1

I'm using Wireshark for getting all https packets and decoding them.

I follow two methods in Wireshark. The first method is on this link: Wireshark SSL. In short, I do following things:

  1. generate key.bem
  2. Import to Wireshark in Protocols\SSL Section. I add an item in RSA Key List.

Here is the detail:

IpAddress: 0.0.0.0
Port: 0
Protocol: HTTP
Keyfile: point to by key.bem
Password: Empty

But When I tried to go some https page such as https://www.google.com. I still cannot decode.

8
  • The first issue I can see which needs correcting is the the protocol. You are using HTTP and SSL will use port 443, which is HTTPS. – SleepyMan Dec 30 '16 at 12:15
  • @SleepyMan I have tried that before but not work. as I read, config port to 0 mean wireshark will try to decode data in all ports. – hqt Dec 30 '16 at 12:22
  • Looking at the documentation, protocol can only be HTTP or Data. But the port should be 443 for SSL/TLS.The Keyfile section should point to the private key. Do you have this? From my understanding, if you are going to google.com, google will have the private key and not you. So to test this, you will need to use something that you have control of in terms of keys/certificates. – SleepyMan Dec 30 '16 at 12:34
  • @SleepyMan about private key, I maybe still don't know how it works. I just tried to generate a key.pem on my local computer. As you said we have no way for getting https data. – hqt Dec 30 '16 at 12:43
  • Try and follow this link and I think you can achieve what you want. jimshaver.net/2015/02/11/… – SleepyMan Dec 30 '16 at 12:52
3

Decoding HTTPS traffic to / from google will only work if you have the private key of Googles webserver imported into Wireshark and the connection is not using PFS (Perfect Forward Secrecy). Otherwise any form of TLS (SSL) encryption would be pretty useless.

For more Details on TLS/SSL see Bulletproof SSL and TLS by Ivan Ristić.

7
  • 1
    Apparently you can, using Firefox and Chrome by logging the symmetric session key used to encrypt TLS traffic to a file and feeding it into Wireshark to decrypt. Obviously only limitted to the traffic using the browser and not any other application. There is a guide on how to do this: jimshaver.net/2015/02/11/… – SleepyMan Dec 30 '16 at 13:49
  • Following your argument, how could my browser decrypt traffic from google without knowing their private key? – JeanPierre Dec 30 '16 at 14:50
  • "It turns out that Firefox and Chrome both support logging the symmetric session key used to encrypt TLS traffic to a file. You can then point Wireshark at said file and presto! decrypted TLS traffic" – SleepyMan Dec 30 '16 at 15:01
  • I'm researching about decode ssl packets using Wireshark. But I think decode SSL packets is doable. I can do similar thing on other apps such as Burp Suite by using proxy, and then providing faking cert. – hqt Dec 30 '16 at 17:23
  • @hqt: Sure. But then your not debugging the session between Client and Sever but between Client and Proxy. – Jens Link Dec 30 '16 at 20:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.