Observe the traffic captured in the top Wireshark packet list pane.These activities will show you how to use Wireshark to capture and analyze Hypertext Transfer Protocol Secure (HTTPS) traffic.Īctivity 1 - Capture HTTPS Traffic Īctivity 2 - Select Destination Traffic Wireshark is a free and open source packet analyzer used for network troubleshooting and analysis. 11 Activity 9 - Analyze HTTPS Encrypted Data Exchange.10 Activity 8 - Analyze SSL/TLS New Session Ticket Traffic.9 Activity 7 - Analyze SSL/TLS Client Key Exchange Traffic.8 Activity 6 - Analyze SSL/TLS Certificate Traffic.7 Activity 5 - Analyze SSL/TLS Server Hello Traffic.6 Activity 4 - Analyze SSL/TLS Client Hello Traffic.5 Activity 3 - Analyze TCP Connection Traffic.4 Activity 2 - Select Destination Traffic.Is it possible to perform the same sslkeylogfile method? I've read that it only works on Chromium and Firefox based browsers, so Safari probably wouldn't work no? Unless Safari is Chromium based which I have no idea about. However the data would be encrypted due to TLS / HTTPS. I learned that you can use what's called ARP poisoning / spoofing to intercept the data between the router and the device. That being super cool, I started wondering if this could be taken a step futher? Doing the same thing but on other devices on the same network.įor instance, if I were to perform a MITM attack on my own network, between my mobile phone and my router, where my laptop would be the MITM. I also tried decrypting data using Wireshark on my home network using the sslkeylogfile method which I found super fascinating, I managed to see a lot of data that had been encrypted using TLS / HTTPS, but this time around it was decrypted.

So I was recommended a video on YouTube where they showcased ARP poisoning and Wireshark, which made me very interested so I played around with it for a little bit.

Wireshark intercept https