Analyzing HTTPS traffic – SSL/TLS basics
HTTPS is a secure version of the HTTP. The S means that it is secured by Secure Socket Layer (SSL)/Transport Layer Security (TLS). It is used when you connect to your bank account, Webmail service, or any other service that runs over HTTP and requires security.
In this recipe, we will see how it works and what can fail when we are using HTTPS communications.
Getting ready
Port-mirror to the suspected device or link that forwards traffic from several devices, and start the capture. HTTPS works with TCP port 443, and this is what you should watch, unless you have a custom application that uses different ports, as discussed in the Configuring HTTP preferences recipe.
How to do it...
To monitor HTTPS sessions, perform the following steps:
- HTTPS session establishment can be done in four or five steps. It is described in the How it works... section of this recipe.
- Watch the order of the packet in the session establishment, and make sure the messages you get are...
