Access the encrypted TLS payload
"Jay Wren (jawren)" <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <BL0PR11MB30746C18B59B8FA8C3EF696FC5750@BL0PR11MB3074.namprd11.prod.outlook.com> |
Hello, Apologies for my ignorant question, my C++ is worse than rusty and I'm completely new to binpac. I'm trying to access the CiphertextRecord restofdata here: https://github.com/zeek/zeek/blob/master/src/analyzer/protocol/ssl/ssl-dtls-analyzer.pac#L59 I'm expecting SSLRecord to have the data in the rec vector, based on how SSLRecord is defined. I must be misunderstanding something: https://github.com/jrwren/zeek/blob/6f7b2973bd23690b6cac65b4d8c0f8fa64e72758/src/analyzer/protocol/ssl/ssl-dtls-analyzer.pac#L61 The RecordText vector is always empty. How can I get at the encrypted data? Thanks, -- Jay _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek