Decrypting SSL/TLS browser traffic with Wireshark (using netsh trace start)

[@mortenwormdue3593]

Only works, if the traffic comes from the browser - in your example, chrome provides the session keys.
So, no - not really workable on a server.

[@bratecyo]

wireshark's team need to integrate converter etLtoPcapng in their product

[@itamarcohen331]

What is that key file? how do i create it and use it?
I created it from scratch but after doing the commands it has 0 length

[@embracethered]

It will be created automatically if the environment variable has been set, not all browsers might support it. Also see embracethered.com/blog/posts/2023/decrypt-wireshark-traffic-https-netsh/

[@shibbyshaggy]

Didn't work on Windows 10 running Chrome. Followed all your steps, it created the files just fine, i converted to pcap and when trying to decrypt in wireshark using the keys file it didn't work. anything special between your windows version and/or Chrome?

[@embracethered]

Thanks for the comment, and checking out my video. A possible reason might be that most browsers only pickup the environment variable on first start, so make sure to terminate all instances (e.g something like taskkill /im chrome.exe /f). More details here: embracethered.com/blog/posts/2023/decrypt-wireshark-traffic-https-netsh/

[@Sway55]

how to do it for traffic outside of browser? say I have a desktop app

[@DSEC_UK]

Appreciate the videos dude

[@embracethered]

Thanks for the comment! Really appreciate the note - knowing some find it useful def keeps the motivation high on creating more.

[@geeksified]

won't decrypt credentials to plain text, correct?

[@embracethered]

It decrypts the TLS browser traffic.

[@codingmuscle4505]

thankyou

[@embracethered]

You're welcome! Hope it was useful!

[@RandomAccess2]

[Environment]::SetEnvironmentVariable("SSLKEYLOGFILE", "c:\temp\sslkeys\keys", "MACHINE")
netsh trace start capture=yes tracefile=c:\temp\sslkeys\trace.etl report=disabled
netsh trace stop