Hello everyone in this lesson. I will show you how to
decrypt https traffic.
As you know to be able to analyze https traffic
and analyst must know how
to decrypt that traffic the type of traffic. First
of all, you need to obtain and store
the TLs session key pairs of
the traffic you are capturing and decrypting
https. Traffic is very easy. Once
you have the session key values
and I have captured a
sample https traffic before and recorded
and stored the session key
values used in
that traffic as a log file on
my computer. And so now
I have an https traffic in here
as a peak file and the associated
session key lock file as well.
I will be showing you the description process
with these files.
Later, and so if you want to
save if you want to store the
session key values in a log file while capturing
https traffic with Wireshark,
let's talk about how you can
do this.
If you want to capture key values online site,
you need to change environment variables
inclined operating system.
So, I mean that you need to
change the OS the operating system
environment variables.
And here the client will be our
web browser. And therefore I
have to make the necessary adjustments necessary
change in the Windows operating system
environment variables to save the session Keys
first, we will see how
you can do this how you can change your
environment variables in
order to
store the session key players values
now firstly let's open the
environment variables in our operating system.
So as you can see I'm using
the Windows operating system and you
can easily go to the
environment variables window.
using the search Tab and
when you type the environment variable to
the search field, you can
easily go to the environment variable window and
now I am opening the environment variable
window in here.
And you will see as well.
So
you can go to this system properties
window as well to
reach the environment variables in here. And when
we open this window, you
can go to the environment variables.
and when you click on the environment variables you
have this window in here
and
in the environment variables window
we will use the user variables
for
admin in here in my computer maybe in
your computer. This field is
called as user variables
for
any user
User variables for John or
any other name it
isn't a matter for us and we will
use this.
Part in here and we will
create a new variable in here and
nothing system variables. They will
create a user variable a new variable
in here and click on
the new button.
and
in this field, we will Define a new
variable and they will give a
name to it.
And in here I will give the name to
my variable as key
lock.
file
and in the variable value
perimeter, you can enter you
can type the file pad where you
want to save your log file. So, for example, I will
type this pet in here.
or you can you can choose your
file pad using this browse
file or browse directly
options, or you can directly type your file
pad in here and I want
to type my pad as the
desktop and
now I will give a name to my
log file which I
will save the session key
values.
And in here I want
to give a name as key lock.
file
that look so you
can name your file like this.
And is key log
file I have typed is key lock
file and you can specify its extension
as that look.
and
then just click the OK button and
confirm the chains of
this.
process
I will not complete this process in here
now because I have done it before so because
and now I will click
on the cancel.
In this way and cancel again.
And to cancel again.
After defining the necessary environment
variable you will see that your log file
is created once you launch your
web browser.
Namely once we activate
it the environment variable the client will start
to store the temporary session Keys
locally in the log file you have defined.
And now we can give that session log
file to Wireshark.
And thus it will decrypt the traffic
for us using this session keys.
So now let's talk about
the decrypting https traffic
in Wireshark.
Earlier, I have captured the https traffic as
I told you before I have captured the https
traffic happening happening. As
soon as I visited the www.wire shirt.org
website and this PK file
contains that traffic to
see only the relevant TLS traffic.
as in here
just like in here.
I fetch the packets following the
TCP stream from the packet
in which the TLs handshake started.
in here and
with this filter with using
this filter experience and I have
already showed this filter in the previous in
the previous lesson. So and now
as you can see no HTTP
packets appear in
Here there is no.
There's no HTTP packet. Just
we can see the TLs packets
in here because the
all packets in the traffic.
Have been encrypted with the TLs
version 1.3 protocol.
and
in addition
Only client hello.
is in here
only client hello and server. Hello
packets are clearly visible from TLS
handshake packets because from
this point on
The traffic is encrypted and all
packets are in the form of application data.
as you can see
in addition, there is only
TLS as a protocol, so now
let's make decryption on the
turf now.
Let me show you how you can decrypt the
packets in Russia.
So to do this, we will go to the edit
menu and the preferences menu
under the edit. Now, let's
go to the protocols and expand
the protocols.
And we will go to the TLs.
protocol
as in here
in this window the transport layer
security protocol window.
We will address the we will
assign the session key payers
values file log file key session
key log file to the
Wireshark. We will give the
Are session key values to Wireshark
in order to decrypt our
traffic and in here,
we have a fair Master secret
log file name and we will show we
will browse our key
logs file is in here. I have a
key logs file in here associated with
this traffic PF File and with
https traffic and choose.
The keys log file key lock
file your key lock file then click
on the open.
and now
you can click on the ok.
Of course.
and click on OK
Here it is. As you can see haircuts that
were previously encrypted are now clearly
visible.
Now we can see the HTTP packets
in here.
and
Other handshake packets are also
visible now as you
can see in here.
These handshake packets were were
in the form of
application data, but now we can see
clearly there.
some
They have some encrypted extensions compressed
shortcut and the other
sort of could verify the data and the
finished message in this packet.
But before the decryption process
we couldn't see the these details
associated with this handshake packet,
but now we can see all the
details about the packets about
the handshake packets and other
encrypted packets and now
we can see a HTTP version
2 file in here clearly and the
other HTTP file.
And now if you type the filter expression to
the display filter field as
HTTP to you
can fetch the packets
associated with this protocol with
the http/2 protocol, but before
the decryption process
Even you have typed the http/2
in here to you couldn't
fetch the packets with the
http/2 protocol. So now
we can clearly see the packets.
We can clearly see the get message
in here get packet is
sent from the client by
the client to the server to the HTTP server.
To why shared servers?
And if when you type as an is
a filter expression for example Wireshark in
here, let me
show you.
I want to see the frames.
Which contains why shark world
or why shark data? Why should
text and you can type frame
matches?
Why shark?
so now
you can see all the packets.
That have this word. This text is
very sharp, and you can fetch the
Packets associated with it as you
can see but we have
only declined Hello Message In
This terrific.
So let's turn back to the our stream again.
using TCP stream equal to
and click on enter so
Now we can.
look at the HTTP get message and
the post also post messages we
can see and
on the other hand now we
can export a clear Text data or
image or similar data in
our traffic if any
so we can easily do content analysis
exporting such these files.
So let me show you and now we can export objects
and the I want to
export the HTTP objects. For
example.
If I have any objects in here.
In our traffic we can export it.
But now we can have any other.
object in the http
but you can see
you can see your
http
packets
as HTTP 2 in here
and there are some data packets.
also, you can see
and haters as you can see in here.
So let me show you in here here.
hypertext transfer protocol
and
as you can see
we can observe clearly the HTTP
headers information in here
after the decryption process. So
in order to see some HTTP
text Data you can
type this filter in the display
filter field and type HTTP
to
Point data
point data
so you can access the some HTTP
data.
easily using this filter expression and
click on the enter as you
can see now we have
the sum HTTP to data packets
in here and you can also
investigate some
html text files in
here.
You can click on the right button The
uncompressed Entity body.
And when you click on this option,
you can see the clearly a
HTML.
page structure as in here
So that's all for now. See you on the
next video.