I was reading this paper on SSL/TLS from the SANS Reading Room on how to capture and decrypt your own SSL traffic with Wireshark. I wanted to capture the credentials used to login to gmail. When the TLS handshake takes place, the browser and the server agree to communicate over SPDY.
SPDY is very new to me. On the wire it looks a bit different than HTTP. I can see the decrypted packets in Wireshark if I filter by 'SPDY'. But I just cannot pin down the packet that contain the credentials. I do a search for the string that contains my password and it returns nothing. I am wondering whether the credentials appear different in SPDY than they do in HTTP. Although when I use the Live HTTP Headers add-on I can definitely see the password.
Looking for some hints on how to search for user credentials within a gmail session over SPDY. Thanks!