# WireShark tricks

## Decrypting TLS

### Decrypting https traffic with server private key

*edit>preference>protocol>ssl>*

![](https://2970664952-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MLAfgNVMwHXqnouOUJz%2Fsync%2F2c18e67c06696b5f671842c2b5bdf49dad0f52da.png?generation=1604368588641807\&alt=media)

Press *Edit* and add all the data of the server and the private key (*IP, Port, Protocol, Key file and password*)

### Decrypting https traffic with symmetric session keys

It turns out that Firefox and Chrome both support logging the symmetric session key used to encrypt TLS traffic to a file. You can then point Wireshark at said file and presto! decrypted TLS traffic. More in: <https://redflagsecurity.net/2019/03/10/decrypting-tls-wireshark/>\
To detect this search inside the environment for to variable `SSLKEYLOGFILE`

A file of shared keys will looks like this:

![](https://2970664952-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MLAfgNVMwHXqnouOUJz%2Fsync%2Fb6cad7d36423ee8c4f315e55224042706854019f.png?generation=1604368588624763\&alt=media)

To import this in wireshark go to *edit>preference>protocol>ssl>* and import it in (Pre)-Master-Secret log filename:

![](https://2970664952-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MLAfgNVMwHXqnouOUJz%2Fsync%2Fab5d833dca662874145ccaae213eea334acd6cc8.png?generation=1604368588675642\&alt=media)
