2

I am trying to capture HTTPS traffic between a client (windows machine) and a server. I would like to do this before the traffic is encrypted as I would like to analyse its contents.

Is there easy way to do this on the local machine? . For example, could I set up a local HTTP proxy to achieve this?

8
  • 4
    The TLS encryption is done by the application, not by the network stack. Therefore you cannot do this on the operating system side. Thus you have to either get the clear-text data from the application or intercept the TLS connection. There's no way to read it from somewhere in the operating system, as this never sees the clear-text data. Oct 20 '15 at 21:43
  • 3
    If you have the keys (and password) from the server, you can add them to the SSL protocol configuration in Wireshark to decrypt the payload. If you don't, then you would need something that will do SSL intercept and not just a proxy (as most proxies won't see the unencrypted data either).
    – YLearn
    Nov 19 '15 at 23:00
  • 3
    To add to what @Ylearn said, you will also want to disable DHE and ECDHE ciphers. While those remain enabled, simply importing the private key into Wireshark will not allow you to decrypt the text. Note, I would only do this while testing, DHE and ECDHE are a huge improvement to your security poster, so I wouldn't leave them disabled for long.
    – Eddie
    Nov 20 '15 at 0:04
  • 2
    Also, if the application that you are using for HTTPS happens to be Firefox or Chrome, there is a way to enable logging of the Master Secret to a file, which you can then import into Wireshark to decrypt SSL session. Again, I would only recommend doing this temporarily while testing, and not indefinitely.
    – Eddie
    Nov 20 '15 at 0:07
  • 1
    @SivaDotRender - Had to withdraw huge compulsion to post the howtos for your request as I'm not too sure if help is warranted for this query... is this for legitimate work?
    – user4565
    May 18 '16 at 20:31
0

If this traffic is not encrypted before it gets to an external firewall, it is possible to capture network traffic either as it leaves the PC or just after it leaves the PC before the firewall.

If the traffic is encrypted by your application, there are proxies that can decrypt/encrypt HTTPS traffic in order to change the source address of the traffic. Whether or not a particular proxy lets you capture the decrypted traffic before it re-encrypts is something you would need to research. Large companies often use these sorts of proxies, and some allow the company to do this in order to snoop on employee web use. These are typically high-end, dedicated proxies that require lots of CPU horsepower.

You will need to do your own research to see if there is a product that fits your needs. Product/resource recommendations are specifically off-topic for this forum.

0

HTTPS Interception commercial products exist (example) whereby they proxy themselves man-in-the-middle style. The browser gives one initial warning but going forward it will appear normal (browser bar will behave as expected).

You will often see this deployed on company issued laptops, for example.

HTTPS Interception Weakens TLS Security - US-CERT, part of the Department of Homeland Security.

Not the answer you're looking for? Browse other questions tagged or ask your own question.