WireShark

Joel

— 1 min read

Since you are on Manjaro (Arch-based), the process is very straightforward. You’ll use the terminal to tell your browser to log the keys, then point Wireshark to that log file.

1. Generate the Key Log File

In Linux, you don't necessarily need to set a permanent system-wide variable. You can just launch your browser from the terminal with the instruction to log keys.

  1. Open your terminal.
  2. Run the following command to launch your browser (choose the one you use):
    • For Firefox:SSLKEYLOGFILE=~/Documents/sslkeys.log firefox
    • For Chromium/Chrome:SSLKEYLOGFILE=~/Documents/sslkeys.log chromium
  3. Keep that terminal window open while you browse to the jellyfish image on Pexels.

2. Configure Wireshark on Manjaro

Now that your browser is writing the "secret handshake" keys to ~/Documents/sslkeys.log, you need to show Wireshark where they are.

  1. Open Wireshark.
  2. Go to Edit > Preferences.
  3. On the left sidebar, expand Protocols and scroll way down to TLS (in older versions of Wireshark, this might be labeled SSL).
  4. Find the entry for (Pre)-Master-Secret log filename.
  5. Click Browse and select the sslkeys.log file from your Documents folder.
  6. Click OK.

3. Finding the Jellyfish

Once those steps are done, the "magic" happens:

  • The packets in your list that used to say TLSv1.3 or Application Data (usually colored purple) should now show an additional tab or line in the packet details for Decrypted TLS.
  • You can now use the filter http2 or http to see the actual requests.
  • Go to File > Export Objects > HTTP... (as we discussed before) and you should see the image files listed there.

A Quick Tip for Manjaro Users

If you are capturing live traffic and don't see any interfaces, you might need to add your user to the wireshark group so you don't have to run it as sudo (which is a security risk). Run this in your terminal:

Bash

sudo usermod -aG wireshark $USER

Note: You’ll need to log out and back in for this to take effect.

Does the sslkeys.log file show any text in it after you've visited the site?

Read more