There is a risk of infection if using a Windows computer. Warning: The pcap used for this tutorial contains Windows-based malware. Here is a Github repository with a ZIP archive containing the pcap and a key log file used for this tutorial. Note: Our instructions assume you have customized your Wireshark column display as previously described in “ Customizing Wireshark – Changing Your Column Display.”. Today, we will examine HTTPS activity from a Dridex malware infection. With this key log file, we can decrypt HTTPS activity in a pcap and review its contents.

Decryption is possible with a text-based log containing encryption key data captured when the pcap was originally recorded. This Wireshark tutorial describes how to decrypt HTTPS traffic from a pcap in Wireshark. When reviewing pcaps from malware activity, it’s very helpful to know what’s contained within post-infection traffic. But like most websites, various types of malware also use HTTPS. Why? Because most websites use the Hypertext Transfer Protocol Secure (HTTPS) protocol. When reviewing suspicious network activity, we often run across encrypted traffic. The instructions assume you are familiar with Wireshark, and it focuses on Wireshark version 3.x.

Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended.This tutorial is designed for security professionals who investigate suspicious network activity and review packet captures (pcaps) of the traffic.

Interested in sponsoring my videos? Reach out to my team here: decryption Practical TLS – Crypto & SSL/TLS foundation: More detail on Ed’s YouTube channel and website //Īsymmetric Encryption explained from a Practical Perspective: Use coupon code: “BombalTLS” to get for $49Ġ2:11 ▶️ How SSL/TLS is shown in a browserĠ6:27 ▶️ Potential Problems with Hashing/man in-the-middle attackĢ2:50 ▶️ SSL/TLS Handshake, Client Hello and Server HelloĢ8:35 ▶️ Client Hello and Server Hello in Wiresharkģ5:35 ▶️ Server Hello, Certificate, Server Hello Done in Wiresharkĥ0:26 ▶️ Client Key Exchange in Wiresharkĥ1:39 ▶️ Client Change Cipher Spec and Finished/Encrypted Verificationĥ4:08 ▶️ Server Change Cipher Spec and Finished/Encryptedĥ7:44 ▶️ Decrypting a PreMaster Key with a Private Key in Wiresharkġ:03:15 ▶️ Where to get in contact with Ed to learn more Warning! This is a technical deep dive and covers a lot of detail including SSL decryption and discusses RSA, Public and Private Keys, symmetric key exchange and lots more. Warning! We go deep in this video to explain how the TLS handshake is completed.

Wireshark use certificate to decrypt