Decrypting outbound REST calls by HTTPS

asked 2019-09-04 10:43:51 +0000

fpoverud gravatar image

updated 2019-09-04 11:05:17 +0000

grahamb gravatar image

Hi All. I spent several hours trying to setup WireShark to decode outbound REST calls, but so far I have not been able to do so.

I have tried to assign the .PFX, .PEM, .KEY and created a KeyLog but the packets are still encrypted.

This is what I get in the debug log:

dissect_ssl enter frame #2062 (first time)
packet_from_server: is from server - FALSE
  conversation = 000000CB5320F940, ssl_session = 000000CB53210750
  record: offset = 0, reported_length_remaining = 309
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 304, ssl state 0x17
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available

The traffic Flow is as follows:

  1. HTTP POST request is created on the client with HTTP headers and a JSON payload.
  2. Request is sent through tomcat to the HTTPS REST Endpoint
  3. Source port is dynamic and target port is static (443)

What I need to see is how the HTTP request is formatted to verify that the creation is correct. I'm using the latest WireShark 64bit version for Windows and running everything on a Windows 2012R2 server. The target endpoint is an external provider where the authentication is done with a base64 encoded credentials token.

Thank you in advance

with Regards Filip Poverud

edit retag flag offensive close merge delete

Comments

This is the Key Exchange so we see that it is using the Elliptic-Curve Diffie-Hellman so I assume that is the problem. Please instruct me if you need to see other frames in the loop. I have removed some data, but all the Keys from the log are matched as seen in the below snippet.

dissect_ssl enter frame #2366 (first time)
packet_from_server: is from server - FALSE
  conversation = 000000CB53240900, ssl_session = 000000CB53241790
  record: offset = 0, reported_length_remaining = 143
dissect_ssl3_record: content_type 22 Handshake
decrypt_ssl3_record: app_data len 138, ssl state 0x17
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 16 offset 5 length 134 bytes, remaining 143 
Calculating hash with offset 5 138
trying to use TLS keylog in ..\..\keys\ws_key.log
ssl_load_keyfile file got deleted, trying to re-open
  checking keylog line: CLIENT_RANDOM
...
...
    matched client_random
ssl_generate_pre_master_secret: found SSL_HND_CLIENT_KEY_EXCHG, state 17
ssl_restore_master_key can't find pre-master secret ...
(more)
fpoverud gravatar imagefpoverud ( 2019-09-04 11:33:31 +0000 )edit
add a comment