I've used Microsoft Network Monitor 3.x before for various reasons but realized today I don't know how to tell the URL inside a conversation. I've got it set for "Windows" Parser Profile and I see a list of TCP and TLS packets, but was hoping there was an easy trick to decipher the HTTP URL requested in the packet details. Fiddler isn't showing me anything for this app accessing the web so I've resorted to netmon which shows me conversations but not sure how to dig out URL's, if possible.
asked Mar 16, 2011 at 4:45
Add a comment
|
2 Answers
There is an open source NetMon "expert" that can decrypt SSL. As long as you're using one of the cipher suites it supports and, obviously, you have the appropriate private key you should be able to decrypt the traffic.
answered Mar 16, 2011 at 9:51
-
That's a good start but don't know what to use as the key for the BPA app. Commented Mar 16, 2011 at 17:31
-
You need the private key from the remote server. If you don't have that then you won't be able to decrypt the traffic. You can't just arbitrarily decrypt SSL traffic w/o the keys used to establish the secure channel (since that's the point of SSL). Commented Mar 16, 2011 at 18:04
-
I guess what I meant was does Windows have a default SSL key of sorts for apps? I imagine what I want is the private key locally of what is coming in/out of the client app. I understand PKI well but not sure how Windows apps manage their keys. Is there a default IE one I could at least try? This could be a separate SF question I know. Commented Mar 21, 2011 at 23:39
"Microsoft Network Monitor" does not decode https traffic.
You may use an internet monitoring program(for example: WFilter, websense) instead.
