[felixrules]

So i managed to decrypt a TLS session on a certain program i use that has multiple users connected to a client at the same time. I was wondering where a good place to be to look into understand the application data in the packet and if it possible to make it human readable to a certain extent. I'm mostly doing this to note patterns and if specific information that a user may not be able to see at the time is being shared on the network already. I may be able to explain more if this doesn't make sense.

[flamery]

If you already decrypted the tls, then its as human readable as it will ever get. I often find people have a false sense of security with tls and will post things like "registered=true" where as people not using tls will use utf-8 encoded strings which as far as my experience has gone are impossible to crack.

The only way is to debug the application and see what it does with the data.

[felixrules]

yea I was hoping there was something I could do with the hex string in the application data part of the packet. My experience in this kind of packet analysis is come to an end.

[flamery]

Not sure what you did buy my advice is use fiddler along with TLS decryption (trust their cert) and you will see as good as you can get

[felixrules]

I already have the packets in TLS decrypted it's just the application data that's in hex that i'm trying to figure out. I went as far as making filters for certain ones that repeated that I could see happening so i knew what that correlated to. This method has been very tedious.