+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: search google query in wireshark trace (/showthread.php?tid=5830402)
search google query in wireshark trace - tulamba - Apr 27, 2018
I am stuck in this question. I tried my best but it seems I am not able to find the google query. It seems for some reason, I was not able to decrypt the trace :(
Here is the question
PHP Code
<?php
Someone performed a Google search, the evidence of which was recorded in the file "https.pcap". What was the one-word search term?
(Hint: You will also need privkey.pem.)
google.com/file/d/1ghYh5EDndlTB-nUgvZ7TNjUR-XpL5YzO/view?usp=sharing]https.pcap
google.com/file/d/141Mdr6Y0y2NMO07Fz_DeJm184FOp_BI-/view?usp=sharing]privkey.pem
Any hints or help will be deeply appreciated.
RE: search google query in wireshark trace - CyberStrike - Apr 27, 2018
Well after you have the ssl cert you need a session key.
https://jimshaver.net/2015/02/11/decrypting-tls-browser-traffic-with-wireshark-the-easy-way/
( it's a local variable pretty much give the article a read)
RE: search google query in wireshark trace - tulamba - Apr 28, 2018
(Apr 27, 2018 08:18 PM)sirru5h Wrote: Well after you have the ssl cert you need a session key.
https://jimshaver.net/2015/02/11/decrypting-tls-browser-traffic-with-wireshark-the-easy-way/
( it's a local variable pretty much give the article a read)
Thanks for your reply. I did go through this article but it didn't help :(
RE: search google query in wireshark trace - pandass - May 1, 2018
I put it in wireshark, added the pem file as a SSH key and one of the decoded files was titled (bunch of text)"toomanysecrets", so I used that