Decryption of HTTP traffic

Jonah Burgess <[email protected]> Wed, 28 Aug 2019 21:22:14 +0000

Newsgroups	gmane.comp.security.detection.bro
Message-ID	<AM6PR07MB53035B950E71AE81956C54138EA30@AM6PR07MB5303.eurprd07.prod.outlook.com>

Hi,

When feeding PCAPs to Zeek, is there any functionality to decrypt HTTPS traffic?

I see that the SSL log contains “a record of SSL sessions, including certificates being used” -  can these certificates be used to decrypt PCAPs before Zeek processes them to ensure HTTP logs are correctly populated?

Thanks,
Jonah

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek