I am trying to decrypt TLS traffic, I should parse GET request header to a specific host.
I was provided the .pcapng file and the txt file with the TLS keys.
I added the keys using “(Pre)-Master-Secret log filename.”
I tried applying a filter such as http.request.method == “GET” && http.host == “hostname” but it doesn't seem to work, am I doing something wrong with the TLS keys?
In unix environment the TLS keys are exported using a variable. You have setup the variable SSLKEYLOGFILE to the path of the file where you want store the keys, then you run the browser. Something like this: $ export SSLKEYLOGFILE=~/.config/chromium/.mysslkeylog chromium Obiously the path must be writeable by the process.
I think the OP is doing some sort of homework assignment where the pcap and keys are provided so there's no need to configure the browser to generate new keys.
Comments