0

I have a exe file, which is sending an https request to the remote server and I think, is downloading something from the site. With process hacker 2 I've got only the remote IP, but I need to see get or post parameters too. Wireshark is seeing the sent request, but all data is encrypted by SSL. It looks like that - https://prnt.sc/sft9a6 Is there any way to decrypt SSL traffic?

2

1 Answer 1

0

Try running the traffic from the exe file through a TLS proxy to inspect the decrypted TLS traffic. You can use PolarProxy (our tool) or SSLsplit to generate a PCAP file with the traffic in decrypted form. Another option is to run the traffic through mitmproxy and let it export the SSL key material.

Also, setting an SSLKEYLOGFILE environment variable variable will probably not be of much help since it is only respected by a handful number of applications, primarily browsers. Most other software will simply continue doing SSL as usual, without logging any keys. This issue is particularly obvious when trying analyze network traffic from malware.

2
  • Is your tool available for windows? I see only links for Linux. And for Windows only some certificate installations
    – Mike2233
    May 16, 2020 at 6:17
  • @Mike2233 We have so far only released Linux builds of PolarProxy. We'd love to release a Windows build as well as, but we haven't found a decent way of redirecting outgoing traffic to the proxy in Windows. The Windows firewall doesn't allow REDIRECT actions for Outbound Rules (only ALLOW and BLOCK). This limitation defeats the purpose of running the proxy on the Windows machine.
    – netresec
    May 18, 2020 at 6:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.