Sniffing Encrypted Traffic (w/ keys)

From: Brad DeShong (brad_at_deshong.net)
Date: 06/23/05

  • Next message: Brad DeShong: "Re: Sniffing Encrypted Traffic (w/ keys)" 
    Date: Wed, 22 Jun 2005 21:42:52 -0500
To: pen-test@securityfocus.com

    During a recent assesment we compromised SSL keys for a webserver and
    wanted to sniff the "encrypted" traffic. In theory this works, but
    what tools exist to do this in practice? I've seen Covelight's
    Clearwatch on a Windows system, but we're working with a Linux system on
    the inside. Is a MITM necessary or can it be done by just looking at
    the traffic after the fact (at least for the half of the connection we
    have keys for?).

    Thanks,
    Brad DeShong
    WestAnnex Security

  • Next message: Brad DeShong: "Re: Sniffing Encrypted Traffic (w/ keys)"