Hacker Read top | best | new | newcomments | leaders | about | bookmarklet login

I wrote about how I decrypt TLS streams in Wireshark for debugging purposes here: https://www.benburwell.com/posts/intercepting-golang-tls-wit...

It won't apply to every situation, but might provide some building blocks you can adapt to your environment.



sort by: page size:

The article covers using Wireshark to decrypt TLS traffic using Pre-Shared Master Secrets!

Wireshark doesn't natively decrypt TLS traffic, though. And SSLKEYLOGFILE is not supported by many network apps.

> I could watch each command and response going over the wire.

AFAIK, Wireshark supports decrypting TLS traffic if you give it the private keys.

> When a POP3 mailbox got hung up on a single huge message you could just telnet in

Use “gnutls-cli” or “openssl s_client” – transparent TLS for your terminal. Both those commands also have options supporting protocols’ use of STARTTLS.


tls isn't magic, you can still observe the encrypted stream and make assumptions based on bytes sent/received on the wire, protocol patterns and timing. See the crime and breach attack.

Neat project.

On HN a lot of people are against TLS interception. How is a defender suppose to detect this traffic? TLS aside snort or yara rules can be implemented.

For personal devices of course TLS should not be interceptable. But I've personally gone 180 and support TLS decryption for enterprise networks.


Have you looked at intercepting the TLS connection by MITMing yourself?

Tools like Fiddler should allow you to see this data in plaintext, though identifying what information it contains is another step.


Also, using TLS with Perfect Forward Secrecy (all modern ciphers), it's not possible to just capture the traffic and dectypt it later. You have to know the private key and do MITM.

Wireshark doesn't come with a built in way to extract the dynamically exhanged TLS keys from applications and use that to decrypt the traffic, so no it does not do what you claim.

You can use mitmproxy [1] to dump the TLS Master Secrets for all connnections it intercepts [2]. The dumpfile goes straight into WireShark.

Obligatory disclaimer: I'm one of the mitmproxy authors - happy to answer any questions.

[1] https://mitmproxy.org/

[2] http://docs.mitmproxy.org/en/stable/dev/sslkeylogfile.html


Just enable ktls and you can sniff all tls-encrypted data directly from the process

> wireshark/tcpdump/ngrep/etc might be challenging to practically use in the presence of SSL/TLS. you can mitigate this problem by setting up SSL termination at your network perimeter so you can monitor unencrypted traffic.

https://mitmproxy.org/ is pretty awesome for that type of work.


> You can't decrypt the traffic

Sure you can. There are many how-to's on decrypting SSL/TLS using wireshark, you just have to have the keys. Here's one - https://support.citrix.com/article/CTX116557


Intercept the traffic somewhere and inspect it with Wireshark. You can decrypt the HTTPS packets if you can manage to log the keys on Android (see https://jimshaver.net/2015/02/11/decrypting-tls-browser-traf...).

I haven't had an opportunity to try this myself, but rather than setting up some kind of MITM proxy, maybe you could try this:

https://jimshaver.net/2015/02/11/decrypting-tls-browser-traf...


I don't know why but your comment reminded me of learning about $SSLKEYLOGFILE and the ability to retroactively decrypt traffic captured in Wireshark: https://everything.curl.dev/usingcurl/tls/sslkeylogfile (I was expecting there to be an entry on MDN since my first contact with that env-var was from Mozilla's TLS library but no luck)

I guess it's the fact that in my mental model any supporting library doesn't have to be modified to allow viewing the traffic, and no cert-pining-breaks required


HTTPS stops interception.

Even if you have perfect faith that it's currently impossible to crack TLS (and you probably shouldn't), they might record the stream and crack it in the future, having tools you can't even imagine currently.


Cool project!

I have one question though, how do you intercept TLS. Let’s say i would connect my phone to your proxy, and try to search something on the web. Wouldn't the connection not be trusted?


You can just hook the networking system calls and you have the unencrypted buffer. TLS encryption doesn't do anything since you can just look at it unencrypted on the network function when they pass in the buffer.

If they encrypt before the network functions, you can just look at the callstack and trace the variable containing the buffer backwards until it's non encrypted.


I don’t understand - how is the attacker able to decrypt TLS packets for ChatGPT requests? It seems like that aspect has been assumed.

Isn’t this similar to someone just replacing your HTML page for an encrypted connection?

next

Legal | privacy