Decrypting HTTPS on Windows in Wireshark

Today, almost all HTTP traffic is encrypted between your web browser and the web server (HTTPS). If you capture HTTPS traffic, you normally cannot see the contents of the TCP payloads - because that is encrypted.
However, Wireshark can decrypt that traffic. If - and it is a big if - if you can find and provide Wireshark with the keys that HTTPS used, Wireshark can in turn also decrypt the contants of the conversation. This video will show you how to accomplish the decryption on a Windows machine using Chrome.

Thank You for watching. Please add your comments/questions below.

Follow me on Twitter: @awalding

Why use our online school? We add exercises and demonstrations on top of our videos!

[stanev]

Works perfectly if you follow the exact instructions!

[dirkxi]

Absolutely fantastic video! Easy to follow! Instructions were crystal clear! Subbed!

[makethisgowhoosh]

This is great to see how packets work, but with all the prep work and restrictions, how would this be useful in a real-life environment?

[rajatrana]

it worked after I put exact same variable name as you

[guilhermepacheco]

Amazing explanation of the content, congratulations!

[pedrof]

Great job, good sound and explanation. Best video actualy about it.

[DemsW]

How does windows know where to put the keys in when the variable name and path are custom ? How does that work

[lokeshreddysura]

That's really a clear and great tutorial.

I did the same and i could read till certificate after that i could read the data.

There are mac addresses in the data fields and some characters

How can i over come this

[ananyasa]

I have one doubt, I have wireshark in kali linux and want to capture packets of windows..is it possible?

[humanbeing]

For some reason the keys directory does not appear in file explorer, I'm running windows 11, any help would be appreciated.

[armincal]

This is what i have been thinking about lately. Even if a client is establishing a secure connection to the server like HTTPS, they still have to exchange the key at some point right? And the key cannot be encrypted itself because then you would need another key to unlock the key which starts an endless loop. So the key must be exchanged in plaintext right? What is stopping someone who is sniffing your conversation(like a man in the middle) from stealing the key and the encrypted messages between the client and the server and read everything?

[fanyang]

After I chose key file, nothing changed (no http shown), what could be possibly wrong?

[DemsW]

Would there be any uses for that a part from reverse engineering a website's communication ? It's still good info though great video

[DjCtavia]

Clearest tutorial seen. Thank's ;)

[saulealex]

it is possible to find usernames and passwords from https web sites ?

[chriswesley]

As someone already asked twice but didn't get an answer, here is the question again.

You chose an arbitrary name ("just give it a title so you can easily recognise this") for your environment variable and location for your keys directory. You didn't tell Windows or anything else what those choices were. So how does anything know to interrogate that variable and put key files in that folder? And for those reasons, of course, it doesn't work for me either, and I don't;see how it could work for anyone else either.

[ilemt]

Does it work for any process?(such as curl)

[danieasafiaa]

Exact like in tools developer option on chrome at network tab

[owordose]

Will the text file be updated as soon as new keys come in and do I get the keys if I google on another device?

[AgungDimasIrawan]

how i can find data login in https web site with this method? i try to login with https, but i just can see username= password= . please help