How to get actual network traffic of an application?

Question

Firstly, sorry for bad English.

I have an application that runs on Citrix Workspace and generally I runs application from .ica extension file format. So I can access the database using this application.

My main purpose is to know this application's network traffic to build my own mobile (like Android, iOS) application project for easy access without extra programs like Citrix Workspace.

So after some researching, I decided to capture network traffic via WireShark and I saw that traffic is encrypted. So that again researching on Internet about 2 days ( I really don't know how actually https work so I searched about it.). And a few method I tried and only SSLKEYLOGFILE variable method worked on my Ubuntu 18.04 desktop but it only supports for browser but the application that I need is to run on Citrix Workspace. I can't get ssl.log file. Also I found a link how to decrypt it but it requires a private key that I haven't.

What I am wondering is that, without owner of server or root access of server, is there any methods to get TCP packets ( that encrypted using TLSv1.2 protocol) as decrypted to know that which url is requesting from app and which method (GET,POST,etc.) is using and what the payload is sent. So I can start build mobile platform application.

Answer 1

In essence, you are asking how to hack the network to intercept the network content.

This simply cannot be done other than how you already found out.

Wireshark is the way to go, but as the content is encrypted, that's basically all you can do.

Alternatively you would want to go on the server where the database is and extract it from there. You would need to make the database publicly accessible, which is a HUGE security risk. You will need your administrators help to open the ports, but they will quite likely say no because of the security implications.

TL;DR: Basically its not possible.

Answer 2

The best way to decrypt traffic from an application that can't create an SSLKEYLOGFILE is to run it via a TLS proxy of some kind (like mitmproxy, burp, fiddler or polarproxy). This way you'll be able to see the decrypted traffic.

If you wanna inspect the decrypted traffic in Wireshark, then PolarProxy is the tool you need. It decrypts and re-encrypts the TLS traffic, while also creating a PCAP file with the decrypted packets.