How to decrypt https

Question

How can i decrypt https with a network sniffer like wireshark or fiddler, without having administrative access to the server? For example if i log onto gmail, how can i set up wireshark from my computer to read all the http headers over the tls? I see tutorials online for decrypting https with wireshark, but they all say i need access to the private key of the server, and I assume this means that it is impossible to decrypt anything like the example i mentioned, gmail, is this correct or not?

Solution 1

Fiddler will do this from your pc if you turn on the decrypt https option. You can only do this for your traffic not others.

http://www.fiddler2.com/Fiddler/help/httpsdecryption.asp

Solution 2

To justify the s of https we agreed not to be able to decrypt network traffic.

Solution 3

It is true that in the general case, you cannot do this.

The only way to do this without the server key would be to launch a man-in-the-middle attack, such as with a tool like sslsniff or a proxy server with a known key. If needed, you could even create your own CA and instruct your browser to trust it, and issue your own private key+cert for what you wanted to sniff; then you could sniff your own traffic to the target.

Solution 4

In principle, you reasonably cannot do that, since it is the very purpose of HTTPS to ensure privacy of the connection.

View more solutions

Comments

[Kerrek SB]

By your logic, we also cannot watch DVD in Linux because the very purpose of CSS is to not let us watch DVDs in Linux.

[Basile Starynkevitch]

I'm not sure there is a libdvdcss equivalent for HTTPS. The libraries I know (Curl) are not able to "crack" an HTTPS connection.

[Dojo]

Technically, it does not decrypt. It uses its own certificate instead of the actual server's. A certificate error shows up on the browser. This is not decryption.

[OneChillDude]

Isn't the green lock in the url enough to convince people?

[Michael Krelin - hacker]

Some people have developed green lock blindness.