PDA

View Full Version : [all variants] [URGENT] decryping HTTPS conversation with Wireshark



nlbs
April 10th, 2009, 05:18 PM
Is it Possible to view the HTTPS Conversation with Wireshark
If Yes How ?

Thanks

superprash2003
April 10th, 2009, 05:19 PM
not possible.. and illegal..

nlbs
April 10th, 2009, 05:22 PM
So there is know way to know What Conversation is going on in my machine if its HTTPS

elox
April 10th, 2009, 05:22 PM
You can see the conversation - it is a standard TCP/IP proto. You can also see most of the "meta data" like IP or MAC.
But it is not possible afaik to see the content of the crypted HTTPS packets in wireshark.

nlbs
April 10th, 2009, 05:27 PM
http://blogs.sun.com/beuchelt/entry/decrypting_ssl_traffic_with_wireshark It says Wireshark can decrypt the conversation if I've the Server's Private Key.

But Its not possible to get Private key of a server Untill and Unless its owned by me.

Thanks

Xbehave
April 10th, 2009, 05:58 PM
only way to read https other than at the endpoints is to pull of a man in the middle attack, but the user will be notified of the changed certificate (and hopefully the big warning in firefox will put them off). I think most mitm attacks are done using ettercap and arp poisoning.