Also see related pages:

This is also a supremely evil attack.

This page covers an HTTPS attack that involves obtaining a private key captured from a browser to decrypt traffic captured from an encrypted session.

Whereas the MITM Labs/Decrypting HTTPS Traffic by Obtaining Browser SSL Session Info page focuses on using the SSLKEYLOGFILE variable to export SSL information, this page focuses on obtaining an actual .pem key file, used by the browser for HTTPS sessions.

Note both techniques require some degree of local access.

Overview

If you wish to sniff HTTPS traffic, you have two options:

Obtain the SSL private key information from the browser via environment variables
Obtain the SSL private key file directly from the browser

Sniffing SSL Traffic

See MITM Labs/Decrypting HTTPS Traffic by Obtaining Browser SSL Session Info#Sniffing SSL Traffic for the SSL sniffing setup and tips. Once we have the private key from the browser, we can either sniff remotely (e.g., by carrying out an ARP attack or a physical attack) or locally (on the sheep's machine).

Let's begin by obtaining the .pem private key from the browser: https://www.identrust.com/irs/fatca/export_certificate.html

To actually use the private key to decrypt SSL traffic, we have two options:

1. Use Wireshark - this is the easiest, GUI utility, just point it to the .pem file and it's done.

2. Use SSLDump - command line utility for processing in a shell script/other