Since it is your own connection, there is no reason why you can't pass the website through a proxy server. However, there are more trivial methods to inspect your own HTTPS traffic. As said, there are ways to utilise this in FireFox and Chrome, although it is dependant upon the client software, and I'm not sure about Flash. The master_secret is the symmetric key that's actually used to encrypt your session. In principle, because you are the client, you are privy to the pre_master_secret which is what you need to derive the master_secret. In that case you would have to know the specific private key used for your single session. SSL/TLS is reliant upon the private certificate staying private.įurthermore, even if you had the server's private key, you might not be able to decrypt traffic from an earlier session if Perfect Forward Secrecy was used. You can't, unless you have administrative control over the 3rd party web server, or retrieve the certificate via some other nefarious means. How would I generate the key file required? Is it possible for me to decrypt HTTPS packets that are sent to 3rd party websites? However, it doesn't explain how the private key file should be obtained or generated, so I went and looked around and found this blog entry: Īfter finding the appropriate packets as shown in the images, I exported the certificate, but unlike the challenge they were doing, the connection established for me uses RSA-2048 and does not provide the factorization (I'm assuming real certificates do not provide that, only the ones for games and such). I found out that Wireshark supports SSL decryption: However, the connection is secured and therefore I can't see the data in wireshark just like that. I would like to write a client to make the requests myself, but in order to do so I would need to first see the request payloads. I am working with a website that sends API requests.
0 kommentar(er)
