Waraxe IT Security Portal

Harq · Regular user

I have been trying out password sniffing (nothing serious, just for a joke on a friend), and I am wondering if I can decrypt the information sent over ssl.

I use Wireshark and have all the packets, so logically, shouldn't I be able to use this to decrypt the sent app data? Unfortunately, I cannot seem to find anything on the topic =\

waraxe · Site admin

There is two private RSA keys, in case of GMail SSL connection one private key is somewhere in Google servers and another in web client home PC. And of course, no private RSA keys ever will be sent over the wire. And if you can't somehow "steal" one or both these private keys - you can't decrypt sessiont keys, used to encrypt actual data stream.

So bottom line - only if you can break in to target's home PC and steal private key, then you can "read" half of traffic - coming from Gmail server.

Another example - you have just hacked in to some webstore server and got private key from webserver. Let's assume that it's not password protected, etc ...
Now, if you sniff traffic between any clients and that compromised webserver, then you are able to "read" traffic from client to webserver. Data from webserver to client remains encrypted.

There are of course MITM possibilities, but that's another strory.
SSL is meant to be secure and it is ... as far as new security holes are not developed Smile

y3dips · Valuable expert

like waraxe said, yep .. thats the thing goes work

easy way is MITM, just fake one of the certificate, n hope the user wont notice
(90%) of them just ignore the error warning

easy way, use cain n abel.

Harq · Regular user