MITM Labs/Decrypting HTTPS Traffic with Private Key File

Also see related pages:

• MITM Labs/Decrypting HTTPS Traffic by Compromising Browser SSL Keys
• SSLSniff

This is also a supremely evil attack.

This page covers an HTTPS attack that involves obtaining a private key captured from a browser to decrypt traffic captured from an encrypted session.

Whereas the MITM Labs/Decrypting HTTPS Traffic by Compromising Browser SSL Keys page focuses on using the SSLKEYLOGFILE variable to export SSL information, this page focuses on obtaining an actual .pem key file, used by the browser for HTTPS sessions.

Note both techniques require some degree of local access.

Overview

If you wish to sniff HTTPS traffic, you have two options:

• Obtain the SSL private key information from the browser via environment variables
• Obtain the SSL private key file directly from the browser

The MITM Labs/Decrypting HTTPS Traffic by Compromising Browser SSL Keys page covers option 1. This page covers option 2.

Sniffing SSL Traffic

See MITM Labs/Decrypting HTTPS Traffic by Compromising Browser SSL Keys#Sniffing SSL Traffic for the SSL sniffing setup and tips. Once we have the private key from the browser, we can either sniff remotely (e.g., by carrying out an ARP attack or a physical attack) or locally (on the sheep's machine).

Obtaining Pem Private Key File

Let's begin by obtaining the .pem private key from the browser: https://www.identrust.com/irs/fatca/export_certificate.html

Decrypting SSL Traffic

To actually use the private key to decrypt SSL traffic, we have two options:

1. Use Wireshark - this is the easiest, GUI utility, just point it to the .pem file and it's done.

2. Use SSLDump - command line utility for processing in a shell script/other