.684467 2017] [dumpio:trace7] [pid 3508:tid 1752] mod_dumpio.c(58): [client 101.164.90.60:50863] mod_dumpio:  dumpio_in (data-TRANSIENT): 281 bytes

[Thu Mar 23 18:19:32.684467 2017] [dumpio:trace7] [pid 3508:tid 1752] mod_dumpio.c(100): [client 101.164.90.60:50863] mod_dumpio:  dumpio_in (data-TRANSIENT): User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 6.1; WOW64; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3; MSOIDCRL 7.250.4556.0; App lync.exe, 15.0.4903.0, {0000003F-002B-0000-6CDD-FA6C4E000000})\r\n

[Thu Mar 23 18:19:32.684467 2017] [dumpio:trace7] [pid 3508:tid 1752] mod_dumpio.c(135): [client 101.164.90.60:50863] mod_dumpio: dumpio_in [getline-blocking] 0 readbytes

[Thu Mar 23 18:19:32.684467 2017] [dumpio:trace7] [pid 3508:tid 1752] mod_dumpio.c(58): [client 101.164.90.60:50863] mod_dumpio:  dumpio_in (data-TRANSIENT): 21 bytes

[Thu Mar 23 18:19:32.684467 2017] [dumpio:trace7] [pid 3508:tid 1752] mod_dumpio.c(100): [client 101.164.90.60:50863] mod_dumpio:  dumpio_in (data-TRANSIENT): Content-Length: 445\r\n

[Thu Mar 23 18:19:32.684467 2017] [dumpio:trace7] [pid 3508:tid 1752] mod_dumpio.c(135): [client 101.164.90.60:50863] mod_dumpio: dumpio_in [getline-blocking] 0 readbytes

[Thu Mar 23 18:19:32.684467 2017] [dumpio:trace7] [pid 3508:tid 1752] mod_dumpio.c(58): [client 101.164.90.60:50863] mod_dumpio:  dumpio_in (data-TRANSIENT): 23 bytes

[Thu Mar 23 18:19:32.684467 2017] [dumpio:trace7] [pid 3508:tid 1752] mod_dumpio.c(100): [client 101.164.90.60:50863] mod_dumpio:  dumpio_in (data-TRANSIENT): Host: www.kimlabs.net\r\n

[Thu Mar 23 18:19:32.684467 2017] [dumpio:trace7] [pid 3508:tid 1752] mod_dumpio.c(135): [client 101.164.90.60:50863] mod_dumpio: dumpio_in [getline-blocking] 0 readbytes

[Thu Mar 23 18:19:32.684467 2017] [dumpio:trace7] [pid 3508:tid 1752] mod_dumpio.c(58): [client 101.164.90.60:50863] mod_dumpio:  dumpio_in (data-TRANSIENT): 2 bytes

[Thu Mar 23 18:19:32.684467 2017] [dumpio:trace7] [pid 3508:tid 1752] mod_dumpio.c(100): [client 101.164.90.60:50863] mod_dumpio:  dumpio_in (data-TRANSIENT): \r\n

 

You will find all Request and Response header information in your apache error_log file.

Outcomes