1

We want to decrypt websocket traffic to analyse the used protocol. The traffic is between a pc-system (windows) and an embedded system. All certificates are available with private keys and everything is set up in a laboratory environment.

When I capture the traffic with Wireshark I can see the key exchange and the ciphersuite which is used. I my case is it TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384.

After searching the Internet, I realized that traffic with this cipher suite can only be decrypted using SSLKEYLOGFILE in Wireshark.

As a first idea, I wanted to change the cipher suite in my Windows system and use a cipher suite that is less secure and can be decrypted using RSA keys. This didn't work and I haven't found a way to do this.

Can anyone tell me how to set the Client Cipher Suite in Windows? Everything I found related to the IIS.

Another idea was to use sslsplit to write an SSLKEYLOG file to use in Wireshark. I can connect using sslsplit. The SSLKEYLOG file is created but remains empty. I used the following command:

sslsplit -D -M sslkey.log -R tls12 -l conn.log -X capture.pcap -P -k ca-key.pem -c ca.crt ssl 192.168.40.130 8443 10.10.11.170 8443

Does anyone have an idea why this is not working?

1 Answer 1

0

I don't know why it is not working but common ways are mitmproxy or burpsuite to intercept and decrypt the traffic.

Windows itself uses schannel which has several configuration options for preferred ciphers: https://docs.microsoft.com/en-us/windows-server/security/tls/tls-ssl-schannel-ssp-overview

Also there are more complicated ways to get the keys like hooking lsass: https://b.poc.fun/decrypting-schannel-tls-part-1/

However, it depends on your application if schannel is actually used. External applications can use some other ssl library like openssl so changing schannel settings won't help in these cases. You maybe can also decrypt traffic on the embedded side depending on the system.

1
  • Burpsuite is definitely the way to go here. It even has dedicated tools for websocket analysis
    – user163495
    Commented Mar 25, 2022 at 11:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .