[tulamba]

I am stuck in this question. I tried my best but it seems I am not able to find the google query. It seems for some reason, I was not able to decrypt the trace :(

Here is the question

PHP Code


<?php 
Someone performed a Google search, the evidence of which was recorded in the file "https.pcap". What was the one-word search term?
(Hint: You will also need privkey.pem.) 


google.com/file/d/1ghYh5EDndlTB-nUgvZ7TNjUR-XpL5YzO/view?usp=sharing]https.pcap
google.com/file/d/141Mdr6Y0y2NMO07Fz_DeJm184FOp_BI-/view?usp=sharing]privkey.pem

Any hints or help will be deeply appreciated.

[CyberStrike]

Well after you have the ssl cert you need a session key.

https://jimshaver.net/2015/02/11/decrypt...-easy-way/

( it's a local variable pretty much give the article a read)

[tulamba]

Well after you have the ssl cert you need a session key.  

https://jimshaver.net/2015/02/11/decrypt...-easy-way/

( it's a local variable pretty much give the article a read)

Thanks for your reply. I did go through this article but it didn't help :(

[pandass]

I put it in wireshark, added the pem file as a SSH key and one of the decoded files was titled (bunch of text)"toomanysecrets", so I used that