Sniffing TCP packets using Wireshark

Question

I am trying to reverse engineer a decoder. The decoder contains a web server that makes sending/receiving information through the Internet possible. To do so I need to sniff the packets that the decoder receives from an Android application installed on my phone, this application is what controls the decoder.

I tried using Wireshark at first, but it turned out that the packets are sent over SSL, so they are all encrypted. I then tried to sniff my TCP packets using mitmproxy, which didn't work since it doesn't sniff TCP packets, it only logs packets sent over HTTP.

After reading the answers to the following question How can I capture all traffic network by mitmproxy?. I decided to give Wireshark a second try.

However, I need the private key which is stored on the decoder. This will enable me the decrypt the SSL packets.

Is there any way I can get this private key from the decoder? would openssl solve this problem? I am on Linux, Ubuntu.

I would appreciate some help with this!

Answer 1

You can instead try injecting code into the process to dump the raw data before it is encrypted/after it is decrypted.

You can use Google's ssl_logger for that.

You need to run python ssl_logger.py -pcap log.pcap 123 with 123 being the process ID. Add -verbose to see live output.

(Note that it needs Python2 and not Python3.)

Once you are done, quit with Ctrl+C and analyze the log.pcap file in Wireshark, it will now contain unencrypted data.