TLS Inspection & SSL Session Decryption

Why Is TLS Traffic Encrypted?

TLS (Transport Layer Security) encrypts application payload data (HTTPS, SMTPS, IMAPS) so that raw packet captures in Wireshark appear as unreadable binary streams (Application Data).

To analyze HTTP headers, GET/POST requests, or hidden flags inside an encrypted PCAP, you must supply decryption keys to Wireshark.

---

1. Decrypting TLS with SSLKEYLOGFILE (Pre-Master Secret Log)

Modern TLS 1.3 (and TLS 1.2 with Ephemeral Diffie-Hellman ECDHE) uses Forward Secrecy, meaning static RSA private keys cannot decrypt session traffic.

Instead, browsers and web clients log per-session symmetric keys to an SSLKEYLOGFILE.

Configuring Wireshark

1. Open Wireshark $\rightarrow$ Edit $\rightarrow$ Preferences $\rightarrow$ Protocols $\rightarrow$ TLS.
2. Set (Pre)-Master-Secret log filename to point to your keylog.txt file.
3. Wireshark instantly decrypts all TLS streams! Filter by http or http.request.

# Example Keylog File Format
CLIENT_RANDOM 4b92c... 8e3f1...
CLIENT_HANDSHAKE_TRAFFIC_SECRET 4b92c... 1a9f0...
SERVER_HANDSHAKE_TRAFFIC_SECRET 4b92c... 7b2c1...

---

2. Decrypting Legacy TLS (RSA Key Exchange)

In legacy TLS 1.2 setups where static RSA key exchange was used (TLS_RSA_WITH_AES_128_CBC_SHA):

1. Open Wireshark $\rightarrow$ Edit $\rightarrow$ Preferences $\rightarrow$ Protocols $\rightarrow$ TLS.
2. Click RSA keys list $\rightarrow$ Edit.
3. Add an entry:
   • IP Address: 192.168.1.10 (or any)
   • Port: 443 (or any)
   • Protocol: http
   • Key File: Browse to server_private_key.pem
4. Click OK.

---

3. TShark Command-Line TLS Decryption

# Decrypt HTTPS PCAP using SSLKEYLOGFILE and dump HTTP GET/POST URLs
tshark -r encrypted.pcap -o "tls.keylog_file:keylog.txt" -Y "http.request" -T fields -e http.host -e http.request.uri

# Export decrypted TLS objects (e.g., downloaded images, HTML files, binaries)
tshark -r encrypted.pcap -o "tls.keylog_file:keylog.txt" --export-objects "http,output_directory/"