Menu
I'm testing an iOS application and I just want to see when HTTPS traffic is sent. I'm not interested in the contents of the traffic. How can I configure Wireshark to do this?
This is just to verify that an analytics package is working. I don't have any control over the servers that my app is talking to.
Thanks!
Edit #1: My current Wireshark configuration can see traffic to http://www.duckduckgo.com but not https://www.duckduckgo.com
346
Conclusion. This tutorial reviewed how to decrypt HTTPS traffic in a pcap with Wireshark using a key log text file. Without a key log file created when the pcap was originally recorded, you cannot decrypt HTTPS traffic from that pcap in Wireshark.
If you are talking about an external attacker which does only have access to the encrypted data packets (e.g. the internet access provider) the answer is NO. You can always redirect HTTPS traffic through a decrypting proxy which records all request and response data.
You can define policies to decrypt HTTPS traffic from selected Web categories. While decrypted, data is treated the same way as HTTP traffic to which URL filtering and scanning rules can be applied. In addition, decrypted data is completely secure since it is still in the IWSVA server's memory.
Wireshark supports TLS decryption when appropriate secrets are provided. The two available methods are: Key log file using per-session secrets (#Usingthe (Pre)-Master Secret). Decryption using an RSA private key.
An alternative is using your Mac as a Wi-Fi access point and sniffing the traffic with TCPDump. Here are the steps:
Create Network. Give it a random name, select security, and set a password.System Preferences > Sharing set To computers using: Wi-Fi. In Wi-Fi Options... choose the network you created before. In Share your connection from:, choose the interface you are getting Internet from, usually Ethernet. Internet Sharing, and connect to this new Wi-Fi network from your iPhone. Settings > General > Network and check your Internet with Safari. Sometimes it takes a few seconds.sudo tcpdump -s 0 -A -i en1 port 443 > log.txt. Use ifconfig if you have a network interface other than en1. The log generated can also be imported by WireShark (which is a GUI version of tcpdump).TCPDump is included with all versions of OS X. For other options, see Technical Q&A QA1176 Getting a Packet Trace.
87
If you want to decrypt the SSL traffic in order to listen in on it, have a look at the Wireshark Wiki. The explanation is a bit longer, but enables you to decrypt SSL traffic.
You also might want to listen on port 443 instead of 80.. :-)
36
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
