Decrypting TLS, HTTP/2 and QUIC with Wireshark

Learn how to decrypt HTTPS, TLS and the new QUIC protocol.
Wireshark course: davidbombal.wiki/chriswireshark
Nmap course: davidbombal.wiki/chrisnmap
// MENU //
0:00 ▶️ Introduction
1:25 ▶️ What is HTTPS vs HTTP2 vs QUIC
6:30 ▶️ What is QUIC
9:42 ▶️ How long have we been using QUIC
10:12 ▶️ Technical tour of QUIC
14:18 ▶️ Why use QUIC instead of TCP
17:48 ▶️ QUIC negotiation and support
19:04 ▶️ Steps to decrypt TLS
20:04 ▶️ Is Wireshark useless without the decryption keys
22:16 ▶️ MITM
23:47 ▶️ Advice on how do I learn Wireshark
25:40 ▶️ TCP/IP Illustrated book
25:54 ▶️ Rather focus on learning protocols instead of Wireshark
26:35 ▶️ Next video ideas
// LINKS //
PCAP file: davidbombal.wiki/ssldecryptio...
Previous video: • HTTPS Decryption with ...
How to Decrypt SSL with Wireshark - HTTPS Decryption Guide: davidbombal.wiki/sslwireshark
Man in the middle Python script: • iPhone and Android WiF...
Chris shows TLS decryption: • How to DECRYPT HTTPS T...
Chris Intro to Wireshark: • Wireshark Tutorial for...
// MY STUFF //
www.amazon.com/shop/davidbombal
// SOCIAL //
Discord: / discord
Twitter: / davidbombal
Instagram: / davidbombal
LinkedIn: / davidbombal
Facebook: / davidbombal.co
TikTok: / davidbombal
KZbin: / davidbombal
//CHRIS GREER //
Udemy course: davidbombal.wiki/chriswireshark
LinkedIn: / cgreer
KZbin: / chrisgreer
Twitter: / packetpioneer
// SPONSORS //
Interested in sponsoring my videos? Reach out to my team here: [e-mail]
wireshark
quic
http2
http
https
tls
ssl
https decryption
quic decryption
tls decryption
wireshark tls
wireshark ssl
https wireshark
tls wireshark
ssl wireshark
ccna
cisco ccna
Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel!
#quic#tls #wireshark

[@davidogedegbe1591]

This is a very educative piece. Brilliant conversation and enlightening. Thanks Dave and Chris

[@davidbombal]

Glad you enjoyed it David!

[@CyberModCC]

Thank you for the calm and relaxed way you manage to convey content without any form of sensation seeking or unnecessary shouting like many other youtubers do.

[@brocholy9289]

Trueee so calm and respectfull and brooo this is so nice to learn with that kind of attitude

[@mendodsoregonbackroads6632]

Totally agree. I learn better from a conversational pace. Absorption is key.

[@fritzbiederstadt4869]

One complication I've run into is tracing the QUIC back to STUN and TCP. I've created various profiles to help me visualize the UDP Stream, then to the QUIC and STUN IDs. Also, I've been doing performance analysis using TCP with encrypted payloads for a good while now...TCP behavior analysis provides as gold mind of practical performance data show which direction latency is coming from, TCP deadlocks, etc. TCP Illustrate is one of the best, if not the TCP learning narratives. Great Video!

[@satyanarayansahoo7608]

#David & #Chris, You both are brilliant human beings. You create videos with higher honesty so that people can learn and earn and you guys never keep any suspense for the viewers. I have observed, that you always ask the correct question even if the guests try to divert from the main topic. Wonderful work for the community. You deserve a lot of blessings. You can understand how much satisfaction I have watching your series.

[@okoliealexander3069]

I feel it's important to convey information of this level of sensitivity in a calm way so that the information finds its way to the brain and remains there. You guys have done justice to the topic and the manner of rendering. Thank you, a lot.

[@CarolineMathieson]

Thing to remember that QUIC was needed because the TCP and UDP protocols cannot be upgraded because the internet connections are full of hardware called middle boxes that can't get firmware upgrades. To provide a better protocol, QUIC was built on top of UDP to give the benefits of TCP without too many of the overheads of TCP.

[@ko-Daegu]

But that sounds like it takes away the benefits of TCP ? Also what are middle box’s what’s the official name ? Also can someone hijack the Quic connection ID steal the response from the target and use them to impersonate the target to hijack the stream ? Making the server feels like yeah this is the same device only different ip ?

[@toromac9786]

@@ko-Daegu this was my immediate thought. I can only assume that the keys are required too

[@Marshdweller]

To me it sounds like udp over TCP. Udp being the protocol that quic is taking advantage of.

[@fredericoamigo]

Thank you so much for this! This helps me a lot in my CS-degree. My lectures often just name drop all of this protocols and jargon, but don’t really go over them I practice - so these vids are really helpful to give my curriculum some context. Keep up the good and important work guys!

[@Zerback]

Thank you David and Chris for this! I'm still learning a lot of cyber and networking, and you guys are helping A LOT!

[@cdenver]

I remember my teacher in college trying to tell me that HTTPS was secure in 2012. It was not secure in 2012, he tried to make me look like an idiot even though I showed him proof. Thanks for the video David and Chris!

[@dean6125]

why was it not secure?

[@DanielSunBerlin]

​@@dean6125 not https was insecure, some libs where. en.wikipedia.org/wiki/Heartbleed

[@babel0118]

One always has a chance to avoid MITM when looking at the certificate. HTTPS is not rendered unsecure when one decides to disregard the alarms and trust the connection

[@jk_tecs]

This's so thoughtful of you guys... Delivering such a tutorial you have provided a lot of information in a simplified way. Thank you so much #David & #Chris for that

[@yogananda8703]

I would like to see a video on how to identify the dodge stuff happening. They way Chris explained on how can we go ahead and find it out that’s interesting. Please make that content as soon as possible

[@davidbombal]

That video is coming soon 😀

[@hamedindex7117]

Identify is certainly

[@TheTAKNO]

Amazing teachers. I am so blessed I'm learning all this for free and at the highest quality. Thank you gentlemen.

[@Odim65]

IKR

[@jetmirrajta6486]

Great stuff! Thanks a lot David & Chris for sharing the knowledge. Your channel really helping with my studies. Bless 🙏

[@davidbombal]

Great to hear that!

[@alkeshmathur4546]

Both the gurus I follow 🙌 Chris you and Lisa Bock have really helped my journey with Wireshark. David of course you are genius - has helped me step up GNS3 labs and helped me with NETMIKO Automation!! Thank you guys for revolutionizing Network Industry!! We definitely need people like you to ease the pain points in Networking.

[@billiraydray]

watching and learning everyday from this channel. Thank you so much David and Chris love from Sierra Leone

[@kumarswamy19]

Just brilliant! Concise and precise information. Thanks to you two.

[@jeffarends8843]

I love the detail that these videos are going into. Keep it up!

[@samratchapagain4804]

Thanks David and chris for this precious session. I know now what a QUIC is.

[@abrazbashar]

I was just looking for this topic a while ago! Thanks for delivering sir!

[@Bilal.Al-Sardar]

This is brilliant, thanks a lot David & Chris!.

[@Gamelover22478]

Packets are so cool man! I was so hyped watching this video and seeing how all of this data is around us. Thanks for helping me understand this information

[@sethadu9045]

Thanks so much, David and Chris for the wonderful information delivered

[@wonderpets5523]

Thank you, sir bombal, for your passionate tutorials!

[@moboladekolawole8349]

I really enjoy this duo.

[@davidbombal]

Thank you!

[@shawn8163]

Awesome videos with Chris! Keep up the good work.

[@pinedajulio1814]

Thank you very much for making it simple and easy to comprehend how to use wireshark 🎉

[@vyasG]

Thank you David and Chris for this video. Looking forward for the next video.

[@davidbombal]

Thank you for watching!

[@joydipsamanta1167]

Thank you David and Chris…So nice explanation…..❤️

[@alexandruszabo]

I was waiting for this part! Thank you!

[@ramnarayana100]

Love you guys keep up the good work, hope more videos coming from you guys together.

[@ranjanadissanayaka5390]

this is interesting, learned a lot . thanks both of you.

[@CmdrStukov]

Excellent series. Absolutely loving it!

[@davidbombal]

Awesome, thank you!

[@ugyentshering6086]

Building the filters and pointing out the weird stuffs from the packets would be fun 😊.. Thank you so much

[@grinder2401]

Thanks David and Chris! Please also do some MITM stuff.

[@jhonl.799]

Hii, David, I am a new subscriber. I am sad that I didn't find your channel before. I bought multiple of your course at a discount. I am excited to put in the time and hours during this winter. I was hoping to see a roadmap for 2022.

[@nickybesters]

Another smash hit from the David and Chris Show! Just what the doctor ordered and there's even a part 3 on the horizon - boy are we in for a treat... I wonder what's in store for Christmas 😀🥳🌲

[@davidbombal]

Thank you for watching Nick!

[@davidbombal]

Learn how to decrypt TLS, HTTP/2 and QUIC using Wireshark. // MENU // 0:00 ▶ Introduction 1:25 ▶ What is HTTPS vs HTTP2 vs QUIC 6:30 ▶ What is QUIC 9:42 ▶ How long have we been using QUIC 10:12 ▶ Technical tour of QUIC 14:18 ▶ Why use QUIC instead of TCP 17:48 ▶ QUIC negotiation and support 19:04 ▶ Steps to decrypt TLS 20:04 ▶ Is Wireshark useless without the decryption keys 22:16 ▶ MITM 23:47 ▶ Advice on how do I learn Wireshark 25:40 ▶ TCP/IP Illustrated book 25:54 ▶ Rather focus on learning protocols instead of Wireshark 26:35 ▶ Next video ideas // LINKS // PCAP file: davidbombal.wiki/ssldecryptionpcap Previous video: kzbin.info/www/bejne/fX6xgIdnlr-gepo How to Decrypt SSL with Wireshark - HTTPS Decryption Guide: davidbombal.wiki/sslwireshark Man in the middle Python script: kzbin.info/www/bejne/hWLNoZahaJZ0qc0 Chris shows TLS decryption: kzbin.info/www/bejne/a6LIlKyQfbFgfbc Chris Intro to Wireshark: kzbin.info/www/bejne/hYaQcmV7orulgbM // MY STUFF // www.amazon.com/shop/davidbombal // SOCIAL // Discord: discord.com/invite/usKSyzb Twitter: twitter.com/davidbombal Instagram: instagram.com/davidbombal LinkedIn: www.linkedin.com/in/davidbombal Facebook: facebook.com/davidbombal.co TikTok: tiktok.com/@davidbombal KZbin: kzbin.info //CHRIS GREER // Udemy course: davidbombal.wiki/chriswireshark LinkedIn: www.linkedin.com/in/cgreer/ KZbin: kzbin.info Twitter: twitter.com/packetpioneer // SPONSORS // Interested in sponsoring my videos? Reach out to my team here: [e-mail] Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel!

[@fahadbawazir1771]

Sure David sir

[@mrpoliticalguy5602]

Hi i got a question in a cisco router how to i assign myself a autonomous system number? when i get one from a internet registry.?

[@gyangaha109]

very great questioning and explanation

[@techlearner4806]

03:45 Thanks David for adding this addon (within the main session). Otherwise, it creates confusion that, on one side, Chris mentioned that everything is happening on one TCP session and, on the other side, Chris mentioned "You can think of each stream as an individual TCP connection." So, basically everything is happening on the main TCP connection but due to advance functionality of the HTTP 2.0, multiple streams are working as on separate TCP connection for better functionality and better user experience.

[@malfoytech4601]

Very informative. Keep making this kinda networking and cyber security videos.

[@davidbombal]

Thank you so much!

[@HardwaremagazineBrasil]

Very informative! Thank you! Your channel is amazing!

[@davidbombal]

Glad you think so!

[@majiddehbi9186]

hi Mr Bombal it's such good opportunity that chris is here and so we can get the advantage to learn from both of you guys God bless u both thx

[@davidbombal]

You're welcome Majid

[@ChrisGreer]

Thanks for the comment Majid! Great to meet you.

[@forgotthisone]

Very good video! Actually entertaining and learnt a lot I'm actually really happy I saw this

[@davidbombal]

Really happy to hear that 😀

[@lastebo]

Thank you Chris, Thank you David!!! Amazing!!!

[@medfac2010]

Thank you very much for this detailed explanation I appreciate it

[@_eyaas_4446]

Thanks David for all your great contents and courses, love them.

[@prolificinvestigations]

This guy Chris, the dude has knowledge they don't kick in college :-) A1 content Dave & Chris

[@peterlodang6012]

Deeply in love with your channel and courses in udemy too.

[@davidbombal]

Happy to hear that Peter!

[@dinieshvc8069]

really super and good information about QUIC, thanks david

[@davidbombal]

Glad you liked it!

[@alexjem6736]

Very interessting topic.... thanks for new Updates 🇩🇪

[@davidbombal]

You're welcome Alex!

[@kevingendron5586]

Another outstanding video!

[@gcobanindzoyi4547]

Hey David you make nice and understandable videos keep them coming :)

[@davidbombal]

Thank you!

[@offensiveredteam]

You are worth millions respect 🙏

[@adityashetty1135]

It's so good sir... Looking forward for more contents with David and Chris sir...😃😃

[@davidbombal]

More to come!

[@ncbowden1963]

Excellent content. Very informative.

[@davidbombal]

Glad you like it! Thank you Nigel!

[@arch417powersports]

Very informative, thank you!

[@davidbombal]

Thank you for watching!

[@simonagger]

you guys rock! thanks for the tips

[@poojithapriya2370]

You are the best teacher. Lots of love to U David❤️❤️❤️❤️

[@davidbombal]

Thank you very much!

[@anandsinghdhouni]

Really awesome information , Thanks you both sir

[@davidbombal]

Thank you! I really appreciate that!

[@luigigarella5756]

Chris and David Bravo! Just so calm explaining with ease. Thank you so much for this video(s). VERY HELPFUL. @Chris;where can I get that T-Shirt?

[@ermias736]

wow its is so helpfull, thanks u david keep going the good work.

[@davidbombal]

Glad it was helpful! Thank you!

[@user-xe3ys9xl6w]

Love You Sir❤ From India in Kerala......🎉

[@raghupanamukkil]

Really informative one. Thank you

[@davidbombal]

Thank you Raghu!

[@dannydyer4444]

Looking forward to the next installment, which is specifically of interest to me since i have a bit of a cyber stalking issue.

[@Alain9-1]

great, waiting for more 👏👏👏

[@clementyves6154]

Thanks for your job !

[@ca7986]

What an amazing talk.

[@Warlock1515]

Super cool video!!

[@aleksandrsvyrydenko9094]

Brilliant content!

[@davidbombal]

Thank you!

[@ErycOyugi]

awesome content dave

[@davidbombal]

Thank you Eryc! I really appreciate that!

[@fernandomendieta5463]

More of this please 🥰

[@tylercoombs1]

I've been following QUIC for many moons now, as soon as I had the chance to switch over i did. The speed of UDP with TLS 1.3 is far superior. Doing huge data dumps is so much faster and it's much more reliable and secure.

[@FrankShortt]

Brilliant stuff!

[@WolfIonGaming]

Love this content David and Chris! I'm doing a project for my DFIR Class and we are using wireshark to analyze the packets thanks for this helps to understand more.

[@bexultanalipov5915]

This video deserves more views

[@LuisGonzalez-gz1qg]

Great stuff!

[@majidalikhanquaid984]

great video ❤

[@gabrielannk]

What a crossover 👏 ❤

[@davidbombal]

Glad you are enjoying the content 😄

[@iterminator987]

Hello, was wondering if the decryption could be done using a MITM, for instance the MITM proxy...Would be great to see that happening perhaps in ur next video with Chris!!!!

[@lallu1122]

EXCELLENT!!! 10/10

[@marounahel8205]

i understood,thank you

[@mateusnunes4290]

Awesome content!

[@davidbombal]

Glad you think so!

[@jindalabhishek1]

@Chris, Thanks mate

[@ChrisGreer]

Great! Glad you liked the content.

[@davidbombal]

Glad you enjoyed the video Abhishek!

[@privilegedesign8745]

Excelent points

[@lallu1122]

BEST ON KZbin

[@hennessy6996]

Hi all, this was a great session. I'm blown away. Question though, doesn't QUIC inhibits security appliances from detecting or scanning the user's traffic, for example, a user at the corporate website visited a website that was prohibited, if QUIC was used to open the session to access the website, the security appliance would not be able to block the website, is that correct?

[@kianooshmehrandish7187]

cool as always

[@killerx8902]

Awesome content. Chris is an amazing guy. I would love to see a man in the middle attack. More difficult = More valuable 😍. Thank you

[@davidbombal]

Thank you!

[@freedomfighter3486]

Awesome!

[@NabinChaudry]

THANK YOU SO MUCH

[@davidbombal]

You're welcome! Thank you for watching!

[@tonym5857]

Againg a usefull video, since old days called Ethereal, Wireshark is a swiss army 💪

[@richardjay1791]

this seems much better

[@lohphat]

Isn’t IPSEC considered a different transport protocol than TCP & UDP? Since it has its own IP protocol number (ESP 50 and AH 51) or are these being used less frequently? I know AH breaks with NAT so isn’t used that often except gateway to gateway tunnels.

[@ko-Daegu]

12:58 can I steal this Conn ID to take over someone else connection and can snoop into their data (maybe even start a MIM attack) or something ?

[@mandezadamz4556]

I would really appreciate it guys if you could illustrate how can we use wireshark to analyze WhatsApp web packages and be able to identify the location of the sender, that's for the 1st Qs 2nd question is : how hackers can use our ip address and specify which websites we have registered to using our email and pswd, i've heard that in a video but they didn't show what tool they use to get the websites we sign up to using the ip address I want to whether or not this is true And thank you for such quality content, really helps

[@omaralhalboosi2713]

THANK YOU , THANK YOU , THANK YOU, if I keep saying thank you wont be enough , the information shared here is enough to pass and impress an employer , really thank you David , ad Chris . I know I wont use these info daily as I am a network engineer but the knowledge is worthy . May God bless you all.

[@davidbombal]

You're welcome Omar! So happy to hear that!

[@dezejongeman]

awsome video. it shall help me with configuration of wafs. only 1 statement is not totally true at this stage of the draft. the first packet of quic is essentially http 1.x or http 2 where the tcp handhake happens and the trust of the connection is build. whould quic work without http1 or http2?

[@prasanthravichandran626]

Does QUIC have any packet format or does it uses UDP's one coz I remembered in UDP there is no part like destination id but needed some clarifications here Thanks😊

[@ForwardEngineering]

So im confused, if you wanted to decrypt QUIC or TLS for a specific IP (assuming android, MAC or Windows host) you would need to extract the keys for all those end hosts and then check the packets for said hosts?

[@EduardKhiaev]

If I recall right there is an inner layer of TLS in QUIC can you show us how to decrypt that one?