How to DECRYPT HTTPS Traffic with Wireshark

Поділитися
Вставка
  • Опубліковано 19 гру 2024

КОМЕНТАРІ • 390

  • @ganeshid1982
    @ganeshid1982 3 роки тому +43

    Thanks as always Chris... really useful 🙏

    • @ChrisGreer
      @ChrisGreer  3 роки тому +2

      My pleasure! Thanks for the comment Ganesh!

  • @numberiforgot
    @numberiforgot 3 роки тому +44

    Even after all the experience I have with IT security/forensics, I’m still learning something new every day.

    • @ChrisGreer
      @ChrisGreer  3 роки тому +3

      Amen to that Christopher! I feel the same. I learn something with every pcap I open.

    • @lovely31bluprint
      @lovely31bluprint 3 роки тому

      You will always learn something more in technology

  • @NovakGoran
    @NovakGoran 3 роки тому +13

    'Packet heads' cracked me up. Thanks for the vid!

    • @ChrisGreer
      @ChrisGreer  3 роки тому

      Glad you liked it! Hey every department needs a Packet Head.

  • @maliki14
    @maliki14 2 роки тому +4

    i havent touched cybersecurity in over a year but bet your ass stumbling on this video made me turn my PC back on, thank you for the insanely ez lesson

  • @alexmook6786
    @alexmook6786 Рік тому +3

    Chris is a gem...I have learned so much from him over the years, especially on Pluralsight.

  • @alexandermayerkirstein
    @alexandermayerkirstein 2 роки тому +2

    Remarkably excellent delivery style. Super efficient clarity. Nothing superfluous. Conceptual through point and click guidance. Compellingly engaging with constant forward quick-step momentum. Not too loud not soft spoken. Knowledgeable, conservative, passionate, trustworthy source. Technoratically enjoyable. First video I watched on this channel. Heading to check your other content for more of the same. Thank you!

    • @ChrisGreer
      @ChrisGreer  2 роки тому

      Thank you for watching and commenting Alexander!

  • @bikupothen5426
    @bikupothen5426 2 роки тому +7

    how did u get that SYSLOG file in the beginning?

  • @TheDyingFox
    @TheDyingFox 3 роки тому +3

    Nice to read online that this method apparently works the same with the Firefox web browser :D

  • @thatpigeondude
    @thatpigeondude 2 роки тому +1

    finally... a video that works. I can't thank you enough dad.

  • @seantierney2028
    @seantierney2028 Рік тому +1

    Fantastic guide! I don't normally comment, but you need to know that you are doing fantastic work! I am experiencing Wireshark for the very first time in a CTF and this was clear, informative, and helpful!

    • @ChrisGreer
      @ChrisGreer  Рік тому

      Thank you for the comment! I really appreciate the feedback.

  • @KaySwiss21
    @KaySwiss21 3 роки тому +2

    Glad you did the Collab with Bombal so I could find your content!

    • @ChrisGreer
      @ChrisGreer  3 роки тому

      I am beyond honored that he wanted to interview me on his channel. Great to have you here!

  • @ductran8118
    @ductran8118 3 роки тому +5

    Thank you for sharing! Now I can understand ssl/tls handshake clearly and how https works. Love it and Subscribed.

  • @scottspa74
    @scottspa74 2 роки тому +5

    I just experimented with this in a ucertify virtual lab I had open for a class assignment, and it was super easy and fun. Thank you for showing this !

    • @ChrisGreer
      @ChrisGreer  2 роки тому +1

      Great job! Thanks for the feedback!

  • @moinvohra5505
    @moinvohra5505 Рік тому +5

    Can somebody help me?
    I am not able to capture the log file even though I created an environment variable with the ssl.log in the end.

    • @VLif3
      @VLif3 3 місяці тому +1

      Just restart the computer. It should work.

  • @dicao6526
    @dicao6526 3 роки тому +2

    Thanks Chris. I like your passion when explan all of this. 🤗

    • @ChrisGreer
      @ChrisGreer  3 роки тому

      Thanks again Di. I appreciate the feedback.

  • @ethancai681
    @ethancai681 3 роки тому +1

    Thanks, Chris. This video helps me a lot.

  • @techanalogies2629
    @techanalogies2629 3 роки тому +10

    A really interesting video indeed!...Learnt many new things....Could you make a video to learn how I can capture and decrypt my smartphone's browsing traffic using wireshark?(Both connected to the same networks)

  • @Noah.Nation
    @Noah.Nation 2 роки тому +1

    3:18 You lost me. How do I open it in wireshark?

  • @elieatia440
    @elieatia440 2 роки тому +2

    Thanks you for your great job. I try it and all it works fine!

    • @Vietquat114
      @Vietquat114 Рік тому

      it means we can decrypt any password even if it uses https protocol ?

  • @ProliantLife
    @ProliantLife Рік тому

    You're a God amongst men sir. Thank you

  • @shuvofahmid1705
    @shuvofahmid1705 2 роки тому +4

    Thanks Chris. Would you mind sharing the process of path variable for log file in Kali Linux and MAC OS ?

  • @bits4all770
    @bits4all770 Рік тому

    When I saw you change a hat I knew this lesson would be outstanding

  • @mattdonnelly3743
    @mattdonnelly3743 2 роки тому +1

    Don't tell me this isn't the same guy as Darknet Diaries. The voice is IDENTICAL.

  • @sammyrajoy
    @sammyrajoy 3 роки тому +5

    Thank you for this video Chris, I was following the WCNA study guide book but got stuck when I didnt see what's in the book(HTTP). I realised the time gap between the date of book publishing and the current version of wireshark. So switched my trail to 443 and TLS. This video helped me decrypt my session.

    • @ChrisGreer
      @ChrisGreer  3 роки тому +2

      Great Samuel! Glad to hear that it helped. I'll get some more TLS 1.3 stuff out there soon.

  • @MoonIsCheese
    @MoonIsCheese 3 роки тому +3

    Why did you not select the log file from the path you created in the system variable?

  • @jiillescas
    @jiillescas 3 роки тому +2

    Great video, please keep sharing more

    • @ChrisGreer
      @ChrisGreer  3 роки тому

      Thanks for the comment! Working on more content and I'll get it out there.

  • @grendal1974
    @grendal1974 3 роки тому +2

    Chris, as always you are the man.

    • @ChrisGreer
      @ChrisGreer  3 роки тому +1

      @Bill Proctor - Great to see you here Bill! Hope all is well on your end.

    • @grendal1974
      @grendal1974 3 роки тому

      @@ChrisGreer absolutely. Just looking forward to being able to travel again for work. Hope to hang out with you sometime soon!

    • @ChrisGreer
      @ChrisGreer  3 роки тому

      @@grendal1974 That would be awesome Bill! Let's chat sometime here soon.

  • @StankBrewing
    @StankBrewing 9 місяців тому

    Thank you, Chris, for such a great educational video)

  • @NathayT-vr8hm
    @NathayT-vr8hm Рік тому

    ❤❤It works 💯% dude I don't have a words u are really great!

  • @Letraveler_rd
    @Letraveler_rd 2 роки тому +1

    I'm loading the file to Wireshark, but some reason the decryption is not working. I'm using a windows machine.

  • @joshsalmon5782
    @joshsalmon5782 2 роки тому +2

    Im so confused. The file that you gave wireshark is completely different from the sslkeylog file that you made earlier. How did you create the file that you gave wireshark?

    • @ChrisGreer
      @ChrisGreer  2 роки тому

      Hey Josh - I probably had to recreate it and share a different one. However the pcap and syslog you get in the link go together and the rest of the video steps are the same.

  • @scottsparling2591
    @scottsparling2591 2 роки тому +2

    You explain so much more clearly and succinctly than my packet analysis instructor. This is great! Thank you.

  • @iterminator987
    @iterminator987 3 роки тому +2

    Hello, was wondering if the decryption could be done using a MITM, for instance the MITM proxy...Would be great to see that happen!!! Ty

    • @ChrisGreer
      @ChrisGreer  3 роки тому +1

      Hey, thanks for the comment. I'll see if I can get it working... (or breaking, depending on how you look at it!)

  • @shumpakshu
    @shumpakshu 2 роки тому +1

    This is some great stuff, keep going.

  • @yosuasitorus3478
    @yosuasitorus3478 3 роки тому +2

    Hai Chris, how about desktop App not browser, how do we generate that log file?

  • @lesdabney1193
    @lesdabney1193 3 роки тому +1

    What if you don't get the DNS packets like you did at 3:56?

    • @isomane7911
      @isomane7911 2 роки тому

      I believe that is because you have visited a website before so address obtained by quering the DNS is in your cache temporarily so you don't need to query DNS server again.

  • @ryankan1229
    @ryankan1229 Рік тому +1

    Hi Chris, so sorry, after I tried to save the SSL Key log file, I cannot find the file at all, for some reason. I am the administrator but I just cannot find it. Is there anything I must do? Thanks!

  • @pjm4334
    @pjm4334 2 роки тому

    3:13 do you have youtube lesson about this filtering that you mentioned here

  • @w451-qx3kx
    @w451-qx3kx 3 роки тому +3

    hi, do you know if there is a way to decrypt https when it isn't from the browser, meaning it doesn't get logged to a key file?

    • @ChrisGreer
      @ChrisGreer  3 роки тому

      Probably - I'd have to tinker with a specific app or implementation, but I imagine if you dig deep enough in the code there is a way to do it.

    • @adammason1587
      @adammason1587 2 роки тому

      @@ChrisGreer So from a hackers perspective in todays day and age, I imagine the flow is something like this:
      1. compromise endhost through zero day or unpatched vulnerability
      2.create a reverse tcp shell via proxy chaining on proxy's that dont log user data (or TOR)
      3.setup the log environmental variable in OS (congrats you have modified a system that's not yours and have now officially committed a crime, though I guess the reverse tcp shell could be argue as the stage when that happens)
      4. discretely capture network traffic, and discretely transfer data back (no idea how that's done)
      5. look for PII/PCI decrypted data
      6. Clear traces of you being there... also not really sure how they would do that. Probably clear a bunch of internal log files.
      I know this comment puts you in a precarious situation, because how do you teach content and answer questions without indirectly possibly helping a hacker, but as a company network engineer I still dont understand how hackers pull of what they do. Is it just a matter of hiding in plane sight and due to the sheer amount of data that goes across the wire, you are hoping nobody notices?

    • @chelvis1569
      @chelvis1569 2 роки тому

      @@adammason1587 Very interesting, to transfer the data back in thinking you could do a loopback but that could be traced.

  • @mastoemoji
    @mastoemoji Рік тому +2

    Nice video. Could you do an other video decrypting UDP traffic 🙏 it will help us a lot, thanks

  • @bravebacon4175
    @bravebacon4175 2 роки тому +1

    Wait so can I store the keys wherever or does it need to be that specific user address?

  • @gregwallace9481
    @gregwallace9481 2 роки тому +1

    Is there a way to do this for non-web browser traffic? For example, I am trying to decrypt commands and responses with racadm in powershell but the keys don't appear in the log.

    • @ChrisGreer
      @ChrisGreer  2 роки тому

      Hey Greg - I have only tried this with Chrome and Firefox. It would def take some more digging to learn where/how/if other API's store the keys.

  • @ImranKhan-tc8jz
    @ImranKhan-tc8jz 3 роки тому +1

    Thank you so much man. Excellent explanation.

  • @AbrahamBilly
    @AbrahamBilly 3 роки тому

    thankyou for sharing, but how we can get the tls key without touching the victim pc / laptop?

    • @ChrisGreer
      @ChrisGreer  3 роки тому

      You would need send all traffic through a man-in-the-middle device on the network, or you could install an agent on the server that will capture them. Either way, it's designed to be hard to get the keys...

    • @AbrahamBilly
      @AbrahamBilly 3 роки тому +1

      @@ChrisGreer isn’t that man in the middle attack / ARP Poisoning doens’t catch the key? please make a video how to get the keys via man in the middle attack sir.

  • @flinfaraday1821
    @flinfaraday1821 2 роки тому +1

    Is the SSLKEYLOGFILE env variable only used by chrome? Or system wide for anything using SSL?

    • @ChrisGreer
      @ChrisGreer  2 роки тому

      I have gotten it to work with Firefox and chrome. I have heard it works with edge but have not tried it for myself. All others, a ton to try… I guess it just depends on the api

  • @oliviermenager9702
    @oliviermenager9702 10 місяців тому

    Thanks for the video. Please could you explain why we see under Transport Layer security TLSv1.3 and the Version TLS 1.2 (0x0303) at 6:47?

  • @gavenchan
    @gavenchan Рік тому +9

    Interesting. Great video. I am puzzled by 2 files in this video. Are the "sslkeylog.log" and "DecryptTraffic_Wireshark.log" the same file?

    • @vladislavvasilev3441
      @vladislavvasilev3441 10 місяців тому +1

      I'm also wondering this - did you find this out?

    • @intnsity
      @intnsity 10 місяців тому

      Yes anyone?

    • @biggspoon68
      @biggspoon68 3 місяці тому

      i noticed that too, and now i am confused

  • @ldavader2704
    @ldavader2704 2 роки тому +1

    Hey Chris, what about other TLS traffic which is not made from any browser? Thanks

    • @ChrisGreer
      @ChrisGreer  2 роки тому +1

      I've only been able to get it to work with Chrome and Firefox, I haven't tried to store them from any one app.

  • @alexmannrocks
    @alexmannrocks 3 роки тому +2

    Great video and example, thanks for what you do

  • @KaySwiss21
    @KaySwiss21 3 роки тому +1

    I have a question... If I'm using a wifi adapter that's in monitor mode, and passively sniffing the other devices on my home network... Is there any methods for decrypting other clients on the same network? Other clients meaning , if I'm on my laptop and I want to see what's going on with my Android on the same network, what methods (if any) are there to decrypt the androids traffic?

    • @ChrisGreer
      @ChrisGreer  3 роки тому

      That is a great question. In theory, you could do a man in the middle attack and intercept their traffic. You can capture it is a passive listener on WiFi, but with the additional layer 1/2 encryption for WiFi (WPA2 for example) it adds another level of complexity. I have never done it.

    • @KaySwiss21
      @KaySwiss21 3 роки тому

      @@ChrisGreer Thanks for the reply! My mind was going into that direction but wasn't sure if there were other ways/methods. Looking forward to more content as well. Since I'm a newer viewer, I dont know the extent of your expertise. But would love to see some cyber security / forensic stuff as that's what I'm currently studying for an associates degree. I see alot of the attacking and vulnerability side, but would like to see more content on defensive and forensic analysis.

  • @txKonen
    @txKonen 11 місяців тому

    I'm sorry, but you referenced at 1:18 - SSLKEYLOGFILE to \users\chris but never referenced it again. At 5:38, you referenced a different file. Were they meant to be the same?

  • @techproductowner
    @techproductowner 2 роки тому +1

    Dear Sir wonderful , How do I decrypt Windows desktop application traffic using wireshark , the desktop app use TLS1.2 and Websocket for communication

    • @ChrisGreer
      @ChrisGreer  2 роки тому

      Hello DataSkull - we would need to see if the app will locally store the TLS keys. As you saw in the video, chrome will do it in an environment variable, but that may not be the case for the application you are trying to decrypt. You have to dig into it and see if the app will store them.

    • @JackSparrow-xm3im
      @JackSparrow-xm3im 2 роки тому

      Same issue here looks like better to go with a proxy server

  • @abhayn3923
    @abhayn3923 2 роки тому +1

    I followed all the steps as explained by you, but I'm still unable to log the ssl keys into my local directory. May I know why that maybe happening? The file is empty , that is, no keys are logged into it.

    • @ChrisGreer
      @ChrisGreer  2 роки тому

      Hmm... weird. That is frustrating. Ok maybe something changed with an update. I'd suggest trying Firefox. If that doesn't work - I've been able to get it working pretty reliably with Kali Linux and Chrome. I demonstrate that here -ua-cam.com/video/QRRHA_5hS2c/v-deo.html

  • @Leafspine
    @Leafspine 3 роки тому +4

    Мужик,лайк тебе ставлю,полезно очень 👍

  • @marlonrivas3413
    @marlonrivas3413 2 роки тому +1

    How do I enable Packet Reassembly and Uncompressed Entity Body?

  • @johnvardy9559
    @johnvardy9559 2 роки тому +1

    about session keys how i could fix that on mac os?

  • @gabrielagyei9112
    @gabrielagyei9112 3 місяці тому

    Thanks for great job and we really appreciate it

  • @gtag174
    @gtag174 2 роки тому +1

    Hey chris, Not sure what is wrong but my log file is empty no matter what i visit. Any idea why ?

    • @ChrisGreer
      @ChrisGreer  2 роки тому

      Arg - no I don't know why but, let's make sure you are using chrome, you restarted it, and made sure you cleared history/cache. Other than that - I would try installing firefox because I have gotten it to work with that browser too.

    • @gtag174
      @gtag174 2 роки тому

      @@ChrisGreer All done. Maybe Win 10 21H1 version does not support it.

  • @odogg6899
    @odogg6899 3 роки тому +1

    Am i supposed to take that log file i d/l and drop it in SSL Keys folder or will system automatically create one for me?

    • @ChrisGreer
      @ChrisGreer  3 роки тому

      You should have to create that folder but the system will create the log.

  • @v.harinath5971
    @v.harinath5971 3 роки тому +1

    Unable to see the keylog file generated in windows. Any additional steps to be followed

    • @ChrisGreer
      @ChrisGreer  3 роки тому

      Make sure that you restart chrome completely after setting up the environment variable. Also - if that doesn't work, give it a shot with Firefox.

  • @GOTHAM21
    @GOTHAM21 3 роки тому +1

    So you'd have to have access to a target host in order to set up the log file?

    • @ChrisGreer
      @ChrisGreer  3 роки тому

      To capture the session keys as you see in this video, yes. It's the simplest way to collect them. It can also possibly happen from the server side or from a device along the path that terminates the connection.

  • @m.adnankhan8245
    @m.adnankhan8245 2 роки тому +1

    Amazing Chris :)
    Thanks!

  • @alimohammed817
    @alimohammed817 3 роки тому +1

    sir, I have tls.pcap packet , how can i decrypt SIP/TLS v1.2 to see RTP ??
    Note that
    TLS encrypt by CA ?

  • @RdozeTV
    @RdozeTV 3 роки тому +1

    Where the f is the pre master secret log filename came from? that's not in the environmental variables you made right?

  • @OliverHext
    @OliverHext 3 місяці тому

    Great video. Clearly explained.

  • @dronomads
    @dronomads 3 роки тому +4

    Thanks, Chris I really appreciate you making videos. Taking the help of your videos I was able to help my colleagues and solve infrastructure problems. Keep making the good stuff as you explain the stuff in quite simple terms.

    • @ChrisGreer
      @ChrisGreer  3 роки тому +2

      Nice! That is great Prateek - glad to hear that the videos helped you. More to come!

  • @christiangrenier9434
    @christiangrenier9434 2 роки тому +1

    Hi Chris, I have a IOT device connected to AWS. I have all certicates... is it possible to decrypt the communication using wireshark? My IOT device is connected to an access point. Actually, I have a switch that I can route all the traffic to the PC but all packets are encrypted. So, I'd like to see the packet contents. Thanks a lot!

  • @collectionsforyou3209
    @collectionsforyou3209 7 місяців тому

    Thanks grish its really nice and helpful

  • @maxfightz4623
    @maxfightz4623 2 роки тому +2

    how would i apply this to a app

  • @__Bla__
    @__Bla__ 2 роки тому +1

    That’s really interesting!

  • @albaniaiptv8335
    @albaniaiptv8335 2 роки тому +1

    great video. can we decrypt request manually by extracting public certificate of website ?

  • @jamesa4958
    @jamesa4958 2 роки тому +1

    Awesome videos. Thank you

  • @tinmaung5828
    @tinmaung5828 3 роки тому +1

    Thank you so much sir for this wonderful video and it is helpful for us.

    • @ChrisGreer
      @ChrisGreer  3 роки тому

      Thanks for the comment Tin!

  • @ashutoshpadha8813
    @ashutoshpadha8813 3 роки тому +1

    sir can it also decrypt the traffic of insta ,tele, twitter like websites ?

    • @ChrisGreer
      @ChrisGreer  3 роки тому

      I haven't tried it with mobile apps yet. But if they store the keys to the keylog, then in theory... yes!

  • @OnlymeLLAMA
    @OnlymeLLAMA 2 роки тому

    I'm having trouble finding "Server Hello" I can find "Client Hello" but not Server. I tried to do the same thing as it shows in the video but I only got some random stuff that I don't know what it means, and sometimes I get nothing at all, even if I'm trying to start the same thing again, nothing shows up (When I do "frame contains 'whatever'" but when I don't do that it shows things that I don't understand). I need help idk what I'm doing. I tried on a website that I wanted to test but only found "Client Hello" or sometimes nothing, and I did the same for Wireshark website but only found "Client Hello" or nothing at all.

    • @ChrisGreer
      @ChrisGreer  2 роки тому

      Hmm... sounds like something to do with the way Wireshark is dissecting. Can you make sure you have the latest version installed? Also - if you like you can send me the pcap and I will take a peek. packetpioneer@gmail.com

  • @tjeaton2405
    @tjeaton2405 3 роки тому +1

    Hey love the video, how can this be done if I'm not using either chrome or firefox?

  • @TaraChand-ys8yd
    @TaraChand-ys8yd 2 роки тому +2

    can you please create a video for decrypting tls traffic in wireshark using private key file

  • @Majidiof
    @Majidiof 3 роки тому +1

    Thank you very much Chris 🙏🏻

  • @noooooo4199
    @noooooo4199 5 місяців тому

    Did you create a ssl key log file and add its path is environment variable or creating an environment variable created the file. Because I am not able to see the file. Please help.

  • @adrian3k
    @adrian3k 3 роки тому +1

    Was struggling to find decent video about wireshark and tls (im totally new to this - wireshark and packet analysis).
    Is listening to browser any different than listening to application?
    I want to pick the html/json/xml data sent from server to application with built-in-browser (Embed Browser Engine) to see the same stuff i see inside app (table/numbers) but I'm stuck at seeing headers with tls info (1.2) - rest is still 'encrypted' -- cant find any info why (probably some wireshark settings wrong/missing) :)
    Hope will get enough info from your tutorials to get thru this problem and see plaintext to work with :D

    • @adrian3k
      @adrian3k 3 роки тому

      ssl.app_data is encrypted.. TLS_AES_256_GCM_SHA384.. got stream as hex to file and out of options (at least for now) :P

    • @adrian3k
      @adrian3k 3 роки тому

      looks like I need to get into 'programming' to get some things from handshake and mix it to get 'decoding setup' - could you make something related (like video) or point to 'get going'? Thx Chris!

    • @adrian3k
      @adrian3k 3 роки тому

      hahaha it turned out I was using 'old wireshark' and could not see the decoded data' 8-)
      I see some data decoded and some not (probably because of packets not being in good order) --> going to stream gives mixed content
      Is there a 'simple' way of reordering the packets? There is Time shift (but it looks like i need to be very specific at time value)
      Can we 'switch packets by place' like move packet No. 250 to 249 (249 goes to 250)?

  • @abhishekkumar-zs1le
    @abhishekkumar-zs1le 4 місяці тому

    Hi Chirs
    Somehow I am unable to apply frame contains filter

  • @fifthamendment1
    @fifthamendment1 Рік тому

    I followed your instructions to the "T" and my log file is not getting populated with temporary keys. After saving setting up the Windows Environment and setting up the SSLKEYLOG, saving it, and opening up chrome and wire shark, the log file remains blank. Any suggestions why????

    • @ChrisGreer
      @ChrisGreer  Рік тому

      Curious what version of chrome/windows you are using.

    • @fifthamendment1
      @fifthamendment1 Рік тому

      Hey Chris,
      I so appreciate your videos!!!
      I restarted my computer and all is good!! Thank you!

  • @aplaceinthesky82
    @aplaceinthesky82 Рік тому +1

    Why I don't see any pre capture log like you have?

    • @aplaceinthesky82
      @aplaceinthesky82 Рік тому

      actually, I don't see any log file at all

    • @aplaceinthesky82
      @aplaceinthesky82 Рік тому +1

      sorry Chris if I write down "frame contains Wireshark" the filter doesn't accept the input

  • @StarLightDotPhotos
    @StarLightDotPhotos 4 місяці тому

    Thank you for this. It was kicking my ass.

  • @putrafams8944
    @putrafams8944 3 роки тому

    hi I'm from Indonesia ❤️

  • @MrJcc444
    @MrJcc444 2 місяці тому

    cool man ... but i'd like to see packets on my other wifi devices I see i can put my network card in monitor mode will this get the keys to decrypt??

  • @sherazhussain8247
    @sherazhussain8247 3 роки тому +2

    Thank you Chris!

  • @Rocky8zuz6t
    @Rocky8zuz6t 3 роки тому

    You got a new subscriber 🙃😉

    • @ChrisGreer
      @ChrisGreer  3 роки тому

      Awesome! Thanks for the sub and see you around the channel.

  • @dineshkrishna1690
    @dineshkrishna1690 3 роки тому +1

    Hi Chris,
    In the video, it was told that this is specific to chrome browser. Is it so? Because i did not see any setting which is made specific to store session keys for sessions in chrome browser

    • @ChrisGreer
      @ChrisGreer  3 роки тому

      I used the chrome browser to demonstrate this in the video, but it also works on Firefox Nightly and I have seen it work on Edge too.

  • @pjm4334
    @pjm4334 2 роки тому

    the frame contains is not available in v4.0.1 also the column Server Name is not showing the default profile of wireshark. please guide in this particular matter thank you.

    • @ChrisGreer
      @ChrisGreer  2 роки тому +1

      You need quotes now. frame contains “Facebook”

  • @10Totti
    @10Totti 2 роки тому

    Hi, I would like to read all the traffic of a game on windows, especially the get and post calls, what can I do?

    • @ChrisGreer
      @ChrisGreer  2 роки тому

      We would have to figure out within the game how and where the keys are stored… that is the difficult part - by design!

    • @10Totti
      @10Totti 2 роки тому

      @@ChrisGreer There is tutorial ?

  • @gabrielhawk6604
    @gabrielhawk6604 2 роки тому +1

    Chris, I'm having a strange issue where only about 70% of my TLS traffic is decrypted this way. It seems when using the ECDHE cipher, the packet can't get decrypted even with the master log file. But I'm told the master log file should be enough to decrypt this. Is this true?

    • @JackSparrow-xm3im
      @JackSparrow-xm3im 2 роки тому

      I am facing the same issue and currently looking to setup a proxy server like "Charles" but its quiet complicated....

  • @mmd.3859
    @mmd.3859 3 роки тому +1

    Please you build on video about how to using the wireshark in windows 10

  • @Animeatlas351466518427er
    @Animeatlas351466518427er 4 місяці тому

    Hey thanks for sharing this cool looking video curiosity question after you decrypt the traffic files and you go to open it in a browser and it says that the content isn't available or if the site was taken down or can the content still be viewed?

  • @simmi352
    @simmi352 Рік тому +1

    Hi Chris, thanks for this one really learnt a lot here. In saying that I've been seeing more of Application Layer Encryption lately, so in theory if you encrypt at the application level before hitting the pipe and encrypt using TLS, would you be able to get to the cleartext?

  • @faanross
    @faanross 4 місяці тому

    Hey Chris, the pcap link is broken - any chance you'd mind reuploading? Thanks

  • @sureshhkumar955
    @sureshhkumar955 2 роки тому +1

    How to get the bottom filters?

  • @roblapp165
    @roblapp165 28 днів тому

    I wasn't able to get it to work. When I create a filter with frame contains "wireshark", it only shows DNS protocol even though I have no other filters set. Also, the link in the description is dead

    • @ChrisGreer
      @ChrisGreer  20 днів тому

      Just fixed it - give this a shot. bit.ly/tlsdecrypt

  • @nicoladellino8124
    @nicoladellino8124 2 роки тому

    Very nice video, TNX.

  • @OmegaBlogss
    @OmegaBlogss 3 роки тому

    Hola, saludos desde Argentina 😃