0

If I have a protocol-analyzer/packet-sniffer, such as wireshark installed on a particular device..

(or in this case; tcpdump & tshark etc. on my smartphone..)

..should I be able to read that devices incoming & outgoing ssl/tls traffic, in an unencrypted/decrypted state?

voices
  • 1,649
  • 7
  • 22
  • 36

4 Answers4

2

don't know about the smartphone case, but with Wireshark, as long as you own the key you can.

Here you have a video doing all the walkthrough and here a Wireshark wiki post about it. Basically you need to go to the preferences of the SSL protocol and put the key file.

The Illusive Man
  • 10,487
  • 16
  • 56
  • 88
  • Right, but where did the `.key` file come from? – voices May 20 '16 at 16:06
  • @tjt263 it's the server's private key. Btw, here you have a related question http://security.stackexchange.com/questions/64814/how-to-get-private-key-used-to-decrypt-https-traffic-sent-and-received-from-my-o – The Illusive Man May 20 '16 at 16:20
1

You need the private key of the server and then you can feed it into wireshark. Also to capture from smartphone, set up a file sharing network. I kind of did it with Windows 7 but not sure about exact steps. Google it, you will find the details.

H4X
  • 161
  • 1
  • 7
1

should I be able to read that devices incoming & outgoing ssl/tls traffic, in an unencrypted/decrypted state?

In general TLS happens inside the application or libraries. By the time the traffic gets to wireshark it's already encrypted. To view the content you need to decrypt it and TLS is designed to make that difficult.

If the server uses a non-emphreal ciphersuite and you have the server's private key you can use that to decrypt the session. If you can modify the client or server application to log the "pre-master secret" then you can use that to decrypt the session. Otherwise you are out of luck.

https://wiki.wireshark.org/SSL

Peter Green
  • 4,918
  • 1
  • 21
  • 26
1

Also if you just want to see the application level traffic, use a proxy like burp suite . Configure the proxy on your smartphone and then you can see all the application level traffic on burp suite running on your system .

H4X
  • 161
  • 1
  • 7