Get the answer without decrypting anything

short · 50 min · Objective 1.3

Task

Take an encrypted session from your own lab and extract everything that is still legible: the destination, the certificate, the name requested, the timing, the volume, the direction. Then state precisely what you could not learn.

Steps

  1. On the Windows VM, generate a self-signed certificate and serve HTTPS on port 8443.
  2. From the Linux VM, start a capture, then fetch a large file and a small file over HTTPS, and send a small amount of data up with a POST.
  3. Stop the capture. Extract, in this order: the TCP endpoints, the TLS version, the SNI, the certificate subject and issuer, and the JA3-style handshake details if your tshark build provides them.
  4. Now measure rather than read: total bytes each way, packet counts, the duration, and the ratio of upstream to downstream bytes.
  5. Write two lists. What you learned. What you could not learn -- and for each item on the second list, whether any vantage point in your lab could have learned it.

Verify

tshark -r /tmp/tls.pcap -Y "tls.handshake.type==1" -T fields -e tls.handshake.extensions_server_name
tshark -r /tmp/tls.pcap -Y "tls.handshake.type==11" -T fields -e x509sat.printableString | head -3
tshark -r /tmp/tls.pcap -q -z conv,tcp | head -8

The first must print the server name from the handshake -- sent in clear text before encryption begins, which is why SNI is the single most useful field in encrypted traffic. The second must show the certificate subject. The third is the conversation table with byte counts each way, which is how an analyst spots an upload without seeing a single byte of it.

Notes

The upstream/downstream ratio is the exfiltration signal. Ordinary browsing is heavily downstream; a host sending far more than it receives, to one destination, over a long session, is the shape worth alerting on -- and it is completely unaffected by encryption.

Note where SNI stops helping: with encrypted client hello, the first command returns nothing, and your detection has to fall back to the certificate and the timing. Write down which of your findings survive that.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.