Once you have made a connection to the sheep, pass all traffic from/to the sheep through a network tap device, and use a standard sniffing tool to dump all the traffic (e.g., tcpdump). If sniffing remotely, carry out a MITM attack, such as ARP Poisoning, with a tool like Bettercap.In order to sniff HTTPS traffic, we can either sniff remotely or locally. OpenSSL and other online converters can convert private keys among the various formats available. Ultimately we're looking for private keys in either PEM or PKCS12 format. How might you obtain the private key they use for HTTPS, which would allow you to decrypt all of their HTTPS traffic? Suppose you wish to eavesdrop on a sheep's HTTPS traffic, and you have physical access to their machine. Unlike SSLStrip or SSLSniff, this attack requires more information from the sheep (and potentially requires more invasive methods), but is entirely transparent to the sheep if carried out correctly. This page will cover an attack on HTTPS that utilizes a stolen private key to decrypt and sniff HTTPS traffic from a sheep user. 2.1.4 Inspecting Decrypted Traffic in Wireshark with SSLKEYLOGFILE.2.1.3 Obtain SSL Session Info from Firefox.2.1.2 Start Capturing Traffic with Wireshark.2.1.1 Optional: Start Man in the Middle Attack.1.3 Decrypting SSL Traffic with SSL Info.And you have just located the password and username you have entered on the unprotected login page - whether or not the password and username are correct are irrelevant. Once you get there look in the red text paragraphs and try to find what I was able to locate in the picture. Then you will right click on it and go down to 'FOLLOW' then to 'TCP STREAM'. You can see exactly what I am talking about if you follow the pictures above. Then at the far right of the packet in the info section you will see something like '.login' or '/login'. This drastically narrows the search and helps to slow down the traffic by minimizing what pops up on the screen. By filtering this you are now only looking at the post packet for HTTP. Wireshark comes with the option to filter packets. HTTP (Hyper Text Transfer Protocol) is the protocol we will be dealing with when looking for passwords. The second step to finding the packets that contain login information is to understand the protocol to look for.

Setting decryption key on wireshark mac