A lot of tools allow us to view HTTPS traffic. Is there any tool out there which will decrypt TLS and allow me to see the network traffic for applications like Gtalk?
migrated from stackoverflow.com Apr 21 '11 at 14:35
This question came from our site for professional and enthusiast programmers.
closed as off topic by Zypher♦ Apr 21 '11 at 15:37
Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.
you can do this with wireshark (http://wiki.wireshark.org/SSL) but it relies on you having access to the browser and server keys.
The standard way to do this is to use a proxy that will offer its own TLS certificate to your browser in place of the legitimate one (Google in this case). If your browser trusts that cert, then the website should function normally; however, the proxy will be transparently decrypting the traffic from the browser, displaying and logging it, then re-encrypting it with the correct Google certificate to transmit to the Gmail server. This is really an exercise in conducting an intentional Man in the Middle attack against yourself.
Here's how to do this with Burp:
Example Decrypted GChat data:
I highly suggest you set up a specific browser profile, or even a separate browser entirely for this work since your browser is completely trusting these proxy root certificates for any purpose.