6

I would like to use tcpflow to monitor https requests. I have read tutorials on how to monitor http traffic but when I connect to a host using https the output is garbled. I am using tcpflow in the following manner:

sudo tcpflow -s -c -i eth0 src or dst host api.linkedin.com
5

If you have a copy of the key you can use ssldump which uses a syntax almost identical to tcpdump.

It won't be quite as pretty as tcpflow, but you can get at the encrypted content.

  • 1
    ssldump link is outdated – zygimantus Sep 13 '18 at 17:20
3

You're missing the point of HTTPS. You cannot read (much) meaningful information from a HTTPS stream, as the TCP layer encapsulating it is encrypted. Ultimately that means that the data will look like garbage to anyone trying to intercept it (including you).

  • If I am not mistake I would have to set-up a http proxy, any recommendations? – Ifthikhan Nov 22 '12 at 19:25
2

You can try sslstrip.

More info here

  • 3
    This won't work with HSTS, and is generally extremely questionable for legitimate purposes. – Chris Down Nov 22 '12 at 19:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.