0

If I have a protocol-analyzer/packet-sniffer, such as wireshark installed on a particular device..

(or in this case; tcpdump & tshark etc. on my smartphone..)

..should I be able to read that devices incoming & outgoing ssl/tls traffic, in an unencrypted/decrypted state?

2

don't know about the smartphone case, but with Wireshark, as long as you own the key you can.

Here you have a video doing all the walkthrough and here a Wireshark wiki post about it. Basically you need to go to the preferences of the SSL protocol and put the key file.

1

You need the private key of the server and then you can feed it into wireshark. Also to capture from smartphone, set up a file sharing network. I kind of did it with Windows 7 but not sure about exact steps. Google it, you will find the details.

  • What if a diffie-hellman key cipher is used? – Neil Smithline May 20 '16 at 17:42
  • 1
    Almost impossible unless you can analyze the memory dumps and get to the key . – H4X May 20 '16 at 18:01
1

should I be able to read that devices incoming & outgoing ssl/tls traffic, in an unencrypted/decrypted state?

In general TLS happens inside the application or libraries. By the time the traffic gets to wireshark it's already encrypted. To view the content you need to decrypt it and TLS is designed to make that difficult.

If the server uses a non-emphreal ciphersuite and you have the server's private key you can use that to decrypt the session. If you can modify the client or server application to log the "pre-master secret" then you can use that to decrypt the session. Otherwise you are out of luck.

https://wiki.wireshark.org/SSL

1

Also if you just want to see the application level traffic, use a proxy like burp suite . Configure the proxy on your smartphone and then you can see all the application level traffic on burp suite running on your system .

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.