Monitoring HTTPS traffic using tcpflow

Question

I would like to use tcpflow to monitor https requests. I have read tutorials on how to monitor http traffic but when I connect to a host using https the output is garbled. I am using tcpflow in the following manner:

sudo tcpflow -s -c -i eth0 src or dst host api.linkedin.com

Solution 1

If you have a copy of the key you can use ssldump which uses a syntax almost identical to tcpdump.

It won't be quite as pretty as tcpflow, but you can get at the encrypted content.

Solution 2

You're missing the point of HTTPS. You cannot read (much) meaningful information from a HTTPS stream, as the TCP layer encapsulating it is encrypted. Ultimately that means that the data will look like garbage to anyone trying to intercept it (including you).

Solution 3

You can try sslstrip.

More info here

Comments

[Ifthikhan]

If I am not mistake I would have to set-up a http proxy, any recommendations?

[zygimantus]

ssldump link is outdated

[Kalyan]

This is such an old question! You will need to do a 'MITM attack'. As long as the browser/client trusts the ssl certificate put up by the proxy in the middle. On windows, I recall using some web request sniffer tool that can decrypt ssl traffic, which I used for debugging purposes while developing. Can't recall the name though. Companies monitor ssl traffic these days using this approach.