Even after all the experience I have with IT security/forensics, I’m still learning something new every day.
@ChrisGreer3 жыл бұрын
Amen to that Christopher! I feel the same. I learn something with every pcap I open.
@lovely31bluprint2 жыл бұрын
You will always learn something more in technology
@NovakGoran3 жыл бұрын
'Packet heads' cracked me up. Thanks for the vid!
@ChrisGreer3 жыл бұрын
Glad you liked it! Hey every department needs a Packet Head.
@maliki142 жыл бұрын
i havent touched cybersecurity in over a year but bet your ass stumbling on this video made me turn my PC back on, thank you for the insanely ez lesson
@ChrisGreer2 жыл бұрын
Awesome!
@alexmook6786 Жыл бұрын
Chris is a gem...I have learned so much from him over the years, especially on Pluralsight.
@ChrisGreer Жыл бұрын
Thank you!
@moinvohra5505 Жыл бұрын
Can somebody help me? I am not able to capture the log file even though I created an environment variable with the ssl.log in the end.
@techanalogies26292 жыл бұрын
A really interesting video indeed!...Learnt many new things....Could you make a video to learn how I can capture and decrypt my smartphone's browsing traffic using wireshark?(Both connected to the same networks)
@KaySwiss212 жыл бұрын
Glad you did the Collab with Bombal so I could find your content!
@ChrisGreer2 жыл бұрын
I am beyond honored that he wanted to interview me on his channel. Great to have you here!
@alexandermayerkirstein2 жыл бұрын
Remarkably excellent delivery style. Super efficient clarity. Nothing superfluous. Conceptual through point and click guidance. Compellingly engaging with constant forward quick-step momentum. Not too loud not soft spoken. Knowledgeable, conservative, passionate, trustworthy source. Technoratically enjoyable. First video I watched on this channel. Heading to check your other content for more of the same. Thank you!
@ChrisGreer2 жыл бұрын
Thank you for watching and commenting Alexander!
@mattdonnelly37432 жыл бұрын
Don't tell me this isn't the same guy as Darknet Diaries. The voice is IDENTICAL.
@scottspa742 жыл бұрын
I just experimented with this in a ucertify virtual lab I had open for a class assignment, and it was super easy and fun. Thank you for showing this !
@ChrisGreer2 жыл бұрын
Great job! Thanks for the feedback!
@seantierney202810 ай бұрын
Fantastic guide! I don't normally comment, but you need to know that you are doing fantastic work! I am experiencing Wireshark for the very first time in a CTF and this was clear, informative, and helpful!
@ChrisGreer10 ай бұрын
Thank you for the comment! I really appreciate the feedback.
@thatpigeondude2 жыл бұрын
finally... a video that works. I can't thank you enough dad.
@ductran81183 жыл бұрын
Thank you for sharing! Now I can understand ssl/tls handshake clearly and how https works. Love it and Subscribed.
@ChrisGreer3 жыл бұрын
Thanks for the comment!
@TheDyingFox3 жыл бұрын
Nice to read online that this method apparently works the same with the Firefox web browser :D
@sammyrajoy3 жыл бұрын
Thank you for this video Chris, I was following the WCNA study guide book but got stuck when I didnt see what's in the book(HTTP). I realised the time gap between the date of book publishing and the current version of wireshark. So switched my trail to 443 and TLS. This video helped me decrypt my session.
@ChrisGreer3 жыл бұрын
Great Samuel! Glad to hear that it helped. I'll get some more TLS 1.3 stuff out there soon.
@bits4all77010 ай бұрын
When I saw you change a hat I knew this lesson would be outstanding
@bikupothen54262 жыл бұрын
how did u get that SYSLOG file in the beginning?
@elieatia4402 жыл бұрын
Thanks you for your great job. I try it and all it works fine!
@Vietquat114 Жыл бұрын
it means we can decrypt any password even if it uses https protocol ?
@scottsparling25912 жыл бұрын
You explain so much more clearly and succinctly than my packet analysis instructor. This is great! Thank you.
@ChrisGreer2 жыл бұрын
Glad it was helpful!
@mastoemoji Жыл бұрын
Nice video. Could you do an other video decrypting UDP traffic 🙏 it will help us a lot, thanks
@dicao65263 жыл бұрын
Thanks Chris. I like your passion when explan all of this. 🤗
@ChrisGreer3 жыл бұрын
Thanks again Di. I appreciate the feedback.
@gavenchan Жыл бұрын
Interesting. Great video. I am puzzled by 2 files in this video. Are the "sslkeylog.log" and "DecryptTraffic_Wireshark.log" the same file?
@vladislavvasilev34416 ай бұрын
I'm also wondering this - did you find this out?
@intnsity6 ай бұрын
Yes anyone?
@shuvofahmid1705 Жыл бұрын
Thanks Chris. Would you mind sharing the process of path variable for log file in Kali Linux and MAC OS ?
@ethancai6812 жыл бұрын
Thanks, Chris. This video helps me a lot.
@StarLightDotPhotosАй бұрын
Thank you for this. It was kicking my ass.
@jiillescas3 жыл бұрын
Great video, please keep sharing more
@ChrisGreer3 жыл бұрын
Thanks for the comment! Working on more content and I'll get it out there.
@grendal19743 жыл бұрын
Chris, as always you are the man.
@ChrisGreer3 жыл бұрын
@Bill Proctor - Great to see you here Bill! Hope all is well on your end.
@grendal19743 жыл бұрын
@@ChrisGreer absolutely. Just looking forward to being able to travel again for work. Hope to hang out with you sometime soon!
@ChrisGreer3 жыл бұрын
@@grendal1974 That would be awesome Bill! Let's chat sometime here soon.
@sherazhussain82472 жыл бұрын
Thank you Chris!
@glorfindelironfoot22972 жыл бұрын
Thanks, Chris.
@TaraChand-ys8yd2 жыл бұрын
can you please create a video for decrypting tls traffic in wireshark using private key file
@StankBrewing5 ай бұрын
Thank you, Chris, for such a great educational video)
@nix89602 жыл бұрын
Thanks a lot
@ChrisGreer2 жыл бұрын
Most welcome
@shumpakshu2 жыл бұрын
This is some great stuff, keep going.
@ChrisGreer2 жыл бұрын
Thanks!
@jamesa49582 жыл бұрын
Awesome videos. Thank you
@MoonIsCheese2 жыл бұрын
Why did you not select the log file from the path you created in the system variable?
@bwest6275 Жыл бұрын
🤦🏻♀️
@__Bla__2 жыл бұрын
That’s really interesting!
@OmarAlpjaly4 ай бұрын
🔴 Important note the variable name is "SSLKEYLOGFILE" not "SSLKEYLOG" as in the description
@joshsalmon57822 жыл бұрын
Im so confused. The file that you gave wireshark is completely different from the sslkeylog file that you made earlier. How did you create the file that you gave wireshark?
@ChrisGreer2 жыл бұрын
Hey Josh - I probably had to recreate it and share a different one. However the pcap and syslog you get in the link go together and the rest of the video steps are the same.
@m.adnankhan82452 жыл бұрын
Amazing Chris :) Thanks!
@ChrisGreer2 жыл бұрын
My pleasure!
@dronomads3 жыл бұрын
Thanks, Chris I really appreciate you making videos. Taking the help of your videos I was able to help my colleagues and solve infrastructure problems. Keep making the good stuff as you explain the stuff in quite simple terms.
@ChrisGreer3 жыл бұрын
Nice! That is great Prateek - glad to hear that the videos helped you. More to come!
@ProliantLife Жыл бұрын
You're a God amongst men sir. Thank you
@TheAychi2 жыл бұрын
Thank you Sir :)
@ChrisGreer2 жыл бұрын
Most welcome!
@nicoladellino81242 жыл бұрын
Very nice video, TNX.
@ChrisGreer2 жыл бұрын
Thanks!
@RamKumar-tj7ln3 жыл бұрын
Learn it by heart -- By order of the peaky blinders
@Letraveler_rd2 жыл бұрын
I'm loading the file to Wireshark, but some reason the decryption is not working. I'm using a windows machine.
@philipgeorgiev32403 жыл бұрын
too cool for a dev, thanks
@ImranKhan-tc8jz3 жыл бұрын
Thank you so much man. Excellent explanation.
@CDizzzle4Rizzle2 жыл бұрын
You have some really great content on your Channel. You should start accepting BAT's so we can tip you!
@ChrisGreer2 жыл бұрын
Hi Chris D - Thanks for the comment. Actually I had considered setting something like that up but wasn't sure if anyone would actually do it! I appreciate the suggestion and will definitely look into it.
@ko-Daegu2 жыл бұрын
I would love a video on how to read important info of encrypted data without decrypting it
@ChrisGreer2 жыл бұрын
That is a great skill - because in the real world, most of the troubleshooting I do is without the decryption keys.
@thomasedison4937 Жыл бұрын
@@ChrisGreer I'd love to learn that skill.... Really wish you could make a video on that... I'll truly appreciate 💜
@garrettjones631Ай бұрын
Great video! I have a few questions. 1. How are attackers able to decrypt https? Are they able to get this log file somehow? 2. Where are the session keys stored before you set this environment variable, just in memory? 3. If you had a computer disk image and a pcap of that computers traffic could you extract session keys from the image to decrypt the https traffic?
@alexmannrocks2 жыл бұрын
Great video and example, thanks for what you do
@ChrisGreer2 жыл бұрын
Thanks for the comment!
@johnvardy95592 жыл бұрын
about session keys how i could fix that on mac os?
@collectionsforyou32093 ай бұрын
Thanks grish its really nice and helpful
@alexborodin8452 жыл бұрын
Cool, thank you!
@ChrisGreer2 жыл бұрын
thanks for the comment Alex!
@ryankan1229 Жыл бұрын
Hi Chris, so sorry, after I tried to save the SSL Key log file, I cannot find the file at all, for some reason. I am the administrator but I just cannot find it. Is there anything I must do? Thanks!
@Majidiof2 жыл бұрын
Thank you very much Chris 🙏🏻
@ChrisGreer2 жыл бұрын
You are very welcome
@maxfightz4623 Жыл бұрын
how would i apply this to a app
@yosuasitorus34782 жыл бұрын
Hai Chris, how about desktop App not browser, how do we generate that log file?
@marlonrivas34132 жыл бұрын
How do I enable Packet Reassembly and Uncompressed Entity Body?
@bravebacon41752 жыл бұрын
Wait so can I store the keys wherever or does it need to be that specific user address?
@tinmaung58283 жыл бұрын
Thank you so much sir for this wonderful video and it is helpful for us.
@ChrisGreer3 жыл бұрын
Thanks for the comment Tin!
@Leafspine3 жыл бұрын
Мужик,лайк тебе ставлю,полезно очень 👍
@simmi35210 ай бұрын
Hi Chris, thanks for this one really learnt a lot here. In saying that I've been seeing more of Application Layer Encryption lately, so in theory if you encrypt at the application level before hitting the pipe and encrypt using TLS, would you be able to get to the cleartext?
@mmd.38593 жыл бұрын
Please you build on video about how to using the wireshark in windows 10
@Animeatlas351466518427er22 күн бұрын
Hey thanks for sharing this cool looking video curiosity question after you decrypt the traffic files and you go to open it in a browser and it says that the content isn't available or if the site was taken down or can the content still be viewed?
@v.harinath59712 жыл бұрын
Unable to see the keylog file generated in windows. Any additional steps to be followed
@ChrisGreer2 жыл бұрын
Make sure that you restart chrome completely after setting up the environment variable. Also - if that doesn't work, give it a shot with Firefox.
@derrickgyamfi4823 Жыл бұрын
Thanks Greer, very useful
@techproductowner2 жыл бұрын
Dear Sir wonderful , How do I decrypt Windows desktop application traffic using wireshark , the desktop app use TLS1.2 and Websocket for communication
@ChrisGreer2 жыл бұрын
Hello DataSkull - we would need to see if the app will locally store the TLS keys. As you saw in the video, chrome will do it in an environment variable, but that may not be the case for the application you are trying to decrypt. You have to dig into it and see if the app will store them.
@JackSparrow-xm3im2 жыл бұрын
Same issue here looks like better to go with a proxy server
@HuzaifaGujjar2 жыл бұрын
Best as always.
@ChrisGreer2 жыл бұрын
Glad you think so!
@albaniaiptv83352 жыл бұрын
great video. can we decrypt request manually by extracting public certificate of website ?
@JackSparrow-xm3im2 жыл бұрын
Hey Chris really great video it helped me a lot but I just wanna mention that, I don't know for some reason but sslkeylog doesn't store every ssl log, it does stores majority of them but not every, soo I came across some proxy servers like charles which stores every ssl but don't know how to set it up on windows to work perfectly. Please make a video about charles or any other proxy server you recommend to decrypt fully...... Thanks
@ChrisGreer2 жыл бұрын
Thanks for the feedback Jack - I would need to figure out how to reproduce that in order to tshoot on my end.
@NathayT-vr8hm Жыл бұрын
❤❤It works 💯% dude I don't have a words u are really great!
@sureshhkumar9552 жыл бұрын
How to get the bottom filters?
@aadityadeshpande90802 жыл бұрын
Great information 🙂 Please do some video on HTTP3 and its benifits... Found this channel after watching your colab on David's channel... Thank you 😊
@ChrisGreer2 жыл бұрын
For sure! I will be doing more content around QUIC and H3 as things continue to develop. Thank you for the comment. I the meantime check out my QUIC decryption video here - kzbin.info/www/bejne/h4O1eXSVas2GaMU
@ginadi97333 жыл бұрын
Great tutorial
@ChrisGreer3 жыл бұрын
Thanks Ginadi. Stick around for more around TLS.
@iterminator9872 жыл бұрын
Hello, was wondering if the decryption could be done using a MITM, for instance the MITM proxy...Would be great to see that happen!!! Ty
@ChrisGreer2 жыл бұрын
Hey, thanks for the comment. I'll see if I can get it working... (or breaking, depending on how you look at it!)
@gregwallace94812 жыл бұрын
Is there a way to do this for non-web browser traffic? For example, I am trying to decrypt commands and responses with racadm in powershell but the keys don't appear in the log.
@ChrisGreer2 жыл бұрын
Hey Greg - I have only tried this with Chrome and Firefox. It would def take some more digging to learn where/how/if other API's store the keys.
@flinfaraday18212 жыл бұрын
Is the SSLKEYLOGFILE env variable only used by chrome? Or system wide for anything using SSL?
@ChrisGreer2 жыл бұрын
I have gotten it to work with Firefox and chrome. I have heard it works with edge but have not tried it for myself. All others, a ton to try… I guess it just depends on the api
@tjeaton24052 жыл бұрын
Hey love the video, how can this be done if I'm not using either chrome or firefox?
@ashutoshpadha88132 жыл бұрын
sir can it also decrypt the traffic of insta ,tele, twitter like websites ?
@ChrisGreer2 жыл бұрын
I haven't tried it with mobile apps yet. But if they store the keys to the keylog, then in theory... yes!
@RdozeTV3 жыл бұрын
Where the f is the pre master secret log filename came from? that's not in the environmental variables you made right?
@hackyourfuture Жыл бұрын
Great video, it´s really useful, thank you!
@jagzam2 жыл бұрын
Gracias por compartir toda esta información.!!
@ChrisGreer2 жыл бұрын
Un placer!
@abhayn39232 жыл бұрын
I followed all the steps as explained by you, but I'm still unable to log the ssl keys into my local directory. May I know why that maybe happening? The file is empty , that is, no keys are logged into it.
@ChrisGreer2 жыл бұрын
Hmm... weird. That is frustrating. Ok maybe something changed with an update. I'd suggest trying Firefox. If that doesn't work - I've been able to get it working pretty reliably with Kali Linux and Chrome. I demonstrate that here -kzbin.info/www/bejne/h4O1eXSVas2GaMU
@lofman3 жыл бұрын
Great vid, thanks!
@ChrisGreer3 жыл бұрын
Thanks for the comment! I really appreciate the feedback.
@lofman3 жыл бұрын
@@ChrisGreer didn't know it was that easy. I guess the environment variable you added in the beginning is Chrome specific?
@ChrisGreer3 жыл бұрын
It works with Chrome, Firefox, and some chromium based browsers. I am not much of an Edge user so I haven't tried it myself, and I understand Safari in the Mac environment isn't too happy with this variable either.
@alimohammed8173 жыл бұрын
sir, I have tls.pcap packet , how can i decrypt SIP/TLS v1.2 to see RTP ?? Note that TLS encrypt by CA ?
@odogg68992 жыл бұрын
Am i supposed to take that log file i d/l and drop it in SSL Keys folder or will system automatically create one for me?
@ChrisGreer2 жыл бұрын
You should have to create that folder but the system will create the log.
@w451-qx3kx3 жыл бұрын
hi, do you know if there is a way to decrypt https when it isn't from the browser, meaning it doesn't get logged to a key file?
@ChrisGreer3 жыл бұрын
Probably - I'd have to tinker with a specific app or implementation, but I imagine if you dig deep enough in the code there is a way to do it.
@adammason15872 жыл бұрын
@@ChrisGreer So from a hackers perspective in todays day and age, I imagine the flow is something like this: 1. compromise endhost through zero day or unpatched vulnerability 2.create a reverse tcp shell via proxy chaining on proxy's that dont log user data (or TOR) 3.setup the log environmental variable in OS (congrats you have modified a system that's not yours and have now officially committed a crime, though I guess the reverse tcp shell could be argue as the stage when that happens) 4. discretely capture network traffic, and discretely transfer data back (no idea how that's done) 5. look for PII/PCI decrypted data 6. Clear traces of you being there... also not really sure how they would do that. Probably clear a bunch of internal log files. I know this comment puts you in a precarious situation, because how do you teach content and answer questions without indirectly possibly helping a hacker, but as a company network engineer I still dont understand how hackers pull of what they do. Is it just a matter of hiding in plane sight and due to the sheer amount of data that goes across the wire, you are hoping nobody notices?
@chelvis15692 жыл бұрын
@@adammason1587 Very interesting, to transfer the data back in thinking you could do a loopback but that could be traced.
@0x80O0oOverfl0w2 жыл бұрын
Does this only work with Chrome? Or will it log keys from windows update and other OS calls?
@AbrahamBilly3 жыл бұрын
thankyou for sharing, but how we can get the tls key without touching the victim pc / laptop?
@ChrisGreer3 жыл бұрын
You would need send all traffic through a man-in-the-middle device on the network, or you could install an agent on the server that will capture them. Either way, it's designed to be hard to get the keys...
@AbrahamBilly3 жыл бұрын
@@ChrisGreer isn’t that man in the middle attack / ARP Poisoning doens’t catch the key? please make a video how to get the keys via man in the middle attack sir.
@christiangrenier94342 жыл бұрын
Hi Chris, I have a IOT device connected to AWS. I have all certicates... is it possible to decrypt the communication using wireshark? My IOT device is connected to an access point. Actually, I have a switch that I can route all the traffic to the PC but all packets are encrypted. So, I'd like to see the packet contents. Thanks a lot!
@ivena3 жыл бұрын
Very useful, how we can do it on linux with mitm? Hope to see this in the next video
@_Omni3 жыл бұрын
Fiddler is good for this 😁
@myyt9053 жыл бұрын
How! Explain please
@brentonm.newbon60263 жыл бұрын
Great video!
@ChrisGreer3 жыл бұрын
Thanks! Appreciate the comment.
@KaySwiss212 жыл бұрын
I have a question... If I'm using a wifi adapter that's in monitor mode, and passively sniffing the other devices on my home network... Is there any methods for decrypting other clients on the same network? Other clients meaning , if I'm on my laptop and I want to see what's going on with my Android on the same network, what methods (if any) are there to decrypt the androids traffic?
@ChrisGreer2 жыл бұрын
That is a great question. In theory, you could do a man in the middle attack and intercept their traffic. You can capture it is a passive listener on WiFi, but with the additional layer 1/2 encryption for WiFi (WPA2 for example) it adds another level of complexity. I have never done it.
@KaySwiss212 жыл бұрын
@@ChrisGreer Thanks for the reply! My mind was going into that direction but wasn't sure if there were other ways/methods. Looking forward to more content as well. Since I'm a newer viewer, I dont know the extent of your expertise. But would love to see some cyber security / forensic stuff as that's what I'm currently studying for an associates degree. I see alot of the attacking and vulnerability side, but would like to see more content on defensive and forensic analysis.
@ldavader27042 жыл бұрын
Hey Chris, what about other TLS traffic which is not made from any browser? Thanks
@ChrisGreer2 жыл бұрын
I've only been able to get it to work with Chrome and Firefox, I haven't tried to store them from any one app.
@OnlymeLLAMA2 жыл бұрын
I'm having trouble finding "Server Hello" I can find "Client Hello" but not Server. I tried to do the same thing as it shows in the video but I only got some random stuff that I don't know what it means, and sometimes I get nothing at all, even if I'm trying to start the same thing again, nothing shows up (When I do "frame contains 'whatever'" but when I don't do that it shows things that I don't understand). I need help idk what I'm doing. I tried on a website that I wanted to test but only found "Client Hello" or sometimes nothing, and I did the same for Wireshark website but only found "Client Hello" or nothing at all.
@ChrisGreer2 жыл бұрын
Hmm... sounds like something to do with the way Wireshark is dissecting. Can you make sure you have the latest version installed? Also - if you like you can send me the pcap and I will take a peek. packetpioneer@gmail.com
@Mike-sx5en3 жыл бұрын
You got a new subscriber 🙃😉
@ChrisGreer3 жыл бұрын
Awesome! Thanks for the sub and see you around the channel.
@txKonen7 ай бұрын
I'm sorry, but you referenced at 1:18 - SSLKEYLOGFILE to \users\chris but never referenced it again. At 5:38, you referenced a different file. Were they meant to be the same?