如何利用Wireshark解密SSL和TLS流量
如何利用Wireshark解密SSL和TLS流量
https://support.citrix.com/article/CTX135121
1.有server端的private key，直接在wireshark上使用
Edit > Preferences->Protocols->RSA keys list
这个protocol必须是小写http,用了大写的会报错。。。
key file必须-----BEGIN RSA PRIVATE KEY-----，如果是-----BEGIN ENCRYPTED PRIVATE KEY-----要转换下,password不填，填了会报错
pfx => pem
Private key
openssl pkcs12 -in yourP12File.pfx -nocerts -out privateKey.pem
-----BEGIN ENCRYPTED PRIVATE KEY-----
...
-----END ENCRYPTED PRIVATE KEY-----
Certificates:
openssl pkcs12 -in yourP12File.pfx -clcerts -nokeys -out publicCert.pem
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
Convert from -----BEGIN ENCRYPTED PRIVATE KEY----- to -----BEGIN RSA PRIVATE KEY-----
rsa -in d:\temp\privateKey.pem -out d:\temp\privateKey.pem
PEM => DER
openssl x509 -in cert.crt -outform der -out cert.der
DER => PEM
openssl x509 -in cert.crt -inform der -outform pem -out cert.pem
2.没有server端的private key，利用fiddler跳转，wireshark上使用fiddler中转的private key
利用Fiddler和Wireshark解密SSL加密流量
http://www.cnblogs.com/AloneSword/p/4567380.html
http://kelvinh.github.io/blog/2014/01/12/decrypt-ssl-using-fiddler-and-wireshark/
SoapUI with Fiddler
http://stackoverflow.com/questions/3744602/soapui-with-fiddler
因为wireshark不支持对loopback监听，所以在一台机器上安装fiddler和wireshark，另一台机器作为客户端安装soapui
Fiddler: Tools->Options->Connections : Allow Remote computers to connect
Tools->Options->HTTPS->Export Root Certificate to Desktop
SoapUI: File->Preferences->Proxy Settings IPaddress:8888
cd C:\Program Files (x86)\SmartBear\SoapUI-4.6.2\jre
keytool -importcert -file c:\temp\FiddlerRoot.cer -keystore "C:\Program Files (x86)\SmartBear\SoapUI-4.6.2\jre\lib\security\cacerts" -alias testkey
After SoapUI server call https requests with Fiddler , we can find the certification in the IE
Tools->Internet Options->Content->Certificates->Export IPaddress certificatin : export the private key
Wireshark: Edit > Preferences->Protocols->RSA keys list
IPaddress 8888 http c:/temp/Ipaddress.pem
wireshark filter:
ssl.record.version == 0x0301
SSL 3.0 3,0 0x0300 TLS 1.0 3,1 0x0301 TLS 1.1 3,2 0x0302 TLS 1.2 3,3 0x0303
(tcp.port == 1234) or (tcp.port == 5678)
最新文章
- iis配置js支持读取json文件配置
- Boost学习笔记（六） progress_display注意事项
- 让sql语句不排序,按照in语句的顺序返回结果
- Leetcode: Largest BST Subtree
- [转].net 使用NPOI或MyXls把DataTable导出到Excel
- #define | enum(enumerator)
- Java API —— Map接口
- win10 64bit 安装scrapy-1.1
- RecyclerView.Adapter
- C++中发声函数Beep详解
- 审计篇丨PHPcms9.6.3后台XSS审计
- JAVA中局部变量 和 成员变量有哪些区别
- Django中的缓存基础知识
- xcrun: error: invalid active developer path (/Library/Developer/CommandLineTools), missing xcrun
- history.back();谷歌浏览器，iframe后退问题
- cordova 5.4版本 适配全面屏 底部黑边问题
- js实现瀑布流以及加载效果
- 【小程序】text-indent设置
- ElasticSearch 数据增删改实现
- 创建WRAPPER时， SQL20076N 未对指定的操作启用数据库的实例。