Network › Module 5 › Lesson 2
Why TLS Changes the Story
Encryption hides bodies from seeing hops — then contrast cleartext on with TLS ideas.
Visual · tls_changes_path
TLS aims to stop silent readers on the path. http://192.168.0.1/ YOUR lab. Loopback HTTP stays YOUR toy, not a café intercept.
Opening
TLS does not remove hops. It tries to make extra participants go blind and clumsy.
Lesson 1 named extra participants. TLS (HTTPS) encrypts the channel so a hop that merely forwards packets should not read URLs/bodies the way it can on HTTP. It also authenticates the dest’s certificate so impersonation is harder — not impossible if users click through warnings or install stranger CAs. This is literacy: why the padlock changed MITM from “read everything” to “break or bypass trust.” Original Cyberlium.
1. Cleartext HTTP is a postcard; TLS is an envelope with a name
On HTTP, any seeing hop gets method, path, headers, body. On TLS, that hop should see IPs, ports, SNI in older setups, and ciphertext. The dest presents a certificate the client is willing to trust. If you ignore warnings, you re-open the postcard yourself.
. A router admin page over HTTP is still not your intercept target — STOP. Your postcard demo is curl -v to (or 8784 if only the proxy exists later).
2. See YOUR cleartext on loopback so the contrast is honest
curl -v against http:/// prints request headers you sent. That is the postcard. We are not capturing a roommate. If 8794 is down, curl -v SAFE 8784 or write the headers you would have sent. Do not “make it real” with a LAN sniffer.
This course’s lab stays HTTP on loopback so YOUR proxy can log YOUR traffic without teaching TLS interception. Breaking other people’s HTTPS is out — including “just for class” on café Wi-Fi.
Command guide
See YOUR cleartext on loopback so the contrast is honest
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
curl -sS -m 2 -v "http://127.0.0.1:8794/" -o "$HOME/cyberlium-lab/t11-m05-tls-toy.body" 2> "$HOME/cyberlium-lab/t11-m05-tls-verbose.txt"
grep -E "^> |Host:" "$HOME/cyberlium-lab/t11-m05-tls-verbose.txt" | head -n 20
python3 - << 'PY'
import socket
for port in (8794, 8784):
s = socket.socket(); s.settimeout(0.4)
print("127.0.0.1:%s" % port, s.connect_ex(("127.0.0.1", port)))
s.close()
PY3. Trust warnings are the remaining MITM story
A hostile hop that cannot read TLS may still try to present another certificate. Browsers complain. Users click through. Enterprises install their own CA on laptops they own — that is authorized intercept on a path they operate, not a café kit. You will not install a stranger CA, not ettercap SSL strip folklore, not arpspoof to force HTTP.
Write: TLS hides postcards from forwarding hops; it does not hide dest IPs; it fails if you mistrust on purpose. chmod 600.
Command guide
Trust warnings are the remaining MITM story
═══ COMMANDS ═══
Command — copy this
grep -E "postcard|envelope" "$HOME/cyberlium-lab/t11-m05-tls.txt"
4. What you ship: a postcard vs envelope note and YOUR verbose curl, not a TLS-break kit
t11-m05-tls.txt written. Verbose curl saved from loopback HTTP. DEMO GATE. No stranger intercept. No fake CA. No ettercap/arpspoof.
5. What you record before the next lesson
Date. TLS hides bodies from forwarding hops. Verbose file from DEMO identified/STOP. NEVER intercept stranger TLS. File t11-m05-l02-tls-changes.txt chmod 600.
6. Wrong vs right: stranger networks vs literacy on systems you own
Worked failure — same network word, opposite target. Right never needs a café or campus LAN.
Wrong
sslstrip a café. Install a random root CA. ettercap + arpspoof to “see HTTPS.” Click through cert warnings on banking sites for class.
Right
curl -v YOUR loopback HTTP. Write what TLS would hide. Next: Proxies You Own vs Stranger Paths.
Mission: contrast YOUR cleartext headers with what TLS would hide
1) / STOP if router. 2) curl -v http:/// (or note if down). 3) Write postcard vs envelope. Do not intercept anyone else. Do not fake CAs.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor why SNI and dest IPs still leak — not how to break HTTPS on a hotel network.
Knowledge Check
APPLY: A forwarding hop on HTTP can read the path. After TLS to a trusted dest, that hop should mainly see:
Multiple choice
Knowledge Check
APPLY: True or False: Clicking through a certificate warning restores a safe path.
True or False
Knowledge Check
APPLY: curl http://192.168.0.1/ is Netgear Router Admin. TLS lesson next step?
Multiple choice