0

If I have a protocol-analyzer/packet-sniffer, such as wireshark installed on a particular device..

(or in this case; tcpdump & tshark etc. on my smartphone..)

..should I be able to read that devices incoming & outgoing ssl/tls traffic, in an unencrypted/decrypted state?

4 Answers 4

2

don't know about the smartphone case, but with Wireshark, as long as you own the key you can.

Here you have a video doing all the walkthrough and here a Wireshark wiki post about it. Basically you need to go to the preferences of the SSL protocol and put the key file.

2
  • Right, but where did the .key file come from? Commented May 20, 2016 at 16:06
  • @tjt263 it's the server's private key. Btw, here you have a related question security.stackexchange.com/questions/64814/… Commented May 20, 2016 at 16:20
1

You need the private key of the server and then you can feed it into wireshark. Also to capture from smartphone, set up a file sharing network. I kind of did it with Windows 7 but not sure about exact steps. Google it, you will find the details.

2
  • What if a diffie-hellman key cipher is used? Commented May 20, 2016 at 17:42
  • 1
    Almost impossible unless you can analyze the memory dumps and get to the key . Commented May 20, 2016 at 18:01
1

should I be able to read that devices incoming & outgoing ssl/tls traffic, in an unencrypted/decrypted state?

In general TLS happens inside the application or libraries. By the time the traffic gets to wireshark it's already encrypted. To view the content you need to decrypt it and TLS is designed to make that difficult.

If the server uses a non-emphreal ciphersuite and you have the server's private key you can use that to decrypt the session. If you can modify the client or server application to log the "pre-master secret" then you can use that to decrypt the session. Otherwise you are out of luck.

https://wiki.wireshark.org/SSL

1

Also if you just want to see the application level traffic, use a proxy like burp suite . Configure the proxy on your smartphone and then you can see all the application level traffic on burp suite running on your system .

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.