Hi All

I am testing some things with xplico and want to decrypt ssl traffic. Is it possible to do? I've the private key of the sessions but no idea where to implement it...

big thanks in advance

StiX

Hi StiX,
at the moment there is no ssl dissector.
However, we have already studied the problem. Our intention is not to use the code of Wireshark but rather use a good library developed by Vladimir Shcherbakov of Atomic Labs.
The name of library is DSSL at can be found here ( The Pion projects are very interesting ) .
One of the advantages of this library is that we can use only the SSL decryption layer and then our ssl-dissector can be "connected" at the tcp dissector.
The ssl-dissector was designed so that it can be used in two modes provided by Xplico:
- cascade mode (a dissector depends on another dissector)
- internal mode (a dissector call an other dissector)

For example:
https (cascade mode): eth->ip->tcp[443]->ssl->http
pop after STARTTLS command (internal mode): eth->ip->tcp[110]->pop(ssl)

Development is not complicated... but we do not have the time .
Xplico is funded only by our free time. We have many ideas, but we do not have much free time .

ok