I currently use fiddler/Charles Proxy/MITM proxy to decrypt and analyze SSL/TLS traffic from suspect mobile apps I want to analyze. The process I follow is to export a CA cert from Fiddler, then import that cert onto the physical phone. I then configure the phone to use the Fiddler capture machine as a proxy.

I want to take this to the next level and create custom SNORT rules for the type of traffic I want to monitor, so I also need to capture PCAP files that SNORT can use. I planned to use Wireshark for the PCAP capture.... I know Wireshark supports decryption of TLS, but the only method I can find documentation for in Wireshark leverages the SSLKEYLOGFILE variable which only works in web browsers like Chrome and Firefox and not the mobile app scenario I am using.

I still want to use a proxy like Fiddler to easily view the HTTPS traffic; I just want to simultaneously capture and decrypt PCAP captures at the same time to run that traffic against my SNORT rulesets. Can anyone help me figure out how to do this?



You must log in to answer this question.

Browse other questions tagged .