SlideShare uma empresa Scribd logo
1 de 59
Sniffing SSL Traffic
Challenges ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],SSL
Question ? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Agenda ,[object Object],[object Object],[object Object],[object Object],[object Object]
Agenda ,[object Object],[object Object],[object Object],[object Object],[object Object]
Symmetric Encryption ,[object Object],[object Object],[object Object],[object Object]
Asymmetric Encryption ,[object Object],[object Object],[object Object],[object Object]
Hashing / Message Digest ,[object Object],[object Object],[object Object],[object Object],[object Object],4fe7ad41
Message Signing ,[object Object],[object Object],[object Object],4fe7ad41 3e7bc46a 4fe7ad41 4fe7ad41 3e7bc46a = ?
Digital Certificates ,[object Object],[object Object],[object Object]
Certificate Authorities ,[object Object],[object Object],[object Object],[object Object]
Agenda ,[object Object],[object Object],[object Object],[object Object],[object Object]
SSL History ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Place in TCP/IP stack ,[object Object],[object Object],IP TCP HTTP SMTP … SSL/TLS SSL record layer handshake change cipherspec application data alert
SSL Record Layer ,[object Object],[object Object],[object Object],[object Object]
SSL Content Types ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Agenda ,[object Object],[object Object],[object Object],[object Object],[object Object]
Choosing the right settings
Analyzing the SSL handshake ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Normal RSA handshake Client Server ServerHello ClientHello Certificate ServerHelloDone ClientKeyExchange ChangeCipherSpec Finished (encrypted) ChangeCipherSpec Finished (encrypted)
First packet…
Analyzing the SSL record layer (1)
Random
Session ID
Cipher Suites
Server name
Server Hello
Certificate Message
Server’s Certificate
Server Hello Done
Certificate Validation
Client Key Exchange
Finally Application Data
Ephemeral RSA (or DH) handshake Client Server ServerHello ClientHello Certificate ServerHelloDone ClientKeyExchange ChangeCipherSpec Finished (encrypted) ChangeCipherSpec Finished (encrypted) ServerKeyExchange
Server Key Exchange
Server Key Exchange
Client Authentication Client Server ServerHello ClientHello Certificate ServerHelloDone Certificate ClientKeyExchange Finished (encrypted) ChangeCipherSpec Finished (encrypted) CertificateRequest CertificateVerify ChangeCipherSpec
Client Certificate Request
Certificate Request
Certificate (C)
Certificate Verify
Caching SSL sessions ,[object Object],[object Object],[object Object],[object Object],[object Object]
Handshake of a Reused Session Client Server ServerHello ClientHello ChangeCipherSpec Finished (encrypted) ChangeCipherSpec Finished (encrypted)
SSL session reuse (new, reused and expired) Full Handshake Partial Handshake
No SSL session caching
Analyzing SSL alerts Without decryption: With decryption:
Decrypting SSL traffic ,[object Object],[object Object],[object Object],[object Object]
Providing the server private key (1) tshark -r file.cap -o ssl.keys_list:192.168.3.3,443,http,"c:ey.pem" -o ssl.debug_file:"c:sl-debug.log" -V -R http ssl.keys_list: 192.168.3.3,443,http,c:ey.pem ssl.debug_file: c:empsl-debug.log Wireshark preferences file: When using Tshark:
[object Object],[object Object],[object Object],Providing the server private key (2) PEM keyfile *with* passphrase: -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,F6C218D4FA3C8B66 FR2cnmkkFHH45Dcsty1qDiIUy/uXn+9m/xeQMVRxtiSAmBmnUDUFIFCDDiDc9yif ERok2jPr2BzAazl5RBxS2TY/+7x0/dHD11sF3LnJUoNruo77TERxqgzOI0W1VDRA ... ygw5JslxgiN18F36E/cEP5rKvVYvfEPMa6IsiRhfZk1jLAuZihVWc7JodDf+6RKV yBXrK/bDtdEih+bOnYu+ZDvjAzVz9GhggCW4QHNboDpTxrrYPkj5Nw== -----END RSA PRIVATE KEY----- PEM keyfile *without* passphrase: -----BEGIN RSA PRIVATE KEY----- MIICXgIBAAKBgQDrHdbb+yGE6m6EZ03bXURpZCjch2H6g97ZAkJVGrjLZFfettBA EYa8vYYxWsf8KBpEZeksSCsDA9MnU2H6QDjzqdOnaSWfeXMAr4OsCOpauStpreq7 q1hk8iOqy+f4KijRrhWplh1QW1A8gtSIg137pyUhW+WsfwxKwmzjGIC1SwIDAQAB AoGBAMneA9U6KIxjb+JUg/99c7h9W6wEvTYHNTXjf6psWA+hpuQ82E65/ZJdszL6 ... b6QKMh16r5wd6smQ+CmhOEnqqyT5AIwwl2RIr9GbfIpTbtbRQw/EcQOCx9wFiEfo tGSsEFi72rHK+DpJqRI9AkEA72gdyXRgPfGOS3rfQ3DBcImBQvDSCBa4cuU1XJ1/ MO93a8v9Vj87/yDm4xsBDsoz2PyBepawHVlIvZ6jDD0aXw== -----END RSA PRIVATE KEY----- ssl_init keys string: 192.168.3.3,443,http,c:empublic.sharkfest.local.key ssl_init found host entry 192.168.3.3,443,http,c:empublic.sharkfest.local.key ssl_init addr '192.168.3.3' port '443' filename 'c:empublic.sharkfest.local.key' password(only for p12 file) '(null)' ssl_load_key: can't import pem data SSL debug log:
Converting keys root@mgmt# openssl rsa -in encrypted.key -out cleartext.key Enter pass phrase for encrypted.key: <passphrase> writing RSA key root@mgmt# root@mgmt# openssl pkcs12 -in pem.cert -inkey pem.key -export -out cert.pkcs12  Enter Export Password: <new-passphrase> Verifying - Enter Export Password: <new-passphrase> root@mgmt# root@mgmt# openssl rsa -inform DER -in der.key -out pem.key Enter pass phrase for encrypted.key: <passphrase> writing RSA key root@mgmt# Removing passphrase: Converting from DER to PEM (and removing passphrase): Converting from PEM to PKCS12 (and adding passphrase):
Decryption in Action
Agenda ,[object Object],[object Object],[object Object],[object Object],[object Object]
Preparation of the proxy ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Man in the middle starts ,[object Object],[object Object]
SSL Strip ,[object Object],[object Object]
Screenshot from browser…
Here is the user and password from logs Tail –f sslstrip.log
Questions & Discussion ? ? ? ? ? ? ? ? ? ? ? ? ? ?
Thank you…

Mais conteúdo relacionado

Mais procurados

SSL Secure socket layer
SSL Secure socket layerSSL Secure socket layer
SSL Secure socket layer
Ahmed Elnaggar
 
Introduction to SSL/TLS
Introduction to SSL/TLSIntroduction to SSL/TLS
Introduction to SSL/TLS
keithrozario
 

Mais procurados (20)

TLS/SSL Protocol Design
TLS/SSL Protocol DesignTLS/SSL Protocol Design
TLS/SSL Protocol Design
 
SSL Secure Socket Layer
SSL Secure Socket LayerSSL Secure Socket Layer
SSL Secure Socket Layer
 
SSL/TLS Introduction with Practical Examples Including Wireshark Captures
SSL/TLS Introduction with Practical Examples Including Wireshark CapturesSSL/TLS Introduction with Practical Examples Including Wireshark Captures
SSL/TLS Introduction with Practical Examples Including Wireshark Captures
 
secure socket layer
secure socket layersecure socket layer
secure socket layer
 
Transport layer security
Transport layer securityTransport layer security
Transport layer security
 
Securing TCP connections using SSL
Securing TCP connections using SSLSecuring TCP connections using SSL
Securing TCP connections using SSL
 
Introduction to Secure Sockets Layer
Introduction to Secure Sockets LayerIntroduction to Secure Sockets Layer
Introduction to Secure Sockets Layer
 
Basics of ssl
Basics of sslBasics of ssl
Basics of ssl
 
SSL Secure socket layer
SSL Secure socket layerSSL Secure socket layer
SSL Secure socket layer
 
Secure socket layer
Secure socket layerSecure socket layer
Secure socket layer
 
SSL And TLS
SSL And TLS SSL And TLS
SSL And TLS
 
Secure Socket Layer (SSL)
Secure Socket Layer (SSL)Secure Socket Layer (SSL)
Secure Socket Layer (SSL)
 
Secure Socket Layer (SSL)
Secure Socket Layer (SSL)Secure Socket Layer (SSL)
Secure Socket Layer (SSL)
 
SSL Layer
SSL LayerSSL Layer
SSL Layer
 
SSl/TLS Analysis
SSl/TLS AnalysisSSl/TLS Analysis
SSl/TLS Analysis
 
SSL/TLS
SSL/TLSSSL/TLS
SSL/TLS
 
SSL/TLS
SSL/TLSSSL/TLS
SSL/TLS
 
All you need to know about transport layer security
All you need to know about transport layer securityAll you need to know about transport layer security
All you need to know about transport layer security
 
SSL
SSLSSL
SSL
 
Introduction to SSL/TLS
Introduction to SSL/TLSIntroduction to SSL/TLS
Introduction to SSL/TLS
 

Destaque

Hacking Cisco Networks and Countermeasures
Hacking Cisco Networks and CountermeasuresHacking Cisco Networks and Countermeasures
Hacking Cisco Networks and Countermeasures
dkaya
 
Mitigating worm attacks
Mitigating worm attacksMitigating worm attacks
Mitigating worm attacks
dkaya
 

Destaque (20)

Intrusion Discovery on Windows
Intrusion Discovery on WindowsIntrusion Discovery on Windows
Intrusion Discovery on Windows
 
Hacking Cisco Networks and Countermeasures
Hacking Cisco Networks and CountermeasuresHacking Cisco Networks and Countermeasures
Hacking Cisco Networks and Countermeasures
 
Mitigating Layer2 Attacks
Mitigating Layer2 AttacksMitigating Layer2 Attacks
Mitigating Layer2 Attacks
 
Cisco Switch Security
Cisco Switch SecurityCisco Switch Security
Cisco Switch Security
 
SAS
SASSAS
SAS
 
Cryptography.
Cryptography.Cryptography.
Cryptography.
 
Mitigating worm attacks
Mitigating worm attacksMitigating worm attacks
Mitigating worm attacks
 
Ip security
Ip security Ip security
Ip security
 
Hacking Layer 2 - Enthernet Switcher Hacking Countermeasures.
Hacking Layer 2 - Enthernet Switcher Hacking Countermeasures.Hacking Layer 2 - Enthernet Switcher Hacking Countermeasures.
Hacking Layer 2 - Enthernet Switcher Hacking Countermeasures.
 
Mastering checkpoint-1-basic-installation
Mastering checkpoint-1-basic-installationMastering checkpoint-1-basic-installation
Mastering checkpoint-1-basic-installation
 
Data Encryption Standard (DES)
Data Encryption Standard (DES)Data Encryption Standard (DES)
Data Encryption Standard (DES)
 
Microsoft Days 09 Windows 2008 Security
Microsoft Days 09 Windows 2008 SecurityMicrosoft Days 09 Windows 2008 Security
Microsoft Days 09 Windows 2008 Security
 
Firewall, Trusted Systems,IP Security ,ESP Encryption and Authentication
Firewall, Trusted Systems,IP Security ,ESP Encryption and AuthenticationFirewall, Trusted Systems,IP Security ,ESP Encryption and Authentication
Firewall, Trusted Systems,IP Security ,ESP Encryption and Authentication
 
Data encryption standard
Data encryption standardData encryption standard
Data encryption standard
 
Understanding and Troubleshooting ASA NAT
Understanding and Troubleshooting ASA NATUnderstanding and Troubleshooting ASA NAT
Understanding and Troubleshooting ASA NAT
 
Implementing Cisco AAA
Implementing Cisco AAAImplementing Cisco AAA
Implementing Cisco AAA
 
Web Security Deployment
Web Security DeploymentWeb Security Deployment
Web Security Deployment
 
Avaya Networking Solution Overview
Avaya Networking Solution OverviewAvaya Networking Solution Overview
Avaya Networking Solution Overview
 
Implementing 802.1x Authentication
Implementing 802.1x AuthenticationImplementing 802.1x Authentication
Implementing 802.1x Authentication
 
Checkpoint r77
Checkpoint r77Checkpoint r77
Checkpoint r77
 

Semelhante a Sniffing SSL Traffic

Recover A RSA Private key from a TLS session with perfect forward secrecy
Recover A RSA Private key from a TLS session with perfect forward secrecyRecover A RSA Private key from a TLS session with perfect forward secrecy
Recover A RSA Private key from a TLS session with perfect forward secrecy
Priyanka Aash
 
8.X Sec & I Pv6
8.X Sec & I Pv68.X Sec & I Pv6
8.X Sec & I Pv6
phanleson
 

Semelhante a Sniffing SSL Traffic (20)

Random musings on SSL/TLS configuration
Random musings on SSL/TLS configurationRandom musings on SSL/TLS configuration
Random musings on SSL/TLS configuration
 
TLS Perf: from three to zero in one spec
TLS Perf:  from three to zero in one specTLS Perf:  from three to zero in one spec
TLS Perf: from three to zero in one spec
 
HTTPS: All you need to know
HTTPS: All you need to knowHTTPS: All you need to know
HTTPS: All you need to know
 
SSL/TLS Eavesdropping with Fullpath Control
SSL/TLS Eavesdropping with Fullpath ControlSSL/TLS Eavesdropping with Fullpath Control
SSL/TLS Eavesdropping with Fullpath Control
 
Sequere socket Layer
Sequere socket LayerSequere socket Layer
Sequere socket Layer
 
Go paranoid
Go paranoidGo paranoid
Go paranoid
 
wolfSSL and TLS 1.3
wolfSSL and TLS 1.3wolfSSL and TLS 1.3
wolfSSL and TLS 1.3
 
SSLtalk
SSLtalkSSLtalk
SSLtalk
 
Webinar SSL English
Webinar SSL EnglishWebinar SSL English
Webinar SSL English
 
Recover A RSA Private key from a TLS session with perfect forward secrecy
Recover A RSA Private key from a TLS session with perfect forward secrecyRecover A RSA Private key from a TLS session with perfect forward secrecy
Recover A RSA Private key from a TLS session with perfect forward secrecy
 
[Wroclaw #8] TLS all the things!
[Wroclaw #8] TLS all the things![Wroclaw #8] TLS all the things!
[Wroclaw #8] TLS all the things!
 
TLS
TLSTLS
TLS
 
Sử dụng TLS đúng cách - Phạm Tùng Dương
Sử dụng TLS đúng cách - Phạm Tùng DươngSử dụng TLS đúng cách - Phạm Tùng Dương
Sử dụng TLS đúng cách - Phạm Tùng Dương
 
What is SSL ? The Secure Sockets Layer (SSL) Protocol
What is SSL ? The Secure Sockets Layer (SSL) ProtocolWhat is SSL ? The Secure Sockets Layer (SSL) Protocol
What is SSL ? The Secure Sockets Layer (SSL) Protocol
 
Ip Sec
Ip SecIp Sec
Ip Sec
 
Ip Sec Rev1
Ip Sec Rev1Ip Sec Rev1
Ip Sec Rev1
 
OpenSSL Basic Function Call Flow
OpenSSL Basic Function Call FlowOpenSSL Basic Function Call Flow
OpenSSL Basic Function Call Flow
 
8.X Sec & I Pv6
8.X Sec & I Pv68.X Sec & I Pv6
8.X Sec & I Pv6
 
Ssl and tls
Ssl and tlsSsl and tls
Ssl and tls
 
HTTPS
HTTPSHTTPS
HTTPS
 

Último

Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
Joaquim Jorge
 

Último (20)

Top 5 Benefits OF Using Muvi Live Paywall For Live Streams
Top 5 Benefits OF Using Muvi Live Paywall For Live StreamsTop 5 Benefits OF Using Muvi Live Paywall For Live Streams
Top 5 Benefits OF Using Muvi Live Paywall For Live Streams
 
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, AdobeApidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
 
Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...
 
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
 
Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...
 
Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
 
Deploy with confidence: VMware Cloud Foundation 5.1 on next gen Dell PowerEdg...
Deploy with confidence: VMware Cloud Foundation 5.1 on next gen Dell PowerEdg...Deploy with confidence: VMware Cloud Foundation 5.1 on next gen Dell PowerEdg...
Deploy with confidence: VMware Cloud Foundation 5.1 on next gen Dell PowerEdg...
 
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost SavingRepurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024
 
Artificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyArtificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : Uncertainty
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
 
Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processors
 
Strategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherStrategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a Fresher
 

Sniffing SSL Traffic

Notas do Editor

  1. Mostly used for bulk encryption How to exchange keys?
  2. public-private key Mostly used for secure key exchanges How to verify keys?