{"id":600,"date":"2021-06-21T21:00:22","date_gmt":"2021-06-21T20:00:22","guid":{"rendered":"https:\/\/www.labtinker.net\/?p=600"},"modified":"2021-06-21T21:00:22","modified_gmt":"2021-06-21T20:00:22","slug":"i-can-see-clearly-now","status":"publish","type":"post","link":"http:\/\/18.135.13.153\/?p=600","title":{"rendered":"I Can See Clearly Now…"},"content":{"rendered":"\n

Wireshark is a powerful tool which captures no end of network protocols but 90% of the time you\u2019re probably working with TCP and 90% of that TCP is probably http and 90% of that is probably encased in TLS encryption making it https. The problem here is that sometimes you need to see what’s inside those packets. The good news is you can using the method described here: <\/p>\n\n\n\n

https:\/\/support.f5.com\/csp\/article\/K50557518<\/a><\/p>\n\n\n\n

Now, I’d variously heard this only worked with certain browsers and not at all with APIs and non-browser traffic so I decided to test it for myself. <\/p>\n\n\n\n

To this end I am using a simple website I stood up in my lab on http:\/\/test.labtinker.net and also https:\/\/test.labtinker.net showing a picture of two Scandinoir enthusiasts before their trip to Copenhagnen: <\/p>\n\n\n\n

\"\"
There is a further element to be aware of which is the fact the decryption won’t work with key exchange protocols which give perfect secrecy, namely Diffie Helman. That is why in the latter section where the private key is imported into Wireshark – the option only mentions RSA keys. If you’re using Ephemeral Diffie Helman key exchange then you won’t be able to decrypt. You can tell what key exchange protocol you’re using by seeing what record is chosen in the TLS Server Hello, so RSA is good (for decryption purposes):<\/figcaption><\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Whereas Diffie Helman Ephermal (DHE) isn’t:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

…but really for security reasons you want DHE over RSA as perfect secrecy is very desirable because er… people can’t decrypt historic captures – like we’re trying to do here.<\/p>\n\n\n\n

I neglected to check what cipher suite the various browsers in this lab had negotiated which would have been pertinent and useful to the post but this paragraph was added with the benefit of hindsight. Now on with the lab…<\/p>\n\n\n\n

When we browse to above website using http, because nothing is encrypted we are able to see this image file from the packets we\u2019ve caught in Wireshark using File\/Export Objects\/HTTP<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

The image file is called ‘boys.png’ and is visible for download:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

So to test the decryption method descripted in the link above I’ll browse to the https version of the website and capture the output in Wireshark and see if the image is available. (Doing this without decryption there are no http objects that can be exported because they are all encrypted)<\/p>\n\n\n\n

Essentially, the method in the link above involves defining a system variable which will capture pre-master secrets in a file and then pointing Wireshark at this.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

When this is working you should see the file being filled up with Pre-Secrets<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

On Windows 10, this was one of those rare occasions when everything worked as expected and I could both see and export the image file from the Wireshark trace when browsing over https uisng Chrome, Mozilla and Edge (after making sure all caches were empty and the trace was restarted.). So far, so good… so what about a non-browser connection….<\/p>\n\n\n\n

I used the Powershell Invoke-WebRequest command below:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

I tried a ‘http’ request as a baseline and was able to see the ‘png’ file. However, when I tried with ‘https’ I was unable to see it which supports the theory that this method can only be used with browsers.<\/p>\n\n\n\n

There is another method available: if you have the webserver’s private certificate (which I did) you can input it within Wireshark’s Protocol Preferences under ‘RSA keys list’<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

…you can add the RSA file. I specified the ip address the website was on, the port (443) and the protocol (http). <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

I tried this with a both a pfx and a pem file to no effect. There are apparently some limitations on this method, (TLS1.3 doesn’t work I seem to remember reading nor do certain ciphers) but I couldn’t find a great deal of information on this.<\/p>\n\n\n\n

Linux<\/strong><\/p>\n\n\n\n

On Linux (Mint 21), I used Chrome and Firefox.<\/p>\n\n\n\n

I firstly confirmed I could download the image file when using http.<\/p>\n\n\n\n

As described in the method above I exported the SSLKEYLOGFILE whose location I pointed Wireshark at within TLS protocols and opened the browser from the same terminal window:<\/p>\n\n\n\n

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

I also started Wireshark from this same terminal window… <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

this seemed to be necessary…. forgive the lack of clarity but with Linux I struggled to pin down consistent behaviour. Certainly, when I did the above with Chrome I saw the following in the http display within Wireshark…<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

So decryption was happening but within http objects I did not see the image file…<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

However, the text file confirmed decryption was happening (to some extent) as it contained the text below the picture…<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

…and to be honest you’re probably going to be more interested in text than pictures.<\/p>\n\n\n\n

Firefox was less predictable and I although I was sure I had previoulsy had some success with https decryption I couldn’t reproduce it using the method described above when I re-tried<\/p>\n\n\n\n

To try a non browser access method I used curl:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

and the above method didn’t work for this nor did the the ‘private key’ method which had failed on Windows.<\/p>\n","protected":false},"excerpt":{"rendered":"

Wireshark is a powerful tool which captures no end of network protocols but 90% of the time you\u2019re probably working with TCP and 90% of that TCP is probably http and 90% of that is probably encased in TLS encryption making it https. The problem here is that sometimes you need to see what’s inside […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,9],"tags":[],"class_list":["post-600","post","type-post","status-publish","format-standard","hentry","category-encryption","category-networking"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"http:\/\/18.135.13.153\/index.php?rest_route=\/wp\/v2\/posts\/600","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/18.135.13.153\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/18.135.13.153\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/18.135.13.153\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/18.135.13.153\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=600"}],"version-history":[{"count":0,"href":"http:\/\/18.135.13.153\/index.php?rest_route=\/wp\/v2\/posts\/600\/revisions"}],"wp:attachment":[{"href":"http:\/\/18.135.13.153\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=600"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/18.135.13.153\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=600"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/18.135.13.153\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=600"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}