Aggregator

Decrypting TLS browser traffic with Wireshark

Embrace The Red
3 years ago

There is a combination of lesser known tools and techniques to capture and later decrypt SSL/TLS network traffic on Windows. This technique is neat because it does not require the installation of additional driver/software when capturing the traffic.

Technique, Tools and Steps

It is quite straight forward and consists of:

  1. Setting the SSLKEYLOGFILE environment variable to capture TLS session keys on target host
  2. Use netsh trace start to capture traffic (no need to install additional driver/software!)
  3. Convert the .etl file to a pcap using Microsoft’s etl2pcapng
  4. Start Wireshark, open the pcap and set the sslkeys under: Preferences->Protocols->TLS->Pre-Master secret. This does not have to be on the same host as steps 1-2.
  5. Enjoy the decrypted traffic!

If you can or want to capture traffic with Wireshark also, there is no need to use netsh of course.

Managed ad