View source for MITM Labs/Decrypting HTTPS Traffic with Private Key File

Also see related pages:
* [[MITM Labs/Decrypting HTTPS Traffic by Obtaining Browser SSL Session Info]]
* [[SSLSniff]]

This is also a supremely evil attack.

This page covers an HTTPS attack that involves obtaining a private key captured from a browser to decrypt traffic captured from an encrypted session.

Whereas the [[MITM Labs/Decrypting HTTPS Traffic by Obtaining Browser SSL Session Info]] page focuses on using the SSLKEYLOGFILE variable to export SSL information, this page focuses on obtaining an actual .pem key file, used by the browser for HTTPS sessions.

Note both techniques require some degree of local access.

=Overview=

If you wish to sniff HTTPS traffic, you have two options:
* Obtain the SSL private key information from the browser via environment variables
* Obtain the SSL private key file directly from the browser

The [[MITM Labs/Decrypting HTTPS Traffic by Obtaining Browser SSL Session Info]] page covers option 1. This page covers option 2.

==Sniffing SSL Traffic==

See [[MITM Labs/Decrypting HTTPS Traffic by Obtaining Browser SSL Session Info#Sniffing SSL Traffic]] for the SSL sniffing setup and tips. Once we have the private key from the browser, we can either sniff remotely (e.g., by carrying out an ARP attack or a physical attack) or locally (on the sheep's machine).

===Obtaining Pem Private Key File===

Let's begin by obtaining the .pem private key from the browser: https://www.identrust.com/irs/fatca/export_certificate.html

==Decrypting SSL Traffic==

To actually use the private key to decrypt SSL traffic, we have two options:

1. Use [[Wireshark]] - this is the easiest, GUI utility, just point it to the .pem file and it's done.

2. Use [[SSLDump]] - command line utility for processing in a shell script/other






=Flags=

{{WiresharkFlag}}

{{MITMSSLFlag}}

{{MITMLabsFlag}}

{{MITMFlag}}

[[Category:Tcpdump]]
[[Category:Dsniff]]
[[Category:HTTPS]]
[[Category:HTTP]]