This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Need to decode ssl locally

0

I want to decode the traffic between a desktop application (on my desktop) and a server out over the Internet. This is HTTPS traffic, but not from a web browser.

There is no pre-shared key or such, but it is traffic on my machine so I don't think it's unreasonable to be able to decode this stream to see what information is being sent.

Is there some way to do this? I have concerns over the data being uploaded and separately want to analysis the communications because it's somewhat slow.

asked 17 Sep '12, 08:35

klamerus's gravatar image

klamerus
1●1●1●1
accept rate: 0%

One Answer:

0

You need either of the following to decrypt SSL traffic:

  • access to the private key of the server (you don't have access to that, as it's a server on the internet)
  • your client 'spits out' the session key (it won't, as it' not a browser).

So, what can you do?

Use a local ssl proxy that is able to intercept ssl connections, like Fiddler2.

http://www.fiddler2.com/fiddler2/

See also my answer in a similar question.

http://ask.wireshark.org/questions/11744/how-to-find-the-symmetric-key-generated-by-the-browser

Regards
Kurt

answered 17 Sep '12, 12:30

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%

My understanding is that fiddler only works with web browsers and this is not a web application (or at least it's not a browser-based client). Can fiddler capture non-browser traffic?

(17 Sep '12, 14:40) klamerus

can you set a proxy in that application? If so, chances are good that you can use Fiddler.

(17 Sep '12, 14:47) Kurt Knochner ♦

And if you can't set a proxy in the application and it does not use the system's proxy if one is configured, then you can use a Backtrack DVD and run:

  • arpspoof to make traffic go through your backtrack box
  • sslsniff to decrypt and reencrypt traffic

This setup will present a new dynamically generated certificate, signed by a CA created by sslsniff. You might need to import that CA certificate in windows or the application.

(17 Sep '12, 15:32) SYN-bit ♦♦