So how can I sniff packets that are being sent from my computer to their server and from their servers to me using a sniffing app like Wireshark?

right now when i use Wireshark, they are all encrypted, but obviously i should be able to sniff it considering my computer is the one that is encrypting and decrypting them using keys

So i guess my question is, how can i sniff telegram packets that are being sent from my computer or to my computer? I'm using Windows and want to sniff the Desktop version if that makes any difference.

  • Your packets are encrypted through an SSL connection. Anyway if you are able(whats not really possible) to turn this off, your packets are encrypted locally on your PC. Thats why they call it End-to-End encryption. All you will be able to see are encrypted packets like you do now. – CD Rohling Oct 1 '18 at 16:43
  • you can't, if they are in a "packet" they have already been encrypted as they use E2E. – dandavis Oct 2 '18 at 15:44

I'm not aware of any off-the-shelf way to accomplish this. In order for wireshark to decrypt the packets, it would need access to the encryption key which Telegram uses, which it does not have direct access to. You would need some way of accessing the memory which Telegram uses, figuring out which part of that memory is the encryption key, and then using that key to decrypt the data. And if you already have access to the memory which Telegram is using, why not just read the data before it was encrypted?

  • What do you mean by just read the data before it gets encrypted? how can i read the data without wireshark or an sniffing app before them getting encrypted and sent? also isn't the private key stored on disk as well, or just memory? – Richard Jones Oct 1 '18 at 16:52
  • By reading the data before it gets encrypted, I mean just reading the data directly out of memory. In order to encrypt the data, the data would need to be stored in clear text in memory some place. As far as the private key goes, the private key is not used to encrypt data directly. In order to reduce processor load and to maintain forward secrecy, encryption protocols typically use their private keys to generate a per-session symmetric key. This symmetric key is what is used to actually encrypt the data. It is what you would need to use to decrypt the data. – user52472 Oct 1 '18 at 17:06
  • but how can i know which part of the data section of my process is the encryption key? there are a lot of data in there and they are just 1's and 0's how can i even know where is the starting and ending bytes of the encryption key? – Richard Jones Oct 1 '18 at 17:40
  • Like I said, I'm not aware of an off-the-shelf way of accomplishing your goal. Finding the ending point of the encryption key should be fairly easy. It's just X bits after the start point, where x is the key length. A securely generated encryption key will be random, so you should be able to use a statistical test to determine if the section of memory is random. – user52472 Oct 1 '18 at 18:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.