+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Blackhat Training (https://hackforums.net/forumdisplay.php?fid=405)
+----- Forum: Reverse Engineering (https://hackforums.net/forumdisplay.php?fid=229)
+----- Thread: Application data in network packets to human readable (/showthread.php?tid=5335690)
Application data in network packets to human readable - felixrules - Jul 11, 2016
So i managed to decrypt a TLS session on a certain program i use that has multiple users connected to a client at the same time. I was wondering where a good place to be to look into understand the application data in the packet and if it possible to make it human readable to a certain extent. I'm mostly doing this to note patterns and if specific information that a user may not be able to see at the time is being shared on the network already. I may be able to explain more if this doesn't make sense.
* - flamery - Jul 11, 2016
If you already decrypted the tls, then its as human readable as it will ever get. I often find people have a false sense of security with tls and will post things like "registered=true" where as people not using tls will use utf-8 encoded strings which as far as my experience has gone are impossible to crack.
The only way is to debug the application and see what it does with the data.
* - felixrules - Jul 12, 2016
yea I was hoping there was something I could do with the hex string in the application data part of the packet. My experience in this kind of packet analysis is come to an end.
* - flamery - Jul 12, 2016
Not sure what you did buy my advice is use fiddler along with TLS decryption (trust their cert) and you will see as good as you can get
* - felixrules - Jul 12, 2016
I already have the packets in TLS decrypted it's just the application data that's in hex that i'm trying to figure out. I went as far as making filters for certain ones that repeated that I could see happening so i knew what that correlated to. This method has been very tedious.