Decrypt TLS traffic

asked 2024-06-09 11:22:44 +0000

I am trying to decrypt TLS traffic, I should parse GET request header to a specific host.

I was provided the .pcapng file and the txt file with the TLS keys.

I added the keys using “(Pre)-Master-Secret log filename.”

I tried applying a filter such as http.request.method == “GET” && http.host == “hostname” but it doesn't seem to work, am I doing something wrong with the TLS keys?

answered 2024-06-19 13:17:41 +0000

Virgo
1 ●1 ●1 ●2

In unix environment the TLS keys are exported using a variable. You have setup the variable SSLKEYLOGFILE to the path of the file where you want store the keys, then you run the browser. Something like this: $ export SSLKEYLOGFILE=~/.config/chromium/.mysslkeylog chromium Obiously the path must be writeable by the process.

edit flag offensive delete link

Comments

I think the OP is doing some sort of homework assignment where the pcap and keys are provided so there's no need to configure the browser to generate new keys.

grahamb ( 2024-06-19 13:50:20 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Decrypt TLS traffic

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Decrypt TLS traffic edit

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Decrypt TLS traffic