I have tried: tshark n -o ssl.keylog_file:/tmp/master.txt -Y ip.src==xxx.yyy.nnn.mmm -d tcp.port==0-999999,ssl I see this Capturing on 'eth0' How can I dump the packet content as "follow tcp streamm" in wireshark already does ? Is it possible to use something like as described in https://isc.sans.edu/forums/diary/Psst+Your+Browser+Knows+All+Your+Secrets/16415/ in such a way as to have a file decrypted packets in real time ? This question is marked "community wiki". asked 12 Jan '16, 11:51  famedoro edited 14 Jan '16, 00:01 |
One Answer:
To decrypt, as mentioned by @sindy, you must enter the key info into the SSL RSA Keys list preference in Wireshark. This will create a ssl_keys file in your preferences directory. Once this has been set up tshark will decrypt the SSL data. For example, using the snakeoil sample capture you must enter the following into the SSL RSA Keys List preferences:
Loading the rsasnakeoil2.cap file into Wireshark should show the decrypted HTTP traffic. If successful, tshark can then be used to dump the stream using the If you just want the raw hex without the offsets and ascii, use answered 13 Jan ‘16, 15:59  grahamb ♦ @grahamb Is it possible to use something like as described in https://isc.sans.edu/forums/diary/Psst+Your+Browser+Knows+All+Your+Secrets/16415/ in such a way as to have a file decrypted packets in real time ? (13 Jan ‘16, 23:59) famedoro Not easily as you need to somehow retrigger Wireshark that the contents of the SSL key log file has changed, and then select the appropriate ssl stream. (14 Jan ‘16, 00:30) grahamb ♦ @grahamb Must I use wireshark ? Is it possible to have a decrypted real time data stream using only tshark ? (14 Jan ‘16, 01:02) famedoro The issue is not whether you use tshark or Wireshark, the issue is the dynamic nature of the session keys. *shark doesn’t read the key log file each time it needs a value from it but only once when starting, that’s why @grahamb wrote that you’d have to tell *shark that the contents of the file has changed (and choose the right tcp stream id). As far as I know, there is currently no “input point for asynchronous events” allowing to tell a running *shark that it should do something, nor any “watch for changes” functionality of the *shark itself. Normally you only need to decrypt ongoing communication in real time in order to take urgent measures based on its contents, and this is an activity which a typical *shark user doesn’t perform too often. Those who need it usually work with an appropriate budget. (14 Jan ‘16, 03:03) sindy |
Lacking your capture and the keys, I cannot answer you, I can only give a hint. I've tried with https sample capture, where you need to set a link to a file containing the RSA decryption key to get the payload decrypted, and I am not sure whether the keylog file is used the same way.
As the mappings between IP, port, payload protocol and RSA key file are not stored in the preferences file but in a separate one, they cannot (to my knowledge) be handed over to tshark using the
-oparameter. But if you define these mappings using Wireshark, they get stored and tshark will use them too, without any options telling it to do so.Now another point, the dissector to be used to the decrypted payload is not chosen automatically based on the tcp port of the encrypted packet; instead, you define it together with the mapping between ip,port, and rsa key. If you set it to "http", you'll have no single protocol field to output. So I'd recommend to set the payload "protocol" to
data, and if you do so, you can use tshark options-T fields -e data. This way, you'll get the decrypted payload as hex stream without any separators. I.e. anAbcstring in the decrypted payload will be output as416263.@sindy I have already shark n -o ssl.keylog_file:/tmp/master.txt -Y ip.src==xxx.yyy.nnn.mmm -d tcp.port==0-999999,ssl -T fields -e data and in this case does not show any information. Is it possible to use something like as described in https://isc.sans.edu/forums/diary/Psst+Your+Browser+Knows+All+Your+Secrets/16415/ in such a way as to have a file decrypted packets in real time ?