Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Wireshark Tutorial: Decrypting HTTPS Traffic

Summary: A Unit 42 Palo Alto Networks tutorial describes how to decrypt HTTPS traffic in Wireshark 3.x using a text-based key log file created via a Man in the Middle technique when the pcap was originally recorded. The walkthrough uses a pcap from a Dridex malware infection on a Windows 10 host, where decryption reveals a GET request to foodsgoodforliver[.]com that returned a Dridex DLL and POST requests to 105711[.]com that are command and control traffic.

Key Takeaway: The tutorial states plainly that without a key log file created at capture time, HTTPS traffic in that pcap cannot be decrypted in Wireshark - so the visibility a security leader assumes exists during an investigation depends entirely on whether that key material was collected when the traffic was recorded.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related