With this key log file, we can decrypt HTTPS activity in a pcap and review its contents. Decryption is possible with a text-based log containing encryption key data captured when the pcap was originally recorded. This Wireshark tutorial describes how to decrypt HTTPS traffic from a pcap in Wireshark. When reviewing pcaps from malware activity, it’s very helpful to know what’s contained within post-infection traffic. But like most websites, various types of malware also use HTTPS. Why? Because most websites use the Hypertext Transfer Protocol Secure (HTTPS) protocol.

When reviewing suspicious network activity, we often run across encrypted traffic. The instructions assume you are familiar with Wireshark, and it focuses on Wireshark version 3.x. The left-most connector is male and the remainder are female DB-9 connectors.įor software if running Windows I'd recommend RealTerm which has a nice array of display options including hexadecimal and it supports logging including timestamps.This tutorial is designed for security professionals who investigate suspicious network activity and review packet captures (pcaps) of the traffic. If you were only interested in data flowing in one direction one of those connectors could be omitted, but it may make send to include both in case you require it in the future. So the grounds are connected together between all connectors and pin 2 is the receive pin allowing data to be received on a PC at the top and bottom.

To explain the above further here is the pinout of a male DB-9 connector taken from Quatech QSC-100D documentation which is the DTE connector you'd typically find on a PC:

Port A at the top for example will show data received by port A on the left: There are commercial solutions but here's the schematic and photo of a little DIY system I made a number of years back to handle the hardware side things, from left to right passes through all signals between the system being analyzed and the top and bottom you can connect to a pair of RS-232 ports on a PC or laptop.

Port sniffing