2

I am trying to reverse engineer a decoder. To do so I need to sniff the packets that the decoder receives from an Android application installed on my phone, this application is what controls the decoder.

I tried using Wireshark at first, but it turned out that the packets are sent over SSL, so they are all encrypted. I then tried to sniff my TCP packets using MITMproxy, which didn't work since it doesn't sniff TCP packets, it only logs packets sent over HTTP.

After reading the answers to the following question

How can I capture all traffic network by mitmproxy?. I decided to give Wireshark a second try.

To do this I need to know the location of the private key which I have no idea about. I know what a private key is, but I don't know where I can find it? or which private key we're talking about?

I would appreciate some help with this, this is my first time working with packets sniffing.

  • 1
    The private key is stored on the device you are trying to reverse engineer. You'd need access to its file system (and possibly some knowledge on its architecture). – Esa Jokinen May 16 at 10:50
  • @EsaJokinen Thank you for your response! It's a decoder that has a web server inside of it. – yosra May 16 at 10:54
  • 2
    Apart from that the private key might not be sufficient at all but you'll need the (pre-)master secret of the specific connection. In general - this question is too broad. It is well documented on the internet how to do decrypt SSL with wireshark once you have the necessary secrets. How to get to the secrets (and if this is even possible) fully depends on the exact applications which are involved, i.e. things like "web server" does not help. And this would be out of scope here too, but you might try Reverse Engineering. – Steffen Ullrich May 16 at 10:56
  • 1
    Apart from that, mitmproxy can also do more than just HTTPS, see tcpproxy. – Steffen Ullrich May 16 at 10:59
  • @SteffenUllrich Thank you I will post on reverse Engineering and see if it's possible to get the key. – yosra May 16 at 11:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.