Hello, guys, and welcome to another video on this chapter
in this video, we are going to learn how to decrypt a SSL and TLS traffic using
Wireshark before we go ahead and demonstrate this.
So let's go through some history regarding TLS protocol.
So the primary goal of the tosspot layer security protocol is to provide privacy
and data integrity between two communicating applications.
And this is being ensured by encrypting the data so that no one as a
third party will be able to intercept the communication.
It Authentication appears to verify their identity by providing a secure channel of
communication between allows TLS protocol protects the integrity of the
message and ensures it has not been tampered.
TLS are used interchangeably.
TLS evolved from a SSL protocol that is no
longer question secure vulnerabilities such as the poodle Attack
has demonstrated this TLS has gone through iterations
TLS one point one TLS one point two with the latest update TLS one point
three. So TLS lies in between the application and the transport layer.
It is designed to work on top of a
reliable transport protocol such as TCP, and is divided into mainly two suppliers.
So the TCP protocol layer.
You can see here, this is the lower layer, which lies on top
of the TCP layer, and it's usually responsible for
encrypt decrypt in the Hash data, compressing, decompressing the outgoing
or incoming data, fragmenting the message to be transmitted into multiple blocks.
It is responsible also for applying the
message Authentication code Hash to maintain the data integrity.
And also it is transmitting the data from the upper application layer to the low.
To the lower transport layer and vice versa.
To the the higher so the higher layer.
You can see here
these consist of the following protocol as the graph indicates alert.
This is a sub
protocol that defines the alert levels and provides a description of the
alerts. It is used to notify the peer of any error condition that has occurred.
So the changecypherspec.
It defines changes in the cypher
strategies, the changecypherspec methods transmitted by both the client and the
Server defined to the renegotiated cypher spec and keys that would be used for all
the messages exchanged henceforth the application data.
This protocol ensures that messages are
fragmented, compressed, encrypted and transmitted in a very secure manner.
Handshake the to communicate over a secure channel to peers must agree on the
cryptography, keys and encryption algorithms for that session.
TLS protocol describes the steps to
authenticate the peers set up a secure connection with defined parameters.
The entire sequence, which involves setting up the station identifier TLS
protocol, virtual negotiating, the cipher shoot
certificate authentication of the peers and cryptography.
Key change between peers is called a TLS handshake.
One way of decrypting SSL TLS sessions is
to use the private key from the server that's being connected to by the client
using master secret key must have secret key to the group necessarily.
Where is the recommended method.
A ping master security is generated by the client and used by the
Server to derive a master key that encrypts decision traffic.
It's the current standard in cryptography,
and it's usually implemented via defeat Hellman.
You are not always going to have access to
the servers private key in this case, there is another option for
easily viewing Browser, SSL, TLS traffic from your local system.
So Firefox or Chrome allowed to choose in a specific environment Firewall.
Then the individual SSL TLS symmetric
easily log to file that got that Wireshark can read.
With a case Wireshark can show you the
session fully decrypted, so let us go and configure first the
environment variables and we are going to take these firstly in the Windows machine.
So once you go to your Windows machine,
you have to go to this PC, right click properties.
And then you may want to go to advanced
system settings, environment variables, and here in this
section, you have to configure the environment variables.
So in this, as you can see, I've already set it up.
So the way to do that is by pressing New,
you set the variable name by writing a SSL.
Keylogger.
File in the variable value,
you can browse the directory that you have created, the SSLKeylogfile.
So before you browse that file, you can just go ahead to a folder or Directory of
your choice and create a file called SSL Keylogger file dot log.
Then you can come back here to variable value section
and you can just go ahead and browse the file, as you can see, it provided me
straight away to the path because I've already set it up.
You just select it.
You can put any kind of name if you want to.
The log on the it has to be that name.
You select it open and now you're ready to press ok and configure this environment,
but now you're ready to configure this environment variable for Windows system.
So let's see now how you can configure the environment variable in Linux.
And Mark, so you can just go ahead and sudo the command or just sign in with
route and just type export space,
the same name as SSL Keylogfile.
Equals and then you.
Can type the path to SSL, Keylog file that you have previously created.
Hit enter and then you can.
Go ahead and continue with the rest.
So now that we have configured the
environment, variable, we need to configure Wireshark as well.
So from the before you start capturing anything from
the drop down menu, you have to go and select edit preferences.
Then you have to go to protocols and then you can scroll all the way down until you
reach the SSL section
and you are going to find a SSL.
And then you are going to
then you are going to have to go to pre master secret log file.
So here you have to browse to the log file that you placed in
your environment variable like we described before.
And then we are ready to start capturing on our local system so you can hit browse
and then you can navigate to the location path that you have created this
SSL Keylog file and just select it and open.
So remember hit, okay.
And now you are ready.
So before we start browsing and HTTPs a site with our Browser,
we have to start capturing, you will see that after you have browsed
one or many HTTPs sites, the log file that you created will start to increase in size
because it logs the symmetric session keys.
So before we go to the Browser lets just hit,
start capturing, select the network interface first
that you would like to capture the traffic from and start capturing the packets.
So in our Browser now let us go ahead and navigate ourselves.
So let's go ahead and use the Browser and
navigate ourselves to one or more HTTP Website.
So we can navigate to our website just to create more traffic.
Once we are done with that or we would like to visit some other HTTPS.
Website, we can just go ahead and do so.
And once we are finished, we can just go to back to Wireshark again and start.
And stop the capture.
So now that we stop the capture,
we may want to go and apply a display filter since we want to decrypt the.
SSL traffic, so let's go ahead and type TCP hit enter so we can see all the.
So we can see all the TCP traffic.
So when you look at the packets.
You need to check for Server key exchange
packet apparently Wireshark cannot decrypt deficient encrypted data.
So the reason that we use the display filter is that Wireshark captures traffic
from all sorts of programs and Software that we have in our system.
So we like to focus on our session with the Browser.
So as you have gone through every line and found the Server client communication.
You will see that.
In the client key exchange, you will see the decrypted SSL.
Tab, which.
You can hit and you can see everything decrypted in Plaintext.
So the change cipher spec
decrypted SSL, so you can see
that everything is a plaintext.
Again, here in this encrypted station, you hear decrypted the SSL top down under.
And you can see that everything is.
Pretty much in a Plaintext format.
And you have all the information that you will need.
Another way to view the session is to use
the analyze, drop down and follow the stream so you can just go and select the
desired line that you would like to follow, analyze.
Follow SSL stream.
One thing that I would like to also
mention is that you should use caution when liking these keys and pcaps someone
with access to the Keylog file and your pcap might very well find your Password
and Authentication quickies within the pcap.
So that was it for today.
And now you can go ahead and click on the next video named Converting PCAP XML.