The main point is to save the SSL/TLS keys those used by the web browser (SSLKEYLOGFILE=/tmp/tmp-google/.ssl-key.log
).
In the example below we run brand new instance of Google Chrome (--user-data-dir=/tmp/tmp-google
do the trick):
SSLKEYLOGFILE=/tmp/tmp-google/.ssl-key.log /Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --user-data-dir=/tmp/tmp-google
Then run the Wireshark and open the Preferences -> Protocols -> SSL, where we put the path to the SSL keys log file into the (Pre)-Master-Secret log filename
field.
Now all SSL/TLS traffic from this browser instance will be decrypted.
- Put
tlskeylogger.plist
at~/Library/LaunchAgents/tlskeylogger.plist
launchctl load ~/Library/LaunchAgents/tlskeylogger.plist
, so it will load on the next restartlaunchctl start ~/Library/LaunchAgents/tlskeylogger.plist
, so it will load the environment variable immediately- Restart your browser(s)
- See how TLS keys are being written to
~/.tlskeyfile
viatail -f ~/.tlskeyfile
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
filepath = 'local-filepath' | |
url = 'web-url' | |
File.open(filepath, 'w') {|f| | |
block = proc { |response| | |
response.read_body do |chunk| | |
puts "Working on response" | |
f.write chunk | |
end | |
} | |
RestClient::Request.new(method: :get, url: url, block_response: block).execute |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
require 'openssl' | |
key = OpenSSL::PKey::RSA.new(2048) | |
p encrypted_string = key.public_encrypt('my plaintext string', OpenSSL::PKey::RSA::PKCS1_OAEP_PADDING) | |
p decrypted_string = key.private_decrypt(encrypted_string, OpenSSL::PKey::RSA::PKCS1_OAEP_PADDING) |