One of the ports (10000) acts like a normal TLS server, one of the ports (10001) is just used to trigger a TLS connection back to you on port 40001, and the 3rd (10002) is a TCP server that when connected to acts like a TLS client.

So to get them to talk to each other you could either write a server that listens on 40001 then proxies any incoming connections back to 10000 (that's what nothrabannosir's named pipes + nc example does), or just connect to 10000 and 10002 and pipe the two connections to each other.

e.x. in Node.js:

    var net = require("net");
    var server = net.connect({ host: 'ownme.ipredator.se', port: 10002 });
    var client = net.connect({ host: 'ownme.ipredator.se', port: 10000 });
    server.on('data', console.log.bind(console, 'server'));
    client.on('data', console.log.bind(console, 'client'));
    client.pipe(server).pipe(client);

They offer a TLS client and server interface, so you can have your own host act as a proxy.

Try this:

    $ mkfifo /tmp/tlspipe
    $ nc -l -p 40001 </tmp/tlspipe | tee /tmp/tlsconvo | nc ownme.ipredator.se 10000 > /tmp/tlspipe

Then visit http://ownme.ipredator.se:10001 from that same host (curl or firefox or whatever). Now look at /tmp/tlspipe.

Disclaimer: I'm completely unfamiliar with named pipes or tls, but I think this is what they mean.

EDIT: This should also work:

    $ mkfifo /tmp/tlspipe
    $ nc ownme.ipredator.se 10002 </tmp/tlspipe | tee /tmp/tlsconvo2 | nc ownme.ipredator.se 10000 >/tmp/tlspipe

EDIT2: Just realized that the above only captures one part of the convo. Try this:

    $ nc ownme.ipredator.se 10002 </tmp/tlspipe | tee /tmp/client-to-server | nc ownme.ipredator.se 10000 | tee /tmp/server-to-client >/tmp/tlspipe

Now you have the full back and forth. E.g.:

    $ strings /tmp/server-to-client
    sYcdI*
            Cambridge1
    BTC Pinata Team1 0
    ocaml-tls@h3q.com0
    150207183718Z
    150329183718Z0$1
    tls services0
    
    ...

For those who are interested, this is a great source of cool things you can do with netcat.

http://www.felipemartins.info/2013/03/netcat-the-it-swiss-kn...

Hah, and I wondered how come we suddenly started getting MITM connections from several places.

FWIW you can also do it with a single socat invocation, but I'll leave the exact command as an exercise for the reader.

Maybe then run something like:

$ cat /tmp/tlsconvo2|xxd|less

But I'm not into crypto, even that I don't know what it means or if it's the way to go. I liked the initiative though :-)

`cat`ed tlsconvo2. That's some quality gibberish :D