2

So let's say you have setup TLS between two different services. And you want to "prove" that out (for lack of better words. Basically just trying to witness the encrypted traffic in action).

What's the best/easiest way to do that? Because those two services are communicating directly, can you really put yourself in the "middle" of the communication without doing major things (I guess modifying the routing tables of both services to send traffic through the observer?)?

I suppose one way is to go on one service and just look at network traffic with tcpdump? Is that correct? And if so, is that the easiest way?

Thanks in advance!

3
  • 2
    It is unknown what access you have to the specific systems. Running Wireshark on any of these should be sufficient to watch the traffic, without being man in the middle in the network. Oct 27, 2021 at 20:22
  • 1
    Thanks for the comment! So I have full access to the systems (this isn't production, just a test environment). It is a containerized environment though. So instead of wireshark I guess I can just use tcpdump. Oct 27, 2021 at 20:31
  • 1
    Yes, tcpdump or tshark (wireshark command line) Oct 27, 2021 at 20:35

2 Answers 2

1

To intercept (manipulator-in-the-middle) I prefer Burp

To be passive; i.e. view some PCAP files you obtained from TLS communication elsewhere, Wireshark is capable of (if you also obtained the secrets) decrypting the PCAPs and view the TLS as cleartext, a recent guide is here

-1

It depends on what exactly you want to verify, and where in the stack you are. If you operate either system, logs from either one can generally tell you if the inter-system traffic uses TLS. If you're just on the outside of the systems and sitting in the same network, then Wireshark can look at packets and see if their message content is ciphertext. There are other options as well, again depending on your desired outcomes.

Above all, make sure that if you need permission to do whatever you're doing, you have it. It is super important to only use any security tool legally and responsibly.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .