To decrypt the packets we need the matching TLS keys, Chrome and Firefox will provide these when the SSLKEYLOGFILE environment variable is set but unfortunately there seems to be no equivalent for Safari.įortunately thanks to tools like Frida, we have the ability to implement it ourselves. I’ve filtered the capture to just display the traffic to and from But as the traffic is encrypted using TLS 1.2 we can’t see the contents of the packets. You should see a screen something like this: If they’re not already installed, install xcode’s command line tools:.

You can find more details in this article from Apple but the basic process is: This mirrors the network traffic from the device to a virtual interface in MacOS and from there the traffic can be captured using tools like tcpdump and Wireshark. Capturing iOS network trafficĪpple support capturing iOS device network traffic via a Remote Virtual Interface (RVI).

In this post I walk through how I capture iOS apptraffic using tcpdump, and how I use a Frida script to extract the TLS keys during the capture so that I can decrypt the traffic too. Safari and iOS doesn’t have this feature natively, and proxies like Charles only communicate to the browser via HTTP/1.x so I needed to find another solution. One challenge with analysing HTTP/2 traffic is that it’s encrypted and while Chrome and Firefox support logging TLS keys and tools like Wireshark can then decrypt the traffic. Sometimes I can use the tools built into browsers, other times proxies, but when I want to take a deeper look and particularly if I’m looking at how a browser is using HTTP/2, I rely on packet captures. Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended.I often want to examine the web traffic generated by browsers, and other apps. Interested in sponsoring my videos? Reach out to my team here: decryption How to Decrypt SSL with Wireshark – HTTPS Decryption Guide: How to import the keys into Wireshark: 29:04 TLS negotiation and Wireshark details: 24:17 Which keys are stored in the keylog: 13:56

How do you get the capture (Man in the middle): 9:44

Learn how to decrypt TLS / HTTPS traffic using Wireshark. You can also follow along by downloading the Wireshark pcap using the link below. NOTE: Jump to 24:17 if you are only interested in the Wireshark capture and SSL decryption technical explanation.

Wireshark https traffic decrypt