Decrypting TLS browser traffic with Wireshark
Brief
There is a combination of lesser known tools and techniques to capture and later decrypt SSL/TLS network traffic on Windows. This technique is neat because it does not require the installation of additional driver/software when capturing the traffic.
Technique, Tools and Steps
It is quite straight forward and consists of:
- Setting the SSLKEYLOGFILE environment variable to capture TLS session keys on target host
- Use netsh trace start to capture traffic (no need to install additional driver/software!)
- Convert the .etl file to a pcap using Microsoft’s etl2pcapng
- Start Wireshark , open the pcap and set the sslkeys under: Preferences-Protocols-TLS-Pre-Master secret .
This does not have to be on the same host as steps 1-2.
- Enjoy the decrypted traffic!
If you can or want to capture traffic with Wireshark also, there is no need to use netsh of course.