TLS\SSL pcap with key - save decrypted output to pcap file without the attach key

asked 2019-10-15 12:32:14 +0000

Dana
1 ●1 ●1 ●1

Hi, I know how to use wireshark inorder to decode an encrypted ssl\tls pcap when providing the key. I can't save the decrypted pcap without it depending on the key. Is there a way to save the decrypted pcap in a way that it won't depend on the key? Thanks

edit retag flag offensive close merge delete

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2019-10-15 17:55:53 +0000

SYN-bit

18528 ●9 ●339 ●255 https://SYN-b.it

Wireshark won't save the decrypted data, but you can export the session keys which are specific to the traffic in your capture file. After doing the decryption with the private key, go to file -> Export TLS Session Keys. Save the keys to a file. When you want to view the decrypted traffic again without the private key, point to the session keys file in the TLS protocol preferences under "(Pre)-Master-Secret log filename".

You can also add the keys to the pcap-ng file so that you do not have to point to a separate file by using editcap --inject-secrets tls,<file-with-exported-keys> <original.pcap> <new.pcap>

edit flag offensive delete link

Comments

I am trying to do the same thing. I used the editcap command line, but the error says my key "is not a key log file, but an unsupported private key file". Can I fix this somehow?

Tiger123 ( 2020-07-30 18:18:23 +0000 )edit

Did you export the TLS session keys as mentioned. Or are you trying to attach the private key of the server? Only the TLS session keys can be added, not the private key.

SYN-bit ( 2020-08-13 13:35:30 +0000 )edit

add a comment

answered 2019-10-15 18:48:17 +0000

Pascal Quantin
5846 ●63 ●65

You can also save the decrypted packets starting from Wireshark 2.0 (if I remember correctly) by clicking on File -> Export PDUs to file -> OSI layer 7.

edit flag offensive delete link

add a comment