When reviewing pcaps from malware activity, it’s very helpful to know what’s contained within post-infection traffic.

But like most websites, various types of malware also use HTTPS. Why? Because most websites use the Hypertext Transfer Protocol Secure (HTTPS) protocol. When reviewing suspicious network activity, we often run across encrypted traffic. The instructions assume you are familiar with Wireshark, and it focuses on Wireshark version 3.x. In order to do this, find the CLIENT_HELLO frames of the sessions of interest in Wireshark and match the Random bytes to the lines in the tutorial is designed for security professionals who investigate suspicious network activity and review packet captures (pcaps) of the traffic. This will only allow the chosen sessions to be decrypted by the third party. If you need to limit the scope of the information given to a third-party for debugging, you can only copy a subset of the lines from the file. The sslkeyfile.log will contain the master secret for all sessions inbound and outbound from DataPower. Note: only sessions that have captured the full SSL keyexchange consisting of CLIENT_HELLO and SERVER_HELLO can be properly decrypted. If packets are not decrypting properly, you can enable a debug output file under “Preferences -> Protocols -> SSL”:

Now load the packet capture file using “File -> Open” to see that the TLS sessions containing a complete TLS handshake are now decrypted automatically. If you’re using a non-standard port for HTTPS, update “Preferences -> Protocols -> HTTP” as shown below: In the (Pre)-Master-Secret log filename input, specify the location of the sslkeyfile.log copied from DataPower: Open Wireshark and from the menu select “Preferences -> Protocols -> SSL”. Stop the packet capture and copy logtemp:///sslkeyfile.log and temporary:///capture.pcap to a system running Wireshark: Once the packet capture is started the system will begin logging the private master secret information to logtemp:///sslkeyfile.log System administrators have the option to enable this feature when starting a network packet capture:

How to decrypt wireshark capture