I mean, if I am, for example, on Facebook, every packet I send out of my NIC is encrypted. But there must be phase of that packet before it is encrypted. The browser (I think) must create that packet and encrypt it afterwards. So if I am on the machine creating those packets, am I able to see them before encryption?
And if yes, are there malware capable of doing this? I think with administrator/root privileges it is certain that it can, but what about without them?
With the availability of browser extensions, actually reading the traffic should be quite doable. If both the malware and web browser run as the same user (and therefore can write to the browser profile directory), then installation of browser extensions can be done relatively easily.
You can also open the Web Developer Tools, typically accessible by pressing F12 and visit the Networking tab. That will show you all traffic before it is encrypted and pushed onto the network.
The above methods are passive ways that do not interfere with communications. Active methods perform a man in the middle (MitM) attack and actually modify data before it gets forwarded (Tylerl describes an example with Fiddler).
SSLKEYLOG environment variable to have the browser dump the encryption secrets, so that Wireshark can reassemble the plaintext content.
SSLKEYLOGFILE method is another passive method, but technically you are then decrypting traffic and not looking at the data before they get encrypted. For the concerned, see also this question about how this is done.
Commented
Dec 26, 2016 at 10:58
installation of browser extensions can be done relatively easily - not so feasible nowadays. Extensions has to be signed by vendor in order to run (at least recent FF and Chrome).
The network traffic out of your browser gets encrypted before the browser calls send() to put it on the network. So to intercept it before encryption, you'd have to intercept it before it's sent at all -- that is, within the browser itself. This isn't impossible, but it's a lot of work.
An alternative is to set up a "Man In The Middle" proxy, such as fiddler, which decrypts the traffic before it leaves your network, inspects it, and then re-encrypts it on its way out. Generally SSL is designed to prevent this, so you'll need some amount of cooperation by your computer to allow it (i.e. your browser will have to trust fiddler's public key) but this is all part of how you set up fiddler, so it's well-enough documented.
The browser (I think) must create that packet and encrypt it afterwards. So if I am on the machine creating those packets, am I able to see them before encryption?
No, that's not how it works. Inside the browser, the data is encrypted and only encrypted data is passed between the browser and the network stack. The network stack splits the encrypted data into packets and re-assembles received encrypted data from packets back into the stream of data for the browser to decrypt. There simply aren't any packets at the level the browser handles, and the browser handles the encryption and decryption.
So your question is based on a false premise.
