Decrypting TLS, HTTP/2 and QUIC with Wireshark

Learn how to decrypt HTTPS, TLS and the new QUIC protocol.
Wireshark course: davidbombal.wiki/chriswireshark
Nmap course: davidbombal.wiki/chrisnmap
// MENU //
0:00 ▶️ Introduction
1:25 ▶️ What is HTTPS vs HTTP2 vs QUIC
6:30 ▶️ What is QUIC
9:42 ▶️ How long have we been using QUIC
10:12 ▶️ Technical tour of QUIC
14:18 ▶️ Why use QUIC instead of TCP
17:48 ▶️ QUIC negotiation and support
19:04 ▶️ Steps to decrypt TLS
20:04 ▶️ Is Wireshark useless without the decryption keys
22:16 ▶️ MITM
23:47 ▶️ Advice on how do I learn Wireshark
25:40 ▶️ TCP/IP Illustrated book
25:54 ▶️ Rather focus on learning protocols instead of Wireshark
26:35 ▶️ Next video ideas
// LINKS //
PCAP file: davidbombal.wiki/ssldecryptio...
Previous video: • HTTPS Decryption with ...
How to Decrypt SSL with Wireshark - HTTPS Decryption Guide: davidbombal.wiki/sslwireshark
Man in the middle Python script: • iPhone and Android WiF...
Chris shows TLS decryption: • How to DECRYPT HTTPS T...
Chris Intro to Wireshark: • Wireshark Tutorial for...
// MY STUFF //
www.amazon.com/shop/davidbombal
// SOCIAL //
Discord: / discord
Twitter: / davidbombal
Instagram: / davidbombal
LinkedIn: / davidbombal
Facebook: / davidbombal.co
TikTok: / davidbombal
KZbin: / davidbombal
//CHRIS GREER //
Udemy course: davidbombal.wiki/chriswireshark
LinkedIn: / cgreer
KZbin: / chrisgreer
Twitter: / packetpioneer
// SPONSORS //
Interested in sponsoring my videos? Reach out to my team here: [e-mail]
wireshark
quic
http2
http
https
tls
ssl
https decryption
quic decryption
tls decryption
wireshark tls
wireshark ssl
https wireshark
tls wireshark
ssl wireshark
ccna
cisco ccna
Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel!
#quic#tls #wireshark

[@fritzbiederstadt4869]

One complication I've run into is tracing the QUIC back to STUN and TCP. I've created various profiles to help me visualize the UDP Stream, then to the QUIC and STUN IDs. Also, I've been doing performance analysis using TCP with encrypted payloads for a good while now...TCP behavior analysis provides as gold mind of practical performance data show which direction latency is coming from, TCP deadlocks, etc. TCP Illustrate is one of the best, if not the TCP learning narratives. Great Video!

[@davidogedegbe1591]

This is a very educative piece. Brilliant conversation and enlightening. Thanks Dave and Chris

[@davidbombal]

Glad you enjoyed it David!

[@CarolineMathieson]

Thing to remember that QUIC was needed because the TCP and UDP protocols cannot be upgraded because the internet connections are full of hardware called middle boxes that can't get firmware upgrades. To provide a better protocol, QUIC was built on top of UDP to give the benefits of TCP without too many of the overheads of TCP.

[@ko-Daegu]

But that sounds like it takes away the benefits of TCP ? Also what are middle box’s what’s the official name ? Also can someone hijack the Quic connection ID steal the response from the target and use them to impersonate the target to hijack the stream ? Making the server feels like yeah this is the same device only different ip ?

[@toromac9786]

@@ko-Daegu this was my immediate thought. I can only assume that the keys are required too

[@Marshdweller]

To me it sounds like udp over TCP. Udp being the protocol that quic is taking advantage of.

[@cdenver]

I remember my teacher in college trying to tell me that HTTPS was secure in 2012. It was not secure in 2012, he tried to make me look like an idiot even though I showed him proof. Thanks for the video David and Chris!

[@dean6125]

why was it not secure?

[@DanielSunBerlin]

​@@dean6125 not https was insecure, some libs where. en.wikipedia.org/wiki/Heartbleed

[@babel0118]

One always has a chance to avoid MITM when looking at the certificate. HTTPS is not rendered unsecure when one decides to disregard the alarms and trust the connection

[@okoliealexander3069]

I feel it's important to convey information of this level of sensitivity in a calm way so that the information finds its way to the brain and remains there. You guys have done justice to the topic and the manner of rendering. Thank you, a lot.

[@yogananda8703]

I would like to see a video on how to identify the dodge stuff happening. They way Chris explained on how can we go ahead and find it out that’s interesting. Please make that content as soon as possible

[@davidbombal]

That video is coming soon 😀

[@hamedindex7117]

Identify is certainly

[@CyberModCC]

Thank you for the calm and relaxed way you manage to convey content without any form of sensation seeking or unnecessary shouting like many other youtubers do.

[@brocholy9289]

Trueee so calm and respectfull and brooo this is so nice to learn with that kind of attitude

[@mendodsoregonbackroads6632]

Totally agree. I learn better from a conversational pace. Absorption is key.

[@jk_tecs]

This's so thoughtful of you guys... Delivering such a tutorial you have provided a lot of information in a simplified way. Thank you so much #David & #Chris for that

[@Zerback]

Thank you David and Chris for this! I'm still learning a lot of cyber and networking, and you guys are helping A LOT!

[@fredericoamigo]

Thank you so much for this! This helps me a lot in my CS-degree. My lectures often just name drop all of this protocols and jargon, but don’t really go over them I practice - so these vids are really helpful to give my curriculum some context. Keep up the good and important work guys!

[@satyanarayansahoo7608]

#David & #Chris, You both are brilliant human beings. You create videos with higher honesty so that people can learn and earn and you guys never keep any suspense for the viewers. I have observed, that you always ask the correct question even if the guests try to divert from the main topic. Wonderful work for the community. You deserve a lot of blessings. You can understand how much satisfaction I have watching your series.

[@jeffarends8843]

I love the detail that these videos are going into. Keep it up!

[@kumarswamy19]

Just brilliant! Concise and precise information. Thanks to you two.

[@abrazbashar]

I was just looking for this topic a while ago! Thanks for delivering sir!

[@Gamelover22478]

Packets are so cool man! I was so hyped watching this video and seeing how all of this data is around us. Thanks for helping me understand this information

[@jetmirrajta6486]

Great stuff! Thanks a lot David & Chris for sharing the knowledge. Your channel really helping with my studies. Bless 🙏

[@davidbombal]

Great to hear that!

[@alkeshmathur4546]

Both the gurus I follow 🙌 Chris you and Lisa Bock have really helped my journey with Wireshark. David of course you are genius - has helped me step up GNS3 labs and helped me with NETMIKO Automation!! Thank you guys for revolutionizing Network Industry!! We definitely need people like you to ease the pain points in Networking.

[@TheTAKNO]

Amazing teachers. I am so blessed I'm learning all this for free and at the highest quality. Thank you gentlemen.

[@Odim65]

IKR

[@billiraydray]

watching and learning everyday from this channel. Thank you so much David and Chris love from Sierra Leone

[@Bilal.Al-Sardar]

This is brilliant, thanks a lot David & Chris!.

[@samratchapagain4804]

Thanks David and chris for this precious session. I know now what a QUIC is.

[@sethadu9045]

Thanks so much, David and Chris for the wonderful information delivered

[@techlearner4806]

03:45 Thanks David for adding this addon (within the main session). Otherwise, it creates confusion that, on one side, Chris mentioned that everything is happening on one TCP session and, on the other side, Chris mentioned "You can think of each stream as an individual TCP connection." So, basically everything is happening on the main TCP connection but due to advance functionality of the HTTP 2.0, multiple streams are working as on separate TCP connection for better functionality and better user experience.

[@shawn8163]

Awesome videos with Chris! Keep up the good work.

[@wonderpets5523]

Thank you, sir bombal, for your passionate tutorials!

[@alexandruszabo]

I was waiting for this part! Thank you!

[@ramnarayana100]

Love you guys keep up the good work, hope more videos coming from you guys together.

[@_eyaas_4446]

Thanks David for all your great contents and courses, love them.

[@vyasG]

Thank you David and Chris for this video. Looking forward for the next video.

[@davidbombal]

Thank you for watching!

[@CmdrStukov]

Excellent series. Absolutely loving it!

[@davidbombal]

Awesome, thank you!

[@nickybesters]

Another smash hit from the David and Chris Show! Just what the doctor ordered and there's even a part 3 on the horizon - boy are we in for a treat... I wonder what's in store for Christmas 😀🥳🌲

[@davidbombal]

Thank you for watching Nick!

[@majiddehbi9186]

hi Mr Bombal it's such good opportunity that chris is here and so we can get the advantage to learn from both of you guys God bless u both thx

[@davidbombal]

You're welcome Majid

[@ChrisGreer]

Thanks for the comment Majid! Great to meet you.

[@moboladekolawole8349]

I really enjoy this duo.

[@davidbombal]

Thank you!

[@joydipsamanta1167]

Thank you David and Chris…So nice explanation…..❤️

[@ranjanadissanayaka5390]

this is interesting, learned a lot . thanks both of you.

[@pinedajulio1814]

Thank you very much for making it simple and easy to comprehend how to use wireshark 🎉

[@poojithapriya2370]

You are the best teacher. Lots of love to U David❤️❤️❤️❤️

[@davidbombal]

Thank you very much!

[@malfoytech4601]

Very informative. Keep making this kinda networking and cyber security videos.

[@davidbombal]

Thank you so much!

[@jhonl.799]

Hii, David, I am a new subscriber. I am sad that I didn't find your channel before. I bought multiple of your course at a discount. I am excited to put in the time and hours during this winter. I was hoping to see a roadmap for 2022.

[@HardwaremagazineBrasil]

Very informative! Thank you! Your channel is amazing!

[@davidbombal]

Glad you think so!

[@ugyentshering6086]

Building the filters and pointing out the weird stuffs from the packets would be fun 😊.. Thank you so much

[@forgotthisone]

Very good video! Actually entertaining and learnt a lot I'm actually really happy I saw this

[@davidbombal]

Really happy to hear that 😀

[@grinder2401]

Thanks David and Chris! Please also do some MITM stuff.

[@peterlodang6012]

Deeply in love with your channel and courses in udemy too.

[@davidbombal]

Happy to hear that Peter!

[@gcobanindzoyi4547]

Hey David you make nice and understandable videos keep them coming :)

[@davidbombal]

Thank you!

[@adityashetty1135]

It's so good sir... Looking forward for more contents with David and Chris sir...😃😃

[@davidbombal]

More to come!

[@gyangaha109]

very great questioning and explanation

[@lastebo]

Thank you Chris, Thank you David!!! Amazing!!!

[@kevingendron5586]

Another outstanding video!

[@WolfIonGaming]

Love this content David and Chris! I'm doing a project for my DFIR Class and we are using wireshark to analyze the packets thanks for this helps to understand more.

[@prolificinvestigations]

This guy Chris, the dude has knowledge they don't kick in college :-) A1 content Dave & Chris

[@medfac2010]

Thank you very much for this detailed explanation I appreciate it

[@dinieshvc8069]

really super and good information about QUIC, thanks david

[@davidbombal]

Glad you liked it!

[@user-xe3ys9xl6w]

Love You Sir❤ From India in Kerala......🎉

[@alexjem6736]

Very interessting topic.... thanks for new Updates 🇩🇪

[@davidbombal]

You're welcome Alex!

[@offensiveredteam]

You are worth millions respect 🙏

[@ncbowden1963]

Excellent content. Very informative.

[@davidbombal]

Glad you like it! Thank you Nigel!

[@tylercoombs1]

I've been following QUIC for many moons now, as soon as I had the chance to switch over i did. The speed of UDP with TLS 1.3 is far superior. Doing huge data dumps is so much faster and it's much more reliable and secure.

[@Alain9-1]

great, waiting for more 👏👏👏

[@simonagger]

you guys rock! thanks for the tips

[@FrankShortt]

Brilliant stuff!

[@anandsinghdhouni]

Really awesome information , Thanks you both sir

[@davidbombal]

Thank you! I really appreciate that!

[@dannydyer4444]

Looking forward to the next installment, which is specifically of interest to me since i have a bit of a cyber stalking issue.

[@ermias736]

wow its is so helpfull, thanks u david keep going the good work.

[@davidbombal]

Glad it was helpful! Thank you!

[@luigigarella5756]

Chris and David Bravo! Just so calm explaining with ease. Thank you so much for this video(s). VERY HELPFUL. @Chris;where can I get that T-Shirt?

[@Warlock1515]

Super cool video!!

[@aleksandrsvyrydenko9094]

Brilliant content!

[@davidbombal]

Thank you!

[@raghupanamukkil]

Really informative one. Thank you

[@davidbombal]

Thank you Raghu!

[@arch417powersports]

Very informative, thank you!

[@davidbombal]

Thank you for watching!

[@LuisGonzalez-gz1qg]

Great stuff!

[@ErycOyugi]

awesome content dave

[@davidbombal]

Thank you Eryc! I really appreciate that!

[@lohphat]

Isn’t IPSEC considered a different transport protocol than TCP & UDP? Since it has its own IP protocol number (ESP 50 and AH 51) or are these being used less frequently? I know AH breaks with NAT so isn’t used that often except gateway to gateway tunnels.

[@ca7986]

What an amazing talk.

[@clementyves6154]

Thanks for your job !

[@hennessy6996]

Hi all, this was a great session. I'm blown away. Question though, doesn't QUIC inhibits security appliances from detecting or scanning the user's traffic, for example, a user at the corporate website visited a website that was prohibited, if QUIC was used to open the session to access the website, the security appliance would not be able to block the website, is that correct?

[@bexultanalipov5915]

This video deserves more views

[@iterminator987]

Hello, was wondering if the decryption could be done using a MITM, for instance the MITM proxy...Would be great to see that happening perhaps in ur next video with Chris!!!!

[@mandezadamz4556]

I would really appreciate it guys if you could illustrate how can we use wireshark to analyze WhatsApp web packages and be able to identify the location of the sender, that's for the 1st Qs 2nd question is : how hackers can use our ip address and specify which websites we have registered to using our email and pswd, i've heard that in a video but they didn't show what tool they use to get the websites we sign up to using the ip address I want to whether or not this is true And thank you for such quality content, really helps

[@mateusnunes4290]

Awesome content!

[@davidbombal]

Glad you think so!

[@ko-Daegu]

12:58 can I steal this Conn ID to take over someone else connection and can snoop into their data (maybe even start a MIM attack) or something ?

[@gabrielannk]

What a crossover 👏 ❤

[@davidbombal]

Glad you are enjoying the content 😄

[@majidalikhanquaid984]

great video ❤

[@prasanthravichandran626]

Does QUIC have any packet format or does it uses UDP's one coz I remembered in UDP there is no part like destination id but needed some clarifications here Thanks😊

[@EduardKhiaev]

If I recall right there is an inner layer of TLS in QUIC can you show us how to decrypt that one?

[@mrpoliticalguy5602]

Hi i got a question in a cisco router how to i assign myself a autonomous system number? when i get one from a internet registry.?

[@lallu1122]

EXCELLENT!!! 10/10

[@drwombat]

Around 00:18:12 Chris says he has a client who cannot utilize QUIC because they "don't trust UDP over 443" and have it blocked. What would make them so wary as to block it altogether? I'm sure it happens I'm just unable to understand the particular reason(s) why a network may choose to have it blocked.

[@dezejongeman]

awsome video. it shall help me with configuration of wafs. only 1 statement is not totally true at this stage of the draft. the first packet of quic is essentially http 1.x or http 2 where the tcp handhake happens and the trust of the connection is build. whould quic work without http1 or http2?

[@ForwardEngineering]

So im confused, if you wanted to decrypt QUIC or TLS for a specific IP (assuming android, MAC or Windows host) you would need to extract the keys for all those end hosts and then check the packets for said hosts?

[@fernandomendieta5463]

More of this please 🥰

[@jindalabhishek1]

@Chris, Thanks mate

[@ChrisGreer]

Great! Glad you liked the content.

[@davidbombal]

Glad you enjoyed the video Abhishek!

[@mariusztokarz4786]

I would like to see drawbacks of wireshark. Can it have impact on os stack?

[@kianooshmehrandish7187]

cool as always

[@NUWASASIRAABEL]

im running firefox ESR on linux, can see QUIC in my captured wireshark packets? thx

[@privilegedesign8745]

Excelent points

[@freedomfighter3486]

Awesome!

[@marounahel8205]

i understood,thank you

[@mariaalkin1271]

Not to mention this will make it more difficult to do port scanning.. Especially, if the firewall filters ICMP responses. For example, if I'm running an API over QUIC using port 34000 for an IoT device and my IoT software firewall filters port unreachable ICMP that port will look the same as any other... You'd have to craft a QUIC initial packet and assume it's QUIC for each port or simply MITM the device. With TCP all ports that are open must respond to a SYN.

[@mariaalkin1271]

You could technically guard against this too.. if the IoT device connected to your Wi-Fi and then got time from NTP and your phone app does the same you both have a time reference to prevent packet replay attacks. Then the IoT device could not listen for anything until an encrypted broadcast packet hit it telling it to listen on port X for Y time which would be a PSK at the time of factory. You could MITM it to see what port was picked for this session but it would be encrypted and make it more difficult to reverse engineer - likely moving to disassembling the app or IoT device itself.

[@lallu1122]

BEST ON KZbin

[@tonym5857]

Againg a usefull video, since old days called Ethereal, Wireshark is a swiss army 💪