Skip to content

Add support for network capture decryption#20024

Merged
adfoster-r7 merged 1 commit intorapid7:masterfrom
cgranleese-r7:add-support-for-network-capture-decryption
Apr 11, 2025
Merged

Add support for network capture decryption#20024
adfoster-r7 merged 1 commit intorapid7:masterfrom
cgranleese-r7:add-support-for-network-capture-decryption

Conversation

@cgranleese-r7
Copy link
Contributor

Needed to support changes made in rapid7/rex-socket#74.

This pull request adds enhanced support for network capture decryption. By writing to the sslkeylogfile it enable network capture decryption which is useful to decrypt TLS traffic in wireshark.

Needs tested with the above rex-text changes, to do this add the following to the Metasploit-Framework Gemfile:

gem "rex-socket", path: "../rex-socket"

Then bundle install.

Verification

  • Start msfconsole
  • Use scanner/http/title
  • Run run rhosts=https://www.google.com verbose=true httptrace=true sslkeylogfile=./sslkeylogfile.txt
  • The module should complete
  • Run ls -la and you should now see a file called sslkeylogfile.txt

@cgranleese-r7 cgranleese-r7 added enhancement rn-enhancement release notes enhancement labels Apr 11, 2025
@cgranleese-r7 cgranleese-r7 force-pushed the add-support-for-network-capture-decryption branch from 1ce9faa to f4340a6 Compare April 11, 2025 11:06
@cgranleese-r7 cgranleese-r7 marked this pull request as ready for review April 11, 2025 11:07
@cgranleese-r7 cgranleese-r7 force-pushed the add-support-for-network-capture-decryption branch from f4340a6 to 3ee6abd Compare April 11, 2025 11:25
@adfoster-r7
Copy link
Contributor

Looks like this is missing some of the other protocols, we'll circle back to that after this code goes out 👍

@cgranleese-r7 cgranleese-r7 force-pushed the add-support-for-network-capture-decryption branch 2 times, most recently from 0c28290 to 12f8cac Compare April 11, 2025 12:31
@cgranleese-r7 cgranleese-r7 force-pushed the add-support-for-network-capture-decryption branch from 12f8cac to c79f7db Compare April 11, 2025 12:34
@adfoster-r7 adfoster-r7 merged commit 053f0e8 into rapid7:master Apr 11, 2025
31 checks passed
@cgranleese-r7 cgranleese-r7 deleted the add-support-for-network-capture-decryption branch April 11, 2025 12:43
@adfoster-r7
Copy link
Contributor

Release Notes

Adds a new sslkeylogfile datastore option to HTTP modules to support decrypting SSL/TLS network traffic

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement rn-enhancement release notes enhancement

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants