re-tls

Decrypt TLS traffic by setting the SSLKEYLOGFILE environment variable before launching Chrome or Firefox, then point Wireshark or tshark to the keylog file. Use tshark -r capture.pcap -o tls.keylog_file:keys.log to re-parse and view plaintext HTTP fields.

Extract JA3 fingerprints with tshark -r out.pcap -Y 'tls.handshake.type == 1' -T fields -e tls.handshake.ja3. JA4 requires Wireshark 4.2 or later and uses the tls.handshake.ja4 field; cluster results with sort and uniq to group client stacks.

TLS 1.3 has no master secret; it uses per-session traffic secrets recorded in the keylog as CLIENT_HANDSHAKE_TRAFFIC_SECRET and similar entries. Hand the keylog file directly to Wireshark or tshark, which automatically derives record keys for both TLS 1.2 and 1.3.

Bypass certificate pinning by using Frida to hook validation functions like SSL_CTX_set_verify or X509_verify_cert so they return success, then route traffic through mitmproxy. Perform this in a sandboxed environment and document the bypass method and target version.

Decryption is impossible when only a pcap exists without session keys, because ECDHE forward secrecy keeps session keys in endpoint memory only. In that case, fall back to metadata analysis of SNI, certificates, packet lengths, and timing patterns.