Decrypting HTTPS Traffic With Wireshark

Decrypting HTTPS Traffic With Wireshark

by HackerSploit · View the channel on PSI

Applied Sciences & Engineering Computing & Cybersecurity UTComputer networking and communicationsUTNNetwork security
🎙 HackerSploit 👥 1.0M 📅 May 17, 2022 ⏱ 15 min 👁 136K 📄 tutorial 🧭 2026-10-09
Available in: English (current) Français

Keywords

WiresharkHTTPSTLSPCAPMalware

Summary

This video tutorial by HackerSploit demonstrates how to decrypt HTTPS traffic captured in a PCAP file using Wireshark. The presenter starts by introducing a practical exercise: analyzing a PCAP file containing encrypted HTTPS data from a network infection. He explains how to load the provided SSL/TLS keys into Wireshark’s preferences to enable decryption. After configuring the keys, he applies filters to isolate HTTP requests and TLS handshakes, revealing a suspicious GET request for a DLL file named ‘invest20.dll’. This leads to identifying the infection as the Dridex malware, which is known to spread via malicious Excel macros. The presenter then shows how to export the DLL object from the decrypted traffic and analyze it using VirusTotal to confirm its malicious nature. He also demonstrates how to trace the command-and-control (C2) server communication through the decrypted HTTPS streams. Finally, he identifies the infected host by its network IP and hostname, providing a complete workflow for threat analysis. The video ends with a preview of the next topic: using Snort for intrusion detection.

171 words

Critical Evaluation

Value of the Information & Strength of the Argument

The video provides clear, step-by-step instructions that are valuable for cybersecurity professionals, especially those in blue team roles. The presenter walks through the entire process logically, from loading keys to exporting and verifying malware, making it easy to follow. The argumentation is solid, as every step is demonstrated live with real data, and the identification of Dridex is backed by the VirusTotal analysis. However, the video does not delve into theoretical explanations of TLS decryption or potential limitations, which might reduce its depth for advanced viewers.

Scientific Rigor, Source Quality, Title Accuracy

The main source referenced is the official Wireshark website, which is highly reliable. The PCAP exercise files and slides are provided via shortened links, but their origin is not directly verifiable. The title is fully aligned with the content, though the video extends beyond decryption to include malware analysis. The presenter’s method is practical and reproducible, but the lack of citations to external research or documentation weakens the scientific rigor. No comments were available for analysis.

177 words

Title / Content Match

The title accurately describes the content, as the video focuses on decrypting HTTPS traffic with Wireshark, though it also covers malware identification.

Quality & Reliability

7/10

The tutorial is practical and accurate, demonstrating a standard method for decrypting HTTPS traffic using provided TLS keys. However, it relies heavily on the presenter's experience without citing external authoritative sources beyond the official Wireshark website, limiting its scholarly rigor.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

External References

Contribution & Novelties

The video offers a practical, hands-on demonstration of decrypting HTTPS traffic using Wireshark, a skill essential for network forensics. It goes beyond basic decryption by integrating malware analysis, showing how to export and identify malicious binaries. The approach is original in its step-by-step workflow, tailored for blue team analysts. However, it does not introduce new technical concepts, as the method is well-established.

62 words

Radar Profile

Reliability 7/10