On the Authorities tab, click the button and select the polarproxy.cer file.Click and select “ Trusted Root Certification Authorities” and click.Click and then select “ Place all certificates in the following store“.

Double click the polarproxy.cer file and click.

For that you have to download the certificate file first by visiting the following REMnux VM address, for example in my case:, then the polarproxy.cer file will be downloaded automatically. Next, you need to install the root CA certificate from PolarProxy on your Windows VM. You can customize the destination PCAP file location, in this case I saved it in the user directory named polarproxy.pcap. Sudo iptables -t nat -A PREROUTING -i ens37 -p tcp -dport 443 -j REDIRECT -to 10443Īfter the rule is created, to run PolarProxy you can use the following command: sudo polarproxy -v -p 10443,80,443 -certhttp 10080 -w ~/polarproxy.pcap ens37 here is my Host-only interface, you can customize it yourself: sudo iptables -A INPUT -i ens37 -p tcp -dport 10443 -m state -state NEW -j ACCEPT To do this we have to create some iptables rules.

PolarProxy will listen on port 10443, for that we have to redirect traffic 443 to 10443. PolarProxy is also installed by default in REMnux. PolarProxy is a transparent SSL/TLS proxy designed to intercept and decrypt TLS traffic, and save it in PCAP format so that we can analyze it further using Wireshark. This is a follow-up post from building a lab for malware analysis that you can apply to decrypt the malware HTTPS traffic from REMnux.

Proxy https wireshark traffic