Wireshark SSL debug log dissect_ssl enter frame #4 (first time) ssl_session_init: initializing ptr 0x7f265a927060 size 688 conversation = 0x7f2686942088, ssl_session = 0x7f265a927060 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 39639 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4434 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #6 (first time) conversation = 0x7f2686942088, ssl_session = 0x7f265a927060 record: offset = 0, reported_length_remaining = 1245 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0x0003 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 1159 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898 record: offset = 898, reported_length_remaining = 347 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 333, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 903 length 329 bytes, remaining 1236 record: offset = 1236, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1241 length 0 bytes, remaining 1245 dissect_ssl enter frame #8 (first time) conversation = 0x7f2686942088, ssl_session = 0x7f265a927060 record: offset = 0, reported_length_remaining = 140 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 68, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 64 bytes, remaining 73 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929a... looking for RSA pre-master32acad72b858a286ba5fe24745258ef762da47719ed2ba27... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 key expansion[64]: | b3 a7 58 8e 43 4f 3e 0f 20 48 f5 6d 1f a7 18 98 |..X.CO>. H.m....| | 28 94 66 d6 e6 c8 b5 fc 82 60 49 6e 7b d0 19 bb |(.f......`In{...| | 48 67 9c 7d b3 58 6c dd 07 94 71 67 77 42 34 06 |Hg.}.Xl...qgwB4.| | 93 8b 7a 2c 11 59 c9 da 10 40 42 3d 21 78 ac c1 |..z,.Y...@B=!x..| ssl_generate_keyring_material MD5(client_random) ssl_generate_keyring_material MD5(server_random) Client MAC key[16]: | b3 a7 58 8e 43 4f 3e 0f 20 48 f5 6d 1f a7 18 98 |..X.CO>. H.m....| Server MAC key[16]: | 28 94 66 d6 e6 c8 b5 fc 82 60 49 6e 7b d0 19 bb |(.f......`In{...| Client Write key[16]: | 95 6b 28 90 bd 9f 9c bf 84 87 a5 8b f7 64 3d 3d |.k(..........d==| Server Write key[16]: | 83 bf 9a 95 db 76 ed 98 bf ee ca 14 45 c6 21 1b |.....v......E.!.| Client Write IV[8]: | 00 00 00 00 00 00 00 00 |........ | Server Write IV[8]: | d0 62 76 03 00 00 00 00 |.bv..... | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: ARCFOUR decoder initialized (digest len 16) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: ARCFOUR decoder initialized (digest len 16) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | 96 5d c5 5a e6 9e 9e 11 13 2c ab 48 f4 19 ab 80 |.].Z.....,.H....| | f9 7d 6c c8 c6 98 9e ae ff da 1d 57 d0 12 aa 25 |.}l........W...%| ssl_save_session stored master secret[48]: | 19 58 65 0f 35 74 79 29 55 54 da 62 f8 f3 0c 5f |.Xe.5ty)UT.b..._| | f9 38 d6 f8 30 7f 41 bf 90 1f 2a 94 fc 8a 03 f6 |.8..0.A...*.....| | d0 9e bb 32 ff 54 6b d6 3d a5 16 7a 01 9e 11 5e |...2.Tk.=..z...^| dissect_ssl3_handshake session keys successfully generated record: offset = 73, reported_length_remaining = 67 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 79, reported_length_remaining = 61 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 56, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 56 Ciphertext[56]: | 3f d9 e7 46 b4 5f 14 c0 4a 35 b3 fe 6b 40 50 93 |?..F._..J5..k@P.| | fe d6 83 02 2f 4c e7 18 c5 63 b8 d6 17 de 36 5c |..../L...c....6\| | 8b c9 25 17 5d 98 0b 55 66 60 c2 9d 0c 03 76 5a |..%.]..Uf`....vZ| | 31 ab ba a9 b0 66 23 0d |1....f#. | ssl_decrypt_record: allocating 88 bytes for decrypt data (old len 32) Plaintext[56]: | 14 00 00 24 7f e5 b9 73 7f fd a6 1d 29 d6 96 33 |...$...s....)..3| | 37 30 5f 88 44 98 a6 30 db 32 fc 09 ac a8 01 e6 |70_.D..0.2......| | 36 67 1b ae a6 0d 7c 74 24 89 9b b8 04 4c 19 47 |6g....|t$....L.G| | d6 97 8d 3a 2c 7a 6b d6 |...:,zk. | checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #9 (first time) conversation = 0x7f2686942088, ssl_session = 0x7f265a927060 record: offset = 0, reported_length_remaining = 67 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 61 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 56, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 56 Ciphertext[56]: | e5 99 34 7d 47 5d c6 69 31 e2 94 3e 7f 83 75 17 |..4}G].i1..>..u.| | 0f 0a e2 11 ba a3 d5 1b 6d 40 71 fa 2a b1 d3 33 |........m@q.*..3| | d2 cb 17 01 b7 46 3a bb b4 10 26 d3 e6 81 51 7d |.....F:...&...Q}| | bc 13 cc b8 1d 9c 54 55 |......TU | Plaintext[56]: | 14 00 00 24 a4 33 9b 09 d7 af 08 c5 a2 04 c1 a0 |...$.3..........| | 4d a2 16 3c 61 5a be 24 64 e4 b4 62 ac b7 81 23 |M..5.,....0..| | 99 |. | checking mac (len 65, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 65, seq = 0, nxtseq = 65 association_find: TCP port 39639 found (nil) association_find: TCP port 4434 found 0x3451b20 dissect_ssl3_record decrypted len 65 decrypted app data fragment[65]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 78 70 2d 72 63 34 2d 6d 64 |Host: exp-rc4-md| | 35 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |5.local.al.leken| | 73 74 65 79 6e 2e 6e 6c 3a 34 34 33 34 0d 0a 0d |steyn.nl:4434...| | 0a |. | dissect_ssl3_record found association 0x3451b20 dissect_ssl enter frame #11 (first time) conversation = 0x7f2686942088, ssl_session = 0x7f265a927060 record: offset = 0, reported_length_remaining = 376 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 371, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 371 Ciphertext[371]: | 7f bb 77 be 54 a3 47 11 fa 1b bc d6 d1 df 27 3f |..w.T.G.......'?| | 2f 52 89 bc 57 be 28 9c 26 9e f1 42 36 74 66 40 |/R..W.(.&..B6tf@| | a8 78 c3 7a 0a bb b0 0c fa 01 6d cc 54 f2 37 55 |.x.z......m.T.7U| | f5 6b 5d 95 a4 a5 90 fb 93 00 3a 20 ac 08 57 dd |.k].......: ..W.| | b5 51 3a e5 a2 f4 e0 b0 13 c2 f6 6f ff a3 33 e4 |.Q:........o..3.| | b2 88 43 7e cb 6a 55 75 7e 03 86 15 c1 d7 53 b7 |..C~.jUu~.....S.| | f4 d9 5f fe 10 9b 99 f5 12 e4 ff ab 18 19 9e ad |.._.............| | b1 6d 58 1d 07 44 36 43 e2 e7 25 a5 7b f9 f3 dd |.mX..D6C..%.{...| | e0 b1 ff 94 36 ed 4e 2c 14 4b eb 59 6d 4e 42 b9 |....6.N,.K.YmNB.| | 9f 58 3b 66 97 bd 02 23 c9 32 cf 2a 11 76 1a b8 |.X;f...#.2.*.v..| | 7b 68 9b 84 5f 47 e3 c9 89 92 fc 13 dc 66 8b 10 |{h.._G.......f..| | b3 82 3e 31 1b 9d 63 99 78 a0 8f 73 ac 41 9f 9a |..>1..c.x..s.A..| | e4 dc 94 ac ed 8c c9 be 44 db ec 1e 17 f2 0e ad |........D.......| | c1 7a 15 f3 63 a9 60 5d 8e 7c 89 d3 88 7e 75 03 |.z..c.`].|...~u.| | 5e 22 2b dc 3e 90 98 9c 93 4d 5f 17 63 da 50 35 |^"+.>....M_.c.P5| | cd 85 ef ef c0 e0 e9 13 3a 86 74 44 27 82 ad 3d |........:.tD'..=| | 2e 00 62 cf 66 39 19 9c 16 af ac 30 58 fb b8 a7 |..b.f9.....0X...| | be a3 91 1c 67 c2 d5 46 5e 2f 34 8d 7c c5 ae 77 |....g..F^/4.|..w| | 0d d8 e0 04 65 a6 cb 61 3c c7 09 38 44 a8 cd c6 |....e..a<..8D...| | 24 84 dc 17 2b bc 47 04 6c b7 75 50 b5 4e 22 1d |$...+.G.l.uP.N".| | b7 3e dd a4 93 4a ed 70 dc 55 3c f3 e2 2d 9c 10 |.>...J.p.U<..-..| | 29 91 df 8f 7f 85 de f0 14 35 23 b7 24 15 08 8c |)........5#.$...| | 31 9a 40 33 c4 e5 0f 59 34 bb 2c e3 f3 3b e4 43 |1.@3...Y4.,..;.C| | 18 d4 99 |... | ssl_decrypt_record: allocating 403 bytes for decrypt data (old len 88) Plaintext[371]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:16 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 38 0d 0a 43 6f 6e 6e 65 63 74 |th: 148..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 30 33 20 2d 20 45 58 50 2d 52 |x00,0x03 - EXP-R| | 43 34 2d 4d 44 35 20 20 20 20 20 20 20 20 20 20 |C4-MD5 | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 28 | SSLv3 Kx=RSA(| | 35 31 32 29 20 41 75 3d 52 53 41 20 20 45 6e 63 |512) Au=RSA Enc| | 3d 52 43 34 28 34 30 29 20 20 20 4d 61 63 3d 4d |=RC4(40) Mac=M| | 44 35 20 20 65 78 70 6f 72 74 3c 73 63 72 69 70 |D5 exportdocument.domai| | 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |n='local.al.leke| | 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 |nsteyn.nl'k.....*J.@D..| | 64 09 b3 |d.. | checking mac (len 355, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 355, seq = 0, nxtseq = 355 association_find: TCP port 4434 found 0x3451b20 dissect_ssl3_record decrypted len 355 decrypted app data fragment[355]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:16 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 38 0d 0a 43 6f 6e 6e 65 63 74 |th: 148..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 30 33 20 2d 20 45 58 50 2d 52 |x00,0x03 - EXP-R| | 43 34 2d 4d 44 35 20 20 20 20 20 20 20 20 20 20 |C4-MD5 | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 28 | SSLv3 Kx=RSA(| | 35 31 32 29 20 41 75 3d 52 53 41 20 20 45 6e 63 |512) Au=RSA Enc| | 3d 52 43 34 28 34 30 29 20 20 20 4d 61 63 3d 4d |=RC4(40) Mac=M| | 44 35 20 20 65 78 70 6f 72 74 3c 73 63 72 69 70 |D5 exportdocument.domai| | 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |n='local.al.leke| | 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 |nsteyn.nl' | dissect_ssl3_record found association 0x3451b20 dissect_ssl enter frame #12 (first time) conversation = 0x7f2686942088, ssl_session = 0x7f265a927060 record: offset = 0, reported_length_remaining = 23 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 18, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 18 Ciphertext[18]: | 23 cb ce f3 3e 1c e5 9c a3 18 2e 8b b1 ea 4b 4d |#...>.........KM| | c4 0c |.. | Plaintext[18]: | 01 00 81 89 fa 2d f0 bb 30 50 c1 71 72 27 ec 87 |.....-..0P.qr'..| | 1f 02 |.. | checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #14 (first time) conversation = 0x7f2686942088, ssl_session = 0x7f265a927060 record: offset = 0, reported_length_remaining = 23 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 18, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 18 Ciphertext[18]: | 18 39 1a 72 9e b6 e0 37 7d 2a d0 b5 44 7a 7f e1 |.9.r...7}*..Dz..| | b4 3b |.; | Plaintext[18]: | 01 00 12 6c 59 8b fa 9f 35 44 99 3f 9b f6 61 fe |...lY...5D.?..a.| | 77 a2 |w. | checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #19 (first time) ssl_session_init: initializing ptr 0x7f265a929780 size 688 conversation = 0x7f26869423d8, ssl_session = 0x7f265a929780 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 45669 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4435 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #21 (first time) conversation = 0x7f26869423d8, ssl_session = 0x7f265a929780 record: offset = 0, reported_length_remaining = 907 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0x0004 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 821 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898 record: offset = 898, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 903 length 0 bytes, remaining 907 dissect_ssl enter frame #23 (first time) conversation = 0x7f26869423d8, ssl_session = 0x7f265a929780 record: offset = 0, reported_length_remaining = 332 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 260, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 256 bytes, remaining 265 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d296898... looking for RSA pre-master5164da4eaa7f53fad32c696ff088651f000dbf2d6d475100... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 key expansion[64]: | 09 5d 8b 39 7f d1 fd f3 14 74 19 f8 96 9e 8f 13 |.].9.....t......| | 4c 43 d6 ee 15 db 98 d7 29 6d 27 d9 30 d7 c0 49 |LC......)m'.0..I| | 5b 0c 43 48 52 88 3b fa a1 c0 d4 18 64 f1 4d c1 |[.CHR.;.....d.M.| | a0 45 26 fa 6c 9e b4 b9 c0 d7 a3 9d 23 35 86 98 |.E&.l.......#5..| Client MAC key[16]: | 09 5d 8b 39 7f d1 fd f3 14 74 19 f8 96 9e 8f 13 |.].9.....t......| Server MAC key[16]: | 4c 43 d6 ee 15 db 98 d7 29 6d 27 d9 30 d7 c0 49 |LC......)m'.0..I| Client Write key[16]: | 5b 0c 43 48 52 88 3b fa a1 c0 d4 18 64 f1 4d c1 |[.CHR.;.....d.M.| Server Write key[16]: | a0 45 26 fa 6c 9e b4 b9 c0 d7 a3 9d 23 35 86 98 |.E&.l.......#5..| Client Write IV[8]: | 00 00 00 00 00 00 00 00 |........ | Server Write IV[8]: | 80 96 74 03 00 00 00 00 |..t..... | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: ARCFOUR decoder initialized (digest len 16) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: ARCFOUR decoder initialized (digest len 16) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | 6b 11 43 a3 f9 ef fc 65 f0 5b aa 1e 73 3d 8c 9c |k.C....e.[..s=..| | d6 93 c2 cd d7 d0 92 71 b7 60 38 72 c0 03 1f 9e |.......q.`8r....| ssl_save_session stored master secret[48]: | ad 12 09 32 5c 2a 53 0a ff ff 2e 3d 35 58 df ac |...2\*S....=5X..| | 5f 9d 4c fc de 96 91 87 1e f8 33 02 c2 75 8b e9 |_.L.......3..u..| | b5 f3 f6 bf 4b f9 f4 8e 01 65 99 ee 9b 3e 4a c1 |....K....e...>J.| dissect_ssl3_handshake session keys successfully generated record: offset = 265, reported_length_remaining = 67 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 271, reported_length_remaining = 61 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 56, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 56 Ciphertext[56]: | b7 98 d5 53 66 67 02 ec 31 44 23 f9 b1 d6 fb cc |...Sfg..1D#.....| | f4 28 0a 41 9e 78 85 a6 e6 e3 44 7a de a9 af c3 |.(.A.x....Dz....| | 01 63 57 b8 74 1c cd 5a ca 64 1e ee 86 7a 2f 2c |.cW.t..Z.d...z/,| | b0 74 bf 7f 80 24 62 b2 |.t...$b. | Plaintext[56]: | 14 00 00 24 45 88 9d 85 32 62 7e 62 d5 b2 9f a2 |...$E...2b~b....| | 2c 9f 81 ac ca 14 f7 44 ff fd 09 92 32 61 21 ab |,......D....2a!.| | b3 b4 2c 91 56 e5 d2 72 d9 c4 a1 3f 7f 82 81 dc |..,.V..r...?....| | 4d 0d f9 ee c3 42 e3 1a |M....B.. | checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #24 (first time) conversation = 0x7f26869423d8, ssl_session = 0x7f265a929780 record: offset = 0, reported_length_remaining = 67 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 61 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 56, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 56 Ciphertext[56]: | 22 53 66 ff 10 32 6f a3 84 e5 86 37 80 54 f2 3f |"Sf..2o....7.T.?| | ec a2 ec 15 1c 89 eb c3 8b c3 f0 cc d2 73 9d aa |.............s..| | 24 ea 8a 8a b4 78 da 3d f6 b4 90 d0 c0 88 de 96 |$....x.=........| | 60 77 16 e3 01 41 49 46 |`w...AIF | Plaintext[56]: | 14 00 00 24 91 31 8e 11 5c ad fe d7 a2 88 85 26 |...$.1..\......&| | 32 01 65 25 ad 1b d1 8e 83 93 21 b0 f9 61 b6 1f |2.e%......!..a..| | 11 22 9f 81 fc ad 8d 6c e3 79 5b 9f 06 f6 e6 5f |.".....l.y[...._| | 45 f4 2b e3 5d 32 2e 38 |E.+.]2.8 | checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #25 (first time) conversation = 0x7f26869423d8, ssl_session = 0x7f265a929780 record: offset = 0, reported_length_remaining = 82 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 77, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 77 Ciphertext[77]: | 1a 52 d4 2e 82 d6 e9 5c 4f 3b cb 11 ef d4 cb 90 |.R.....\O;......| | a5 03 6d ca 7d 0c 4a d3 71 7f 53 dd d3 8e 8b 6e |..m.}.J.q.S....n| | c8 a0 86 50 36 3f ff d5 41 a0 5a 20 e4 21 90 bd |...P6?..A.Z .!..| | 20 e1 0b f6 e3 0d 66 3c f9 76 d4 e3 dc 09 6c 57 | .....f<.v....lW| | 02 a6 4f f8 15 c9 07 d8 a8 d2 9d 28 22 |..O........(" | Plaintext[77]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 72 63 34 2d 6d 64 35 2e 6c 6f |Host: rc4-md5.lo| | 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey| | 6e 2e 6e 6c 3a 34 34 33 35 0d 0a 0d 0a 81 d1 79 |n.nl:4435......y| | 8c 18 37 40 87 fc a0 57 ed 2b 27 a6 a4 |..7@...W.+'.. | checking mac (len 61, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 61, seq = 0, nxtseq = 61 association_find: TCP port 45669 found (nil) association_find: TCP port 4435 found 0x345a630 dissect_ssl3_record decrypted len 61 decrypted app data fragment[61]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 72 63 34 2d 6d 64 35 2e 6c 6f |Host: rc4-md5.lo| | 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey| | 6e 2e 6e 6c 3a 34 34 33 35 0d 0a 0d 0a |n.nl:4435.... | dissect_ssl3_record found association 0x345a630 dissect_ssl enter frame #26 (first time) conversation = 0x7f26869423d8, ssl_session = 0x7f265a929780 record: offset = 0, reported_length_remaining = 368 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 363, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 363 Ciphertext[363]: | d1 79 d8 90 f6 35 c2 1e 79 a4 3c c6 ec bc a2 58 |.y...5..y.<....X| | db 82 0d 0c d0 a3 da db b3 58 33 18 6f 87 ac 70 |.........X3.o..p| | 40 a7 83 f4 07 40 12 e3 68 85 7c 6d 3e 27 1c 43 |@....@..h.|m>'.C| | 95 a5 69 ff 37 b2 7c 81 98 a1 ed a9 b4 3d f7 74 |..i.7.|......=.t| | 24 2f 9c 93 75 97 2e 7a 16 ff bc 1e d1 34 de e9 |$/..u..z.....4..| | 8b 0e b8 6c b3 9c 8f a2 68 74 6b 35 39 b2 12 b2 |...l....htk59...| | e4 cb 94 61 71 9a 63 1b 9b 76 89 b2 ac 30 6f 0e |...aq.c..v...0o.| | d0 72 93 d3 3d 6c a2 c6 70 81 83 11 1c bd ba 88 |.r..=l..p.......| | 33 66 de 20 3b 70 7d 40 98 56 0d 15 44 f9 9c 96 |3f. ;p}@.V..D...| | b7 39 85 35 15 15 6d 90 43 8c 05 b4 63 a3 b7 08 |.9.5..m.C...c...| | 95 97 bb 0a fd 2f 50 da 15 e7 2f 32 0c 27 c1 1f |...../P.../2.'..| | 9d 51 08 b1 4a 81 22 bd 3c 1c 06 db c3 a7 55 63 |.Q..J.".<.....Uc| | 8c 2e d5 46 09 68 c0 83 ec e3 4e f6 cf 99 2c ae |...F.h....N...,.| | f0 f1 34 03 d8 ae 5e 45 02 9f e3 17 a1 68 4a 2b |..4...^E.....hJ+| | 15 36 7f bc eb be 60 a6 98 93 12 9a b7 d3 0c 34 |.6....`........4| | c2 f2 af e1 b2 5b b2 60 f9 6d db f6 08 4c fe 0c |.....[.`.m...L..| | c3 5c 85 8d db a1 df 06 33 71 1c 28 f9 43 f8 9d |.\......3q.(.C..| | 8d c6 41 5d 2e 1d d6 58 a3 58 93 67 71 29 07 1d |..A]...X.X.gq)..| | 33 cf 3b 21 fa 02 81 c3 89 e3 a6 48 5b 20 bd 2d |3.;!.......H[ .-| | bc f9 de d1 71 c3 ea 94 37 5f 6d cf ec 8b 29 8c |....q...7_m...).| | b0 1a 58 d1 f4 c0 08 97 0b ff 64 e4 07 aa a8 cb |..X.......d.....| | 86 0e bb 1a 4f 36 57 3e fd fc ba 16 bb 8b 61 41 |....O6W>......aA| | 4a 86 7c 5b b2 9e 7a b9 4e a5 19 |J.|[..z.N.. | Plaintext[363]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:16 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 30 0d 0a 43 6f 6e 6e 65 63 74 |th: 140..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 30 34 20 2d 20 52 43 34 2d 4d |x00,0x04 - RC4-M| | 44 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |D5 | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 4d |=RC4(128) Mac=M| | 44 35 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 |D5..&..| | e0 c0 6f 50 71 40 f7 da cf d0 e3 |..oPq@..... | checking mac (len 347, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 347, seq = 0, nxtseq = 347 association_find: TCP port 4435 found 0x345a630 dissect_ssl3_record decrypted len 347 decrypted app data fragment[347]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:16 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 30 0d 0a 43 6f 6e 6e 65 63 74 |th: 140..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 30 34 20 2d 20 52 43 34 2d 4d |x00,0x04 - RC4-M| | 44 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |D5 | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 4d |=RC4(128) Mac=M| | 44 35 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 |D5 | dissect_ssl3_record found association 0x345a630 dissect_ssl enter frame #27 (first time) conversation = 0x7f26869423d8, ssl_session = 0x7f265a929780 record: offset = 0, reported_length_remaining = 23 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 18, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 18 Ciphertext[18]: | 2e 44 db b0 67 a5 91 5a 72 0d 87 b5 8e 35 35 ae |.D..g..Zr....55.| | 7e da |~. | Plaintext[18]: | 01 00 f6 4a 40 94 5d 82 9a c4 6f 6f eb a5 13 ef |...J@.]...oo....| | fc 82 |.. | checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #29 (first time) conversation = 0x7f26869423d8, ssl_session = 0x7f265a929780 record: offset = 0, reported_length_remaining = 23 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 18, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 18 Ciphertext[18]: | 41 ef 7b 34 1a 57 eb b1 b3 8a 2f 00 68 cb 7f 6f |A.{4.W..../.h..o| | 58 c7 |X. | Plaintext[18]: | 01 00 5f 64 10 77 15 4c 72 80 50 c3 e8 03 37 02 |.._d.w.Lr.P...7.| | 5e 7c |^| | checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #34 (first time) ssl_session_init: initializing ptr 0x7f265a92bf40 size 688 conversation = 0x7f2686942728, ssl_session = 0x7f265a92bf40 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 52022 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4436 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #36 (first time) conversation = 0x7f2686942728, ssl_session = 0x7f265a92bf40 record: offset = 0, reported_length_remaining = 907 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0x0005 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 821 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898 record: offset = 898, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 903 length 0 bytes, remaining 907 dissect_ssl enter frame #38 (first time) conversation = 0x7f2686942728, ssl_session = 0x7f265a92bf40 record: offset = 0, reported_length_remaining = 336 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 260, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 256 bytes, remaining 265 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e... looking for RSA pre-master82b9ec1045937e8c8d013b75ddaf13ecff77d1e03c377691... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 key expansion[72]: | c8 60 96 dc dd d7 42 6f 2a 68 62 51 9c 50 80 5a |.`....Bo*hbQ.P.Z| | 31 61 17 67 3d e6 04 00 36 c8 65 e2 52 7a 70 af |1a.g=...6.e.Rzp.| | ca d1 7c ac fd dc 0c c7 8e b8 e2 55 42 38 a1 1c |..|........UB8..| | 7d 75 e1 f5 10 7c 05 bb 07 a3 22 fc 4c cc 2e 59 |}u...|....".L..Y| | d5 25 99 54 30 b1 f1 3f |.%.T0..? | Client MAC key[20]: | c8 60 96 dc dd d7 42 6f 2a 68 62 51 9c 50 80 5a |.`....Bo*hbQ.P.Z| | 31 61 17 67 |1a.g | Server MAC key[20]: | 3d e6 04 00 36 c8 65 e2 52 7a 70 af ca d1 7c ac |=...6.e.Rzp...|.| | fd dc 0c c7 |.... | Client Write key[16]: | 8e b8 e2 55 42 38 a1 1c 7d 75 e1 f5 10 7c 05 bb |...UB8..}u...|..| Server Write key[16]: | 07 a3 22 fc 4c cc 2e 59 d5 25 99 54 30 b1 f1 3f |..".L..Y.%.T0..?| Client Write IV[8]: | 00 00 00 00 00 00 00 00 |........ | Server Write IV[8]: | 20 63 76 03 00 00 00 00 | cv..... | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: ARCFOUR decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: ARCFOUR decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | 8f 51 19 c8 9d 53 b9 3f 3c 2c 91 5d 46 87 2f ae |.Q...S.?<,.]F./.| | 21 99 9e 20 19 d4 c1 b3 b0 ff b5 a1 aa 8b 10 01 |!.. ............| ssl_save_session stored master secret[48]: | 07 0c 19 d8 fb d8 66 65 15 d0 a4 69 ee 51 d5 b2 |......fe...i.Q..| | 6e 4d fc 97 0a ef df 1b e6 06 1d 58 40 fa 5f 16 |nM.........X@._.| | 62 f3 4c 51 18 ec 27 05 08 5e dc d4 b0 fc cb b2 |b.LQ..'..^......| dissect_ssl3_handshake session keys successfully generated record: offset = 265, reported_length_remaining = 71 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 271, reported_length_remaining = 65 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 60, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 60 Ciphertext[60]: | bd 17 35 d1 ca 73 df 0d b9 43 ff 83 47 df cc 20 |..5..s...C..G.. | | 42 bc 01 6c 9f 65 c7 2a db ea ab f5 f7 8e 6e 4a |B..l.e.*......nJ| | 0b 42 1a f0 7f 13 43 d0 77 c1 92 af 15 0f b4 1f |.B....C.w.......| | 5b 59 a7 ef 30 18 dd c4 a1 a1 21 95 |[Y..0.....!. | Plaintext[60]: | 14 00 00 24 ac 9c 1c 17 dd 68 cb 73 41 9b 5f 39 |...$.....h.sA._9| | 68 4d d2 a0 63 f1 53 85 e2 bd a5 75 06 c8 cf b1 |hM..c.S....u....| | 7b 1e c1 82 ea e3 f0 8a 85 14 66 d1 f1 f0 8a 73 |{.........f....s| | 21 c0 0e bf 5d 08 0a 24 86 a8 b4 ac |!...]..$.... | checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #39 (first time) conversation = 0x7f2686942728, ssl_session = 0x7f265a92bf40 record: offset = 0, reported_length_remaining = 71 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 65 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 60, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 60 Ciphertext[60]: | 8d d5 8d 2b 54 a4 e8 bb 39 e6 b0 a5 5d 29 5b 77 |...+T...9...])[w| | 69 68 9c fa 8f b9 db f6 85 1e 34 3b 2e 32 10 f4 |ih........4;.2..| | ca e3 c5 2b c8 ce e3 1a 6d a5 ad ea a3 e5 ad 87 |...+....m.......| | 29 d4 56 84 42 ca ad 00 5d 45 7b 2a |).V.B...]E{* | Plaintext[60]: | 14 00 00 24 8f b1 d3 42 41 0b 1f 2f 23 76 e6 a9 |...$...BA../#v..| | d1 94 a3 8e 67 13 81 37 db 69 5b 08 b8 fe 7b 0e |....g..7.i[...{.| | 52 e8 8a 47 53 c5 64 e3 e5 da 34 4b 40 5a 2e 87 |R..GS.d...4K@Z..| | de c0 1e c0 f6 cd ac 42 4c f6 39 52 |.......BL.9R | checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #40 (first time) conversation = 0x7f2686942728, ssl_session = 0x7f265a92bf40 record: offset = 0, reported_length_remaining = 86 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 81, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 81 Ciphertext[81]: | 87 66 ab b1 99 e0 15 3e bf 52 75 23 5e 46 da eb |.f.....>.Ru#^F..| | 50 b9 b3 5a d2 20 17 86 da b0 8f fd 60 c4 ed 5b |P..Z. ......`..[| | 10 dd e5 2c 61 7f 92 6c c6 a9 4d b0 62 d1 f4 29 |...,a..l..M.b..)| | d2 88 69 c4 df 7b 64 28 48 fd fa 9c 0b 34 b8 cc |..i..{d(H....4..| | 88 47 f5 b5 9b d5 41 3a ce 40 fe bc e4 99 f8 0b |.G....A:.@......| | 17 |. | Plaintext[81]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 72 63 34 2d 73 68 61 2e 6c 6f |Host: rc4-sha.lo| | 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey| | 6e 2e 6e 6c 3a 34 34 33 36 0d 0a 0d 0a 6d 17 a1 |n.nl:4436....m..| | 5e 66 d7 9c bd 67 df 19 46 13 07 fb b9 09 d3 1e |^f...g..F.......| | cd |. | checking mac (len 61, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 61, seq = 0, nxtseq = 61 association_find: TCP port 52022 found (nil) association_find: TCP port 4436 found 0x2e1c9d0 dissect_ssl3_record decrypted len 61 decrypted app data fragment[61]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 72 63 34 2d 73 68 61 2e 6c 6f |Host: rc4-sha.lo| | 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey| | 6e 2e 6e 6c 3a 34 34 33 36 0d 0a 0d 0a |n.nl:4436.... | dissect_ssl3_record found association 0x2e1c9d0 dissect_ssl enter frame #41 (first time) conversation = 0x7f2686942728, ssl_session = 0x7f265a92bf40 record: offset = 0, reported_length_remaining = 373 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 368, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 368 Ciphertext[368]: | c9 4b e4 55 98 86 b7 58 28 b8 a1 22 53 33 20 66 |.K.U...X(.."S3 f| | 74 43 ac ae a0 21 22 56 ec c8 61 09 24 9d ff be |tC...!"V..a.$...| | e3 16 1a 31 6d 11 e0 f5 51 cf 52 dd de fe ad 78 |...1m...Q.R....x| | 11 cb 18 29 06 04 c3 b0 cb b5 0b 7b ad 60 aa ae |...).......{.`..| | ad 9e 80 e0 dc d6 60 75 24 99 4c 12 95 87 b7 71 |......`u$.L....q| | 58 d0 03 02 2b d2 d0 0f 5e b1 0b 4a be 12 b5 2a |X...+...^..J...*| | 0c 53 03 1e de 00 d8 d2 7e b0 5f 3f 85 74 76 90 |.S......~._?.tv.| | 82 64 9d e1 2f 03 97 78 c2 70 4b c9 07 91 e9 82 |.d../..x.pK.....| | be 8a 7c 9d 1b 63 f4 7b c2 60 a0 de 76 88 68 18 |..|..c.{.`..v.h.| | c8 93 20 ab a1 d2 d7 a3 6c f3 a6 80 56 78 d3 13 |.. .....l...Vx..| | d9 9a d8 94 a7 97 6a 0f 60 7b 96 70 93 67 9b b8 |......j.`{.p.g..| | 01 8b 73 86 b5 16 f5 f4 18 72 e9 7f 5c ad c4 eb |..s......r..\...| | e8 da dd 25 4a f3 1b 96 b7 08 95 4a 30 61 03 3c |...%J......J0a.<| | 94 2c 6e 8d fc 29 39 c7 58 41 4b 1f d3 ae e2 f9 |.,n..)9.XAK.....| | f8 83 40 7e 56 0e 85 7a e3 f5 67 74 36 15 bd 6d |..@~V..z..gt6..m| | ed 88 d3 ff 77 24 51 f6 19 3d ae b1 8d 60 ae 6b |....w$Q..=...`.k| | 5a 10 25 40 1d 71 46 98 78 11 0a 06 8d 5b f1 b3 |Z.%@.qF.x....[..| | 63 87 e4 27 37 6b 45 b8 e5 68 22 49 82 05 08 4b |c..'7kE..h"I...K| | f6 7c 60 89 5f 60 27 2d 21 f3 53 a1 3b 9e 2d 83 |.|`._`'-!.S.;.-.| | bd 12 3a ca 10 3b 9e 54 3a 38 a8 e0 c1 57 57 0b |..:..;.T:8...WW.| | 5e e7 08 71 de a7 50 4c 88 4e e8 a3 12 e4 e2 36 |^..q..PL.N.....6| | 56 3e ca 8e 10 8e 0d e1 eb 51 d5 35 75 de ea dc |V>.......Q.5u...| | 5c a7 4b 8d 3f 37 62 a3 26 19 e2 7e 4b 57 3c 4e |\.K.?7b.&..~KWdocum| | 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca| | 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.| | 6e 6c 27 3c 2f 73 63 72 69 70 74 3e b2 31 fd d4 |nl'.1..| | 79 e3 65 b3 0d 12 0a d2 97 4e 49 cf d0 c1 19 89 |y.e......NI.....| checking mac (len 348, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348 association_find: TCP port 4436 found 0x2e1c9d0 dissect_ssl3_record decrypted len 348 decrypted app data fragment[348]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:16 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 30 35 20 2d 20 52 43 34 2d 53 |x00,0x05 - RC4-S| | 48 41 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |HA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 53 |=RC4(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1 | dissect_ssl3_record found association 0x2e1c9d0 dissect_ssl enter frame #42 (first time) conversation = 0x7f2686942728, ssl_session = 0x7f265a92bf40 record: offset = 0, reported_length_remaining = 27 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 22, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 22 Ciphertext[22]: | 3a ab cf 51 14 d9 48 f8 e5 ae 22 7c 71 0b d3 1b |:..Q..H..."|q...| | dd 97 ca f2 2d 66 |....-f | Plaintext[22]: | 01 00 49 b6 07 ea 09 cb e5 15 d0 19 b3 85 74 e1 |..I...........t.| | 6d d9 7a 5f 88 4c |m.z_.L | checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #44 (first time) conversation = 0x7f2686942728, ssl_session = 0x7f265a92bf40 record: offset = 0, reported_length_remaining = 27 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 22, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 22 Ciphertext[22]: | 3e bd 51 1e 6c f2 78 69 2d 7f 2d ef 29 03 5d 2e |>.Q.l.xi-.-.).].| | 17 d7 c7 31 8f a5 |...1.. | Plaintext[22]: | 01 00 79 d5 af 46 2c 4b 33 ed 17 48 4f 1a 6d 84 |..y..F,K3..HO.m.| | 89 62 15 61 90 c5 |.b.a.. | checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #49 (first time) ssl_session_init: initializing ptr 0x7f265a92e700 size 688 conversation = 0x7f2686942a78, ssl_session = 0x7f265a92e700 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 42500 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4437 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #51 (first time) conversation = 0x7f2686942a78, ssl_session = 0x7f265a92e700 record: offset = 0, reported_length_remaining = 1245 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0x0006 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 1159 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898 record: offset = 898, reported_length_remaining = 347 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 333, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 903 length 329 bytes, remaining 1236 record: offset = 1236, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1241 length 0 bytes, remaining 1245 dissect_ssl enter frame #53 (first time) conversation = 0x7f2686942a78, ssl_session = 0x7f265a92e700 record: offset = 0, reported_length_remaining = 148 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 68, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 64 bytes, remaining 73 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60e... looking for RSA pre-master3487889b063f97654522ee8e3f44dc641071cfc4cd344af9... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 ssl3_prf: sha1_hash(6) ssl3_prf: md5_hash(6) datalen 48 key expansion[88]: | 62 91 2f d8 a2 90 ee b8 20 a7 6a ce 01 6e ce e0 |b./..... .j..n..| | 35 ff c1 6e 96 6e 73 38 0c ca c1 a5 d5 ec 81 13 |5..n.ns8........| | 13 b3 f0 6b 89 3d 04 a6 b1 03 c2 07 9f 77 18 9f |...k.=.......w..| | 25 a8 e0 86 7b b2 f1 1c c3 32 69 a7 10 84 58 0b |%...{....2i...X.| | 78 a5 ce 0e 6d 5b c4 ab 6e a8 90 de 9d 00 71 60 |x...m[..n.....q`| | 18 09 f5 2f de 36 5a 6e |.../.6Zn | ssl_generate_keyring_material ssl3_generate_export_iv export iv[8]: | 1e de d3 51 14 95 52 21 |...Q..R! | ssl_generate_keyring_material ssl3_generate_export_iv(2) export iv[8]: | cb 87 2b a2 bb a1 e6 a2 |..+..... | ssl_generate_keyring_material MD5(client_random) ssl_generate_keyring_material MD5(server_random) Client MAC key[20]: | 62 91 2f d8 a2 90 ee b8 20 a7 6a ce 01 6e ce e0 |b./..... .j..n..| | 35 ff c1 6e |5..n | Server MAC key[20]: | 96 6e 73 38 0c ca c1 a5 d5 ec 81 13 13 b3 f0 6b |.ns8...........k| | 89 3d 04 a6 |.=.. | Client Write key[16]: | 40 8b c6 91 5b d5 20 4d 45 fb 73 db a5 04 77 d3 |@...[. ME.s...w.| Server Write key[16]: | 95 fc fb 62 7d 8b 08 50 3c 1a 19 32 dd 80 e6 ae |...b}..P<..2....| Client Write IV[8]: | 1e de d3 51 14 95 52 21 |...Q..R! | Server Write IV[8]: | cb 87 2b a2 bb a1 e6 a2 |..+..... | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: RC2 ssl_create_decoder can't find cipher RC2 ssl_generate_keyring_material can't init client decoder dissect_ssl3_handshake can't generate keyring material record: offset = 73, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 79, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x37 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 220 offset 84 length 3050327 bytes, remaining 148 dissect_ssl enter frame #54 (first time) conversation = 0x7f2686942a78, ssl_session = 0x7f265a92e700 record: offset = 0, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x37 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 243 offset 11 length 9422513 bytes, remaining 75 dissect_ssl enter frame #55 (first time) conversation = 0x7f2686942a78, ssl_session = 0x7f265a92e700 record: offset = 0, reported_length_remaining = 122 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 24, ssl state 0x37 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available association_find: TCP port 42500 found (nil) association_find: TCP port 4437 found 0x221ac20 record: offset = 29, reported_length_remaining = 93 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 88, ssl state 0x37 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available association_find: TCP port 42500 found (nil) association_find: TCP port 4437 found 0x221ac20 dissect_ssl enter frame #56 (first time) conversation = 0x7f2686942a78, ssl_session = 0x7f265a92e700 record: offset = 0, reported_length_remaining = 381 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 376, ssl state 0x37 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available association_find: TCP port 4437 found 0x221ac20 dissect_ssl enter frame #57 (first time) conversation = 0x7f2686942a78, ssl_session = 0x7f265a92e700 record: offset = 0, reported_length_remaining = 29 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 24, ssl state 0x37 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl enter frame #59 (first time) conversation = 0x7f2686942a78, ssl_session = 0x7f265a92e700 record: offset = 0, reported_length_remaining = 29 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 24, ssl state 0x37 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl enter frame #64 (first time) ssl_session_init: initializing ptr 0x7f265a9304d0 size 688 conversation = 0x7f2686942d20, ssl_session = 0x7f265a9304d0 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 52578 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4438 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #66 (first time) conversation = 0x7f2686942d20, ssl_session = 0x7f265a9304d0 record: offset = 0, reported_length_remaining = 907 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0x0007 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 821 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898 record: offset = 898, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 903 length 0 bytes, remaining 907 dissect_ssl enter frame #68 (first time) conversation = 0x7f2686942d20, ssl_session = 0x7f265a9304d0 record: offset = 0, reported_length_remaining = 340 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 260, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 256 bytes, remaining 265 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd... looking for RSA pre-master3020985a5736aab08d91165d975e4db8e638402b794e782c... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 ssl3_prf: sha1_hash(6) ssl3_prf: md5_hash(6) datalen 48 key expansion[88]: | 74 b3 17 5c 58 09 22 fe 45 1f 7d 58 85 df de 0a |t..\X.".E.}X....| | 4d da f9 40 17 15 4e 87 9e 2e 17 c9 1c b0 d1 c4 |M..@..N.........| | 18 28 40 f8 f3 2c 43 8a a7 a9 14 b8 9b 5b b1 42 |.(@..,C......[.B| | 42 34 68 f3 30 9b 27 7f cd 6b d3 0f c6 f5 00 41 |B4h.0.'..k.....A| | 09 66 45 0c 7e 0f 55 35 c1 b4 b3 18 86 2e 44 fc |.fE.~.U5......D.| | 1f 75 5b 27 64 fd 9e 22 |.u['d.." | Client MAC key[20]: | 74 b3 17 5c 58 09 22 fe 45 1f 7d 58 85 df de 0a |t..\X.".E.}X....| | 4d da f9 40 |M..@ | Server MAC key[20]: | 17 15 4e 87 9e 2e 17 c9 1c b0 d1 c4 18 28 40 f8 |..N..........(@.| | f3 2c 43 8a |.,C. | Client Write key[16]: | a7 a9 14 b8 9b 5b b1 42 42 34 68 f3 30 9b 27 7f |.....[.BB4h.0.'.| Server Write key[16]: | cd 6b d3 0f c6 f5 00 41 09 66 45 0c 7e 0f 55 35 |.k.....A.fE.~.U5| Client Write IV[8]: | c1 b4 b3 18 86 2e 44 fc |......D. | Server Write IV[8]: | 1f 75 5b 27 64 fd 9e 22 |.u['d.." | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: IDEA decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: IDEA decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | f7 28 87 a1 70 bf f5 f9 2d 54 92 95 7a ab 17 99 |.(..p...-T..z...| | ca 3a fa e5 eb b5 c5 8f 67 74 2b fb 9a 4f 7c fd |.:......gt+..O|.| ssl_save_session stored master secret[48]: | 0c 9d a0 33 b5 2c 5b 8e 8a f8 56 e8 e4 00 cb 4d |...3.,[...V....M| | b6 d0 56 78 f5 91 3b f0 f4 6b 2a ff 90 25 f6 96 |..Vx..;..k*..%..| | 8e 5e a3 07 23 12 b9 d1 2d 34 84 ab 56 07 ae 0e |.^..#...-4..V...| dissect_ssl3_handshake session keys successfully generated record: offset = 265, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 271, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 98 aa 29 b5 e3 c5 59 a7 2b 43 28 f5 71 5a c1 bf |..)...Y.+C(.qZ..| | 5a 00 da a6 f6 0c 8e 75 e5 7d 83 fc 9f bd 6d ca |Z......u.}....m.| | 83 62 ed 49 67 ae 04 c6 53 23 7d c6 3f 5d bb 9b |.b.Ig...S#}.?]..| | c9 76 2b 16 35 0c a1 ab 19 8a b9 77 a3 4a eb 5f |.v+.5......w.J._| Plaintext[64]: | 14 00 00 24 b1 a2 de a3 32 0a 4d f6 41 48 e2 dc |...$....2.M.AH..| | 40 2d 64 45 5a db 5e 5a eb 20 76 28 dc d2 67 94 |@-dEZ.^Z. v(..g.| | 15 b6 33 73 6c 36 e6 69 92 50 43 22 61 07 b0 de |..3sl6.i.PC"a...| | e2 68 0a 65 b1 3f 5b 0e 1a c7 11 e9 00 00 00 03 |.h.e.?[.........| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #69 (first time) conversation = 0x7f2686942d20, ssl_session = 0x7f265a9304d0 record: offset = 0, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 88 f0 18 86 d2 9d 20 36 cd 4e b4 a6 7d 27 62 bc |...... 6.N..}'b.| | fe c7 57 84 8f 4b 36 51 3e 48 26 da fe 23 74 c5 |..W..K6Q>H&..#t.| | 63 a7 e6 70 3a ec 2a 6f 21 cc 72 f2 e9 56 f8 f3 |c..p:.*o!.r..V..| | 40 2c 31 1b 63 05 f2 db 08 37 db 51 e2 4f f1 57 |@,1.c....7.Q.O.W| Plaintext[64]: | 14 00 00 24 fa 12 13 49 21 1d e1 82 d2 58 71 c7 |...$...I!....Xq.| | 54 8c 3c 40 d5 df fb 6e 61 b5 7c 68 d4 58 68 13 |T.<@...na.|h.Xh.| | 2a 27 fd 87 02 bd 65 5c 3f f3 cd c6 67 98 1b ef |*'....e\?...g...| | 3c 18 f4 e0 02 4e 7f f0 ee 2b a8 b0 00 00 00 03 |<....N...+......| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #70 (first time) conversation = 0x7f2686942d20, ssl_session = 0x7f265a9304d0 record: offset = 0, reported_length_remaining = 122 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 24, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 24 Ciphertext[24]: | 1f a7 54 1e 3a 5f 56 ff ee 8b ed b3 c7 1d 12 a0 |..T.:_V.........| | 70 ad fd 06 ea 3c c6 d7 |p....<.. | Plaintext[24]: | f3 12 91 9c 24 92 3e a9 a9 43 43 fe e5 08 d9 4b |....$.>..CC....K| | 79 cc 70 dd 00 00 00 03 |y.p..... | ssl_decrypt_record found padding 3 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 52578 found (nil) association_find: TCP port 4438 found 0x3451d20 record: offset = 29, reported_length_remaining = 93 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 88, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 88 Ciphertext[88]: | 14 56 7f 6c e5 8e e5 f5 b1 64 5d 45 96 79 6f 01 |.V.l.....d]E.yo.| | 18 3f fd dc 82 e3 e0 6c 78 27 f0 0f 2a 7b e5 3f |.?.....lx'..*{.?| | 95 11 c6 29 ea f9 6a 83 7c 35 1a 85 80 00 47 cc |...)..j.|5....G.| | f1 bc 32 e0 c7 32 f0 61 08 fc 59 b3 f7 93 25 78 |..2..2.a..Y...%x| | ec 52 35 0c f2 98 f1 4f d2 c4 5f b5 c2 3b 69 4a |.R5....O.._..;iJ| | e5 f8 42 9a c3 86 c0 ae |..B..... | Plaintext[88]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 69 64 65 61 2d 63 62 63 2d 73 |Host: idea-cbc-s| | 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |ha.local.al.leke| | 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 33 38 0d 0a |nsteyn.nl:4438..| | 0d 0a d7 28 32 7c 58 f3 8e 32 0b 20 ec 94 1a e9 |...(2|X..2. ....| | ca 1a fe 09 79 f0 00 01 |....y... | ssl_decrypt_record found padding 1 final len 86 checking mac (len 66, version 300, ct 23 seq 2) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 66, seq = 0, nxtseq = 66 association_find: TCP port 52578 found (nil) association_find: TCP port 4438 found 0x3451d20 dissect_ssl3_record decrypted len 66 decrypted app data fragment[66]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 69 64 65 61 2d 63 62 63 2d 73 |Host: idea-cbc-s| | 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |ha.local.al.leke| | 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 33 38 0d 0a |nsteyn.nl:4438..| | 0d 0a |.. | dissect_ssl3_record found association 0x3451d20 dissect_ssl enter frame #71 (first time) conversation = 0x7f2686942d20, ssl_session = 0x7f265a9304d0 record: offset = 0, reported_length_remaining = 381 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 376, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 376 Ciphertext[376]: | 5d 68 31 66 d8 32 8c b1 6d 06 74 36 d2 40 9f 8c |]h1f.2..m.t6.@..| | 38 20 a3 64 c4 13 74 aa 03 a9 07 da 45 61 49 7a |8 .d..t.....EaIz| | 8d cc e4 cb e7 c1 78 0a f4 db dd 66 94 85 a4 2a |......x....f...*| | da 37 06 04 d1 b2 38 6f 93 ad a9 d2 85 8a c3 87 |.7....8o........| | d0 25 60 9c 14 30 12 88 54 9a 0f a4 a8 67 f9 fc |.%`..0..T....g..| | 58 70 d3 14 e1 4d 50 ca e0 3d f2 0c be 42 ab e7 |Xp...MP..=...B..| | 37 44 3f 4d 48 e9 a7 9c 1b 8b 42 47 d1 b2 9f d5 |7D?MH.....BG....| | 92 c6 7c 59 89 ba 74 c0 af 9f 19 4c ad c1 be da |..|Y..t....L....| | da 37 32 46 95 73 33 9a 2d 52 34 60 1f 7c 5e fa |.72F.s3.-R4`.|^.| | 84 05 ef c5 0d 6f 4a df 0f 6e 54 d9 8a 03 0b 42 |.....oJ..nT....B| | ba 59 bc c9 51 dd 24 6b 5c f6 b6 58 ce 75 98 6e |.Y..Q.$k\..X.u.n| | 18 e7 c3 da 34 5b ea a5 c1 a7 fa e1 e6 ca 3d bf |....4[........=.| | 37 8a 55 7d 90 0c d8 aa 15 6a 2e 3b f3 03 13 70 |7.U}.....j.;...p| | 82 6b 5e f6 cd da f5 65 b7 6b df bd f8 78 0b 83 |.k^....e.k...x..| | de 9d 93 24 b0 9d 98 73 33 99 0b 9a ed cc 34 f4 |...$...s3.....4.| | 59 82 34 b8 03 4e a7 b9 f0 2b d6 00 76 0d 98 96 |Y.4..N...+..v...| | 43 e8 9a 50 fc 9a bf 6e 74 cd 1f a1 33 cf ee 15 |C..P...nt...3...| | 55 8f e4 ce 39 68 92 bf e1 de c8 05 62 5d cb 72 |U...9h......b].r| | b9 5f 74 cd e0 9e 0a bc e0 e3 7b 81 0d ea 66 5b |._t.......{...f[| | 64 0a 95 29 84 e3 92 f6 b6 26 aa e0 72 51 7f bc |d..).....&..rQ..| | 96 8b 67 59 d1 11 3d 03 86 19 06 3d de 8a a5 6d |..gY..=....=...m| | 33 a8 23 92 c7 90 f6 c7 fd 4a 79 0f a5 da 0a 5d |3.#......Jy....]| | 1f c7 e6 40 9e 4a 93 a2 2c 15 12 e3 44 a0 6b 33 |...@.J..,...D.k3| | d9 c6 0e 0e b9 33 5b 28 |.....3[( | Plaintext[376]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:17 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 30 37 20 2d 20 49 44 45 41 2d |x00,0x07 - IDEA-| | 43 42 43 2d 53 48 41 20 20 20 20 20 20 20 20 20 |CBC-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 49 44 45 41 28 31 32 38 29 20 4d 61 63 3d 53 |=IDEA(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1.?..| | c0 02 18 b7 9b 84 35 6b 95 83 2a 1a a3 23 5b 23 |......5k..*..#[#| | 00 00 00 00 00 00 00 07 |........ | ssl_decrypt_record found padding 7 final len 368 checking mac (len 348, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348 association_find: TCP port 4438 found 0x3451d20 dissect_ssl3_record decrypted len 348 decrypted app data fragment[348]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:17 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 30 37 20 2d 20 49 44 45 41 2d |x00,0x07 - IDEA-| | 43 42 43 2d 53 48 41 20 20 20 20 20 20 20 20 20 |CBC-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 49 44 45 41 28 31 32 38 29 20 4d 61 63 3d 53 |=IDEA(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1 | dissect_ssl3_record found association 0x3451d20 dissect_ssl enter frame #72 (first time) conversation = 0x7f2686942d20, ssl_session = 0x7f265a9304d0 record: offset = 0, reported_length_remaining = 29 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 24, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 24 Ciphertext[24]: | bf 22 e6 0b 32 76 e3 94 8c b9 b9 5d 68 c8 74 04 |."..2v.....]h.t.| | 8a cf e1 42 5f e4 cd e9 |...B_... | Plaintext[24]: | 01 00 fe 61 08 2e d6 04 3a 0c f7 0a a0 77 da 26 |...a....:....w.&| | 11 43 43 1d 9b cc 00 01 |.CC..... | ssl_decrypt_record found padding 1 final len 22 checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #74 (first time) conversation = 0x7f2686942d20, ssl_session = 0x7f265a9304d0 record: offset = 0, reported_length_remaining = 29 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 24, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 24 Ciphertext[24]: | 8c c5 ca dd 8b 4a 25 2d 81 7e 90 14 e2 35 23 3c |.....J%-.~...5#<| | f9 87 dd 69 95 9c cd c3 |...i.... | Plaintext[24]: | 01 00 65 cb 63 c4 81 95 7b 1c d8 b4 38 57 70 19 |..e.c...{...8Wp.| | 83 1b 99 d3 ce ea 00 01 |........ | ssl_decrypt_record found padding 1 final len 22 checking mac (len 2, version 300, ct 21 seq 3) ssl_decrypt_record: mac ok dissect_ssl enter frame #79 (first time) ssl_session_init: initializing ptr 0x7f265a932d30 size 688 conversation = 0x7f2686943078, ssl_session = 0x7f265a932d30 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 51639 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4439 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #81 (first time) conversation = 0x7f2686943078, ssl_session = 0x7f265a932d30 record: offset = 0, reported_length_remaining = 1245 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0x0008 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 1159 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898 record: offset = 898, reported_length_remaining = 347 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 333, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 903 length 329 bytes, remaining 1236 record: offset = 1236, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1241 length 0 bytes, remaining 1245 dissect_ssl enter frame #83 (first time) conversation = 0x7f2686943078, ssl_session = 0x7f265a932d30 record: offset = 0, reported_length_remaining = 148 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 68, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 64 bytes, remaining 73 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef79... looking for RSA pre-master7923a2cab3257ae850d71ffcb09c8b3286134e61dd14976a... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 key expansion[72]: | 8c ea ea bb 9e 2d 1d 3c b7 47 2a 30 a3 7e 34 da |.....-.<.G*0.~4.| | 5b 61 79 5b af 73 49 f4 7a e8 e4 f5 9a aa 7b 35 |[ay[.sI.z.....{5| | 17 2b 80 58 f6 de 06 41 43 f7 bb aa ea bf bf 82 |.+.X...AC.......| | ea a4 d6 20 18 c1 32 9c 02 98 0c 29 6c f7 43 36 |... ..2....)l.C6| | ee 24 57 21 75 b8 8f be |.$W!u... | ssl_generate_keyring_material ssl3_generate_export_iv export iv[8]: | 99 9f 26 3d 26 c3 f9 95 |..&=&... | ssl_generate_keyring_material ssl3_generate_export_iv(2) export iv[8]: | f9 d1 4b a7 4e 91 6f 30 |..K.N.o0 | ssl_generate_keyring_material MD5(client_random) ssl_generate_keyring_material MD5(server_random) Client MAC key[20]: | 8c ea ea bb 9e 2d 1d 3c b7 47 2a 30 a3 7e 34 da |.....-.<.G*0.~4.| | 5b 61 79 5b |[ay[ | Server MAC key[20]: | af 73 49 f4 7a e8 e4 f5 9a aa 7b 35 17 2b 80 58 |.sI.z.....{5.+.X| | f6 de 06 41 |...A | Client Write key[8]: | be 18 2d 3c 17 35 9f f8 |..-<.5.. | Server Write key[8]: | b2 33 4b 9f 94 e4 86 4d |.3K....M | Client Write IV[8]: | 99 9f 26 3d 26 c3 f9 95 |..&=&... | Server Write IV[8]: | f9 d1 4b a7 4e 91 6f 30 |..K.N.o0 | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | 67 cd 75 c5 ce 3a e6 d3 48 ec 14 98 a9 69 05 ee |g.u..:..H....i..| | 92 bf 1d bf 2b 2c 3f 48 51 0d 31 d7 09 99 2a 70 |....+,?HQ.1...*p| ssl_save_session stored master secret[48]: | ca fa 4d 43 12 80 91 20 7f 8e b6 f2 f0 f8 01 cd |..MC... ........| | bf 1e 4c d8 34 da 0a eb af 23 66 36 9e f1 fc f8 |..L.4....#f6....| | 3f 81 cf 77 05 53 ec 15 b1 09 67 d9 3a 92 84 e8 |?..w.S....g.:...| dissect_ssl3_handshake session keys successfully generated record: offset = 73, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 79, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | e5 42 33 96 fc 98 1b bb 5e be 87 0c 09 d4 80 55 |.B3.....^......U| | 98 8f f0 f5 12 88 d3 45 42 2b dc c8 a2 60 c9 aa |.......EB+...`..| | 81 d3 a2 66 43 d3 90 e1 bb d9 fe d7 3f 1c f1 68 |...fC.......?..h| | fc b0 b1 2b 76 2f e6 8d 62 f4 7c 1d 07 f5 f5 e1 |...+v/..b.|.....| Plaintext[64]: | 14 00 00 24 32 2e 70 30 7a 42 8d d4 93 ee 91 ac |...$2.p0zB......| | 06 c9 1f 31 76 de 2a 1c 35 9f 7b d6 51 7c 69 6a |...1v.*.5.{.Q|ij| | e6 43 78 ef 75 35 8c 01 33 26 e9 03 6a 27 71 3d |.Cx.u5..3&..j'q=| | 45 a9 6d f3 25 d4 41 16 1c e2 cf 88 00 00 00 03 |E.m.%.A.........| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #84 (first time) conversation = 0x7f2686943078, ssl_session = 0x7f265a932d30 record: offset = 0, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | aa c5 79 3b d4 dc 59 ab 43 db f0 e3 3a 45 0f e4 |..y;..Y.C...:E..| | 21 46 b5 83 76 d1 8d e9 89 f7 06 45 1a 54 22 5a |!F..v......E.T"Z| | f7 58 44 5b 51 f4 e0 8d 3a 5b c5 b7 5f c3 38 0d |.XD[Q...:[.._.8.| | f3 94 73 2c 52 d6 f5 b2 f5 94 e1 87 a0 90 d7 2c |..s,R..........,| Plaintext[64]: | 14 00 00 24 a6 56 5b bf be 0c a4 6e 54 13 82 90 |...$.V[....nT...| | 7b 4e 92 f0 1b b7 48 e3 38 35 9a 57 cc 49 ae 51 |{N....H.85.W.I.Q| | 72 b7 4a 41 6b da ae 14 59 2b cb 2d 20 f7 71 c0 |r.JAk...Y+.- .q.| | 07 20 3e 94 fb 8d d9 14 44 49 0e 84 00 00 00 03 |. >.....DI......| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #85 (first time) conversation = 0x7f2686943078, ssl_session = 0x7f265a932d30 record: offset = 0, reported_length_remaining = 130 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 24, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 24 Ciphertext[24]: | ad 23 e4 39 6a 30 3b 73 30 3e ec 1d 48 a7 79 d9 |.#.9j0;s0>..H.y.| | 70 fd d4 bd aa b8 51 68 |p.....Qh | Plaintext[24]: | 13 60 5c c9 bb 4e 48 32 0e 17 7d ab 61 2e 7d 69 |.`\..NH2..}.a.}i| | eb 66 a7 53 00 00 00 03 |.f.S.... | ssl_decrypt_record found padding 3 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 51639 found (nil) association_find: TCP port 4439 found 0x345a120 record: offset = 29, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 96, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 96 Ciphertext[96]: | 58 d4 53 35 6f 8f 5f 83 37 b9 c2 a1 26 e0 e0 a6 |X.S5o._.7...&...| | 3b 00 8b c6 cc 7a 2e 4b b8 8c 9e 13 4c 1b f5 00 |;....z.K....L...| | 0c 75 81 90 71 bd 96 5c a3 fd 00 fc 37 fb 6e da |.u..q..\....7.n.| | 55 b7 a6 67 f0 d8 6a b8 8f 21 3f 33 c5 f0 97 fd |U..g..j..!?3....| | ec 12 16 38 0b 7d b9 66 28 30 d5 ee 22 2e 53 64 |...8.}.f(0..".Sd| | b8 a8 bb d5 ca 4a 43 ab 6f 4a 7a aa d8 ac 30 ff |.....JC.oJz...0.| Plaintext[96]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 78 70 2d 64 65 73 2d 63 62 |Host: exp-des-cb| | 63 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c |c-sha.local.al.l| | 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 33 |ekensteyn.nl:443| | 39 0d 0a 0d 0a fb b9 56 27 96 dc 16 74 81 21 cf |9......V'...t.!.| | 4d f1 2e 4a dd 52 54 69 13 00 00 00 00 00 00 06 |M..J.RTi........| ssl_decrypt_record found padding 6 final len 89 checking mac (len 69, version 300, ct 23 seq 2) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 69, seq = 0, nxtseq = 69 association_find: TCP port 51639 found (nil) association_find: TCP port 4439 found 0x345a120 dissect_ssl3_record decrypted len 69 decrypted app data fragment[69]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 78 70 2d 64 65 73 2d 63 62 |Host: exp-des-cb| | 63 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c |c-sha.local.al.l| | 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 33 |ekensteyn.nl:443| | 39 0d 0a 0d 0a |9.... | dissect_ssl3_record found association 0x345a120 dissect_ssl enter frame #86 (first time) conversation = 0x7f2686943078, ssl_session = 0x7f265a932d30 record: offset = 0, reported_length_remaining = 381 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 376, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 376 Ciphertext[376]: | 95 43 6f c9 5b 8f 17 f6 64 a8 ff 5f 5a 5c d0 24 |.Co.[...d.._Z\.$| | b8 d6 7a 51 95 10 6b bd 16 9b d0 36 91 b1 72 f5 |..zQ..k....6..r.| | be 28 63 cf cd 13 ba 39 97 5d a2 6a 92 e4 8b 9d |.(c....9.].j....| | 3e 93 1d 0b d9 5f 17 7b f0 53 f7 86 6a b1 82 35 |>...._.{.S..j..5| | 37 be 95 64 de 91 9e a0 93 5c 81 08 c5 9c e4 e8 |7..d.....\......| | 4c 2d 55 18 58 96 60 49 db 76 78 b3 99 e3 16 fb |L-U.X.`I.vx.....| | 72 8b c8 18 0b 49 ab 80 8d ed 8e f2 45 db dd 21 |r....I......E..!| | 7d ea 04 4a f9 ba ac 47 f1 ef b1 88 35 4e 76 9d |}..J...G....5Nv.| | 79 e8 4e c8 ee d8 69 03 d3 c5 64 5e 1b bb 1f 89 |y.N...i...d^....| | e9 56 26 55 5c 43 0e 7b a2 e0 ba ae cc b5 8e b6 |.V&U\C.{........| | 4d 5a 1a 4a c9 d9 19 e4 82 6e c2 26 76 80 24 37 |MZ.J.....n.&v.$7| | 80 c1 f0 26 7c 79 f1 47 42 81 7a 48 8d a3 cf 39 |...&|y.GB.zH...9| | 02 0c c9 ee 6b d3 33 2a 16 15 17 dd 0d 7f b0 08 |....k.3*........| | 1a e0 a6 19 46 14 73 46 5e 84 3c 70 3c 8e 5f 71 |....F.sF^.document.domai| | 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |n='local.al.leke| | 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 |nsteyn.nl'.X..M..K.....| | 34 9b cc 13 7d 50 e2 00 |4...}P.. | ssl_decrypt_record found padding 0 final len 375 checking mac (len 355, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 355, seq = 0, nxtseq = 355 association_find: TCP port 4439 found 0x345a120 dissect_ssl3_record decrypted len 355 decrypted app data fragment[355]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:17 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 38 0d 0a 43 6f 6e 6e 65 63 74 |th: 148..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 30 38 20 2d 20 45 58 50 2d 44 |x00,0x08 - EXP-D| | 45 53 2d 43 42 43 2d 53 48 41 20 20 20 20 20 20 |ES-CBC-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 28 | SSLv3 Kx=RSA(| | 35 31 32 29 20 41 75 3d 52 53 41 20 20 45 6e 63 |512) Au=RSA Enc| | 3d 44 45 53 28 34 30 29 20 20 20 4d 61 63 3d 53 |=DES(40) Mac=S| | 48 41 31 20 65 78 70 6f 72 74 3c 73 63 72 69 70 |HA1 exportdocument.domai| | 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |n='local.al.leke| | 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 |nsteyn.nl' | dissect_ssl3_record found association 0x345a120 dissect_ssl enter frame #87 (first time) conversation = 0x7f2686943078, ssl_session = 0x7f265a932d30 record: offset = 0, reported_length_remaining = 29 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 24, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 24 Ciphertext[24]: | ac ef 10 0f 4c 29 74 45 8e 6a bb df 7d 12 58 de |....L)tE.j..}.X.| | 95 8b 1a eb 2c 10 d4 7f |....,... | Plaintext[24]: | 01 00 42 87 e1 00 aa 95 b5 1f ae 67 f9 0f 8a eb |..B........g....| | d1 2e 61 aa 52 63 00 01 |..a.Rc.. | ssl_decrypt_record found padding 1 final len 22 checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #89 (first time) conversation = 0x7f2686943078, ssl_session = 0x7f265a932d30 record: offset = 0, reported_length_remaining = 29 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 24, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 24 Ciphertext[24]: | 9b c5 23 07 78 9c 15 d0 16 f2 2b 49 6d 75 5c 4f |..#.x.....+Imu\O| | 42 db 6e 26 99 94 83 8c |B.n&.... | Plaintext[24]: | 01 00 fe 92 71 97 73 46 a5 d5 d4 f0 1f 38 80 d6 |....q.sF.....8..| | 74 13 e9 5f 11 ce 00 01 |t.._.... | ssl_decrypt_record found padding 1 final len 22 checking mac (len 2, version 300, ct 21 seq 3) ssl_decrypt_record: mac ok dissect_ssl enter frame #94 (first time) ssl_session_init: initializing ptr 0x7f265a9354e0 size 688 conversation = 0x7f26869433d0, ssl_session = 0x7f265a9354e0 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 49621 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4440 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #96 (first time) conversation = 0x7f26869433d0, ssl_session = 0x7f265a9354e0 record: offset = 0, reported_length_remaining = 907 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0x0009 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 821 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898 record: offset = 898, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 903 length 0 bytes, remaining 907 dissect_ssl enter frame #98 (first time) conversation = 0x7f26869433d0, ssl_session = 0x7f265a9354e0 record: offset = 0, reported_length_remaining = 340 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 260, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 256 bytes, remaining 265 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b77957... looking for RSA pre-masterb52278e70c03ef1d2c633b02650cf3ffcddf7fb2ff9d4607... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 key expansion[72]: | c6 b5 10 d5 ce 41 a7 70 e2 82 c9 33 b5 a7 9d 2d |.....A.p...3...-| | aa 3a 8d 73 75 01 14 d4 b8 30 43 56 d4 a5 d3 af |.:.su....0CV....| | 53 3c 4d 30 d8 12 9f 7c 0f b4 b0 cb 19 b3 ac 4e |S+| | a0 ae 4d 29 98 20 15 b1 96 e8 64 59 09 08 9c 90 |..M). ....dY....| | 6e 42 0b 07 0b bf 00 48 35 dc fa 6b 90 0e 58 66 |nB.....H5..k..Xf| dissect_ssl3_handshake session keys successfully generated record: offset = 265, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 271, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 33 86 b8 55 42 a4 c1 da 2e d3 2b 98 2b e0 c3 4d |3..UB.....+.+..M| | 97 69 89 f8 3f 53 d3 92 9a fd 5b 0c be ab 20 c9 |.i..?S....[... .| | b8 c7 0d c9 03 91 91 fa 6d 75 fe 80 de 32 00 ef |........mu...2..| | ee 05 7b 37 e8 2f da 41 64 1f ce b6 29 f6 82 cb |..{7./.Ad...)...| Plaintext[64]: | 14 00 00 24 1f 78 16 f6 1f 17 84 b3 a0 59 e8 ba |...$.x.......Y..| | 9f d6 0f b6 3e 78 4e a9 a9 9a 72 10 2a 63 9b a3 |....>xN...r.*c..| | 9d 85 de 52 58 17 5a 53 49 75 63 56 9d 95 cb f4 |...RX.ZSIucV....| | 0f c2 35 b6 3c 97 95 79 be d8 34 07 00 00 00 03 |..5.<..y..4.....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #99 (first time) conversation = 0x7f26869433d0, ssl_session = 0x7f265a9354e0 record: offset = 0, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 9b 67 99 15 ad 31 90 ad 43 0e a9 da 3d c2 77 ab |.g...1..C...=.w.| | 4b 29 3b 4e 7b fa c9 c1 c7 dd aa 5a 76 e0 fa f8 |K);N{......Zv...| | 81 de 4d 5f e8 bb 78 81 0d b2 82 a6 75 5e 9b 74 |..M_..x.....u^.t| | 75 fe 2a 43 9c ee d6 00 a4 85 09 15 be 93 6b 08 |u.*C..........k.| Plaintext[64]: | 14 00 00 24 73 1a 8d 4e 5d 8b e8 cf 4e 38 11 95 |...$s..N]...N8..| | d7 ac 2d 59 4a 26 b1 b2 c4 98 58 1d 7b dc 25 f7 |..-YJ&....X.{.%.| | cc 3e f7 bd b8 b8 ed 99 46 80 d4 5f b4 a1 5f 5e |.>......F.._.._^| | 74 7a 75 fd 23 f6 32 51 e4 79 fc d8 00 00 00 03 |tzu.#.2Q.y......| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #100 (first time) conversation = 0x7f26869433d0, ssl_session = 0x7f265a9354e0 record: offset = 0, reported_length_remaining = 122 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 24, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 24 Ciphertext[24]: | f1 ee 22 20 2e 7d 17 34 a6 81 e6 7c 71 5d 92 11 |.." .}.4...|q]..| | 53 23 e4 6c 27 e5 c2 a0 |S#.l'... | Plaintext[24]: | 80 0a 61 92 30 49 3d 67 c9 c1 4d 69 27 54 fa 02 |..a.0I=g..Mi'T..| | e1 bb b1 83 00 00 00 03 |........ | ssl_decrypt_record found padding 3 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 49621 found (nil) association_find: TCP port 4440 found 0x3459d10 record: offset = 29, reported_length_remaining = 93 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 88, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 88 Ciphertext[88]: | f5 36 12 c1 2a f6 d2 eb 28 97 4e e9 b3 27 a2 08 |.6..*...(.N..'..| | df 1f 2d e3 46 f0 f8 65 17 41 e0 56 a9 ed 5e dd |..-.F..e.A.V..^.| | 32 4f 42 7e 22 52 8d 2f 1f a1 2a e2 2b 16 6c 00 |2OB~"R./..*.+.l.| | 3e 95 1a 0c 0a 39 4f f5 17 e3 c3 fc 8b 22 ec 35 |>....9O......".5| | e4 42 af 69 02 a9 db 09 3a f6 ea eb 50 f0 6a 3f |.B.i....:...P.j?| | 2b 39 55 c6 93 7e 46 59 |+9U..~FY | Plaintext[88]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 65 73 2d 63 62 63 2d 73 68 |Host: des-cbc-sh| | 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |a.local.al.leken| | 73 74 65 79 6e 2e 6e 6c 3a 34 34 34 30 0d 0a 0d |steyn.nl:4440...| | 0a 3d 91 c0 3c c1 51 f6 b9 df 15 6d 51 e6 d9 d4 |.=..<.Q....mQ...| | 71 cc 8d ec 2a 00 00 02 |q...*... | ssl_decrypt_record found padding 2 final len 85 checking mac (len 65, version 300, ct 23 seq 2) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 65, seq = 0, nxtseq = 65 association_find: TCP port 49621 found (nil) association_find: TCP port 4440 found 0x3459d10 dissect_ssl3_record decrypted len 65 decrypted app data fragment[65]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 65 73 2d 63 62 63 2d 73 68 |Host: des-cbc-sh| | 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |a.local.al.leken| | 73 74 65 79 6e 2e 6e 6c 3a 34 34 34 30 0d 0a 0d |steyn.nl:4440...| | 0a |. | dissect_ssl3_record found association 0x3459d10 dissect_ssl enter frame #101 (first time) conversation = 0x7f26869433d0, ssl_session = 0x7f265a9354e0 record: offset = 0, reported_length_remaining = 381 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 376, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 376 Ciphertext[376]: | f1 2a 57 bd 8c 91 e9 81 33 d5 97 b8 94 88 79 6d |.*W.....3.....ym| | 7d b1 1c 27 43 fe 5b 3d 80 e7 c7 aa 89 1c 97 99 |}..'C.[=........| | cf 73 ff 0c 44 32 24 7f e3 54 bc ff 4a e4 c8 69 |.s..D2$..T..J..i| | bc 54 88 5d 2e 77 28 30 dc 5c 7a 04 7b bc f5 e3 |.T.].w(0.\z.{...| | a8 e1 e0 94 aa 67 3f 6e 3f 5b a6 75 e9 c1 c8 38 |.....g?n?[.u...8| | 1e b3 e3 d6 b5 83 59 dd 96 91 f6 40 18 6c 67 14 |......Y....@.lg.| | 8b 23 f4 a7 a5 85 2d c0 45 58 bb aa f4 db db aa |.#....-.EX......| | c9 b3 f1 2a 2a bb 27 7b 7b d0 f5 00 ce 13 be d6 |...**.'{{.......| | 67 c8 56 04 f1 36 e5 48 83 69 2d 31 b3 9d da 85 |g.V..6.H.i-1....| | 1f f3 0a c1 c0 b1 63 e5 21 f1 68 5b 2d 7b 01 88 |......c.!.h[-{..| | 9b 6e 09 0d 45 4b c2 22 d2 2e 3e 32 df 69 a9 f9 |.n..EK."..>2.i..| | ff 70 97 bb 1b 4c f0 a1 c1 1c 67 0c 1a 61 7f 52 |.p...L....g..a.R| | b0 77 94 3c d5 b5 c1 81 88 89 be c4 1e 3d 58 96 |.w.<.........=X.| | d9 87 4c 2a 43 bb 48 be cf d6 b9 52 2d 16 23 ba |..L*C.H....R-.#.| | 15 1b c2 04 a3 d7 7b ad c1 59 88 5b 15 e4 2f 19 |......{..Y.[../.| | 62 cb 1d 50 ff 6d eb a7 65 c2 d1 05 9c 4a a2 d7 |b..P.m..e....J..| | 34 4f 45 0c c1 6d a1 b2 92 f5 d1 5e 8c 52 68 16 |4OE..m.....^.Rh.| | c8 29 5d 73 1d 0c 96 8e ce 64 8d 19 9b 78 14 f9 |.)]s.....d...x..| | 03 b5 d8 4e a2 5e 9b ec 86 d7 ce 54 f1 c6 f0 11 |...N.^.....T....| | 02 b4 ad 70 e9 eb 04 57 66 c8 a4 bb 17 77 8e 11 |...p...Wf....w..| | d2 91 f2 2c ab b9 29 26 2b b8 17 01 ba 2a 2d 5f |...,..)&+....*-_| | 7c 09 21 37 dc c2 ad 75 01 8d 1e 8d 30 cd c2 4f ||.!7...u....0..O| | dd e9 b3 b9 28 26 15 5b 18 ea de f3 78 8a 5b 29 |....(&.[....x.[)| | 68 2d 9d 07 34 81 e6 f7 |h-..4... | Plaintext[376]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:17 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 30 39 20 2d 20 44 45 53 2d 43 |x00,0x09 - DES-C| | 42 43 2d 53 48 41 20 20 20 20 20 20 20 20 20 20 |BC-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 44 45 53 28 35 36 29 20 20 20 4d 61 63 3d 53 |=DES(56) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA18..-| | 79 b9 1c a2 de 99 db 12 43 7d c5 3c d9 70 a3 9e |y.......C}.<.p..| | 00 00 00 00 00 00 00 07 |........ | ssl_decrypt_record found padding 7 final len 368 checking mac (len 348, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348 association_find: TCP port 4440 found 0x3459d10 dissect_ssl3_record decrypted len 348 decrypted app data fragment[348]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:17 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 30 39 20 2d 20 44 45 53 2d 43 |x00,0x09 - DES-C| | 42 43 2d 53 48 41 20 20 20 20 20 20 20 20 20 20 |BC-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 44 45 53 28 35 36 29 20 20 20 4d 61 63 3d 53 |=DES(56) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1 | dissect_ssl3_record found association 0x3459d10 dissect_ssl enter frame #102 (first time) conversation = 0x7f26869433d0, ssl_session = 0x7f265a9354e0 record: offset = 0, reported_length_remaining = 29 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 24, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 24 Ciphertext[24]: | 70 85 df 76 21 cf 92 8a c8 dc e5 dc 9d a9 62 b8 |p..v!.........b.| | 09 89 8a bd 04 b4 ca 66 |.......f | Plaintext[24]: | 01 00 22 3f 67 f1 73 37 e9 f6 70 f9 22 48 ea fa |.."?g.s7..p."H..| | 2c 44 01 fe b0 07 00 01 |,D...... | ssl_decrypt_record found padding 1 final len 22 checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #104 (first time) conversation = 0x7f26869433d0, ssl_session = 0x7f265a9354e0 record: offset = 0, reported_length_remaining = 29 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 24, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 24 Ciphertext[24]: | a3 11 f5 c4 69 35 7e 03 05 88 ae ff dd 18 e9 b7 |....i5~.........| | 75 cb 83 9d 6f de 54 2c |u...o.T, | Plaintext[24]: | 01 00 0d 17 34 dd 55 5a 95 61 a6 a0 94 f4 fc 18 |....4.UZ.a......| | 9b 82 f9 01 87 13 00 01 |........ | ssl_decrypt_record found padding 1 final len 22 checking mac (len 2, version 300, ct 21 seq 3) ssl_decrypt_record: mac ok dissect_ssl enter frame #109 (first time) ssl_session_init: initializing ptr 0x7f265a937d00 size 688 conversation = 0x7f2686943720, ssl_session = 0x7f265a937d00 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 55229 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4441 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #111 (first time) conversation = 0x7f2686943720, ssl_session = 0x7f265a937d00 record: offset = 0, reported_length_remaining = 907 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0x000A -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 821 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898 record: offset = 898, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 903 length 0 bytes, remaining 907 dissect_ssl enter frame #113 (first time) conversation = 0x7f2686943720, ssl_session = 0x7f265a937d00 record: offset = 0, reported_length_remaining = 340 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 260, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 256 bytes, remaining 265 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360... looking for RSA pre-master305122df4df84bd261f34442b78f7032986928cac1c0c8aa... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 ssl3_prf: sha1_hash(6) ssl3_prf: md5_hash(6) datalen 48 ssl3_prf: sha1_hash(7) ssl3_prf: md5_hash(7) datalen 48 key expansion[104]: | c2 3f df 32 50 77 e3 09 ca 2c de 9c 51 23 85 a3 |.?.2Pw...,..Q#..| | 9b 22 ab b6 7a 40 74 65 5f c5 e0 5b 16 47 6c c9 |."..z@te_..[.Gl.| | 0b 84 fa 47 13 01 04 f2 7c 16 ed 43 44 1d 41 ec |...G....|..CD.A.| | 55 87 3e 01 18 34 fa be 3f 4b d5 60 15 ac 71 b1 |U.>..4..?K.`..q.| | 0e cc b1 81 63 18 f4 1d cf 0e 39 7c c2 4d 88 48 |....c.....9|.M.H| | 9d d8 bf 1a ef 07 69 19 c4 a8 43 b9 04 03 0a bc |......i...C.....| | b5 42 97 ca a4 6a 8d de |.B...j.. | Client MAC key[20]: | c2 3f df 32 50 77 e3 09 ca 2c de 9c 51 23 85 a3 |.?.2Pw...,..Q#..| | 9b 22 ab b6 |.".. | Server MAC key[20]: | 7a 40 74 65 5f c5 e0 5b 16 47 6c c9 0b 84 fa 47 |z@te_..[.Gl....G| | 13 01 04 f2 |.... | Client Write key[24]: | 7c 16 ed 43 44 1d 41 ec 55 87 3e 01 18 34 fa be ||..CD.A.U.>..4..| | 3f 4b d5 60 15 ac 71 b1 |?K.`..q. | Server Write key[24]: | 0e cc b1 81 63 18 f4 1d cf 0e 39 7c c2 4d 88 48 |....c.....9|.M.H| | 9d d8 bf 1a ef 07 69 19 |......i. | Client Write IV[8]: | c4 a8 43 b9 04 03 0a bc |..C..... | Server Write IV[8]: | b5 42 97 ca a4 6a 8d de |.B...j.. | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | 34 30 e3 c1 1d 8e 32 94 6a 63 23 8c a4 22 df 2c |40....2.jc#..".,| | c4 95 75 4c b0 e1 1f 30 37 94 a4 a5 5a 46 91 92 |..uL...07...ZF..| ssl_save_session stored master secret[48]: | 92 9c 30 16 cf 0f 05 c1 e8 6b 1d cd a3 a9 ac bf |..0......k......| | a8 36 a3 d1 a2 2f ab ce de 25 97 35 e5 85 99 93 |.6.../...%.5....| | bb fe cc e9 45 8d 89 92 91 73 60 2f 5f af 35 a7 |....E....s`/_.5.| dissect_ssl3_handshake session keys successfully generated record: offset = 265, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 271, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 5e dc 28 01 11 47 da 64 26 91 d0 a6 99 eb 95 3d |^.(..G.d&......=| | 1d 5f 84 0e af b2 8c 45 30 59 06 45 38 04 47 9b |._.....E0Y.E8.G.| | b7 a6 74 8e 97 8c 4f b1 66 50 09 a7 be 31 da 69 |..t...O.fP...1.i| | 57 d3 34 0a 6c 8c 3d b3 ab 53 a5 fc 0d c9 14 e2 |W.4.l.=..S......| Plaintext[64]: | 14 00 00 24 5c a3 a5 28 51 27 1e ce f1 87 cf b6 |...$\..(Q'......| | af d1 92 7b 17 1a da 7a 18 42 34 47 2a e5 f0 9a |...{...z.B4G*...| | 98 57 d1 9f 25 92 fe 36 e8 3a bd 32 a3 47 1f 18 |.W..%..6.:.2.G..| | f7 d2 e1 6d 52 98 db a6 f1 b1 e8 69 00 00 00 03 |...mR......i....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #114 (first time) conversation = 0x7f2686943720, ssl_session = 0x7f265a937d00 record: offset = 0, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | f1 41 4c da cb b6 92 1d cd 5c 47 68 f4 84 7f d4 |.AL......\Gh....| | 2e d5 e6 b5 f5 2e a3 5f a5 39 78 6c a4 5f 1c bf |......._.9xl._..| | 91 84 26 b2 70 b5 d8 12 65 dd 6a dc 1d 9b e4 80 |..&.p...e.j.....| | 9a e5 d9 4b f1 42 22 73 78 87 a5 e2 0f 8a da 3f |...K.B"sx......?| Plaintext[64]: | 14 00 00 24 cb 2f f7 8a b8 70 14 61 58 b4 0c 34 |...$./...p.aX..4| | 92 9e 65 ea 85 24 46 c3 f8 f1 c3 ef 46 75 f5 cc |..e..$F.....Fu..| | a2 83 a2 33 5e 72 01 52 3d b5 ca 13 d7 d6 7c 2f |...3^r.R=.....|/| | 3f 77 b2 ae a1 20 d3 bb dd 3a 5a fd 00 00 00 03 |?w... ...:Z.....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #115 (first time) conversation = 0x7f2686943720, ssl_session = 0x7f265a937d00 record: offset = 0, reported_length_remaining = 122 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 24, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 24 Ciphertext[24]: | bc 0a 5a 16 11 2a a2 f4 5e ba 9e d7 bd e5 33 d2 |..Z..*..^.....3.| | f5 42 3f 51 32 70 0b b7 |.B?Q2p.. | Plaintext[24]: | 2c d6 ed 80 b5 c2 ae fb 9a e0 6f 5e 9a 0f f8 6a |,.........o^...j| | 90 8e a9 93 00 00 00 03 |........ | ssl_decrypt_record found padding 3 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 55229 found (nil) association_find: TCP port 4441 found 0x3459da0 record: offset = 29, reported_length_remaining = 93 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 88, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 88 Ciphertext[88]: | f6 be 8f 10 c8 17 92 5f 57 e9 8b 8b aa c0 5b 4a |......._W.....[J| | 1d d4 aa 21 2f 71 e7 25 48 78 dd d4 a2 f7 10 65 |...!/q.%Hx.....e| | b2 09 c0 32 a6 36 12 c1 2b 83 9a cb 97 05 7d bd |...2.6..+.....}.| | ac 57 37 40 d8 42 e8 e4 da 4c b6 76 39 d3 e0 fd |.W7@.B...L.v9...| | 7f c0 61 86 c5 86 e8 da 2c 97 a1 de ac 17 c0 31 |..a.....,......1| | 9d 89 f9 0b 60 5b a4 31 |....`[.1 | Plaintext[88]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 65 73 2d 63 62 63 33 2d 73 |Host: des-cbc3-s| | 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |ha.local.al.leke| | 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 34 31 0d 0a |nsteyn.nl:4441..| | 0d 0a fb 73 95 a0 ae eb 87 31 af 17 42 b2 70 a8 |...s.....1..B.p.| | 0f 8e 9f 1f 57 2d 00 01 |....W-.. | ssl_decrypt_record found padding 1 final len 86 checking mac (len 66, version 300, ct 23 seq 2) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 66, seq = 0, nxtseq = 66 association_find: TCP port 55229 found (nil) association_find: TCP port 4441 found 0x3459da0 dissect_ssl3_record decrypted len 66 decrypted app data fragment[66]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 65 73 2d 63 62 63 33 2d 73 |Host: des-cbc3-s| | 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |ha.local.al.leke| | 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 34 31 0d 0a |nsteyn.nl:4441..| | 0d 0a |.. | dissect_ssl3_record found association 0x3459da0 dissect_ssl enter frame #116 (first time) conversation = 0x7f2686943720, ssl_session = 0x7f265a937d00 record: offset = 0, reported_length_remaining = 381 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 376, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 376 Ciphertext[376]: | e9 ce 7f 3c 63 59 b0 c6 94 6a 00 97 da 2f 32 2d |.....:.p.Nd{.| | 71 b0 55 d2 79 32 fa cb 90 6e 0d d6 56 45 bf 2c |q.U.y2...n..VE.,| | a3 e5 05 dd 85 36 8e d5 97 6e db 09 30 a8 14 13 |.....6...n..0...| | bd 75 77 16 40 b6 a3 b5 eb 01 ed e4 f1 e9 86 02 |.uw.@...........| | a5 d1 7e 00 2e 0b a7 78 cb 2b 07 d1 67 a5 02 2e |..~....x.+..g...| | 45 a0 02 06 00 67 71 02 17 c7 0c b5 8e c7 3e ce |E....gq.......>.| | 42 b1 53 ba fc f2 c5 0e 18 2e fe a8 d9 59 0e b9 |B.S..........Y..| | 84 5f bd 35 c2 15 12 9b bf ec 7b 70 0a 1d e8 c6 |._.5......{p....| | 65 f0 ca 72 f9 2b 53 61 a3 00 6e 03 e1 5d fa 68 |e..r.+Sa..n..].h| | d6 37 e7 49 4c 1c 22 74 e6 4b c9 c7 5f 92 69 a3 |.7.IL."t.K.._.i.| | f0 c8 f7 f8 25 4c 34 b9 c0 36 fa 6d e8 5b 0e e8 |....%L4..6.m.[..| | 14 82 34 23 8b 75 87 9a 12 e5 b1 a2 73 11 a9 0e |..4#.u......s...| | 27 cc 6e b7 38 2f eb e5 8c fc 41 2c 04 8b be 7c |'.n.8/....A,...|| | cd bd dc 03 f6 12 44 c4 79 45 03 49 f6 22 cd a9 |......D.yE.I."..| | 58 6e f5 5f 21 a4 a6 70 7d ec d8 f8 aa 67 ce ba |Xn._!..p}....g..| | 5d 67 96 1d d0 09 2d 25 24 b5 11 10 32 af e4 fb |]g....-%$...2...| | 09 10 e6 81 3a 12 89 28 70 6f 50 7c 06 b0 86 a2 |....:..(poP|....| | b5 6a f0 d4 d8 c0 2b d4 bf e9 88 43 57 2e d3 45 |.j....+....CW..E| | 9f 75 89 fc 41 8a e7 22 b5 9e 9a a4 82 88 92 3a |.u..A..".......:| | 83 b7 27 ed 93 38 1d 5e cf ce 0c 05 c7 95 bc 63 |..'..8.^.......c| | 7e 34 bc fe 45 db 1d d3 94 da f2 bf 9c 4b 4e 47 |~4..E........KNG| | 5c 57 c1 83 8b fc 8c f8 11 5a b4 a7 0d a4 97 c9 |\W.......Z......| | 09 50 f5 ba 25 74 57 77 |.P..%tWw | Plaintext[376]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:18 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 30 41 20 2d 20 44 45 53 2d 43 |x00,0x0A - DES-C| | 42 43 33 2d 53 48 41 20 20 20 20 20 20 20 20 20 |BC3-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 33 44 45 53 28 31 36 38 29 20 4d 61 63 3d 53 |=3DES(168) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1.}7.| | cf 5a a7 56 e8 0a 46 82 e7 a3 12 58 07 95 24 26 |.Z.V..F....X..$&| | 00 00 00 00 00 00 00 07 |........ | ssl_decrypt_record found padding 7 final len 368 checking mac (len 348, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348 association_find: TCP port 4441 found 0x3459da0 dissect_ssl3_record decrypted len 348 decrypted app data fragment[348]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:18 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 30 41 20 2d 20 44 45 53 2d 43 |x00,0x0A - DES-C| | 42 43 33 2d 53 48 41 20 20 20 20 20 20 20 20 20 |BC3-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 33 44 45 53 28 31 36 38 29 20 4d 61 63 3d 53 |=3DES(168) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1 | dissect_ssl3_record found association 0x3459da0 dissect_ssl enter frame #117 (first time) conversation = 0x7f2686943720, ssl_session = 0x7f265a937d00 record: offset = 0, reported_length_remaining = 29 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 24, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 24 Ciphertext[24]: | f6 a8 d6 48 03 f6 fa f0 38 cc 52 9e 1b 74 22 ac |...H....8.R..t".| | c2 34 be 73 1a 07 74 d0 |.4.s..t. | Plaintext[24]: | 01 00 81 a7 8c c7 1d b6 6b a3 57 4f 43 4f 2c 33 |........k.WOCO,3| | f3 a5 e4 7f 9b d2 00 01 |........ | ssl_decrypt_record found padding 1 final len 22 checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #119 (first time) conversation = 0x7f2686943720, ssl_session = 0x7f265a937d00 record: offset = 0, reported_length_remaining = 29 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 24, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 24 Ciphertext[24]: | 40 17 a7 ad 22 7a 4c 9d 64 ac 0d 91 52 d8 dc c5 |@..."zL.d...R...| | 59 31 fe c0 05 79 66 2a |Y1...yf* | Plaintext[24]: | 01 00 d3 6a 09 12 02 cb 41 8e 7e 06 10 cb 0b 29 |...j....A.~....)| | 41 81 d2 94 d5 09 00 01 |A....... | ssl_decrypt_record found padding 1 final len 22 checking mac (len 2, version 300, ct 21 seq 3) ssl_decrypt_record: mac ok dissect_ssl enter frame #124 (first time) ssl_session_init: initializing ptr 0x7f265a93a560 size 688 conversation = 0x7f2686943a78, ssl_session = 0x7f265a93a560 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 46947 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4443 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #126 (first time) conversation = 0x7f2686943a78, ssl_session = 0x7f265a93a560 record: offset = 0, reported_length_remaining = 1156 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0x0012 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 1070 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 735, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 731 bytes, remaining 826 record: offset = 826, reported_length_remaining = 330 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 316, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 831 length 312 bytes, remaining 1147 record: offset = 1147, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1152 length 0 bytes, remaining 1156 dissect_ssl enter frame #128 (first time) conversation = 0x7f2686943a78, ssl_session = 0x7f265a93a560 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8... looking for RSA pre-master00805de634e34707519547ad69cd5c304ba4f92efeb4dbbe... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 key expansion[72]: | 9a d0 19 dc e7 72 fc ad cf 06 7a 96 21 e6 c6 ac |.....r....z.!...| | 19 79 6a c8 71 b0 21 d1 61 2c 20 8e f7 58 4c ce |.yj.q.!.a, ..XL.| | 28 4d 01 3b 29 90 c8 7a 6b 1d ab fa 06 bf 40 8d |(M.;)..zk.....@.| | a3 09 13 d9 75 83 79 7a 3c 6d 45 b2 91 e7 00 68 |....u.yz.B.......| | 24 44 4c e1 64 a4 04 ae 53 8b 76 63 1f d5 72 a3 |$DL.d...S.vc..r.| | d5 ce 74 49 41 a8 6b 1b 71 ac 30 55 99 61 fa ce |..tIA.k.q.0U.a..| | 96 81 ab 44 85 99 97 e4 fe 7a d8 a1 9b 1d 48 70 |...D.....z....Hp| Plaintext[64]: | 14 00 00 24 e4 a0 7e 29 40 c4 44 d8 bd 3f 24 32 |...$..~)@.D..?$2| | 7f a4 e1 b0 bd e7 42 2d 16 25 d3 f4 14 15 ee 2a |......B-.%.....*| | 12 cc 15 a1 58 e8 8e 22 64 9c 61 c7 f0 42 cb 60 |....X.."d.a..B.`| | 72 b4 85 8c 4e 2a 9d 0c ac f2 5a 9c 00 00 00 03 |r...N*....Z.....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #129 (first time) conversation = 0x7f2686943a78, ssl_session = 0x7f265a93a560 record: offset = 0, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | ae af 68 0e c4 27 60 9a bb 46 16 ce 32 7c f7 02 |..h..'`..F..2|..| | 6c 10 9c 39 98 cb 9b 24 a8 34 91 82 ba ec aa ec |l..9...$.4......| | 29 a2 55 1e 31 78 89 38 6b 3c 94 df bf 5a 8b 7c |).U.1x.8k<...Z.|| | 9d 97 fa 5a fa 32 0c 7e 32 ab fd 2e 69 50 8e d3 |...Z.2.~2...iP..| Plaintext[64]: | 14 00 00 24 34 ca 3f 13 c5 1a 99 d3 37 ed e3 26 |...$4.?.....7..&| | 81 8f ad 43 f7 a7 e6 6f c8 cb 72 35 26 ce 99 06 |...C...o..r5&...| | 8a dc 3e 9f 04 3f 15 da 97 e1 57 a8 15 da a4 56 |..>..?....W....V| | 4b fb 8b 12 9b 00 96 91 c4 da 79 a2 00 00 00 03 |K.........y.....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #130 (first time) conversation = 0x7f2686943a78, ssl_session = 0x7f265a93a560 record: offset = 0, reported_length_remaining = 130 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 24, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 24 Ciphertext[24]: | a3 44 51 40 f2 01 b2 cb ba 48 0d 27 05 0e 62 f9 |.DQ@.....H.'..b.| | 2b 02 54 93 23 ca 7f 12 |+.T.#... | Plaintext[24]: | f7 94 ba 54 e1 bb 7f b6 66 63 ef 08 1c 71 dc f4 |...T....fc...q..| | 9b b2 ff ab 00 00 00 03 |........ | ssl_decrypt_record found padding 3 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 46947 found (nil) association_find: TCP port 4443 found 0x345a6c0 record: offset = 29, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 96, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 96 Ciphertext[96]: | 81 18 de fc 95 8b bc 91 f4 d2 3e 9a 0e 08 96 14 |..........>.....| | e3 5e 1e 3a 67 19 ef d3 42 7b d4 53 99 5c b4 91 |.^.:g...B{.S.\..| | 18 2a 41 e2 f2 d1 c1 09 bb 23 3d 95 78 e9 11 cc |.*A......#=.x...| | 48 08 7c 6d 5a 02 d0 17 9c 45 80 a6 6b 35 f0 71 |H.|mZ....E..k5.q| | 71 77 c0 ba 9b 20 a6 31 cf b2 90 56 d6 70 bb a6 |qw... .1...V.p..| | d7 fa c9 01 17 7c 63 fb be 85 d1 e8 54 9a c0 94 |.....|c.....T...| Plaintext[96]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 64 68 2d 64 73 73 2d 64 65 |Host: edh-dss-de| | 73 2d 63 62 63 2d 73 68 61 2e 6c 6f 63 61 6c 2e |s-cbc-sha.local.| | 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c |al.lekensteyn.nl| | 3a 34 34 34 33 0d 0a 0d 0a b9 6a 90 8e 50 5d 90 |:4443.....j..P].| | f4 77 76 7e ee 66 30 47 6e a0 65 5f f9 00 00 02 |.wv~.f0Gn.e_....| ssl_decrypt_record found padding 2 final len 93 checking mac (len 73, version 300, ct 23 seq 2) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 73, seq = 0, nxtseq = 73 association_find: TCP port 46947 found (nil) association_find: TCP port 4443 found 0x345a6c0 dissect_ssl3_record decrypted len 73 decrypted app data fragment[73]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 64 68 2d 64 73 73 2d 64 65 |Host: edh-dss-de| | 73 2d 63 62 63 2d 73 68 61 2e 6c 6f 63 61 6c 2e |s-cbc-sha.local.| | 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c |al.lekensteyn.nl| | 3a 34 34 34 33 0d 0a 0d 0a |:4443.... | dissect_ssl3_record found association 0x345a6c0 dissect_ssl enter frame #131 (first time) conversation = 0x7f2686943a78, ssl_session = 0x7f265a93a560 record: offset = 0, reported_length_remaining = 381 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 376, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 376 Ciphertext[376]: | 19 d0 e6 03 93 cc 3a f1 33 cd 20 60 d3 7c be 4f |......:.3. `.|.O| | 6d 3b 71 fb fc 56 75 94 da 92 43 84 ed 46 39 f7 |m;q..Vu...C..F9.| | 3b 54 15 d1 2f 2d 26 b7 cd 18 55 fc 72 d1 17 2c |;T../-&...U.r..,| | ba 22 54 32 41 b2 97 e0 3c 77 51 2f 09 7d 36 14 |."T2A...docum| | 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca| | 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.| | 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 45 fb 47 4d |nl'E.GM| | 3b c7 dc 0b f2 8e db 56 17 2e e3 fa 00 de d9 1c |;......V........| | 00 00 00 00 00 00 00 07 |........ | ssl_decrypt_record found padding 7 final len 368 checking mac (len 348, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348 association_find: TCP port 4443 found 0x345a6c0 dissect_ssl3_record decrypted len 348 decrypted app data fragment[348]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:18 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 31 32 20 2d 20 45 44 48 2d 44 |x00,0x12 - EDH-D| | 53 53 2d 44 45 53 2d 43 42 43 2d 53 48 41 20 20 |SS-DES-CBC-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc| | 3d 44 45 53 28 35 36 29 20 20 20 4d 61 63 3d 53 |=DES(56) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1 | dissect_ssl3_record found association 0x345a6c0 dissect_ssl enter frame #132 (first time) conversation = 0x7f2686943a78, ssl_session = 0x7f265a93a560 record: offset = 0, reported_length_remaining = 29 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 24, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 24 Ciphertext[24]: | 18 45 62 1b 3a 82 1c 33 45 b5 a3 bf 48 0a e3 00 |.Eb.:..3E...H...| | 9a d9 ea b6 12 a7 f4 1d |........ | Plaintext[24]: | 01 00 6c 09 24 3b 3f ac c0 6a 89 de 3c 57 e8 ef |..l.$;?..j.. state 0x01 dissect_ssl enter frame #141 (first time) conversation = 0x7f2686943dd0, ssl_session = 0x7f265a93cd40 record: offset = 0, reported_length_remaining = 1155 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0x0013 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 1069 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 735, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 731 bytes, remaining 826 record: offset = 826, reported_length_remaining = 329 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 315, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 831 length 311 bytes, remaining 1146 record: offset = 1146, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1151 length 0 bytes, remaining 1155 dissect_ssl enter frame #143 (first time) conversation = 0x7f2686943dd0, ssl_session = 0x7f265a93cd40 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301b... looking for RSA pre-master00807ab3c48d7f09cdca0d8b779ca754010c7e3ada7ad6de... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 ssl3_prf: sha1_hash(6) ssl3_prf: md5_hash(6) datalen 48 ssl3_prf: sha1_hash(7) ssl3_prf: md5_hash(7) datalen 48 key expansion[104]: | 9b e8 ff 35 91 66 89 f0 af d2 a9 7e 31 0c 5c 5b |...5.f.....~1.\[| | 83 a8 27 22 11 6d f9 80 fd af 76 52 35 b0 a5 63 |..'".m....vR5..c| | 67 b5 c4 68 3d 59 0e a2 aa 14 cf 99 c4 35 67 f6 |g..h=Y.......5g.| | 4c cb 87 b9 67 6a c4 11 62 12 21 d7 6d 20 44 90 |L...gj..b.!.m D.| | d6 2a 12 dd b1 22 b8 7d 3c 6d 4d 10 98 4d c9 81 |.*...".}.P.......| | 60 f1 62 35 54 36 e4 db |`.b5T6.. | Client MAC key[20]: | 9b e8 ff 35 91 66 89 f0 af d2 a9 7e 31 0c 5c 5b |...5.f.....~1.\[| | 83 a8 27 22 |..'" | Server MAC key[20]: | 11 6d f9 80 fd af 76 52 35 b0 a5 63 67 b5 c4 68 |.m....vR5..cg..h| | 3d 59 0e a2 |=Y.. | Client Write key[24]: | aa 14 cf 99 c4 35 67 f6 4c cb 87 b9 67 6a c4 11 |.....5g.L...gj..| | 62 12 21 d7 6d 20 44 90 |b.!.m D. | Server Write key[24]: | d6 2a 12 dd b1 22 b8 7d 3c 6d 4d 10 98 4d c9 81 |.*...".}. | Client Write IV[8]: | 50 16 81 a8 d2 e8 9c c7 |P....... | Server Write IV[8]: | 60 f1 62 35 54 36 e4 db |`.b5T6.. | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | 5c 51 97 ed e2 a4 d9 56 f5 18 3d b3 e4 fe 5d 30 |\Q.....V..=...]0| | 6f f3 ef 15 ad 76 06 7b a9 e8 ad 85 f2 6e 4b 8d |o....v.{.....nK.| ssl_save_session stored master secret[48]: | 4a 4c c6 02 ae 6b 52 2a b5 c7 0e ee d5 94 ff 3b |JL...kR*.......;| | eb ea 0d 49 a9 d7 31 8c d6 50 81 c0 29 47 3f 9f |...I..1..P..)G?.| | 9d 82 33 40 bd 73 2f 53 cf 8f de 18 81 34 65 5c |..3@.s/S.....4e\| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | b9 1e aa 28 42 23 55 29 a0 d5 e5 7c 36 b1 8f 0e |...(B#U)...|6...| | c8 bb 5b 7f bd 99 96 bd 81 d0 13 e3 82 f2 68 ee |..[...........h.| | 91 c6 18 1f 47 5b 32 18 ef 86 05 d0 ae 35 72 9a |....G[2......5r.| | 2b 2d e1 55 f5 a3 18 57 46 3f 67 e2 89 de 1b 85 |+-.U...WF?g.....| Plaintext[64]: | 14 00 00 24 25 29 d5 7e 49 9f a0 cb b9 48 df f9 |...$%).~I....H..| | ec fb f7 15 bd e9 12 a0 ca d8 06 44 4a 69 ee f0 |...........DJi..| | 2f 16 5a 1a f5 cf 24 87 16 c4 72 5e 7d 43 ac 01 |/.Z...$...r^}C..| | ce 9f 9c e7 14 98 56 df d8 08 ab a7 00 00 00 03 |......V.........| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #144 (first time) conversation = 0x7f2686943dd0, ssl_session = 0x7f265a93cd40 record: offset = 0, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 10 5d 6b f8 f0 7a d3 61 bf c2 d5 26 35 b3 6e 99 |.]k..z.a...&5.n.| | 2f 23 42 38 43 d4 9d a3 2c 02 81 2b d7 dd 04 81 |/#B8C...,..+....| | 4c 13 be aa 68 d3 e9 b5 19 2b 98 7f 4f 84 cc f2 |L...h....+..O...| | b0 20 d6 5d 4f e8 5c fa 5c f7 34 8f 8d 0c d5 b6 |. .]O.\.\.4.....| Plaintext[64]: | 14 00 00 24 8b a0 13 41 d4 77 59 c4 84 6b bb 2a |...$...A.wY..k.*| | f9 bc e1 09 1a c4 d3 87 00 33 22 2c 59 1f 32 82 |.........3",Y.2.| | 49 42 6c fd 12 27 90 20 1e 6f 53 1c d3 be 37 e9 |IBl..'. .oS...7.| | fa 6b 35 a0 04 e8 28 86 9c 75 73 f2 00 00 00 03 |.k5...(..us.....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #145 (first time) conversation = 0x7f2686943dd0, ssl_session = 0x7f265a93cd40 record: offset = 0, reported_length_remaining = 130 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 24, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 24 Ciphertext[24]: | 54 07 1a 1e c3 73 d6 10 c8 85 9f dd 14 b3 3a 79 |T....s........:y| | 28 7c 73 e9 99 de cf 63 |(|s....c | Plaintext[24]: | 6c f2 b8 17 7f 94 dd 43 f1 6b f6 03 e1 6c 1d d4 |l......C.k...l..| | 7e cf f5 81 00 00 00 03 |~....... | ssl_decrypt_record found padding 3 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 59874 found (nil) association_find: TCP port 4444 found 0x345a750 record: offset = 29, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 96, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 96 Ciphertext[96]: | c8 a0 4c 36 28 bc 80 8f e4 ca 2f ab ca 95 eb bb |..L6(...../.....| | 9b 19 ae df c4 cc 3e 1e 7e 6e c6 4c 0b 6e 71 c6 |......>.~n.L.nq.| | 81 ac f3 32 a1 81 d7 22 ba 80 9e 8d 16 f0 0d d6 |...2..."........| | eb dd 51 fc b4 a4 94 14 76 3a 06 67 c9 c1 ec 47 |..Q.....v:.g...G| | 0b ca 61 51 cd 8b 9c 75 7e 5b d9 82 02 56 eb c0 |..aQ...u~[...V..| | 36 13 5e 61 a9 26 b3 99 8f 93 d4 55 4b 6c 53 59 |6.^a.&.....UKlSY| Plaintext[96]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 64 68 2d 64 73 73 2d 64 65 |Host: edh-dss-de| | 73 2d 63 62 63 33 2d 73 68 61 2e 6c 6f 63 61 6c |s-cbc3-sha.local| | 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n| | 6c 3a 34 34 34 34 0d 0a 0d 0a d8 17 fb e9 90 c8 |l:4444..........| | 47 f7 96 21 1d 96 f9 d9 1c 86 19 23 9c 62 00 01 |G..!.......#.b..| ssl_decrypt_record found padding 1 final len 94 checking mac (len 74, version 300, ct 23 seq 2) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 74, seq = 0, nxtseq = 74 association_find: TCP port 59874 found (nil) association_find: TCP port 4444 found 0x345a750 dissect_ssl3_record decrypted len 74 decrypted app data fragment[74]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 64 68 2d 64 73 73 2d 64 65 |Host: edh-dss-de| | 73 2d 63 62 63 33 2d 73 68 61 2e 6c 6f 63 61 6c |s-cbc3-sha.local| | 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n| | 6c 3a 34 34 34 34 0d 0a 0d 0a |l:4444.... | dissect_ssl3_record found association 0x345a750 dissect_ssl enter frame #146 (first time) conversation = 0x7f2686943dd0, ssl_session = 0x7f265a93cd40 record: offset = 0, reported_length_remaining = 381 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 376, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 376 Ciphertext[376]: | 3f d9 bd 7b fb 42 50 c7 c0 e3 76 1a ab d0 ff 5f |?..{.BP...v...._| | e6 3d a8 f2 85 8f a3 c2 c1 06 f6 23 bd 04 e6 7d |.=.........#...}| | 95 3b 55 ca 1f 7e 44 d6 f5 05 bb 5a de 6a 9a a7 |.;U..~D....Z.j..| | fa 57 4e 65 72 dd f0 3c 1a d2 49 b6 0f 13 df 44 |.WNer..<..I....D| | ce 67 e9 16 0b 1a 44 08 45 af 9f fd 1f f6 6d 34 |.g....D.E.....m4| | 03 3f 01 f3 fd 58 c7 ea 7a 70 fa 09 93 2e af 9d |.?...X..zp......| | b7 91 e6 46 d2 96 fb 5f df 0e eb 16 ed 25 ab 5e |...F..._.....%.^| | 43 68 1d 22 eb ee f5 94 0b 59 e5 c5 c0 11 3d 3b |Ch.".....Y....=;| | 4c d1 23 6c 64 a8 9a 88 49 2a d0 ad 22 d2 67 44 |L.#ld...I*..".gD| | 3f 8c 5f 58 1a 22 06 10 9e 0a 5d 5c 51 75 86 74 |?._X."....]\Qu.t| | 4c b4 77 f2 ff bf 52 7c aa 4a 6a f5 b9 d3 b5 4b |L.w...R|.Jj....K| | d1 73 3f d7 64 9b 0f 62 e4 90 6a 00 6b e4 2c 42 |.s?.d..b..j.k.,B| | a4 4a 9a 99 25 32 0f a8 ba c4 45 38 25 8c b3 77 |.J..%2....E8%..w| | 3a d5 e2 34 b6 94 2a c0 27 5f 48 9d ae c0 26 66 |:..4..*.'_H...&f| | 19 a6 ba ec 09 2d eb 96 f7 6f 7e 6b 5a 9f 2f 1c |.....-...o~kZ./.| | 34 86 69 e3 43 d8 d6 0e f6 41 b1 77 b9 db f4 f1 |4.i.C....A.w....| | 0a 14 a1 db cf 1a b7 bf 28 0b 23 af 50 23 1b 51 |........(.#.P#.Q| | 82 80 3e 0b a6 9a fe 41 3e 00 de 5c 59 4d 52 4f |..>....A>..\YMRO| | f3 1b c4 a8 22 2a 29 3a cf 0c 6b 39 83 f3 7d 7f |...."*):..k9..}.| | 8e 05 ea c7 4f 22 d7 91 9e 3e 97 61 a4 10 06 ad |....O"...>.a....| | 45 58 82 97 1f 2a 5b a0 99 e2 8d 11 6c d9 ae 82 |EX...*[.....l...| | 32 9c 5b 2c fb da 86 86 86 4e 26 78 1b e3 72 78 |2.[,.....N&x..rx| | ed 2c 26 f1 c3 1f 19 a3 55 17 7b 59 7b 3e 1a a7 |.,&.....U.{Y{>..| | 12 b3 22 37 1e c5 bd 22 |.."7..." | Plaintext[376]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:18 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 31 33 20 2d 20 45 44 48 2d 44 |x00,0x13 - EDH-D| | 53 53 2d 44 45 53 2d 43 42 43 33 2d 53 48 41 20 |SS-DES-CBC3-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc| | 3d 33 44 45 53 28 31 36 38 29 20 4d 61 63 3d 53 |=3DES(168) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1IP.[| | fc 07 a2 57 3e cc ab ca a0 e6 b7 de ee 11 fe 3c |...W>..........<| | 00 00 00 00 00 00 00 07 |........ | ssl_decrypt_record found padding 7 final len 368 checking mac (len 348, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348 association_find: TCP port 4444 found 0x345a750 dissect_ssl3_record decrypted len 348 decrypted app data fragment[348]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:18 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 31 33 20 2d 20 45 44 48 2d 44 |x00,0x13 - EDH-D| | 53 53 2d 44 45 53 2d 43 42 43 33 2d 53 48 41 20 |SS-DES-CBC3-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc| | 3d 33 44 45 53 28 31 36 38 29 20 4d 61 63 3d 53 |=3DES(168) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1 | dissect_ssl3_record found association 0x345a750 dissect_ssl enter frame #147 (first time) conversation = 0x7f2686943dd0, ssl_session = 0x7f265a93cd40 record: offset = 0, reported_length_remaining = 29 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 24, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 24 Ciphertext[24]: | bc 59 84 90 5f 26 64 57 19 81 62 bd 1e 9d a7 7e |.Y.._&dW..b....~| | fe 00 36 fa 2d 92 1f 03 |..6.-... | Plaintext[24]: | 01 00 4d 8d 73 8c f6 6f 05 d7 b8 4b c7 59 1d ff |..M.s..o...K.Y..| | ff 18 07 2b 51 79 00 01 |...+Qy.. | ssl_decrypt_record found padding 1 final len 22 checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #149 (first time) conversation = 0x7f2686943dd0, ssl_session = 0x7f265a93cd40 record: offset = 0, reported_length_remaining = 29 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 24, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 24 Ciphertext[24]: | 94 f7 00 56 4d eb f2 36 d0 27 41 db c6 6f fb 60 |...VM..6.'A..o.`| | 8a 70 e5 77 bb 22 fc 48 |.p.w.".H | Plaintext[24]: | 01 00 24 62 ed 2c f0 55 95 18 25 30 0d 32 b7 b5 |..$b.,.U..%0.2..| | 16 e4 5c 5e 30 26 00 01 |..\^0&.. | ssl_decrypt_record found padding 1 final len 22 checking mac (len 2, version 300, ct 21 seq 3) ssl_decrypt_record: mac ok dissect_ssl enter frame #154 (first time) ssl_session_init: initializing ptr 0x7f265a93f520 size 688 conversation = 0x7f2686944130, ssl_session = 0x7f265a93f520 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 33884 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4446 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #156 (first time) conversation = 0x7f2686944130, ssl_session = 0x7f265a93f520 record: offset = 0, reported_length_remaining = 1437 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0x0015 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 1351 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898 record: offset = 898, reported_length_remaining = 539 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 525, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 903 length 521 bytes, remaining 1428 record: offset = 1428, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1433 length 0 bytes, remaining 1437 dissect_ssl enter frame #158 (first time) conversation = 0x7f2686944130, ssl_session = 0x7f265a93f520 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84f... looking for RSA pre-master0080a046e74ffedeed810bc34ad61195062ec99ed35fb2b9... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 key expansion[72]: | e9 fa 97 9d 76 7f 9d 49 40 3b d6 f8 f4 66 ed fd |....v..I@;...f..| | 04 95 52 78 dc 64 60 a0 60 53 d2 94 7e 7d f3 a8 |..Rx.d`.`S..~}..| | dd bf 13 0d 9c ba 39 3e 29 4a 2d 95 c0 bb 49 52 |......9>)J-...IR| | 1d 5a 17 99 9b 3e 06 50 b1 71 24 3e b1 f6 c2 90 |.Z...>.P.q$>....| | 28 f1 31 59 f6 05 6b a9 |(.1Y..k. | Client MAC key[20]: | e9 fa 97 9d 76 7f 9d 49 40 3b d6 f8 f4 66 ed fd |....v..I@;...f..| | 04 95 52 78 |..Rx | Server MAC key[20]: | dc 64 60 a0 60 53 d2 94 7e 7d f3 a8 dd bf 13 0d |.d`.`S..~}......| | 9c ba 39 3e |..9> | Client Write key[8]: | 29 4a 2d 95 c0 bb 49 52 |)J-...IR | Server Write key[8]: | 1d 5a 17 99 9b 3e 06 50 |.Z...>.P | Client Write IV[8]: | b1 71 24 3e b1 f6 c2 90 |.q$>.... | Server Write IV[8]: | 28 f1 31 59 f6 05 6b a9 |(.1Y..k. | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | 14 5e 8b ce a2 84 77 bb 23 36 f8 a2 f2 5c 3b e6 |.^....w.#6...\;.| | 01 98 3b 80 d1 e4 1a 54 a3 5e ce 19 65 22 94 95 |..;....T.^..e"..| ssl_save_session stored master secret[48]: | 26 e4 7d a9 54 35 80 c8 4f 02 b9 34 0e 95 03 a5 |&.}.T5..O..4....| | 86 ba 81 f8 cd 34 f8 a8 1f 90 07 40 0e d0 6a 79 |.....4.....@..jy| | 6e 5a c0 f6 8d 2f 49 56 10 cf 69 20 b9 c7 5c ea |nZ.../IV..i ..\.| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 4b 44 ca 8d 7e ab a4 28 21 01 d7 2a 2a 75 87 dc |KD..~..(!..**u..| | 66 c3 53 d3 d3 07 d8 38 22 a0 ba b7 a6 b5 31 6d |f.S....8".....1m| | af 74 24 f5 fd 11 ae a9 b5 14 35 8e 76 44 96 6d |.t$.......5.vD.m| | ab 0e 8e 21 b3 c1 f0 91 0f 91 3e 1e cf 4c f3 b8 |...!......>..L..| Plaintext[64]: | 14 00 00 24 60 eb 93 ae f8 16 c6 bf 45 5c 1b ed |...$`.......E\..| | 27 1f 99 85 15 54 e4 d3 28 14 99 97 de a8 59 52 |'....T..(.....YR| | 3c 53 8c fe 2d 26 f5 d5 29 23 3c 2d a2 b1 28 f5 |.| | 70 dd 1f 8f f3 90 bd 5b 21 ff bd 0d 94 e7 72 98 |p......[!.....r.| | e9 4a a4 8e a5 c2 fc 80 9d d8 50 17 e3 88 1b 09 |.J........P.....| | 52 cc 99 a8 54 a8 c4 4f 67 ef 3e a4 2c 3f 31 e5 |R...T..Og.>.,?1.| Plaintext[64]: | 14 00 00 24 42 3c 97 db 90 8a 0e 70 8b 96 fb 1a |...$B<.....p....| | 7e 36 39 21 04 82 d8 b8 68 9d 7a 96 e0 59 90 08 |~69!....h.z..Y..| | d7 ef 1e 24 58 5b 0e b2 06 ca ca bf e2 10 00 d4 |...$X[..........| | 9a 3c fb a5 80 36 58 a9 29 4e 45 93 00 00 00 03 |.<...6X.)NE.....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #160 (first time) conversation = 0x7f2686944130, ssl_session = 0x7f265a93f520 record: offset = 0, reported_length_remaining = 130 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 24, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 24 Ciphertext[24]: | 44 29 76 72 37 4a d2 06 f5 d5 a5 bb 9b 8f 5c eb |D)vr7J........\.| | 01 62 a5 3c 13 00 1e 81 |.b.<.... | Plaintext[24]: | de 05 6e 70 c9 bc 0a 03 20 e7 02 1c bc 5e 17 b0 |..np.... ....^..| | 45 65 03 67 00 00 00 03 |Ee.g.... | ssl_decrypt_record found padding 3 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 33884 found (nil) association_find: TCP port 4446 found 0x345a870 record: offset = 29, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 96, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 96 Ciphertext[96]: | 6c 99 b7 6e cc 01 e4 46 30 89 e5 e7 88 ad 2e e6 |l..n...F0.......| | b5 ec 36 6a ce 58 8f eb 18 50 15 16 a7 8a 44 c2 |..6j.X...P....D.| | 2d 5f 77 11 73 d5 cf e7 3a 20 98 ee cc 44 16 92 |-_w.s...: ...D..| | 54 46 3c 78 51 ea c4 15 8b 2e 9f 3b be 3c 8e f9 |TF.=........| | dd 5b 41 63 0a 3c 55 42 1a 3f 24 13 4b bd 44 9e |.[Ac.XV..|.<......| | 2e 19 04 fa bc 32 97 5c 6d a6 47 e9 f5 b6 b0 01 |.....2.\m.G.....| | 39 6c ae 5e 02 09 ee 20 7f 9a 1b 53 05 d4 6d 3e |9l.^... ...S..m>| | de 30 03 53 cf ef a7 e1 3a 3d 09 77 61 f0 4f ca |.0.S....:=.wa.O.| | 25 d2 11 dc 2e 26 63 97 0f d1 9f 06 f5 7f 0f 36 |%....&c........6| | 6c 0c df 3b fa 0c 64 ec 98 fa 8c 0a 83 10 2e 8d |l..;..d.........| | 43 e3 cb c2 ee 87 ce 01 db b6 af 8d 35 bd 1b 9e |C...........5...| | e8 eb 5b fe ca 3c 28 a4 36 aa be 14 5a 4a fd f2 |..[..<(.6...ZJ..| | 0b 04 84 dc 8d 9e e8 83 ee 50 4b d8 db ab e7 5f |.........PK...._| | 98 12 73 86 fc 89 4b a8 04 a0 15 fe 26 c9 74 e5 |..s...K.....&.t.| | a4 b1 a7 a6 34 f7 ce 48 d9 77 f9 24 67 40 33 99 |....4..H.w.$g@3.| | 03 44 84 30 19 8c d8 c5 |.D.0.... | Plaintext[376]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:18 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 31 35 20 2d 20 45 44 48 2d 52 |x00,0x15 - EDH-R| | 53 41 2d 44 45 53 2d 43 42 43 2d 53 48 41 20 20 |SA-DES-CBC-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 44 45 53 28 35 36 29 20 20 20 4d 61 63 3d 53 |=DES(56) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1L...| | c2 82 e6 d0 0f 5c ab ae 76 e4 b3 a9 7b 24 ca 06 |.....\..v...{$..| | 00 00 00 00 00 00 00 07 |........ | ssl_decrypt_record found padding 7 final len 368 checking mac (len 348, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348 association_find: TCP port 4446 found 0x345a870 dissect_ssl3_record decrypted len 348 decrypted app data fragment[348]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:18 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 31 35 20 2d 20 45 44 48 2d 52 |x00,0x15 - EDH-R| | 53 41 2d 44 45 53 2d 43 42 43 2d 53 48 41 20 20 |SA-DES-CBC-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 44 45 53 28 35 36 29 20 20 20 4d 61 63 3d 53 |=DES(56) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1 | dissect_ssl3_record found association 0x345a870 dissect_ssl enter frame #162 (first time) conversation = 0x7f2686944130, ssl_session = 0x7f265a93f520 record: offset = 0, reported_length_remaining = 29 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 24, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 24 Ciphertext[24]: | dc 47 2a 1f 7f 1d 73 b6 48 d2 a7 19 3b 45 0f d7 |.G*...s.H...;E..| | e8 d6 5f 1f 04 ed e2 0e |.._..... | Plaintext[24]: | 01 00 87 58 bf 52 e8 d4 ef d2 1b e2 92 d8 c3 23 |...X.R.........#| | 4a 51 1d c8 c0 8f 00 01 |JQ...... | ssl_decrypt_record found padding 1 final len 22 checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #164 (first time) conversation = 0x7f2686944130, ssl_session = 0x7f265a93f520 record: offset = 0, reported_length_remaining = 29 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 24, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 24 Ciphertext[24]: | 75 ba 8f 45 fc 45 f8 9d fb 9b 69 03 4b a4 2a 5a |u..E.E....i.K.*Z| | 73 e2 25 5d f7 41 37 de |s.%].A7. | Plaintext[24]: | 01 00 5b 6d b4 90 18 9a f6 17 9f c0 50 11 3f 9c |..[m........P.?.| | 43 4d e0 f7 01 7b 00 01 |CM...{.. | ssl_decrypt_record found padding 1 final len 22 checking mac (len 2, version 300, ct 21 seq 3) ssl_decrypt_record: mac ok dissect_ssl enter frame #169 (first time) ssl_session_init: initializing ptr 0x7f265a941cc0 size 688 conversation = 0x7f2686944488, ssl_session = 0x7f265a941cc0 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 34102 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4447 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #171 (first time) conversation = 0x7f2686944488, ssl_session = 0x7f265a941cc0 record: offset = 0, reported_length_remaining = 1437 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0x0016 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 1351 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898 record: offset = 898, reported_length_remaining = 539 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 525, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 903 length 521 bytes, remaining 1428 record: offset = 1428, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1433 length 0 bytes, remaining 1437 dissect_ssl enter frame #173 (first time) conversation = 0x7f2686944488, ssl_session = 0x7f265a941cc0 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383e... looking for RSA pre-master0080b5993b98996be9961f2d2863a7adc41823d9906a82ff... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 ssl3_prf: sha1_hash(6) ssl3_prf: md5_hash(6) datalen 48 ssl3_prf: sha1_hash(7) ssl3_prf: md5_hash(7) datalen 48 key expansion[104]: | a8 a6 08 a7 38 40 cd b7 ec f5 7f ed 5b 86 36 0b |....8@......[.6.| | 20 9b fa 5d af 45 10 e1 b6 ef 44 58 c9 93 32 90 | ..].E....DX..2.| | 65 b6 37 d8 3b 62 14 40 78 64 c3 1e f2 aa 77 1b |e.7.;b.@xd....w.| | aa 62 cf a3 ac 0a aa d5 2a 32 39 68 3e 19 df 49 |.b......*29h>..I| | 04 4b 98 c3 2c a6 f7 68 70 1f d9 11 09 c4 bf 04 |.K..,..hp.......| | b7 c9 fe ec cf e3 70 de 1f 1c f8 1d 7a c2 4d 33 |......p.....z.M3| | 8d 26 1e 42 a5 cb 59 2d |.&.B..Y- | Client MAC key[20]: | a8 a6 08 a7 38 40 cd b7 ec f5 7f ed 5b 86 36 0b |....8@......[.6.| | 20 9b fa 5d | ..] | Server MAC key[20]: | af 45 10 e1 b6 ef 44 58 c9 93 32 90 65 b6 37 d8 |.E....DX..2.e.7.| | 3b 62 14 40 |;b.@ | Client Write key[24]: | 78 64 c3 1e f2 aa 77 1b aa 62 cf a3 ac 0a aa d5 |xd....w..b......| | 2a 32 39 68 3e 19 df 49 |*29h>..I | Server Write key[24]: | 04 4b 98 c3 2c a6 f7 68 70 1f d9 11 09 c4 bf 04 |.K..,..hp.......| | b7 c9 fe ec cf e3 70 de |......p. | Client Write IV[8]: | 1f 1c f8 1d 7a c2 4d 33 |....z.M3 | Server Write IV[8]: | 8d 26 1e 42 a5 cb 59 2d |.&.B..Y- | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | 98 06 55 df 33 2e 33 bd 42 07 49 17 a9 8d f6 50 |..U.3.3.B.I....P| | 45 2d d2 0e 5c cf bb 28 38 b1 f8 34 22 7f d3 1e |E-..\..(8..4"...| ssl_save_session stored master secret[48]: | ab 74 82 08 a6 99 72 c2 2c 06 59 23 f4 3d d8 3a |.t....r.,.Y#.=.:| | b2 f8 6b eb e3 0e c0 5b 2a 17 1a f1 38 56 ad f2 |..k....[*...8V..| | 1c aa 06 ef c9 d6 58 8d 6c db 38 f6 ec 98 13 67 |......X.l.8....g| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 9e 53 59 1d 1e 3b 61 fe 7d a8 be 3f 90 51 d7 b7 |.SY..;a.}..?.Q..| | 00 76 48 58 89 4b 03 99 af a6 e8 a6 cc 86 0d 50 |.vHX.K.........P| | 3b a4 aa 23 30 04 6c 08 c7 5b 95 47 a5 af 7c 54 |;..#0.l..[.G..|T| | 6c 85 0c 23 3b 15 68 65 e1 f1 71 85 94 69 09 5f |l..#;.he..q..i._| Plaintext[64]: | 14 00 00 24 51 d1 51 54 72 9f 08 23 0a 76 c9 55 |...$Q.QTr..#.v.U| | b5 87 95 c1 b5 57 b7 41 6e 47 f0 fc 7e 27 88 70 |.....W.AnG..~'.p| | 9c 58 67 da 2c 6b 14 98 6f 3a 00 ad 4e 77 bd 40 |.Xg.,k..o:..Nw.@| | 96 ca cf 45 08 85 b7 df 9f 3f 63 1c 00 00 00 03 |...E.....?c.....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #174 (first time) conversation = 0x7f2686944488, ssl_session = 0x7f265a941cc0 record: offset = 0, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | cb e9 7a 07 ea 8a 95 06 3a df b7 32 b7 9f 0f 9b |..z.....:..2....| | 06 5f d2 78 11 b3 1a 64 de a1 c8 92 32 f3 2e 6f |._.x...d....2..o| | 9d 16 b4 6b 0e 85 91 a4 6e 6e a8 f4 1c bb fc dc |...k....nn......| | cd 49 9b 32 9a cd 2a 05 24 b3 ae da 59 3e b4 d1 |.I.2..*.$...Y>..| Plaintext[64]: | 14 00 00 24 3d 5d 9a 09 31 8b 33 ab 68 f1 3b c3 |...$=]..1.3.h.;.| | f3 eb be 1d 1d 6a cc 27 25 9c 4e 06 2f e5 29 4e |.....j.'%.N./.)N| | b1 75 89 68 6f ae d4 5d 85 40 f8 d5 f3 16 2b a4 |.u.ho..].@....+.| | 27 59 da a5 f0 d7 f2 31 fc 79 ad 7d 00 00 00 03 |'Y.....1.y.}....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #175 (first time) conversation = 0x7f2686944488, ssl_session = 0x7f265a941cc0 record: offset = 0, reported_length_remaining = 130 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 24, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 24 Ciphertext[24]: | 8f 20 2f 19 e0 b9 ff 09 15 0f 20 34 df 6b a8 08 |. /....... 4.k..| | 55 a1 ca 4a c0 50 91 6a |U..J.P.j | Plaintext[24]: | 8c dd ad d7 b5 db bd 77 5d 56 53 fd e6 54 df 32 |.......w]VS..T.2| | f6 ce 8d ce 00 00 00 03 |........ | ssl_decrypt_record found padding 3 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 34102 found (nil) association_find: TCP port 4447 found 0x345a900 record: offset = 29, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 96, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 96 Ciphertext[96]: | f9 dd 72 4f 9f 2b a2 33 74 9c 7a ee 36 7b db d1 |..rO.+.3t.z.6{..| | df 98 28 4d 5d 76 5d 36 cf ba 9c 51 79 69 53 cf |..(M]v]6...QyiS.| | 27 56 d2 20 eb 39 19 68 90 29 54 ac c9 24 01 64 |'V. .9.h.)T..$.d| | b9 78 dd 2d cb f6 8f c8 98 d2 35 b4 09 62 13 1a |.x.-......5..b..| | 2e e5 9c 12 66 c9 63 8a dd 97 35 9d 88 1d d8 36 |....f.c...5....6| | 6f 55 4e 82 5f bc 3a 41 fe 83 c8 3e 85 ad 8d 6c |oUN._.:A...>...l| Plaintext[96]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 64 68 2d 72 73 61 2d 64 65 |Host: edh-rsa-de| | 73 2d 63 62 63 33 2d 73 68 61 2e 6c 6f 63 61 6c |s-cbc3-sha.local| | 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n| | 6c 3a 34 34 34 37 0d 0a 0d 0a 92 23 8a 35 66 c1 |l:4447.....#.5f.| | de 14 01 d7 4c 97 fc 7f 58 85 30 77 de 0d 00 01 |....L...X.0w....| ssl_decrypt_record found padding 1 final len 94 checking mac (len 74, version 300, ct 23 seq 2) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 74, seq = 0, nxtseq = 74 association_find: TCP port 34102 found (nil) association_find: TCP port 4447 found 0x345a900 dissect_ssl3_record decrypted len 74 decrypted app data fragment[74]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 64 68 2d 72 73 61 2d 64 65 |Host: edh-rsa-de| | 73 2d 63 62 63 33 2d 73 68 61 2e 6c 6f 63 61 6c |s-cbc3-sha.local| | 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n| | 6c 3a 34 34 34 37 0d 0a 0d 0a |l:4447.... | dissect_ssl3_record found association 0x345a900 dissect_ssl enter frame #176 (first time) conversation = 0x7f2686944488, ssl_session = 0x7f265a941cc0 record: offset = 0, reported_length_remaining = 381 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 376, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 376 Ciphertext[376]: | ae da 20 e3 b0 3c 7d 72 83 3f 65 66 fa 79 a0 35 |.. ..<}r.?ef.y.5| | 03 95 b0 f0 9f 30 99 25 8a 36 41 3b 29 83 fa ad |.....0.%.6A;)...| | a9 a6 41 67 04 85 13 92 22 12 50 e9 36 38 e8 6a |..Ag....".P.68.j| | 29 51 d4 7d 66 f0 f8 b4 cc 3d 6a 4a b2 80 cd 38 |)Q.}f....=jJ...8| | 24 68 c5 29 9d e5 58 98 9b 7a fb 70 b1 d2 88 f1 |$h.)..X..z.p....| | 73 53 42 4e ab a1 51 74 0e 48 9f 28 ad 19 43 e7 |sSBN..Qt.H.(..C.| | da 49 7b 95 da d0 32 39 de 65 c7 72 19 b0 a8 74 |.I{...29.e.r...t| | f3 43 fa 5c 05 ec c7 2d 6b d1 f0 a6 b2 e9 41 4f |.C.\...-k.....AO| | 7c 6b f9 f2 ee bc 97 b0 fe e6 6a 8a d7 c7 80 d0 ||k........j.....| | 3f 4a 3a 63 fc 6f d2 f1 36 6c 24 58 2e ce a1 b1 |?J:c.o..6l$X....| | 8e dc 8f ab 2e f4 a5 92 9e c1 cf 16 82 e8 bf 4b |...............K| | 9c 52 b5 fb 1f 5d 0d c6 e0 0b 13 2a 14 08 1f a6 |.R...].....*....| | 21 7d 83 50 8a 41 3e 9e 3a 6c 99 f7 00 02 62 76 |!}.P.A>.:l....bv| | 46 6b 8b 2c 4f eb 32 11 fe 0e c6 d0 a5 0a 48 25 |Fk.,O.2.......H%| | 54 31 a0 f1 2c 14 1b bb 6c d4 fc ec 3a 7e a7 c3 |T1..,...l...:~..| | 33 92 ee 69 4d 2e 26 31 df 4f c4 a6 b3 71 98 fc |3..iM.&1.O...q..| | cd 8b 27 35 8e 8f c2 15 fc fa 6a 76 e3 17 fc fc |..'5......jv....| | ed d8 02 ad 33 f8 8e 08 c8 38 ac b4 18 66 3f 27 |....3....8...f?'| | ac b5 c9 0e ea 95 53 58 4b 87 80 94 b8 dd 3e de |......SXK.....>.| | 9c 37 ef 3c 4e c5 b1 97 c8 ef 9d 78 dc de d8 d5 |.7.!| | 14 ec 3e 6e 0a cb 5d 82 03 0b 12 c8 43 c0 1d 97 |..>n..].....C...| | c1 79 23 5b ff af ef 8d |.y#[.... | Plaintext[376]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:18 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 31 36 20 2d 20 45 44 48 2d 52 |x00,0x16 - EDH-R| | 53 41 2d 44 45 53 2d 43 42 43 33 2d 53 48 41 20 |SA-DES-CBC3-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 33 44 45 53 28 31 36 38 29 20 4d 61 63 3d 53 |=3DES(168) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1.D..| | f5 ec aa 1f 10 cd f3 e2 1f f1 a5 3d b6 5e 64 dd |...........=.^d.| | 00 00 00 00 00 00 00 07 |........ | ssl_decrypt_record found padding 7 final len 368 checking mac (len 348, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348 association_find: TCP port 4447 found 0x345a900 dissect_ssl3_record decrypted len 348 decrypted app data fragment[348]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:18 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 31 36 20 2d 20 45 44 48 2d 52 |x00,0x16 - EDH-R| | 53 41 2d 44 45 53 2d 43 42 43 33 2d 53 48 41 20 |SA-DES-CBC3-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 33 44 45 53 28 31 36 38 29 20 4d 61 63 3d 53 |=3DES(168) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1 | dissect_ssl3_record found association 0x345a900 dissect_ssl enter frame #177 (first time) conversation = 0x7f2686944488, ssl_session = 0x7f265a941cc0 record: offset = 0, reported_length_remaining = 29 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 24, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 24 Ciphertext[24]: | 87 07 3d 39 06 ca 14 60 63 dc f5 18 6d b3 6f 10 |..=9...`c...m.o.| | 4d eb 2d 27 b4 25 b7 df |M.-'.%.. | Plaintext[24]: | 01 00 20 da db 7d c9 4b 91 a1 ad a4 e2 89 45 87 |.. ..}.K......E.| | c1 29 c8 91 01 b1 00 01 |.)...... | ssl_decrypt_record found padding 1 final len 22 checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #179 (first time) conversation = 0x7f2686944488, ssl_session = 0x7f265a941cc0 record: offset = 0, reported_length_remaining = 29 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 24, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 24 Ciphertext[24]: | 07 ea a4 8a 72 9d ae dd 6e b3 e8 b3 9d 78 5e d4 |....r...n....x^.| | 39 9e d8 ef 29 e1 05 1b |9...)... | Plaintext[24]: | 01 00 79 ff 92 02 f5 f0 97 78 a9 a9 81 37 4a ab |..y......x...7J.| | 64 0e 84 ac 2f e4 00 01 |d.../... | ssl_decrypt_record found padding 1 final len 22 checking mac (len 2, version 300, ct 21 seq 3) ssl_decrypt_record: mac ok dissect_ssl enter frame #184 (first time) ssl_session_init: initializing ptr 0x7f265a9444a0 size 688 conversation = 0x7f26869447e8, ssl_session = 0x7f265a9444a0 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 56057 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4448 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #186 (first time) conversation = 0x7f26869447e8, ssl_session = 0x7f265a9444a0 record: offset = 0, reported_length_remaining = 907 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0x002F -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 821 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898 record: offset = 898, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 903 length 0 bytes, remaining 907 dissect_ssl enter frame #188 (first time) conversation = 0x7f26869447e8, ssl_session = 0x7f265a9444a0 record: offset = 0, reported_length_remaining = 340 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 260, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 256 bytes, remaining 265 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e... looking for RSA pre-master5a4b402157a882062a4b2b19838818b8342937edf3db611c... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 ssl3_prf: sha1_hash(6) ssl3_prf: md5_hash(6) datalen 48 ssl3_prf: sha1_hash(7) ssl3_prf: md5_hash(7) datalen 48 key expansion[104]: | 7a c6 33 9c 18 11 98 dc 28 c7 e5 61 58 cd 69 e7 |z.3.....(..aX.i.| | 8d c6 71 9f c7 ee f3 07 9f cb f9 97 f4 82 f4 eb |..q.............| | 25 ae 96 a7 7e fa 87 6c 16 ca 27 c2 10 c4 03 7a |%...~..l..'....z| | 8f b9 3b 94 fc 86 2e b5 87 35 30 ca dd 33 37 b6 |..;......50..37.| | ed 94 40 c5 c2 2a 1a 41 65 0e bf 36 3a 0e 6c 74 |..@..*.Ae..6:.lt| | 98 a1 19 9c be b5 87 81 6a 12 49 1c 5c b7 d0 1f |........j.I.\...| | 82 f4 3f 46 ab 8e 59 c8 |..?F..Y. | Client MAC key[20]: | 7a c6 33 9c 18 11 98 dc 28 c7 e5 61 58 cd 69 e7 |z.3.....(..aX.i.| | 8d c6 71 9f |..q. | Server MAC key[20]: | c7 ee f3 07 9f cb f9 97 f4 82 f4 eb 25 ae 96 a7 |............%...| | 7e fa 87 6c |~..l | Client Write key[16]: | 16 ca 27 c2 10 c4 03 7a 8f b9 3b 94 fc 86 2e b5 |..'....z..;.....| Server Write key[16]: | 87 35 30 ca dd 33 37 b6 ed 94 40 c5 c2 2a 1a 41 |.50..37...@..*.A| Client Write IV[16]: | 65 0e bf 36 3a 0e 6c 74 98 a1 19 9c be b5 87 81 |e..6:.lt........| Server Write IV[16]: | 6a 12 49 1c 5c b7 d0 1f 82 f4 3f 46 ab 8e 59 c8 |j.I.\.....?F..Y.| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | 60 c8 27 21 df 4a 0b 60 88 e6 06 16 da 56 67 d0 |`.'!.J.`.....Vg.| | 32 2d 04 51 31 17 92 a7 fd ea 33 c1 0e ee ca 30 |2-.Q1.....3....0| ssl_save_session stored master secret[48]: | a1 50 7a 7e 7d 5c ca a7 9d 73 d0 de 88 16 e5 ff |.Pz~}\...s......| | b5 0e 99 ab 68 52 31 c6 42 94 13 0b af e0 90 ed |....hR1.B.......| | 1b 24 92 8e 12 af 26 64 29 e8 df 43 86 22 f0 fc |.$....&d)..C."..| dissect_ssl3_handshake session keys successfully generated record: offset = 265, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 271, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 0b d3 bb 09 40 27 d4 ea 86 45 92 60 48 0b fb 89 |....@'...E.`H...| | 31 7c 2c 2a 96 2d 05 82 4e d0 b2 64 7e cf f4 0d |1|,*.-..N..d~...| | 43 89 7b a2 05 d4 40 77 ce 41 4d b4 1d 5a cb 7a |C.{...@w.AM..Z.z| | 3e 56 9f fe 29 5d 45 7f 83 8b ef e6 76 d0 fc 99 |>V..)]E.....v...| Plaintext[64]: | 14 00 00 24 8c 8f c5 f0 ee 18 db b0 fe 68 05 de |...$.........h..| | d5 e8 79 31 ba 59 0b 24 9c a1 22 28 41 79 b9 51 |..y1.Y.$.."(Ay.Q| | 49 e3 89 8d 95 a0 95 ab 8d a8 56 73 c5 57 9e 5b |I.........Vs.W.[| | 24 04 24 b1 2f 82 76 68 c6 51 e6 2a 00 00 00 03 |$.$./.vh.Q.*....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #189 (first time) conversation = 0x7f26869447e8, ssl_session = 0x7f265a9444a0 record: offset = 0, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 6c 81 a0 65 5c 2d 02 36 cd 5a 6f 0e ef 91 e9 d7 |l..e\-.6.Zo.....| | 58 07 be c2 a6 d6 c1 49 2c 25 23 e0 71 87 a2 5d |X......I,%#.q..]| | 98 00 58 d5 7f 1f 76 08 bc 5e c0 c4 ad f9 eb 45 |..X...v..^.....E| | 2a 1b 62 a9 08 c7 e8 6c 1b 49 f8 56 d2 d6 18 90 |*.b....l.I.V....| Plaintext[64]: | 14 00 00 24 28 d9 c7 74 4b 4c 61 b0 d5 6a 57 7b |...$(..tKLa..jW{| | 26 fd 97 99 1b b1 c2 04 07 9e ba 4d dd b3 a4 bf |&..........M....| | d7 7e 67 9d ec 1b 0e 24 cf 0b dc a2 28 b8 54 a5 |.~g....$....(.T.| | 0f fc 0f 97 61 00 bf b8 d1 97 47 bc 00 00 00 03 |....a.....G.....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #190 (first time) conversation = 0x7f26869447e8, ssl_session = 0x7f265a9444a0 record: offset = 0, reported_length_remaining = 138 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | db 68 17 af e9 18 23 15 2b c0 4b fa e5 6e be fd |.h....#.+.K..n..| | d1 8e 79 82 21 c3 ed 94 9e 37 16 67 11 c9 80 d1 |..y.!....7.g....| Plaintext[32]: | ef 38 c3 3c 16 63 56 48 03 be 88 63 e4 3e 0b 87 |.8.<.cVH...c.>..| | f5 bd 1c 1c 00 00 00 00 00 00 00 00 00 00 00 0b |................| ssl_decrypt_record found padding 11 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 56057 found (nil) association_find: TCP port 4448 found 0x345a990 record: offset = 37, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 96, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 96 Ciphertext[96]: | 97 40 76 6d 35 66 8f 61 2b 49 ef dd c2 cf 21 a3 |.@vm5f.a+I....!.| | 54 f6 bb ac 62 21 05 6e a2 3f ac 8b 2b 15 d5 0e |T...b!.n.?..+...| | 6b f2 ad 9d df 3d 5b bc f4 a1 5a 50 ec 74 15 78 |k....=[...ZP.t.x| | d4 0e 73 42 00 ec db f6 b3 2d c9 aa 14 6e f1 93 |..sB.....-...n..| | 06 08 dd 64 4c 86 6e 70 13 15 d9 64 9f 40 d2 51 |...dL.np...d.@.Q| | 7e fa c2 06 65 b4 ef 35 3a 39 08 a5 35 9b e6 c0 |~...e..5:9..5...| Plaintext[96]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 61 65 73 31 32 38 2d 73 68 61 |Host: aes128-sha| | 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 |.local.al.lekens| | 74 65 79 6e 2e 6e 6c 3a 34 34 34 38 0d 0a 0d 0a |teyn.nl:4448....| | 18 5b c7 5d 64 ed 6e 46 9d 06 54 3a 07 48 55 cd |.[.]d.nF..T:.HU.| | ac 93 bd eb 00 00 00 00 00 00 00 00 00 00 00 0b |................| ssl_decrypt_record found padding 11 final len 84 checking mac (len 64, version 300, ct 23 seq 2) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 64, seq = 0, nxtseq = 64 association_find: TCP port 56057 found (nil) association_find: TCP port 4448 found 0x345a990 dissect_ssl3_record decrypted len 64 decrypted app data fragment[64]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 61 65 73 31 32 38 2d 73 68 61 |Host: aes128-sha| | 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 |.local.al.lekens| | 74 65 79 6e 2e 6e 6c 3a 34 34 34 38 0d 0a 0d 0a |teyn.nl:4448....| dissect_ssl3_record found association 0x345a990 dissect_ssl enter frame #191 (first time) conversation = 0x7f26869447e8, ssl_session = 0x7f265a9444a0 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | 70 2a 3c 79 99 f1 00 9c 87 4b 0a 69 35 f6 a4 e9 |p*....("B..H.#o.| | 31 bd da fd f9 67 d7 7e 07 1a 5d e4 01 98 e6 43 |1....g.~..]....C| | a1 86 d4 2d dc e4 86 07 3a a9 08 ff 9e 5e 4d f3 |...-....:....^M.| | 94 41 39 f5 3f 81 90 da 36 6b 33 00 64 7e bf b3 |.A9.?...6k3.d~..| | 9c 67 5a 55 cb a6 44 52 10 a3 50 fa ed 88 7d 19 |.gZU..DR..P...}.| | e0 3c 84 48 38 8e 92 a9 7a e5 49 a5 dc 3b 29 fc |.<.H8...z.I..;).| | 68 49 db 31 86 9e d3 1c a9 21 b2 0c 61 a9 c3 c5 |hI.1.....!..a...| | 07 31 1f 86 22 80 5f 01 d6 2f bd 7a bc c5 85 e8 |.1.."._../.z....| | 24 83 74 c0 e9 ac 20 c7 1e ef fa 08 c0 e8 7f 77 |$.t... ........w| | a5 25 0e 89 86 f9 ed 6b 6b 63 b5 4f 7b c8 af b6 |.%.....kkc.O{...| | bd e9 ac 51 d4 1f d4 a7 93 1d 9c 76 d6 8f 4d ca |...Q.......v..M.| | e3 21 92 8d ce 79 d2 07 79 8f de 7e 92 94 7f 87 |.!...y..y..~....| | f1 3d a4 f5 37 29 44 f1 e5 56 e8 8b e8 ec b4 38 |.=..7)D..V.....8| | 46 06 85 b0 4d de b8 f6 27 29 82 20 cd 13 c7 a9 |F...M...'). ....| | ed 5f af 8e 74 19 89 39 2b b6 61 2a 61 96 9d 38 |._..t..9+.a*a..8| | 52 39 d7 d2 97 5a f1 72 71 83 2a 15 80 06 e9 24 |R9...Z.rq.*....$| | 18 71 c9 32 0f 9c 93 3e 85 f9 f3 6a de 01 09 99 |.q.2...>...j....| | c0 a3 48 e6 49 25 e9 b6 30 f4 65 67 31 86 9f 06 |..H.I%..0.eg1...| | 62 c0 e0 e5 eb 51 99 61 82 df 7e b0 55 75 97 6a |b....Q.a..~.Uu.j| | 2f c1 7d 5e 8f 99 5b c0 71 b8 45 46 3c de 0a cb |/.}^..[.q.EF<...| Plaintext[384]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 31 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:19 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 32 46 20 2d 20 41 45 53 31 32 |x00,0x2F - AES12| | 38 2d 53 48 41 20 20 20 20 20 20 20 20 20 20 20 |8-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1.h.4| | ad 80 7f 3a 40 10 b5 3b 89 62 61 b3 de 25 e9 7f |...:@..;.ba..%..| | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f |................| ssl_decrypt_record found padding 15 final len 368 checking mac (len 348, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348 association_find: TCP port 4448 found 0x345a990 dissect_ssl3_record decrypted len 348 decrypted app data fragment[348]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 31 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:19 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 32 46 20 2d 20 41 45 53 31 32 |x00,0x2F - AES12| | 38 2d 53 48 41 20 20 20 20 20 20 20 20 20 20 20 |8-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1 | dissect_ssl3_record found association 0x345a990 dissect_ssl enter frame #192 (first time) conversation = 0x7f26869447e8, ssl_session = 0x7f265a9444a0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 19 83 de ee c5 a6 43 03 87 16 b1 bd db 45 f8 2d |......C......E.-| | 77 3b 7a 4a 66 0e b2 89 64 95 f1 b0 be ea dc 87 |w;zJf...d.......| Plaintext[32]: | 01 00 0c 67 74 ca 62 ea de 45 e6 e8 04 51 1c 3d |...gt.b..E...Q.=| | e2 60 81 f9 0a ed 00 00 00 00 00 00 00 00 00 09 |.`..............| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #194 (first time) conversation = 0x7f26869447e8, ssl_session = 0x7f265a9444a0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 2d 8c d2 8b 9e a1 62 75 e5 12 67 2a 6d 07 de a1 |-.....bu..g*m...| | 52 12 a7 71 25 b5 d8 42 ce 7d be da 90 51 a0 b7 |R..q%..B.}...Q..| Plaintext[32]: | 01 00 32 50 28 23 5e 8a f9 0d ea 17 fa 1c b4 48 |..2P(#^........H| | 21 bf 18 d3 9e de 00 00 00 00 00 00 00 00 00 09 |!...............| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 3) ssl_decrypt_record: mac ok dissect_ssl enter frame #199 (first time) ssl_session_init: initializing ptr 0x7f265a946d00 size 688 conversation = 0x7f2686944b38, ssl_session = 0x7f265a946d00 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 34646 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4449 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #201 (first time) conversation = 0x7f2686944b38, ssl_session = 0x7f265a946d00 record: offset = 0, reported_length_remaining = 1156 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0x0032 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 1070 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 735, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 731 bytes, remaining 826 record: offset = 826, reported_length_remaining = 330 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 316, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 831 length 312 bytes, remaining 1147 record: offset = 1147, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1152 length 0 bytes, remaining 1156 dissect_ssl enter frame #203 (first time) conversation = 0x7f2686944b38, ssl_session = 0x7f265a946d00 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a1... looking for RSA pre-master00805ab67b5fe5bcd772b7417f40934875d1ea2a66e00547... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 ssl3_prf: sha1_hash(6) ssl3_prf: md5_hash(6) datalen 48 ssl3_prf: sha1_hash(7) ssl3_prf: md5_hash(7) datalen 48 key expansion[104]: | 9e 7b fb 21 a3 6d a2 3c 06 eb f6 0d 3b 15 7c c3 |.{.!.m.<....;.|.| | 7b f0 2b 9e 54 83 e4 04 56 3e 28 d0 ab 53 78 b8 |{.+.T...V>(..Sx.| | c1 8b e8 dd 78 d7 74 92 f5 87 e2 4d 87 2f 7b 7c |....x.t....M./{|| | 5f 18 a7 53 fe 95 6e 19 6e 9a a1 e9 2e 68 0d 88 |_..S..n.n....h..| | 1d ff a8 9c 67 64 e0 c9 df ca ea 79 73 d0 6c 07 |....gd.....ys.l.| | aa 79 6c d9 9b 47 08 16 87 41 d8 7b 7e 95 53 86 |.yl..G...A.{~.S.| | 92 01 93 40 25 80 41 26 |...@%.A& | Client MAC key[20]: | 9e 7b fb 21 a3 6d a2 3c 06 eb f6 0d 3b 15 7c c3 |.{.!.m.<....;.|.| | 7b f0 2b 9e |{.+. | Server MAC key[20]: | 54 83 e4 04 56 3e 28 d0 ab 53 78 b8 c1 8b e8 dd |T...V>(..Sx.....| | 78 d7 74 92 |x.t. | Client Write key[16]: | f5 87 e2 4d 87 2f 7b 7c 5f 18 a7 53 fe 95 6e 19 |...M./{|_..S..n.| Server Write key[16]: | 6e 9a a1 e9 2e 68 0d 88 1d ff a8 9c 67 64 e0 c9 |n....h......gd..| Client Write IV[16]: | df ca ea 79 73 d0 6c 07 aa 79 6c d9 9b 47 08 16 |...ys.l..yl..G..| Server Write IV[16]: | 87 41 d8 7b 7e 95 53 86 92 01 93 40 25 80 41 26 |.A.{~.S....@%.A&| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | 79 6d a7 fd 8f bf 0e ac 06 8d 84 cc 46 b1 54 c8 |ym..........F.T.| | 8e 53 97 d8 ee 9f 08 86 e6 60 d7 74 83 6e 8a 64 |.S.......`.t.n.d| ssl_save_session stored master secret[48]: | 56 b0 1f 4e 1e 68 04 b2 5b d6 da 77 e2 15 f2 3c |V..N.h..[..w...<| | f4 86 6c 7d 0c ae e4 62 d8 8b f4 6b e1 17 00 5e |..l}...b...k...^| | a7 82 a0 de e0 99 33 22 98 9f 0b 15 4e 88 41 a3 |......3"....N.A.| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 19 80 e2 52 e0 e1 70 85 ee d9 52 88 ab 28 bf f9 |...R..p...R..(..| | 8e 01 9e 8f ee 8f f1 27 1d e1 90 8d ff 59 ce 7c |.......'.....Y.|| | 62 bc 89 ac 8e 37 85 d5 00 94 ff a7 49 45 ae f1 |b....7......IE..| | d5 60 fd d1 46 36 c7 aa d8 31 fe d5 07 cb 67 f3 |.`..F6...1....g.| Plaintext[64]: | 14 00 00 24 53 8c ff 5c c6 c2 6f 3a 4c 02 d0 d4 |...$S..\..o:L...| | 73 55 9b 30 a4 58 5a 42 8d 0b cc f5 53 37 88 ce |sU.0.XZB....S7..| | ce 65 99 49 34 07 e1 b6 11 d8 8e db 78 70 9c 05 |.e.I4.......xp..| | 43 7f f0 57 ba 83 6b ce 79 c5 b5 39 00 00 00 03 |C..W..k.y..9....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #204 (first time) conversation = 0x7f2686944b38, ssl_session = 0x7f265a946d00 record: offset = 0, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | a6 ee 9e 9d 17 48 55 d9 6f bc c3 8e 36 69 91 10 |.....HU.o...6i..| | 9b ae 8c 9c 15 66 41 ca 2b 74 4c bc e3 63 8e 75 |.....fA.+tL..c.u| | 47 64 af 01 23 f4 66 5e 60 b2 b0 f4 d2 b8 11 d3 |Gd..#.f^`.......| | a8 1a c6 c2 1c 34 4a 2b b2 0e 18 59 05 64 25 70 |.....4J+...Y.d%p| Plaintext[64]: | 14 00 00 24 c9 22 01 45 9d c6 87 23 f0 15 36 b7 |...$.".E...#..6.| | ae cb 1b 8c 39 77 b7 57 9a cb 4a 96 e2 50 a4 49 |....9w.W..J..P.I| | ae 19 1f f7 8b dc 53 df 3e 46 7d ac 16 1f 5b b6 |......S.>F}...[.| | 67 97 e2 78 70 e9 fc 01 6e e0 ae e1 00 00 00 03 |g..xp...n.......| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #205 (first time) conversation = 0x7f2686944b38, ssl_session = 0x7f265a946d00 record: offset = 0, reported_length_remaining = 138 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 56 70 14 b0 e9 96 f2 b7 ab e9 8c 71 6c d7 6b 5e |Vp.........ql.k^| | 2f 71 9b 41 c1 40 4a 6a b6 e2 3c 8a 4b 90 b4 64 |/q.A.@Jj..<.K..d| Plaintext[32]: | 15 b6 d7 05 8c fa 75 ae c6 4e bb 5a a0 bd e4 9d |......u..N.Z....| | c0 3c bd fc 00 00 00 00 00 00 00 00 00 00 00 0b |.<..............| ssl_decrypt_record found padding 11 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 34646 found (nil) association_find: TCP port 4449 found 0x345aa20 record: offset = 37, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 96, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 96 Ciphertext[96]: | 8e 75 14 bf 60 ca 81 3b 33 54 ae 6d 2e b7 13 9e |.u..`..;3T.m....| | 6a c4 7e d4 bc fc a3 60 7d 36 b3 9e bb e0 39 bf |j.~....`}6....9.| | 40 6e cb 4f 10 6c b1 ee c3 79 51 46 59 6a 6f 9f |@n.O.l...yQFYjo.| | 27 b0 4d 15 31 a7 28 d8 90 23 88 3f c0 8b 5a 2e |'.M.1.(..#.?..Z.| | 8b 8f 7b c5 e0 88 a0 4c 87 34 93 ce a6 d9 f7 b9 |..{....L.4......| | e8 a9 17 48 03 4f 4c 94 fb 4f 19 6d 45 9f c2 f9 |...H.OL..O.mE...| Plaintext[96]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 61 65 |Host: dhe-dss-ae| | 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s128-sha.local.a| | 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:| | 34 34 34 39 0d 0a 0d 0a 63 9e ce d0 b7 87 ba 80 |4449....c.......| | 1c 2f ac 37 77 dd d3 f1 7a bd 48 22 00 00 00 03 |./.7w...z.H"....| ssl_decrypt_record found padding 3 final len 92 checking mac (len 72, version 300, ct 23 seq 2) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 72, seq = 0, nxtseq = 72 association_find: TCP port 34646 found (nil) association_find: TCP port 4449 found 0x345aa20 dissect_ssl3_record decrypted len 72 decrypted app data fragment[72]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 61 65 |Host: dhe-dss-ae| | 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s128-sha.local.a| | 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:| | 34 34 34 39 0d 0a 0d 0a |4449.... | dissect_ssl3_record found association 0x345aa20 dissect_ssl enter frame #206 (first time) conversation = 0x7f2686944b38, ssl_session = 0x7f265a946d00 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | 31 de 9b 55 3a 9c 50 1b 20 7c 8f 31 d1 4a ee 5e |1..U:.P. |.1.J.^| | f0 d5 33 14 b6 be 53 25 58 ed c4 cb 55 d5 a0 7b |..3...S%X...U..{| | 64 d5 31 a8 ff 36 33 75 9f 8d 7f 5d 8f be 4d 63 |d.1..63u...]..Mc| | 24 45 47 89 38 01 00 ad 73 c0 0c e3 9a 54 3e 7d |$EG.8...s....T>}| | 6d 9f 09 97 9f 32 9b 84 2c 0b ce 97 69 b9 eb 7a |m....2..,...i..z| | a2 36 0d 12 b2 1c c5 4c 19 9a bd f4 19 2d 3c 75 |.6.....L.....-..x.'...g.1.?..| | 88 70 93 23 2a c3 c8 ff 75 af 04 21 fc a2 95 7d |.p.#*...u..!...}| | 0f f9 f0 52 bd a3 f1 03 54 fe 1e 6f 99 eb 3c a0 |...R....T..o..<.| | 7a 77 04 dd cf 4a cf 3f ef c8 c1 a8 ae 60 65 3f |zw...J.?.....`e?| | 33 fc e5 2b 64 f1 2e 1e 75 dd 87 cc 18 24 06 9e |3..+d...u....$..| | f1 67 dc 50 e1 61 18 8c d4 a1 70 ff d3 77 85 cc |.g.P.a....p..w..| | 45 f7 a7 0a d6 5e 7e 06 3f d4 01 36 d5 d7 40 6e |E....^~.?..6..@n| | f9 50 70 97 83 64 55 b7 f4 7a e9 43 21 c9 07 bd |.Pp..dU..z.C!...| | 81 7a 02 06 59 4c c5 91 f4 0d 8a ff 5b d3 c0 c3 |.z..YL......[...| | ed 49 19 d5 1f 5c 93 43 68 81 3e bd ef 1a e2 e1 |.I...\.Ch.>.....| | 4b a8 f5 e5 6d 4c c1 b5 65 8d 77 f2 70 e4 88 d3 |K...mL..e.w.p...| | 00 c0 f7 52 3f a4 1b 2f 9c 93 16 6d 46 fe 55 3f |...R?../...mF.U?| | e5 1f 6d 20 38 56 23 d9 8a 1a f9 12 26 28 eb 5d |..m 8V#.....&(.]| | fa 32 e2 0d b9 3e 21 ea 23 f8 98 6e 66 a5 c5 e9 |.2...>!.#..nf...| | 28 e7 89 f7 0c 63 b5 34 d7 7d 2e e7 26 21 88 3c |(....c.4.}..&!.<| | cc d7 f1 8a b3 4f 9e 6c 1a dd e7 39 8e 8f 26 89 |.....O.l...9..&.| | ab 3c 9c 5a 58 f6 da f9 24 94 69 e6 05 80 fd 19 |.<.ZX...$.i.....| | 77 58 ce 37 c3 08 5a 5f 9f 74 42 47 72 58 47 32 |wX.7..Z_.tBGrXG2| Plaintext[384]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 31 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:19 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 33 32 20 2d 20 44 48 45 2d 44 |x00,0x32 - DHE-D| | 53 53 2d 41 45 53 31 32 38 2d 53 48 41 20 20 20 |SS-AES128-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc| | 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1...*| | 39 e2 0f f0 f2 02 a3 78 8a ab 0d 0d 8b cb 2e 21 |9......x.......!| | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f |................| ssl_decrypt_record found padding 15 final len 368 checking mac (len 348, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348 association_find: TCP port 4449 found 0x345aa20 dissect_ssl3_record decrypted len 348 decrypted app data fragment[348]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 31 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:19 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 33 32 20 2d 20 44 48 45 2d 44 |x00,0x32 - DHE-D| | 53 53 2d 41 45 53 31 32 38 2d 53 48 41 20 20 20 |SS-AES128-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc| | 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1 | dissect_ssl3_record found association 0x345aa20 dissect_ssl enter frame #207 (first time) conversation = 0x7f2686944b38, ssl_session = 0x7f265a946d00 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | ed 27 3c b4 73 d0 de 5a 4f b9 88 5c 25 33 f5 36 |.'<.s..ZO..\%3.6| | e6 63 b9 6c 4d 72 c0 95 0b 63 96 dd 21 74 90 50 |.c.lMr...c..!t.P| Plaintext[32]: | 01 00 f2 25 4e 43 88 21 8c 25 bc a9 58 90 1a b6 |...%NC.!.%..X...| | df f6 18 15 73 7a 00 00 00 00 00 00 00 00 00 09 |....sz..........| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #209 (first time) conversation = 0x7f2686944b38, ssl_session = 0x7f265a946d00 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 28 da 7e db cd 5c 5b a3 96 e1 5a 13 3c 55 2d 0f |(.~..\[...Z. state 0x01 dissect_ssl enter frame #216 (first time) conversation = 0x7f2686944e90, ssl_session = 0x7f265a9494e0 record: offset = 0, reported_length_remaining = 1437 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0x0033 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 1351 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898 record: offset = 898, reported_length_remaining = 539 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 525, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 903 length 521 bytes, remaining 1428 record: offset = 1428, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1433 length 0 bytes, remaining 1437 dissect_ssl enter frame #218 (first time) conversation = 0x7f2686944e90, ssl_session = 0x7f265a9494e0 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cd... looking for RSA pre-master00807faa022a4447ccba03e26aa70a784b5107ac44057dd6... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 ssl3_prf: sha1_hash(6) ssl3_prf: md5_hash(6) datalen 48 ssl3_prf: sha1_hash(7) ssl3_prf: md5_hash(7) datalen 48 key expansion[104]: | 4a be 53 77 4f ba 42 8f b3 f5 0d 06 e7 0f 41 35 |J.SwO.B.......A5| | a4 e7 d5 4e 4b a5 e5 67 2e 28 8c c8 4d 3a 62 5f |...NK..g.(..M:b_| | 09 51 f5 ce 8f af 16 2b 11 1a 83 40 0a e5 5c ee |.Q.....+...@..\.| | ef 71 bf a6 c2 b7 17 f1 44 1b d9 59 81 c5 06 d2 |.q......D..Y....| | a6 52 52 40 df d2 ec 50 e9 0a bb 6d c5 94 38 e7 |.RR@...P...m..8.| | 67 c5 55 35 ac d0 c3 d2 94 9e 1b a1 16 eb f8 62 |g.U5...........b| | 55 a5 b4 00 3f ba 3a 4b |U...?.:K | Client MAC key[20]: | 4a be 53 77 4f ba 42 8f b3 f5 0d 06 e7 0f 41 35 |J.SwO.B.......A5| | a4 e7 d5 4e |...N | Server MAC key[20]: | 4b a5 e5 67 2e 28 8c c8 4d 3a 62 5f 09 51 f5 ce |K..g.(..M:b_.Q..| | 8f af 16 2b |...+ | Client Write key[16]: | 11 1a 83 40 0a e5 5c ee ef 71 bf a6 c2 b7 17 f1 |...@..\..q......| Server Write key[16]: | 44 1b d9 59 81 c5 06 d2 a6 52 52 40 df d2 ec 50 |D..Y.....RR@...P| Client Write IV[16]: | e9 0a bb 6d c5 94 38 e7 67 c5 55 35 ac d0 c3 d2 |...m..8.g.U5....| Server Write IV[16]: | 94 9e 1b a1 16 eb f8 62 55 a5 b4 00 3f ba 3a 4b |.......bU...?.:K| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | 4b d8 9a f2 e4 56 2b 4a 12 e9 e0 64 a4 55 d5 c8 |K....V+J...d.U..| | 47 e0 89 6d 8b ef e5 20 e8 1a af c6 4b a7 a0 5a |G..m... ....K..Z| ssl_save_session stored master secret[48]: | ed f9 98 b5 96 94 15 15 fb 94 a7 10 89 a6 11 0e |................| | 63 75 10 c3 f2 29 5e 05 e5 48 d3 83 36 8b b2 a4 |cu...)^..H..6...| | ab 14 92 05 1e 45 28 32 6e df b7 6f d3 f1 53 1d |.....E(2n..o..S.| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | c9 b2 b0 34 cf db 98 94 c1 23 d6 8f 23 18 18 ee |...4.....#..#...| | 39 ff 3f f3 99 96 c6 e4 e0 91 83 7f 68 d3 d5 c2 |9.?.........h...| | dd 40 dd 1e d5 7a ca 18 a2 15 c9 ce 32 d3 02 15 |.@...z......2...| | cc 9d d5 a5 d9 f7 fa a2 ce 43 47 3d 9c d0 61 3b |.........CG=..a;| Plaintext[64]: | 14 00 00 24 22 b8 34 81 9d 93 3e 37 32 76 2e 66 |...$".4...>72v.f| | f9 87 f4 65 ee 03 38 72 3d 98 03 26 a7 3d aa b0 |...e..8r=..&.=..| | d0 d2 9d 6c 28 7d 74 df f9 26 99 3f 63 0e bb 5f |...l(}t..&.?c.._| | 6c 1d 66 15 da f0 95 75 c6 c9 05 2e 00 00 00 03 |l.f....u........| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #219 (first time) conversation = 0x7f2686944e90, ssl_session = 0x7f265a9494e0 record: offset = 0, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 5e 7e b3 04 b9 4b 7e 92 98 16 49 66 cc 92 45 3d |^~...K~...If..E=| | 0f 69 cf 9c 26 91 e5 e1 9b 0d 3d 81 fd 2b 31 c5 |.i..&.....=..+1.| | 59 96 b6 ce a2 0e fa 54 0f 14 6a 7a 99 d2 05 da |Y......T..jz....| | cd ae 6f fd e5 c7 73 03 bb 1b 03 bd 55 62 20 33 |..o...s.....Ub 3| Plaintext[64]: | 14 00 00 24 c0 d7 89 da 7a 72 18 92 95 b0 9d 68 |...$....zr.....h| | 4d 08 d5 65 44 1d b4 31 33 d2 48 d3 93 4d 5f 06 |M..eD..13.H..M_.| | d8 7e cf e9 9b 7b aa ce 33 18 ad 18 ae 59 40 29 |.~...{..3....Y@)| | 7e cf 56 13 76 87 55 80 22 7a 3a 76 00 00 00 03 |~.V.v.U."z:v....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #220 (first time) conversation = 0x7f2686944e90, ssl_session = 0x7f265a9494e0 record: offset = 0, reported_length_remaining = 138 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 12 10 ae 76 b2 32 fc c5 81 43 dc e3 08 6b 14 27 |...v.2...C...k.'| | f7 0b 7d 14 3b a0 21 a5 86 b7 f1 6e 8c 7d 1f fd |..}.;.!....n.}..| Plaintext[32]: | 13 57 37 0f 88 76 c6 34 f5 d1 98 ba e6 95 92 cd |.W7..v.4........| | f6 a0 1a b9 00 00 00 00 00 00 00 00 00 00 00 0b |................| ssl_decrypt_record found padding 11 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 52866 found (nil) association_find: TCP port 4450 found 0x345aab0 record: offset = 37, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 96, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 96 Ciphertext[96]: | c8 65 ed fb 24 08 0c 76 52 ee 5c 7a 9e 0b fd cb |.e..$..vR.\z....| | c6 60 95 11 46 e0 91 4c 9c 6b cb c2 a5 04 d3 26 |.`..F..L.k.....&| | 27 e4 fc 9d ce 7f ac 95 84 34 84 eb 78 d5 6c 8c |'........4..x.l.| | ee f6 e3 0d a7 db 26 cc 6d 0b e1 ff f1 24 70 88 |......&.m....$p.| | df 5d eb 51 03 c9 b6 78 61 95 a7 fa 08 8c a1 5e |.].Q...xa......^| | c5 d4 75 a8 f4 a1 d7 ce c1 d1 52 f1 6f 50 e7 27 |..u.......R.oP.'| Plaintext[96]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 61 65 |Host: dhe-rsa-ae| | 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s128-sha.local.a| | 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:| | 34 34 35 30 0d 0a 0d 0a 38 ed bc 28 5a 7d 80 4e |4450....8..(Z}.N| | 72 53 9e c9 72 83 fb 7f 14 08 e1 04 00 00 00 03 |rS..r...........| ssl_decrypt_record found padding 3 final len 92 checking mac (len 72, version 300, ct 23 seq 2) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 72, seq = 0, nxtseq = 72 association_find: TCP port 52866 found (nil) association_find: TCP port 4450 found 0x345aab0 dissect_ssl3_record decrypted len 72 decrypted app data fragment[72]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 61 65 |Host: dhe-rsa-ae| | 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s128-sha.local.a| | 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:| | 34 34 35 30 0d 0a 0d 0a |4450.... | dissect_ssl3_record found association 0x345aab0 dissect_ssl enter frame #221 (first time) conversation = 0x7f2686944e90, ssl_session = 0x7f265a9494e0 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | 5d 65 3e a5 ad f8 d7 9e 97 2a ba 5e 6a fc 43 7f |]e>......*.^j.C.| | 22 0a b8 2f f5 a7 d2 db 32 83 b5 d7 27 09 0c b7 |"../....2...'...| | 0c e6 8b 19 c2 a3 58 ef 6c 59 36 34 84 83 34 60 |......X.lY64..4`| | df 70 da f7 d0 b6 08 de 57 70 6e 1a d8 fd bd db |.p......Wpn.....| | 0f ea 32 0b f5 d2 0b 38 5a 37 07 5b be 3a 78 89 |..2....8Z7.[.:x.| | 77 55 ee d1 26 e7 6f 25 b1 61 5b 14 0c 96 8a 08 |wU..&.o%.a[.....| | cf 26 70 4c 46 bb 31 b9 b1 85 10 f4 ad c0 2b 59 |.&pLF.1.......+Y| | 79 f1 71 13 fd f1 94 72 80 0c aa 6e 27 91 c9 8b |y.q....r...n'...| | 48 1d ca d9 85 2c a8 c6 e1 06 fb 6f 1a a3 96 93 |H....,.....o....| | d5 36 ef 0c d5 65 06 13 36 c6 1d 40 ca 04 74 f2 |.6...e..6..@..t.| | 87 c4 a3 7b 2c 98 e5 a2 6a a2 43 9d 27 98 7e 3f |...{,...j.C.'.~?| | 68 b2 49 e7 8a 5c 5f 26 d6 99 b3 cc 6d c1 63 57 |h.I..\_&....m.cW| | 22 28 31 cf 3d a2 9f 35 3a 72 90 04 22 b5 a8 72 |"(1.=..5:r.."..r| | e7 ae 7f a7 59 00 c1 74 b2 4a 2d c5 26 24 75 1c |....Y..t.J-.&$u.| | cf bd 04 d5 ea 3b 38 b1 01 c3 d3 7f 20 39 4f 81 |.....;8..... 9O.| | e8 ae 9d 1e ac ef 07 35 76 f1 d8 6b a4 1b 4e 7d |.......5v..k..N}| | 88 26 bd 36 e4 de 67 b0 72 f2 97 ee af 03 3a 97 |.&.6..g.r.....:.| | fb f5 69 8d 47 f8 0b be 9c f0 92 72 36 c8 bd 19 |..i.G......r6...| | 49 59 9b 29 58 bb 3b c0 e4 33 30 14 f3 f2 79 69 |IY.)X.;..30...yi| | 0d 49 07 83 07 22 1f cb 35 88 30 b0 f3 ac d4 7b |.I..."..5.0....{| | 7b cb 51 cd b3 2c c9 d9 ef 52 b3 f0 28 3f 84 ae |{.Q..,...R..(?..| | 99 13 3d 96 e3 c5 b0 be da 1a 67 4d 07 5a 56 79 |..=.......gM.ZVy| | 6d ac 48 a6 d0 88 ee c8 46 96 95 1f 37 55 bb 4d |m.H.....F...7U.M| | c2 70 d9 e5 ca da 10 97 f3 36 ec 76 c4 a5 06 4e |.p.......6.v...N| Plaintext[384]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 31 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:19 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 33 33 20 2d 20 44 48 45 2d 52 |x00,0x33 - DHE-R| | 53 41 2d 41 45 53 31 32 38 2d 53 48 41 20 20 20 |SA-AES128-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1.s9%| | a2 c5 58 76 42 e4 70 99 87 eb fd e9 a8 9f 28 57 |..XvB.p.......(W| | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f |................| ssl_decrypt_record found padding 15 final len 368 checking mac (len 348, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348 association_find: TCP port 4450 found 0x345aab0 dissect_ssl3_record decrypted len 348 decrypted app data fragment[348]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 31 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:19 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 33 33 20 2d 20 44 48 45 2d 52 |x00,0x33 - DHE-R| | 53 41 2d 41 45 53 31 32 38 2d 53 48 41 20 20 20 |SA-AES128-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1 | dissect_ssl3_record found association 0x345aab0 dissect_ssl enter frame #222 (first time) conversation = 0x7f2686944e90, ssl_session = 0x7f265a9494e0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 87 44 03 21 5d 29 b9 b7 b5 89 0c 90 7e 4d 02 6a |.D.!])......~M.j| | 0e 2f 55 f2 9f 90 cd 54 1d aa 4c 25 f8 81 c1 95 |./U....T..L%....| Plaintext[32]: | 01 00 2d 77 ce bd 0c a6 fc 29 fd f3 b1 99 49 98 |..-w.....)....I.| | b7 fb 2b 6c a7 a9 00 00 00 00 00 00 00 00 00 09 |..+l............| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #224 (first time) conversation = 0x7f2686944e90, ssl_session = 0x7f265a9494e0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | aa 30 4e 0c 4d 42 43 33 8d 1e 72 90 a2 90 d5 25 |.0N.MBC3..r....%| | 74 16 ba 6a 2c 7c d2 5b f8 79 ac c2 ec 7e ba d6 |t..j,|.[.y...~..| Plaintext[32]: | 01 00 fa d1 b0 35 6e 3e 54 2c b5 23 4d 00 6f 2c |.....5n>T,.#M.o,| | 42 d8 dd 7e 4c d0 00 00 00 00 00 00 00 00 00 09 |B..~L...........| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 3) ssl_decrypt_record: mac ok dissect_ssl enter frame #229 (first time) ssl_session_init: initializing ptr 0x7f265a94bc80 size 688 conversation = 0x7f26869451e8, ssl_session = 0x7f265a94bc80 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 45463 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4451 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #231 (first time) conversation = 0x7f26869451e8, ssl_session = 0x7f265a94bc80 record: offset = 0, reported_length_remaining = 907 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0x0035 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 821 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898 record: offset = 898, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 903 length 0 bytes, remaining 907 dissect_ssl enter frame #233 (first time) conversation = 0x7f26869451e8, ssl_session = 0x7f265a94bc80 record: offset = 0, reported_length_remaining = 340 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 260, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 256 bytes, remaining 265 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146... looking for RSA pre-master0bb3025655a4d992bad5e3bec61b9d26cc4587f589fd0282... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 ssl3_prf: sha1_hash(6) ssl3_prf: md5_hash(6) datalen 48 ssl3_prf: sha1_hash(7) ssl3_prf: md5_hash(7) datalen 48 ssl3_prf: sha1_hash(8) ssl3_prf: md5_hash(8) datalen 48 ssl3_prf: sha1_hash(9) ssl3_prf: md5_hash(9) datalen 48 key expansion[136]: | bf fe 72 b8 4d f2 02 fe a2 b5 af 4c 7b 4d 08 dc |..r.M......L{M..| | 9c b4 8a 3a 2c 82 03 2c 09 1f ab 83 92 4b e3 1a |...:,..,.....K..| | d3 6c f7 1f 7e f2 d5 6b 19 ee 1a 45 6f 48 16 45 |.l..~..k...EoH.E| | e0 e2 e6 8c 99 14 89 62 5b f6 78 11 8e ac 7b fb |.......b[.x...{.| | cf 3b b6 80 a5 bc 11 09 c9 65 07 cf a0 64 3e c8 |.;.......e...d>.| | 03 e1 12 65 e2 ed a1 45 bb 71 e0 14 3f 50 03 cb |...e...E.q..?P..| | 61 d9 94 ef 35 81 d3 0c db d6 1b 3e 26 0f 3a 6b |a...5......>&.:k| | e8 f8 63 7d 8a f4 34 d6 ba 0b 83 df ce 39 d6 4b |..c}..4......9.K| | af 5f 69 9d 58 23 57 71 |._i.X#Wq | Client MAC key[20]: | bf fe 72 b8 4d f2 02 fe a2 b5 af 4c 7b 4d 08 dc |..r.M......L{M..| | 9c b4 8a 3a |...: | Server MAC key[20]: | 2c 82 03 2c 09 1f ab 83 92 4b e3 1a d3 6c f7 1f |,..,.....K...l..| | 7e f2 d5 6b |~..k | Client Write key[32]: | 19 ee 1a 45 6f 48 16 45 e0 e2 e6 8c 99 14 89 62 |...EoH.E.......b| | 5b f6 78 11 8e ac 7b fb cf 3b b6 80 a5 bc 11 09 |[.x...{..;......| Server Write key[32]: | c9 65 07 cf a0 64 3e c8 03 e1 12 65 e2 ed a1 45 |.e...d>....e...E| | bb 71 e0 14 3f 50 03 cb 61 d9 94 ef 35 81 d3 0c |.q..?P..a...5...| Client Write IV[16]: | db d6 1b 3e 26 0f 3a 6b e8 f8 63 7d 8a f4 34 d6 |...>&.:k..c}..4.| Server Write IV[16]: | ba 0b 83 df ce 39 d6 4b af 5f 69 9d 58 23 57 71 |.....9.K._i.X#Wq| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | 32 2f 38 60 f3 3f 5d 5c b9 e6 d1 ff 97 ef 8f f8 |2/8`.?]\........| | 04 68 cf dd cf 44 0d 01 fd c5 af 11 f1 97 1f 07 |.h...D..........| ssl_save_session stored master secret[48]: | c4 88 19 65 71 8f 74 c6 f1 e1 c7 fb af 0b db dc |...eq.t.........| | 13 8e 06 e2 90 be 43 3a 2a 7c cb 45 d2 ba 31 40 |......C:*|.E..1@| | 15 5e ef 53 45 37 ed d3 94 aa 04 f1 c3 95 a7 a4 |.^.SE7..........| dissect_ssl3_handshake session keys successfully generated record: offset = 265, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 271, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 04 1a 18 0a 02 96 7c e4 13 c7 12 f8 52 da 05 05 |......|.....R...| | 22 e0 d2 58 e5 ee 5e 04 32 ab 06 f2 bb 24 23 17 |"..X..^.2....$#.| | b6 bb 78 8b 26 32 fc 40 5f 32 12 f9 3c 29 e9 e7 |..x.&2.@_2..<)..| | 57 d4 f3 49 6b cd b0 83 bb f9 b7 60 1b 63 8a f4 |W..Ik......`.c..| Plaintext[64]: | 14 00 00 24 5e 1e 99 c4 9a f1 03 6c 3b 45 7d 8f |...$^......l;E}.| | c8 78 b3 4e c9 2c 2a ca c2 d8 f8 19 ea a4 8b 80 |.x.N.,*.........| | 5d 08 a7 16 52 1e 60 95 dc b0 1b 0c b8 8e 81 0c |]...R.`.........| | b8 a7 1a fa a0 86 f2 bd 15 39 96 53 00 00 00 03 |.........9.S....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #234 (first time) conversation = 0x7f26869451e8, ssl_session = 0x7f265a94bc80 record: offset = 0, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | a9 7f d4 af 81 23 36 ec 2d 89 7a fc c7 18 b7 26 |.....#6.-.z....&| | 2c fb 82 a4 db 98 f9 ab ed 26 68 2a 58 fa 6d 9e |,........&h*X.m.| | 2b af 83 0c e3 d4 7f 9a 37 d3 f2 93 94 4c d6 f0 |+.......7....L..| | a5 b3 44 6b a0 46 37 84 8f 79 d9 ed 64 e6 4c 7d |..Dk.F7..y..d.L}| Plaintext[64]: | 14 00 00 24 4d ad d5 f2 70 a3 93 1b 06 7b 1a 9c |...$M...p....{..| | 86 c0 74 92 92 e0 b3 43 ff 59 4b c1 83 d7 bb 10 |..t....C.YK.....| | 13 76 1f 34 71 b7 d9 08 cd 4b b4 82 42 75 d1 09 |.v.4q....K..Bu..| | 94 2d a1 32 79 40 5f 0b 0a 0d a6 9f 00 00 00 03 |.-.2y@_.........| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #235 (first time) conversation = 0x7f26869451e8, ssl_session = 0x7f265a94bc80 record: offset = 0, reported_length_remaining = 138 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 2f 26 00 53 51 67 44 a8 c3 3d ea 7e f2 34 82 5a |/&.SQgD..=.~.4.Z| | 95 4e 41 0b 40 b5 24 6d 4d ec 91 8b 42 c9 de 87 |.NA.@.$mM...B...| Plaintext[32]: | de 9d 5d 65 72 3f 91 05 52 a0 c7 ba ac 1b 66 6f |..]er?..R.....fo| | d2 ea d6 2c 00 00 00 00 00 00 00 00 00 00 00 0b |...,............| ssl_decrypt_record found padding 11 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 45463 found (nil) association_find: TCP port 4451 found 0x3459f30 record: offset = 37, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 96, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 96 Ciphertext[96]: | 28 37 46 20 bd 12 bf 04 f2 84 a7 ec a9 bb 92 2c |(7F ...........,| | 4b 98 b7 b2 a2 75 23 4e fe 43 3b 8a 91 d1 46 30 |K....u#N.C;...F0| | 11 d7 e9 05 54 40 0f f0 82 a2 07 7a ce 69 3a b9 |....T@.....z.i:.| | a9 3a e8 54 e6 27 14 94 06 81 80 91 9a 2b df 3a |.:.T.'.......+.:| | 53 4c c2 95 00 31 f5 8f 36 9a 22 f9 75 f1 3a 35 |SL...1..6.".u.:5| | 02 de c2 b1 3c 56 e5 4e da ef 5f 9f 81 e1 c5 5c |.....A.| | 1b ec 1b bc 04 62 6b cc df 5d b2 31 7e d7 57 e4 |.....bk..].1~.W.| | 0d 04 6c 57 29 bd 00 89 b0 2f 0b bb 3b c6 fd 44 |..lW)..../..;..D| | d8 58 b2 c7 24 34 82 45 ea 31 ae 17 c9 f3 2e 3a |.X..$4.E.1.....:| | 60 21 aa 79 6f 80 ba 47 9d 4a fd c7 d9 34 b4 08 |`!.yo..G.J...4..| | c9 49 92 00 4b be bc d9 e4 11 c4 4f eb 3b 12 5f |.I..K......O.;._| | 3f 0e 98 3c b4 40 b9 be a8 46 34 43 e1 20 73 44 |?..<.@...F4C. sD| | b4 80 5a cf fa 73 12 fe 3d 8e 8c 1b 13 cb b6 f9 |..Z..s..=.......| | 25 74 8b 12 80 e3 51 da e5 54 be a4 6a 98 2d 72 |%t....Q..T..j.-r| | cd 60 32 e2 6b 33 f6 da f8 6f 8f 75 0e c9 8f 13 |.`2.k3...o.u....| | bf 7d c0 e4 6f 1d cf bc 79 16 59 79 03 f5 39 91 |.}..o...y.Yy..9.| | c8 8e 4c e0 65 97 9a d4 cf 76 b9 10 12 5c 7b d2 |..L.e....v...\{.| | 21 fc d7 3a 3c 46 a6 04 50 d1 6c 20 0e d2 54 21 |!..:docum| | 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca| | 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.| | 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 31 a3 b6 86 |nl'1...| | 41 06 86 4d dc a6 7e 75 db b9 2a cb cc ab 7e 4b |A..M..~u..*...~K| | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f |................| ssl_decrypt_record found padding 15 final len 368 checking mac (len 348, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348 association_find: TCP port 4451 found 0x3459f30 dissect_ssl3_record decrypted len 348 decrypted app data fragment[348]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 31 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:19 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 33 35 20 2d 20 41 45 53 32 35 |x00,0x35 - AES25| | 36 2d 53 48 41 20 20 20 20 20 20 20 20 20 20 20 |6-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1 | dissect_ssl3_record found association 0x3459f30 dissect_ssl enter frame #237 (first time) conversation = 0x7f26869451e8, ssl_session = 0x7f265a94bc80 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 2b ba 3f f9 9d 90 85 6d 83 97 33 bd 03 3a 40 f1 |+.?....m..3..:@.| | 3b 25 2c 6b 72 54 bd e8 92 37 f5 4c cf 02 5e cf |;%,krT...7.L..^.| Plaintext[32]: | 01 00 60 3a 92 c3 13 cb b8 de c7 3e a4 0e f6 f2 |..`:.......>....| | 8f 0c 12 96 e5 4c 00 00 00 00 00 00 00 00 00 09 |.....L..........| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #239 (first time) conversation = 0x7f26869451e8, ssl_session = 0x7f265a94bc80 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | f5 01 63 65 92 17 b9 26 af 44 78 54 f7 27 27 f2 |..ce...&.DxT.''.| | ce ac f7 47 a4 6b 51 ac 2b 1d 7e e0 15 1a 2d 62 |...G.kQ.+.~...-b| Plaintext[32]: | 01 00 c2 34 e5 6b a1 49 8b 7e e9 e2 06 ac 10 5c |...4.k.I.~.....\| | 04 16 bc 48 9c 27 00 00 00 00 00 00 00 00 00 09 |...H.'..........| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 3) ssl_decrypt_record: mac ok dissect_ssl enter frame #244 (first time) ssl_session_init: initializing ptr 0x7f265a94e4e0 size 688 conversation = 0x7f2686945538, ssl_session = 0x7f265a94e4e0 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 44407 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4452 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #246 (first time) conversation = 0x7f2686945538, ssl_session = 0x7f265a94e4e0 record: offset = 0, reported_length_remaining = 1155 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0x0038 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 1069 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 735, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 731 bytes, remaining 826 record: offset = 826, reported_length_remaining = 329 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 315, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 831 length 311 bytes, remaining 1146 record: offset = 1146, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1151 length 0 bytes, remaining 1155 dissect_ssl enter frame #248 (first time) conversation = 0x7f2686945538, ssl_session = 0x7f265a94e4e0 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773... looking for RSA pre-master00800d6f04a715c501d5fa7c2cc5e43deb03e43f0fa70ff9... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 ssl3_prf: sha1_hash(6) ssl3_prf: md5_hash(6) datalen 48 ssl3_prf: sha1_hash(7) ssl3_prf: md5_hash(7) datalen 48 ssl3_prf: sha1_hash(8) ssl3_prf: md5_hash(8) datalen 48 ssl3_prf: sha1_hash(9) ssl3_prf: md5_hash(9) datalen 48 key expansion[136]: | fd 95 51 54 e9 6a 18 b9 21 b4 da 94 5d e4 ff ad |..QT.j..!...]...| | 90 87 ff 04 1b 85 d8 91 ab 1f 10 91 51 9f 0b 34 |............Q..4| | d5 23 b7 84 8b dd 02 be 80 98 77 86 c8 26 16 fc |.#........w..&..| | 42 97 73 27 cf 51 02 ca 49 0b 18 5d bc ba a4 ea |B.s'.Q..I..]....| | 76 db c5 34 72 b1 d5 0a 1d 1c f5 2c e7 4c df 8d |v..4r......,.L..| | 1d 32 97 f2 42 47 07 3d 8e 73 f7 41 e7 3b c4 80 |.2..BG.=.s.A.;..| | 83 5b 2b ab 0b 6e 78 c5 a1 d7 e3 e2 fc b2 c9 27 |.[+..nx........'| | 31 34 d4 f2 b2 3f ba 38 56 b9 18 be 07 f9 90 ea |14...?.8V.......| | 7f 6b 9a c6 2f db 66 29 |.k../.f) | Client MAC key[20]: | fd 95 51 54 e9 6a 18 b9 21 b4 da 94 5d e4 ff ad |..QT.j..!...]...| | 90 87 ff 04 |.... | Server MAC key[20]: | 1b 85 d8 91 ab 1f 10 91 51 9f 0b 34 d5 23 b7 84 |........Q..4.#..| | 8b dd 02 be |.... | Client Write key[32]: | 80 98 77 86 c8 26 16 fc 42 97 73 27 cf 51 02 ca |..w..&..B.s'.Q..| | 49 0b 18 5d bc ba a4 ea 76 db c5 34 72 b1 d5 0a |I..]....v..4r...| Server Write key[32]: | 1d 1c f5 2c e7 4c df 8d 1d 32 97 f2 42 47 07 3d |...,.L...2..BG.=| | 8e 73 f7 41 e7 3b c4 80 83 5b 2b ab 0b 6e 78 c5 |.s.A.;...[+..nx.| Client Write IV[16]: | a1 d7 e3 e2 fc b2 c9 27 31 34 d4 f2 b2 3f ba 38 |.......'14...?.8| Server Write IV[16]: | 56 b9 18 be 07 f9 90 ea 7f 6b 9a c6 2f db 66 29 |V........k../.f)| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | 92 f6 c5 a2 7b 11 66 77 6e fe fb 55 04 e2 3e 84 |....{.fwn..U..>.| | 3d 94 5e ca b4 8a a9 16 ab 6a 9d ce 0d af 80 b0 |=.^......j......| ssl_save_session stored master secret[48]: | e9 62 b6 bd 15 16 ef 95 e9 b1 d6 6d 46 21 f2 0a |.b.........mF!..| | af 55 bc 1f 52 c7 ec 57 11 62 c3 4f 90 22 92 7b |.U..R..W.b.O.".{| | 32 01 90 a0 45 ef 7d a3 11 44 1b e7 2e f8 e4 80 |2...E.}..D......| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 10 81 3b 00 36 ab a1 7b 8f 49 29 bf 9d 43 8a 00 |..;.6..{.I)..C..| | 0d e6 69 9c 5b 80 53 aa 22 63 fe f6 58 b4 c1 9b |..i.[.S."c..X...| | ad 3d 7b 31 cc c1 71 b9 3c 30 70 71 3a 7b ce dc |.={1..q.<0pq:{..| | 75 0b 5a 20 da 8d 53 6a 59 d0 7b 9c c0 5d 1c c4 |u.Z ..SjY.{..]..| Plaintext[64]: | 14 00 00 24 85 d1 21 e5 fa f7 e2 f7 94 ef fa c6 |...$..!.........| | 1e 8d 00 45 e6 09 c1 7d 17 1d 47 21 ef 59 07 46 |...E...}..G!.Y.F| | 59 ac 6d 13 b9 73 62 39 c3 67 8e fa ef d3 e7 96 |Y.m..sb9.g......| | a3 5c 22 9f 71 e4 5c f6 fe fc 8d 76 00 00 00 03 |.\".q.\....v....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #249 (first time) conversation = 0x7f2686945538, ssl_session = 0x7f265a94e4e0 record: offset = 0, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | a9 98 91 db c8 ef df 78 5b c2 51 a6 97 ca 6c 10 |.......x[.Q...l.| | 17 24 06 74 9c 5f 19 51 9e 81 ef 4a 16 62 b3 24 |.$.t._.Q...J.b.$| | 91 85 90 48 f5 8d 98 13 59 fc 65 c6 9b 78 2d eb |...H....Y.e..x-.| | 95 18 78 9e 22 1b 8d 49 d4 5a 0a 33 77 3a cd 7e |..x."..I.Z.3w:.~| Plaintext[64]: | 14 00 00 24 8f ac 58 3f d7 dc 60 b9 b3 c1 da b7 |...$..X?..`.....| | ac ca 69 69 c3 a5 9b 83 dc 1d e7 d3 79 60 93 75 |..ii........y`.u| | 47 19 f9 87 71 1d a2 4f 62 67 fc ed 94 a9 91 f0 |G...q..Obg......| | 57 60 80 fd 76 df 3c 8c 69 d5 f4 6c 00 00 00 03 |W`..v.<.i..l....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #250 (first time) conversation = 0x7f2686945538, ssl_session = 0x7f265a94e4e0 record: offset = 0, reported_length_remaining = 138 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 16 21 e6 9c dc 33 43 63 51 35 65 4c f1 e3 f8 59 |.!...3CcQ5eL...Y| | c9 c4 6d d2 fc 24 7f 18 d4 6d d1 8e 74 cb eb b6 |..m..$...m..t...| Plaintext[32]: | 6e 99 75 3b d8 93 87 d6 49 4f aa d8 65 75 de fa |n.u;....IO..eu..| | 8e 5b 04 a2 00 00 00 00 00 00 00 00 00 00 00 0b |.[..............| ssl_decrypt_record found padding 11 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 44407 found (nil) association_find: TCP port 4452 found 0x3451d50 record: offset = 37, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 96, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 96 Ciphertext[96]: | bc ea 48 f8 91 94 b4 e5 49 bd a9 c2 c2 ac 02 4f |..H.....I......O| | 0b 37 7d c0 70 2f 5b be cb 7f d2 6c b6 ce be 23 |.7}.p/[....l...#| | 8b 5f 7b 88 5a 44 6a a7 7f d9 66 3a 24 9b 33 fc |._{.ZDj...f:$.3.| | 3a 58 2c e0 da b1 f0 2a 10 9b ab 93 d9 14 ce a1 |:X,....*........| | 15 05 7d e3 36 58 03 c8 48 c5 98 31 0d 66 8e 4f |..}.6X..H..1.f.O| | 69 af a7 20 5e 2f bf d2 d9 e4 b2 05 82 58 d4 7d |i.. ^/.......X.}| Plaintext[96]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 61 65 |Host: dhe-dss-ae| | 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s256-sha.local.a| | 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:| | 34 34 35 32 0d 0a 0d 0a 24 1a f6 96 d8 96 d8 de |4452....$.......| | 7f a7 33 34 71 64 ca cb 1f c8 25 af 00 00 00 03 |..34qd....%.....| ssl_decrypt_record found padding 3 final len 92 checking mac (len 72, version 300, ct 23 seq 2) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 72, seq = 0, nxtseq = 72 association_find: TCP port 44407 found (nil) association_find: TCP port 4452 found 0x3451d50 dissect_ssl3_record decrypted len 72 decrypted app data fragment[72]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 61 65 |Host: dhe-dss-ae| | 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s256-sha.local.a| | 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:| | 34 34 35 32 0d 0a 0d 0a |4452.... | dissect_ssl3_record found association 0x3451d50 dissect_ssl enter frame #251 (first time) conversation = 0x7f2686945538, ssl_session = 0x7f265a94e4e0 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | d7 34 c7 8c 42 23 d7 f7 cf e9 44 23 55 06 20 f2 |.4..B#....D#U. .| | 1e c1 5e 2d 79 a0 a7 3a 06 56 72 c5 0f 76 75 06 |..^-y..:.Vr..vu.| | f2 e8 b9 36 68 88 07 f9 e1 e4 ce 93 f5 bd fa f8 |...6h...........| | 37 50 f5 35 df 76 5b 88 53 d1 26 5e 28 2e e0 17 |7P.5.v[.S.&^(...| | d3 a6 50 1a 13 1c 1c 2a 76 6d 0b f4 01 98 d9 8f |..P....*vm......| | b0 6e ee 04 1a ef 70 c9 e4 0d 4d ff a8 66 33 0d |.n....p...M..f3.| | 18 f0 bc 74 98 27 2b 58 5d 49 cb 0d 57 cb a4 43 |...t.'+X]I..W..C| | a3 c2 69 6f 8c af 23 d3 e8 0f 06 a3 72 7b 11 9b |..io..#.....r{..| | 81 91 ce f1 e3 60 60 42 ac c6 2c cf a9 23 29 38 |.....``B..,..#)8| | c0 f7 2a 99 d7 51 1c c1 b5 91 cd 2f 25 9b 1a a8 |..*..Q...../%...| | 59 5c c4 67 8c 28 2b 2c d0 e4 37 b6 da cc 1e 3e |Y\.g.(+,..7....>| | 53 a1 dc f2 44 26 a2 05 b1 9f 4a 8a e3 50 e5 8d |S...D&....J..P..| | 68 02 ef bd 01 23 18 3e 0b a8 2f a5 a7 84 8a 8b |h....#.>../.....| | 74 69 79 ed 3a 5a c4 fc aa ee 9b 2c fe cc f8 a0 |tiy.:Z.....,....| | 20 0b 2a 5a 6e a4 e6 48 21 1d b8 e0 f9 5f cf 63 | .*Zn..H!...._.c| | 17 c7 a1 c8 08 d5 47 99 88 83 50 db 5f 22 12 16 |......G...P._"..| | 38 0b 99 bb ab 80 39 46 18 0e c7 d8 3b 5f 46 91 |8.....9F....;_F.| | a5 9e dd e3 f1 22 44 d8 7a d1 07 b0 14 64 06 bb |....."D.z....d..| | 9d 4c 9d 17 54 6a 69 4c 31 7d 7c e1 98 50 42 be |.L..TjiL1}|..PB.| | 24 6e 2e 10 24 f2 74 b2 75 e9 9c ce ea 5b 3d 0f |$n..$.t.u....[=.| | 12 b7 c0 db 60 1a db a5 f5 1b 40 93 9d 08 ac bc |....`.....@.....| | 31 ea 8f 2f 79 84 cc f2 dd 50 29 22 30 94 1b 69 |1../y....P)"0..i| | 3f e2 1c 3c d8 fa b9 0d cb 7f cd bb b5 7c 02 37 |?..<.........|.7| | b9 04 08 8c a9 ae b7 65 ab 4d 9a 47 e7 c4 29 97 |.......e.M.G..).| Plaintext[384]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 31 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:19 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 33 38 20 2d 20 44 48 45 2d 44 |x00,0x38 - DHE-D| | 53 53 2d 41 45 53 32 35 36 2d 53 48 41 20 20 20 |SS-AES256-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc| | 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1..Ky| | 6b bb ff 76 f9 13 8a 08 4b aa 98 d4 6b 93 e5 19 |k..v....K...k...| | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f |................| ssl_decrypt_record found padding 15 final len 368 checking mac (len 348, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348 association_find: TCP port 4452 found 0x3451d50 dissect_ssl3_record decrypted len 348 decrypted app data fragment[348]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 31 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:19 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 33 38 20 2d 20 44 48 45 2d 44 |x00,0x38 - DHE-D| | 53 53 2d 41 45 53 32 35 36 2d 53 48 41 20 20 20 |SS-AES256-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc| | 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1 | dissect_ssl3_record found association 0x3451d50 dissect_ssl enter frame #252 (first time) conversation = 0x7f2686945538, ssl_session = 0x7f265a94e4e0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | c3 7d b1 8c 16 9c 1e 1e 87 5d 3e db 76 58 d2 b5 |.}.......]>.vX..| | 19 61 1e 94 c6 b5 f0 e7 1f c5 84 9e eb e8 f1 6e |.a.............n| Plaintext[32]: | 01 00 0b aa c8 5d 26 08 ee d7 e4 6f 91 fe a9 39 |.....]&....o...9| | cf 65 2e b5 c3 3a 00 00 00 00 00 00 00 00 00 09 |.e...:..........| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #254 (first time) conversation = 0x7f2686945538, ssl_session = 0x7f265a94e4e0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 16 96 1a 59 5f d7 fc 8f d1 71 3f 77 19 39 d6 bc |...Y_....q?w.9..| | 2c 3a 04 ad 8c ce 94 08 4d e4 54 68 eb fd e7 aa |,:......M.Th....| Plaintext[32]: | 01 00 5c 46 06 bc 9c 17 70 43 d3 18 47 2b 31 59 |..\F....pC..G+1Y| | 12 4f db c6 24 db 00 00 00 00 00 00 00 00 00 09 |.O..$...........| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 3) ssl_decrypt_record: mac ok dissect_ssl enter frame #259 (first time) ssl_session_init: initializing ptr 0x7f265a950cc0 size 688 conversation = 0x7f2686945890, ssl_session = 0x7f265a950cc0 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 52289 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4453 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #261 (first time) conversation = 0x7f2686945890, ssl_session = 0x7f265a950cc0 record: offset = 0, reported_length_remaining = 1437 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0x0039 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 1351 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898 record: offset = 898, reported_length_remaining = 539 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 525, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 903 length 521 bytes, remaining 1428 record: offset = 1428, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1433 length 0 bytes, remaining 1437 dissect_ssl enter frame #263 (first time) conversation = 0x7f2686945890, ssl_session = 0x7f265a950cc0 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b... looking for RSA pre-master008064e9ccdc8d5dc992d78f59e6d78da18214cddbba5670... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 ssl3_prf: sha1_hash(6) ssl3_prf: md5_hash(6) datalen 48 ssl3_prf: sha1_hash(7) ssl3_prf: md5_hash(7) datalen 48 ssl3_prf: sha1_hash(8) ssl3_prf: md5_hash(8) datalen 48 ssl3_prf: sha1_hash(9) ssl3_prf: md5_hash(9) datalen 48 key expansion[136]: | 36 5e fc 68 ca 6e f8 5e 8c 9c 01 05 b4 ad b4 86 |6^.h.n.^........| | b9 a1 97 58 f7 c4 59 5a ce dd 62 10 9a 9d 68 5f |...X..YZ..b...h_| | d2 8c b8 3d 80 a4 41 d3 9c 40 9a c9 ab 41 c3 6b |...=..A..@...A.k| | f2 7d 2f bd cb d9 e8 eb 3f 46 60 52 e0 32 9e 53 |.}/.....?F`R.2.S| | 26 99 2d 37 5a a8 21 ad e1 20 85 9f 3c 26 5f 6d |&.-7Z.!.. ..<&_m| | 6a ea 34 d0 67 30 86 a4 07 6d 5f 84 e9 cd e5 9a |j.4.g0...m_.....| | 73 ca f6 ac 36 40 2f b9 6b 97 bf c0 78 65 d8 af |s...6@/.k...xe..| | 02 c4 0b a9 92 0b 3f 32 0f 20 e6 be 5e 76 b0 09 |......?2. ..^v..| | df 6b bb cc 81 d1 b5 25 |.k.....% | Client MAC key[20]: | 36 5e fc 68 ca 6e f8 5e 8c 9c 01 05 b4 ad b4 86 |6^.h.n.^........| | b9 a1 97 58 |...X | Server MAC key[20]: | f7 c4 59 5a ce dd 62 10 9a 9d 68 5f d2 8c b8 3d |..YZ..b...h_...=| | 80 a4 41 d3 |..A. | Client Write key[32]: | 9c 40 9a c9 ab 41 c3 6b f2 7d 2f bd cb d9 e8 eb |.@...A.k.}/.....| | 3f 46 60 52 e0 32 9e 53 26 99 2d 37 5a a8 21 ad |?F`R.2.S&.-7Z.!.| Server Write key[32]: | e1 20 85 9f 3c 26 5f 6d 6a ea 34 d0 67 30 86 a4 |. ..<&_mj.4.g0..| | 07 6d 5f 84 e9 cd e5 9a 73 ca f6 ac 36 40 2f b9 |.m_.....s...6@/.| Client Write IV[16]: | 6b 97 bf c0 78 65 d8 af 02 c4 0b a9 92 0b 3f 32 |k...xe........?2| Server Write IV[16]: | 0f 20 e6 be 5e 76 b0 09 df 6b bb cc 81 d1 b5 25 |. ..^v...k.....%| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | d1 3a 23 d5 c2 39 18 c0 9f c0 c1 ef 4b e9 d7 ee |.:#..9......K...| | 0f e5 fd d2 be a7 ba 5a 61 c9 9e 82 3c a0 cb 4e |.......Za...<..N| ssl_save_session stored master secret[48]: | fe e1 09 c9 42 3b 8b 31 c0 5b 81 27 dd 44 8b 38 |....B;.1.[.'.D.8| | 5a 41 19 79 dc a3 b5 77 42 fb 61 d3 3f 44 ea 7b |ZA.y...wB.a.?D.{| | 56 24 18 ed de 26 2f 5b d6 cb 1d 7f 94 8f 46 41 |V$...&/[......FA| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | db 3e df 80 db 67 f0 33 77 23 11 20 d5 73 0b e8 |.>...g.3w#. .s..| | 06 9a 63 48 bb 41 51 e2 82 69 d5 35 84 5e c6 66 |..cH.AQ..i.5.^.f| | 73 26 86 3a e5 4f 8d ca 83 04 ee 3e 1e ee 40 f9 |s&.:.O.....>..@.| | 6a 87 f1 7d f6 d1 9b 81 25 58 5a b0 55 41 10 ab |j..}....%XZ.UA..| Plaintext[64]: | 14 00 00 24 db 41 bb a7 b4 4c e9 53 1c 99 1c 89 |...$.A...L.S....| | 7a ba dc c1 ea 8a cb 38 90 72 01 90 db c1 2d a2 |z......8.r....-.| | 39 77 32 e4 38 45 c0 12 5b f0 b5 41 e7 77 47 64 |9w2.8E..[..A.wGd| | 5f 28 1a 0f 5b b9 4f ea be 67 f7 b7 00 00 00 03 |_(..[.O..g......| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #264 (first time) conversation = 0x7f2686945890, ssl_session = 0x7f265a950cc0 record: offset = 0, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 0c 2a b6 2b c1 4c d0 3b c4 50 bd 2f ad b3 83 c7 |.*.+.L.;.P./....| | ff 72 e0 4e d0 72 0d 18 d5 fe 0b ba bf d6 38 25 |.r.N.r........8%| | 3b f4 48 91 e7 23 55 35 ee cf 65 19 e8 69 f5 a8 |;.H..#U5..e..i..| | dd a3 d5 8d fa be f9 cc 1b a4 8d 10 87 26 73 75 |.............&su| Plaintext[64]: | 14 00 00 24 54 16 5f 1d d8 f9 71 da 53 56 17 d5 |...$T._...q.SV..| | 8f ba ba c0 8b 27 c3 04 bc c9 8c 68 fa c0 c2 d6 |.....'.....h....| | 72 28 71 e8 2e 82 ec 86 15 b7 5c df 84 7e de 50 |r(q.......\..~.P| | 4c 8c 98 f3 33 10 3d 9b e4 9d c4 f8 00 00 00 03 |L...3.=.........| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #265 (first time) conversation = 0x7f2686945890, ssl_session = 0x7f265a950cc0 record: offset = 0, reported_length_remaining = 138 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 92 6e 07 23 ec ad 4c 9d 19 10 8c 18 86 92 f1 a8 |.n.#..L.........| | 66 bf 30 b3 7b b1 f2 ff b8 29 8c a7 d0 6a 74 76 |f.0.{....)...jtv| Plaintext[32]: | 39 48 b1 ae 7c 33 5d 2f 65 62 2c cf 75 48 60 5c |9H..|3]/eb,.uH`\| | a5 88 eb be 00 00 00 00 00 00 00 00 00 00 00 0b |................| ssl_decrypt_record found padding 11 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 52289 found (nil) association_find: TCP port 4453 found 0x221aa70 record: offset = 37, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 96, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 96 Ciphertext[96]: | 70 6e 29 8d 94 ef 15 1e be 9a f0 f0 b4 81 ff a1 |pn).............| | 23 2c 33 e3 5c 8e 34 d0 42 7a 0b 20 97 b3 27 91 |#,3.\.4.Bz. ..'.| | 69 71 3b 52 9a 4e be 95 11 d3 ae 97 67 4f ed 15 |iq;R.N......gO..| | 74 68 bc ae 48 54 5d 11 c3 1e 9d d2 b1 53 2d e3 |th..HT]......S-.| | a2 10 00 0d 1b 5b 10 b0 78 aa 42 87 0d b0 6b d3 |.....[..x.B...k.| | 1d 8d 2b 27 6a 66 1d bc c7 40 0f 39 20 44 de d4 |..+'jf...@.9 D..| Plaintext[96]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 61 65 |Host: dhe-rsa-ae| | 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s256-sha.local.a| | 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:| | 34 34 35 33 0d 0a 0d 0a 97 5c 7a 28 a6 81 4e bd |4453.....\z(..N.| | 2d ed ee 4b bb f7 ee 5b 11 23 c8 e3 00 00 00 03 |-..K...[.#......| ssl_decrypt_record found padding 3 final len 92 checking mac (len 72, version 300, ct 23 seq 2) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 72, seq = 0, nxtseq = 72 association_find: TCP port 52289 found (nil) association_find: TCP port 4453 found 0x221aa70 dissect_ssl3_record decrypted len 72 decrypted app data fragment[72]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 61 65 |Host: dhe-rsa-ae| | 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s256-sha.local.a| | 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:| | 34 34 35 33 0d 0a 0d 0a |4453.... | dissect_ssl3_record found association 0x221aa70 dissect_ssl enter frame #266 (first time) conversation = 0x7f2686945890, ssl_session = 0x7f265a950cc0 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | ae b2 f3 06 12 09 a7 d6 12 6b a9 bd c7 f3 52 82 |.........k....R.| | 4f 09 34 d1 ce 11 55 a0 e7 15 c5 1f a1 20 18 a9 |O.4...U...... ..| | 20 4d e3 3a ee 28 d3 f2 e8 e0 a4 5f be a5 31 7b | M.:.(....._..1{| | 5f 2d f1 74 81 f1 87 cd fe 7d d2 e9 44 64 d9 05 |_-.t.....}..Dd..| | 91 a8 ef 77 4e cc 46 80 32 e1 e5 90 77 6e 6d a9 |...wN.F.2...wnm.| | fb 72 6b de 38 b6 77 41 db d3 ad 67 63 3b 02 d7 |.rk.8.wA...gc;..| | fb a6 f5 80 2d 68 f8 5b 50 1f 73 fa ee 14 e5 c9 |....-h.[P.s.....| | 30 52 bd e2 b4 37 6a 88 67 60 a3 7e 19 4b 9d f7 |0R...7j.g`.~.K..| | e7 83 3f d2 cb ed c4 66 67 69 ab c8 9f 7e bf 97 |..?....fgi...~..| | 98 8c d4 51 13 41 ee ce fb a1 13 53 d0 30 8a 71 |...Q.A.....S.0.q| | a9 18 04 1d 2b c6 06 96 f8 e3 68 96 7b a3 7e 43 |....+.....h.{.~C| | fd c3 92 ca 34 b8 85 d5 fd d2 d9 cf 21 86 7e df |....4.......!.~.| | 45 5f 1e 5a 02 19 af 9a 82 f4 41 a3 c1 8f bd ea |E_.Z......A.....| | 09 e9 27 ed 53 c5 37 c2 7e da ba d5 10 fd 3f 8f |..'.S.7.~.....?.| | be 0e 4f 64 fb ca c0 a9 b6 a3 c1 54 bb c9 3f a8 |..Od.......T..?.| | 63 99 26 3e b5 62 a0 7c eb ee d5 8f 04 76 a6 3f |c.&>.b.|.....v.?| | 10 7b 89 d6 a2 3d c8 12 58 a7 ee bd d3 e4 be 23 |.{...=..X......#| | 1f 02 ea 9a 9f ca e8 f4 3a 40 db 11 b1 75 e3 b5 |........:@...u..| | 0f 80 a0 7b c8 ab 98 97 33 0a 3e d8 96 9b 87 65 |...{....3.>....e| | ef 78 59 81 21 f7 28 a6 aa 61 1d ce 42 46 95 83 |.xY.!.(..a..BF..| | c8 cb 85 af 14 91 af ea 89 c1 05 e3 88 32 33 03 |.............23.| | f6 20 91 d2 c6 44 5b 54 14 39 78 fa 10 d2 fc 22 |. ...D[T.9x...."| | cf 1d 53 53 44 97 ec 21 97 b6 6e dc 2e 4a 06 3c |..SSD..!..n..J.<| | 07 c6 1d e9 c2 1c 41 54 8f 9f 88 0e 00 03 32 3a |......AT......2:| Plaintext[384]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:20 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 33 39 20 2d 20 44 48 45 2d 52 |x00,0x39 - DHE-R| | 53 41 2d 41 45 53 32 35 36 2d 53 48 41 20 20 20 |SA-AES256-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1..qt| | 3c 94 db 21 8b 20 20 85 9c 2e 45 38 78 40 76 cb |<..!. ...E8x@v.| | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f |................| ssl_decrypt_record found padding 15 final len 368 checking mac (len 348, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348 association_find: TCP port 4453 found 0x221aa70 dissect_ssl3_record decrypted len 348 decrypted app data fragment[348]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:20 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 33 39 20 2d 20 44 48 45 2d 52 |x00,0x39 - DHE-R| | 53 41 2d 41 45 53 32 35 36 2d 53 48 41 20 20 20 |SA-AES256-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1 | dissect_ssl3_record found association 0x221aa70 dissect_ssl enter frame #267 (first time) conversation = 0x7f2686945890, ssl_session = 0x7f265a950cc0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | a7 02 35 83 db ec 1e 8a f3 dd 3a 69 01 d4 31 88 |..5.......:i..1.| | 73 e3 f4 3c 95 b0 bb 95 00 b5 51 c5 3d be c5 61 |s..<......Q.=..a| Plaintext[32]: | 01 00 be a1 41 ed 62 ff cc ba 9a 07 a4 66 ef a2 |....A.b......f..| | b4 de fc 2a d6 bb 00 00 00 00 00 00 00 00 00 09 |...*............| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #269 (first time) conversation = 0x7f2686945890, ssl_session = 0x7f265a950cc0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | aa ff 34 d5 35 c4 2a 1b 72 df 14 7f de 09 e0 2e |..4.5.*.r.......| | 82 6e 66 7d 62 b5 00 76 08 72 93 48 9e 1b 90 21 |.nf}b..v.r.H...!| Plaintext[32]: | 01 00 3b 84 cf e5 c8 3a e6 76 97 7c cf 24 81 26 |..;....:.v.|.$.&| | 99 a6 e2 3f 63 63 00 00 00 00 00 00 00 00 00 09 |...?cc..........| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 3) ssl_decrypt_record: mac ok dissect_ssl enter frame #274 (first time) ssl_session_init: initializing ptr 0x7f265a9534a0 size 688 conversation = 0x7f2686945be8, ssl_session = 0x7f265a9534a0 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 49805 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4457 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #276 (first time) conversation = 0x7f2686945be8, ssl_session = 0x7f265a9534a0 record: offset = 0, reported_length_remaining = 907 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0x0041 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 821 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898 record: offset = 898, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 903 length 0 bytes, remaining 907 dissect_ssl enter frame #278 (first time) conversation = 0x7f2686945be8, ssl_session = 0x7f265a9534a0 record: offset = 0, reported_length_remaining = 340 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 260, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 256 bytes, remaining 265 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c4... looking for RSA pre-masterafe34cf189316e66a7fef8feecc13a1ddc71b68a1506f8c1... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 ssl3_prf: sha1_hash(6) ssl3_prf: md5_hash(6) datalen 48 ssl3_prf: sha1_hash(7) ssl3_prf: md5_hash(7) datalen 48 key expansion[104]: | 1f d5 35 7e 33 78 6b 1f 08 ab a3 74 f0 75 db e0 |..5~3xk....t.u..| | 49 ee bc 01 c8 9c f3 be 43 eb 47 46 2e 8a 56 27 |I.......C.GF..V'| | 45 63 60 e9 e5 5d b4 47 29 56 70 f9 97 c4 6b ce |Ec`..].G)Vp...k.| | 32 99 e2 1a 1d 6b 45 72 4a 6a 0a 48 e7 03 8e 54 |2....kErJj.H...T| | d1 07 a3 c8 77 5a 9e b4 7e f8 a8 7c f2 11 3c 76 |....wZ..~..|.....<...| | 08 20 0b 2f 16 a4 84 ce 51 73 d6 ba 5e da 82 c1 |. ./....Qs..^...| | e4 54 c1 63 80 b2 42 53 14 44 c4 b6 34 d2 13 a6 |.T.c..BS.D..4...| Plaintext[64]: | 14 00 00 24 82 7a 74 2f e3 e4 95 ee c4 72 4c c8 |...$.zt/.....rL.| | e2 47 92 12 49 50 b2 99 ba 3f d0 42 09 60 e4 d5 |.G..IP...?.B.`..| | 2e 06 78 fa 9a e2 19 29 bc 83 91 f3 c2 70 53 bb |..x....).....pS.| | 2d a6 78 c4 d2 8b 09 73 8c d1 94 1f 00 00 00 03 |-.x....s........| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #280 (first time) conversation = 0x7f2686945be8, ssl_session = 0x7f265a9534a0 record: offset = 0, reported_length_remaining = 138 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 54 70 91 94 2c 25 1f a3 81 ab 44 6f 02 fb 80 12 |Tp..,%....Do....| | fe 1e 4b b5 f9 f8 0d aa c1 8c 58 39 8a 3a 71 ed |..K.......X9.:q.| Plaintext[32]: | 41 fb f8 6b 6f ec 93 b8 91 21 5c 58 25 fd 10 44 |A..ko....!\X%..D| | f9 dd 56 38 00 00 00 00 00 00 00 00 00 00 00 0b |..V8............| ssl_decrypt_record found padding 11 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 49805 found (nil) association_find: TCP port 4457 found 0x3354f40 record: offset = 37, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 96, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 96 Ciphertext[96]: | d4 2d 5c e3 a2 51 f2 9b 4e b7 a0 97 42 eb 31 c2 |.-\..Q..N...B.1.| | 0c 50 a7 50 90 4b 43 20 cb 8c c8 12 54 9d fc 4d |.P.P.KC ....T..M| | 92 51 32 7f ea f2 b6 0f 96 fd f7 7e 07 9b 47 a1 |.Q2........~..G.| | a7 8a b4 48 c1 21 d4 53 dd 94 eb 8c 12 c0 0e 3f |...H.!.S.......?| | 9f ed cc 3d a2 2c e2 c4 0b 76 e9 bd 2d fb de e1 |...=.,...v..-...| | 6e c9 be 36 fe 45 90 db b0 c9 49 40 2f 82 8c c5 |n..6.E....I@/...| Plaintext[96]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 63 61 6d 65 6c 6c 69 61 31 32 |Host: camellia12| | 38 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c |8-sha.local.al.l| | 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 35 |ekensteyn.nl:445| | 37 0d 0a 0d 0a f2 79 21 42 06 fe 4a 08 d1 67 c4 |7.....y!B..J..g.| | 50 c1 7f b6 d1 e6 a3 34 5a 00 00 00 00 00 00 06 |P......4Z.......| ssl_decrypt_record found padding 6 final len 89 checking mac (len 69, version 300, ct 23 seq 2) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 69, seq = 0, nxtseq = 69 association_find: TCP port 49805 found (nil) association_find: TCP port 4457 found 0x3354f40 dissect_ssl3_record decrypted len 69 decrypted app data fragment[69]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 63 61 6d 65 6c 6c 69 61 31 32 |Host: camellia12| | 38 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c |8-sha.local.al.l| | 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 35 |ekensteyn.nl:445| | 37 0d 0a 0d 0a |7.... | dissect_ssl3_record found association 0x3354f40 dissect_ssl enter frame #281 (first time) conversation = 0x7f2686945be8, ssl_session = 0x7f265a9534a0 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | 7f 7c 73 8e a6 ce af 18 b4 01 76 e2 c5 c4 09 b4 |.|s.......v.....| | b5 e6 26 43 77 3e c3 3c 77 b1 71 87 f1 b2 6d a4 |..&Cw>.d| | 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='| | 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst| | 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'| | b0 4c 3c e7 6a ed 66 f5 4f ce c6 a1 59 70 a1 96 |.L<.j.f.O...Yp..| | b0 c4 25 c0 00 00 00 00 00 00 00 00 00 00 00 0b |..%.............| ssl_decrypt_record found padding 11 final len 372 checking mac (len 352, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 352, seq = 0, nxtseq = 352 association_find: TCP port 4457 found 0x3354f40 dissect_ssl3_record decrypted len 352 decrypted app data fragment[352]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:20 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 34 31 20 2d 20 43 41 4d 45 4c |x00,0x41 - CAMEL| | 4c 49 41 31 32 38 2d 53 48 41 20 20 20 20 20 20 |LIA128-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 43 61 6d 65 6c 6c 69 61 28 31 32 38 29 20 4d |=Camellia(128) M| | 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1| dissect_ssl3_record found association 0x3354f40 dissect_ssl enter frame #282 (first time) conversation = 0x7f2686945be8, ssl_session = 0x7f265a9534a0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | f1 cc 64 b6 95 80 ed 56 50 c5 2a 93 26 a1 7e 62 |..d....VP.*.&.~b| | d6 03 e2 1a de 07 9a e0 52 1d 58 0e c8 3e 7a 92 |........R.X..>z.| Plaintext[32]: | 01 00 ea 96 83 be 98 a8 1d 3b 14 c6 9c a8 20 a8 |.........;.... .| | 85 51 17 52 f1 f8 00 00 00 00 00 00 00 00 00 09 |.Q.R............| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #284 (first time) conversation = 0x7f2686945be8, ssl_session = 0x7f265a9534a0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 5e 60 b8 32 1f 3c 40 6d 21 f5 7c ae cc e8 b4 9e |^`.2.<@m!.|.....| | 2a ae 23 3a 75 de 60 07 51 e5 88 b8 86 fa cd 35 |*.#:u.`.Q......5| Plaintext[32]: | 01 00 7f 53 b3 15 ba f5 87 c0 92 d5 85 b5 07 49 |...S...........I| | e9 b6 c7 ed 26 29 00 00 00 00 00 00 00 00 00 09 |....&)..........| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 3) ssl_decrypt_record: mac ok dissect_ssl enter frame #289 (first time) ssl_session_init: initializing ptr 0x7f265a955d10 size 688 conversation = 0x7f2686945f40, ssl_session = 0x7f265a955d10 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 44218 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4458 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #291 (first time) conversation = 0x7f2686945f40, ssl_session = 0x7f265a955d10 record: offset = 0, reported_length_remaining = 1155 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0x0044 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 1069 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 735, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 731 bytes, remaining 826 record: offset = 826, reported_length_remaining = 329 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 315, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 831 length 311 bytes, remaining 1146 record: offset = 1146, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1151 length 0 bytes, remaining 1155 dissect_ssl enter frame #293 (first time) conversation = 0x7f2686945f40, ssl_session = 0x7f265a955d10 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c... looking for RSA pre-master00806b324308605bacc732ea33c19ec7b8087fc381371537... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 ssl3_prf: sha1_hash(6) ssl3_prf: md5_hash(6) datalen 48 ssl3_prf: sha1_hash(7) ssl3_prf: md5_hash(7) datalen 48 key expansion[104]: | d8 c3 76 31 0f 6e 5e 17 17 0d d6 be f3 db c7 56 |..v1.n^........V| | 0b 70 fc 32 9b f8 d9 c0 6a 78 9c 5c 41 85 22 fc |.p.2....jx.\A.".| | 65 fb 64 c7 0d 87 4d e4 a3 14 a5 5d d7 92 c0 d1 |e.d...M....]....| | 6f a7 db a1 fd c3 11 de f1 df 75 02 dc fd de 38 |o.........u....8| | 5c c2 cc fe fb 0b 2f 24 39 0e 75 13 74 8b 46 9f |\...../$9.u.t.F.| | 2e 5b 19 fb 2d 28 ee 43 a9 26 33 b1 5e 84 46 f5 |.[..-(.C.&3.^.F.| | d3 bc 79 2d cf e6 8e ba |..y-.... | Client MAC key[20]: | d8 c3 76 31 0f 6e 5e 17 17 0d d6 be f3 db c7 56 |..v1.n^........V| | 0b 70 fc 32 |.p.2 | Server MAC key[20]: | 9b f8 d9 c0 6a 78 9c 5c 41 85 22 fc 65 fb 64 c7 |....jx.\A.".e.d.| | 0d 87 4d e4 |..M. | Client Write key[16]: | a3 14 a5 5d d7 92 c0 d1 6f a7 db a1 fd c3 11 de |...]....o.......| Server Write key[16]: | f1 df 75 02 dc fd de 38 5c c2 cc fe fb 0b 2f 24 |..u....8\...../$| Client Write IV[16]: | 39 0e 75 13 74 8b 46 9f 2e 5b 19 fb 2d 28 ee 43 |9.u.t.F..[..-(.C| Server Write IV[16]: | a9 26 33 b1 5e 84 46 f5 d3 bc 79 2d cf e6 8e ba |.&3.^.F...y-....| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: CAMELLIA128 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: CAMELLIA128 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | 3f cb 22 9b cd ff 5b 89 70 22 db 6e 16 3b 5c ce |?."...[.p".n.;\.| | 04 8f 6b 91 71 e7 c7 f3 ab 3b 88 c2 34 33 e6 62 |..k.q....;..43.b| ssl_save_session stored master secret[48]: | 53 c1 3c 3c 1c 13 17 08 f3 42 06 43 bb 7b fe 1e |S.<<.....B.C.{..| | c0 1d ac 21 0d 7f ed 48 d5 0c 56 15 6c d3 58 e9 |...!...H..V.l.X.| | a2 84 cb 8d 6c 3b ba 70 aa 86 a5 4f c4 dc 23 12 |....l;.p...O..#.| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 5c 14 fd 1d 19 09 95 af 69 e4 7b 15 09 d1 65 71 |\.......i.{...eq| | 0b 3b bd 41 a3 d3 0c 2d f3 8e f1 ed bb 7b d7 ba |.;.A...-.....{..| | bf f8 06 a1 2e fb 78 74 a8 f4 f0 39 a7 23 64 b9 |......xt...9.#d.| | 80 7e db 8b 1c a2 49 85 94 65 cd 42 39 06 42 e1 |.~....I..e.B9.B.| Plaintext[64]: | 14 00 00 24 c0 f7 36 17 2b 44 f5 60 05 a5 c1 39 |...$..6.+D.`...9| | 77 82 1c 24 f5 d6 c8 5a 1e da 79 00 89 9f fd 07 |w..$...Z..y.....| | 54 fe 0f 67 b6 d2 82 b0 83 b8 50 b6 34 2a 08 3a |T..g......P.4*.:| | 4c 3a b1 75 41 c3 ce 00 5f 9b 14 00 00 00 00 03 |L:.uA..._.......| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #294 (first time) conversation = 0x7f2686945f40, ssl_session = 0x7f265a955d10 record: offset = 0, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | bb a5 41 fa f3 58 17 f4 ab fa 4f 4c 64 5d 22 df |..A..X....OLd]".| | 7f ed b6 c7 ab d2 6b cb 34 fe 1e bc 1c 18 c1 2f |......k.4....../| | fa 9b 33 c6 9c f9 80 39 01 5f c6 40 32 8a 46 6b |..3....9._.@2.Fk| | 3d 6e 83 54 aa 64 82 38 4a 13 fc c2 de 08 04 46 |=n.T.d.8J......F| Plaintext[64]: | 14 00 00 24 81 a9 13 a0 08 5f 49 8f 04 41 4a 8d |...$....._I..AJ.| | 28 96 95 4e 05 55 be 19 2f b7 08 ae 5d bc 97 af |(..N.U../...]...| | 40 33 a5 cf 17 62 26 25 43 35 0c 15 1a b2 f3 e0 |@3...b&%C5......| | e9 5e 1f 84 ea 2e 62 2e cd fb b9 90 00 00 00 03 |.^....b.........| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #295 (first time) conversation = 0x7f2686945f40, ssl_session = 0x7f265a955d10 record: offset = 0, reported_length_remaining = 154 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 76 96 3f 57 84 55 2f cc e9 c4 ca 19 26 f4 cf 5c |v.?W.U/.....&..\| | 17 75 47 44 77 6d 83 af 95 39 96 6f 85 bc 31 50 |.uGDwm...9.o..1P| Plaintext[32]: | 41 9a 69 f5 e2 0a e8 90 6d 1c 95 cd 06 4e 00 20 |A.i.....m....N. | | e0 3b 7a 59 00 00 00 00 00 00 00 00 00 00 00 0b |.;zY............| ssl_decrypt_record found padding 11 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 44218 found (nil) association_find: TCP port 4458 found 0x3354fd0 record: offset = 37, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | 74 2c d6 c9 77 03 99 73 e1 ed 65 33 17 e6 ae 64 |t,..w..s..e3...d| | 6a a4 3f 9b 46 26 86 10 44 43 d7 17 40 49 03 c5 |j.?.F&..DC..@I..| | 92 8a f0 75 42 f2 ba cf c8 97 a4 00 90 db c4 d2 |...uB...........| | ad 2d 1b ca 2d ea dc af 0d 37 87 9b b6 90 c1 65 |.-..-....7.....e| | 14 bf 57 f6 08 87 78 e1 19 73 c2 0d e6 df 97 c1 |..W...x..s......| | b0 ed ed f4 d5 3e 1f cb ff 3f e4 03 11 ca 8b eb |.....>...?......| | 1f 42 dd 96 b5 d0 33 4a da cf fa 33 d3 47 2b 93 |.B....3J...3.G+.| Plaintext[112]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 63 61 |Host: dhe-dss-ca| | 6d 65 6c 6c 69 61 31 32 38 2d 73 68 61 2e 6c 6f |mellia128-sha.lo| | 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey| | 6e 2e 6e 6c 3a 34 34 35 38 0d 0a 0d 0a f3 3f 7e |n.nl:4458.....?~| | 1b 94 6f 38 2f f8 70 47 1d 46 31 6c 46 4a d1 d6 |..o8/.pG.F1lFJ..| | 88 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0e |................| ssl_decrypt_record found padding 14 final len 97 checking mac (len 77, version 300, ct 23 seq 2) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 77, seq = 0, nxtseq = 77 association_find: TCP port 44218 found (nil) association_find: TCP port 4458 found 0x3354fd0 dissect_ssl3_record decrypted len 77 decrypted app data fragment[77]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 63 61 |Host: dhe-dss-ca| | 6d 65 6c 6c 69 61 31 32 38 2d 73 68 61 2e 6c 6f |mellia128-sha.lo| | 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey| | 6e 2e 6e 6c 3a 34 34 35 38 0d 0a 0d 0a |n.nl:4458.... | dissect_ssl3_record found association 0x3354fd0 dissect_ssl enter frame #296 (first time) conversation = 0x7f2686945f40, ssl_session = 0x7f265a955d10 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 3b c8 e9 06 21 77 79 8c fc cc 27 7f 3c cb d0 dc |;...!wy...'.<...| | 08 e1 7d e4 2e 8f 5e c5 e3 6f 8f 85 be c5 10 42 |..}...^..o.....B| Plaintext[32]: | 01 00 96 2f 1a 74 e0 ee 9a 62 02 05 da dd 0d 66 |.../.t...b.....f| | 36 77 93 e2 71 b3 00 00 00 00 00 00 00 00 00 09 |6w..q...........| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 3) ssl_decrypt_record: mac ok dissect_ssl enter frame #297 (first time) conversation = 0x7f2686945f40, ssl_session = 0x7f265a955d10 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | 7d d2 26 10 8c 7a fe d6 0c 1d f1 3f eb 83 13 fd |}.&..z.....?....| | 88 07 47 6b 7e 36 f0 c1 34 b2 f2 a5 de ff 19 4f |..Gk~6..4......O| | ef 85 a2 39 77 d6 06 00 dc 93 1f 8e cc 43 0c 2a |...9w........C.*| | 8b 53 de 52 02 c1 e1 1f 97 ba 46 bb ea d3 94 ab |.S.R......F.....| | c5 2e 04 e2 9a ad 81 74 35 fd f1 63 ff 7a a6 47 |.......t5..c.z.G| | 3a 41 34 02 e7 f3 80 98 53 aa 87 89 d5 b5 34 76 |:A4.....S.....4v| | c5 1b 25 6c cc b4 f2 33 bf 0d 64 85 c9 00 d3 5e |..%l...3..d....^| | 59 0b e5 59 4d d1 20 5d 15 c2 0f 59 74 86 2d a5 |Y..YM. ]...Yt.-.| | 3d 85 cc dc 1d 48 38 c0 18 7b 71 6a 02 81 ea 06 |=....H8..{qj....| | e7 fb a2 db ae ec 1b af 3f 59 ee 2e 85 e3 6d 15 |........?Y....m.| | 72 4a b0 96 b6 28 89 ca c2 af 8c ab 53 5a 38 4d |rJ...(......SZ8M| | f5 11 c9 25 88 72 25 6f 82 0d 93 54 0c 8b 95 9f |...%.r%o...T....| | 32 8b a1 0f d5 97 36 4d 29 66 cf a1 2e a8 56 ec |2.....6M)f....V.| | b6 b6 12 f3 ea ea 2c b5 76 08 11 6a 0b 26 dc b3 |......,.v..j.&..| | 80 eb 3e 62 d3 73 1e 84 75 ed 04 b1 06 48 24 8f |..>b.s..u....H$.| | 9d c8 54 93 f0 9a 64 0f af 42 d7 fb 4b 4b ac be |..T...d..B..KK..| | 5f 52 2a c5 b6 b5 55 5d a1 73 6b 8d b6 71 f0 1f |_R*...U].sk..q..| | 34 82 df 06 58 ed de ec ae c8 20 47 66 3e 17 45 |4...X..... Gf>.E| | e6 da aa 4f b2 1b 10 4e 2f bb 0f 62 b7 d9 ce 7f |...O...N/..b....| | a4 ab b9 2d 3b 76 d7 6f a9 39 b4 fd bb 78 89 8f |...-;v.o.9...x..| | bf 85 33 3d ae c3 65 2d b4 21 ee 62 f2 a7 4d 6e |..3=..e-.!.b..Mn| | 75 4f ea 65 2b d8 b7 a8 c8 98 e8 58 0f 7c 7e 4f |uO.e+......X.|~O| | 4c 19 3e 4f 0d f3 a1 e3 e6 2a ce fd 59 2c dc e5 |L.>O.....*..Y,..| | 9c 36 b0 fb 90 19 98 75 28 eb f7 05 e9 23 2c d2 |.6.....u(....#,.| Plaintext[384]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:20 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 34 34 20 2d 20 44 48 45 2d 44 |x00,0x44 - DHE-D| | 53 53 2d 43 41 4d 45 4c 4c 49 41 31 32 38 2d 53 |SS-CAMELLIA128-S| | 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc| | 3d 43 61 6d 65 6c 6c 69 61 28 31 32 38 29 20 4d |=Camellia(128) M| | 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1| | cb c6 a8 b7 9a 1b 59 13 85 e7 f9 44 eb 33 06 f2 |......Y....D.3..| | bc bb e1 a7 00 00 00 00 00 00 00 00 00 00 00 0b |................| ssl_decrypt_record found padding 11 final len 372 checking mac (len 352, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 352, seq = 0, nxtseq = 352 association_find: TCP port 4458 found 0x3354fd0 dissect_ssl3_record decrypted len 352 decrypted app data fragment[352]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:20 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 34 34 20 2d 20 44 48 45 2d 44 |x00,0x44 - DHE-D| | 53 53 2d 43 41 4d 45 4c 4c 49 41 31 32 38 2d 53 |SS-CAMELLIA128-S| | 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc| | 3d 43 61 6d 65 6c 6c 69 61 28 31 32 38 29 20 4d |=Camellia(128) M| | 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1| dissect_ssl3_record found association 0x3354fd0 dissect_ssl enter frame #302 (first time) ssl_session_init: initializing ptr 0x7f265a958080 size 688 conversation = 0x7f2686946260, ssl_session = 0x7f265a958080 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 45099 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4459 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #304 (first time) conversation = 0x7f2686946260, ssl_session = 0x7f265a958080 record: offset = 0, reported_length_remaining = 1437 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0x0045 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 1351 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898 record: offset = 898, reported_length_remaining = 539 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 525, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 903 length 521 bytes, remaining 1428 record: offset = 1428, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1433 length 0 bytes, remaining 1437 dissect_ssl enter frame #306 (first time) conversation = 0x7f2686946260, ssl_session = 0x7f265a958080 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d... looking for RSA pre-master0080b798eaf6f599d1530d69d93f5c3c464d9afc1d714667... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 ssl3_prf: sha1_hash(6) ssl3_prf: md5_hash(6) datalen 48 ssl3_prf: sha1_hash(7) ssl3_prf: md5_hash(7) datalen 48 key expansion[104]: | 82 24 dc f7 08 9a a6 b5 2a 53 33 12 07 fe bd ec |.$......*S3.....| | 01 0c 06 b3 20 78 6e b7 af 8b c5 11 5d 07 91 42 |.... xn.....]..B| | 6c e3 28 cd 37 9f 92 dc 1c cf 50 b9 dd 2e ff 45 |l.(.7.....P....E| | 7d 42 f8 46 61 65 b9 bb da d3 fe a5 59 87 30 e3 |}B.Fae......Y.0.| | f2 e9 43 5c 24 bb d1 89 1b fb 7d 9e 05 28 e4 f9 |..C\$.....}..(..| | 1b 67 07 2f a7 d4 9f f6 45 25 e3 a6 fe 06 cb 33 |.g./....E%.....3| | aa ed 48 fc c2 35 51 11 |..H..5Q. | Client MAC key[20]: | 82 24 dc f7 08 9a a6 b5 2a 53 33 12 07 fe bd ec |.$......*S3.....| | 01 0c 06 b3 |.... | Server MAC key[20]: | 20 78 6e b7 af 8b c5 11 5d 07 91 42 6c e3 28 cd | xn.....]..Bl.(.| | 37 9f 92 dc |7... | Client Write key[16]: | 1c cf 50 b9 dd 2e ff 45 7d 42 f8 46 61 65 b9 bb |..P....E}B.Fae..| Server Write key[16]: | da d3 fe a5 59 87 30 e3 f2 e9 43 5c 24 bb d1 89 |....Y.0...C\$...| Client Write IV[16]: | 1b fb 7d 9e 05 28 e4 f9 1b 67 07 2f a7 d4 9f f6 |..}..(...g./....| Server Write IV[16]: | 45 25 e3 a6 fe 06 cb 33 aa ed 48 fc c2 35 51 11 |E%.....3..H..5Q.| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: CAMELLIA128 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: CAMELLIA128 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | 37 6d 2c 1d b6 bd f2 44 60 6f 0d 39 91 e2 f2 60 |7m,....D`o.9...`| | b6 ac dc 88 a7 0b 83 b5 b5 4d 1f ea 6a f8 b5 c6 |.........M..j...| ssl_save_session stored master secret[48]: | 65 cc 16 42 59 70 2e 78 48 9f 6c 4f 9f 3f d2 b3 |e..BYp.xH.lO.?..| | ab f9 fc 5d bc 43 e7 59 2f 76 70 f8 78 0d e9 f3 |...].C.Y/vp.x...| | 3b 20 5d dc b4 59 02 b8 cc af 48 b5 9a 80 b9 ac |; ]..Y....H.....| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 59 17 37 d7 0a f6 48 f9 38 0c 21 cf be 46 c4 62 |Y.7...H.8.!..F.b| | e7 1a 67 f4 86 ff 17 e8 fa b7 0b 4f 6a 6e 4b f5 |..g........OjnK.| | 68 30 49 31 07 3a 7c 29 2b 0f e0 69 46 66 f2 aa |h0I1.:|)+..iFf..| | fd 8f a9 58 bf 2f 6e 70 88 40 5a d4 ac 22 d5 20 |...X./np.@Z..". | Plaintext[64]: | 14 00 00 24 0c 82 76 88 55 cd 40 8a 0d 91 a5 c8 |...$..v.U.@.....| | 94 43 24 79 a3 6d 92 73 f8 54 5e ae 9e 66 0e 88 |.C$y.m.s.T^..f..| | 30 c7 9a 4b 17 91 90 98 9b a2 db 67 67 49 d6 1e |0..K.......ggI..| | 54 19 4c 40 36 56 0c 37 e1 ea 3a 04 00 00 00 03 |T.L@6V.7..:.....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #307 (first time) conversation = 0x7f2686946260, ssl_session = 0x7f265a958080 record: offset = 0, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 04 dc 2a 0f bd 9b a7 af fe 02 86 2f ca 8f 47 8d |..*......../..G.| | e9 81 0b 5a 80 a4 77 ca bc eb 1d a9 c7 1b 8a 84 |...Z..w.........| | 6f 00 69 68 e3 98 f8 55 49 e5 e7 8c e0 37 e5 bf |o.ih...UI....7..| | 28 bb e2 0b 3c a5 c2 8c bc de ac 4b 17 b6 6e a0 |(...<......K..n.| Plaintext[64]: | 14 00 00 24 4a a6 19 c3 07 22 31 e4 de 31 fe 58 |...$J...."1..1.X| | 01 10 8a 83 a7 b1 91 ed 41 2a 37 4a fa 2f 79 be |........A*7J./y.| | 01 84 8e 57 5c 69 07 fe d5 e3 20 f7 72 dd 3e 53 |...W\i.... .r.>S| | 9e c7 59 d8 24 51 bf 33 60 f5 7a 8e 00 00 00 03 |..Y.$Q.3`.z.....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #308 (first time) conversation = 0x7f2686946260, ssl_session = 0x7f265a958080 record: offset = 0, reported_length_remaining = 154 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 1c 2f ac ee a2 b8 92 e1 8c 47 41 83 99 14 41 d0 |./.......GA...A.| | 20 4c 6b 31 06 84 7e 96 30 98 85 7d 29 74 c5 e3 | Lk1..~.0..})t..| Plaintext[32]: | 18 ac e1 a0 a9 c4 85 a6 e3 48 de a9 bc b3 c5 a8 |.........H......| | 7b fa 07 05 00 00 00 00 00 00 00 00 00 00 00 0b |{...............| ssl_decrypt_record found padding 11 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 45099 found (nil) association_find: TCP port 4459 found 0x3355860 record: offset = 37, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | 0f e6 3a 23 f4 e1 e9 c8 d4 e2 77 fd a1 fa 79 20 |..:#......w...y | | 75 e0 36 8b 45 d4 13 d0 a7 b3 e1 02 54 98 4d 44 |u.6.E.......T.MD| | 4a f2 a3 da 1b ae c1 e3 c7 ed d8 ba 42 c8 3b 2f |J...........B.;/| | 27 c9 98 98 0a 4a bb ae f4 a7 59 cc 08 be 04 66 |'....J....Y....f| | 05 c5 45 dc 4e 5f 39 f2 2e ec 0a 82 5e db a6 1b |..E.N_9.....^...| | 22 19 cb e5 b7 d7 e2 6d 3c 11 cc 9e 39 20 dd 69 |"......m<...9 .i| | d3 d2 2c 57 d2 0f e2 04 c0 b6 d8 f2 c9 a8 54 bb |..,W..........T.| Plaintext[112]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 63 61 |Host: dhe-rsa-ca| | 6d 65 6c 6c 69 61 31 32 38 2d 73 68 61 2e 6c 6f |mellia128-sha.lo| | 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey| | 6e 2e 6e 6c 3a 34 34 35 39 0d 0a 0d 0a d2 83 1a |n.nl:4459.......| | 61 3d 07 a0 13 a0 88 d1 33 e0 86 c3 60 85 16 48 |a=......3...`..H| | 5b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0e |[...............| ssl_decrypt_record found padding 14 final len 97 checking mac (len 77, version 300, ct 23 seq 2) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 77, seq = 0, nxtseq = 77 association_find: TCP port 45099 found (nil) association_find: TCP port 4459 found 0x3355860 dissect_ssl3_record decrypted len 77 decrypted app data fragment[77]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 63 61 |Host: dhe-rsa-ca| | 6d 65 6c 6c 69 61 31 32 38 2d 73 68 61 2e 6c 6f |mellia128-sha.lo| | 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey| | 6e 2e 6e 6c 3a 34 34 35 39 0d 0a 0d 0a |n.nl:4459.... | dissect_ssl3_record found association 0x3355860 dissect_ssl enter frame #309 (first time) conversation = 0x7f2686946260, ssl_session = 0x7f265a958080 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | 4d 1c b4 32 d3 8d 35 17 f2 ae 52 52 1a 3b 11 95 |M..2..5...RR.;..| | c8 6c cc 6f 01 8c 1b 38 43 ea d6 ba 48 05 02 5d |.l.o...8C...H..]| | cc 20 48 15 f5 2d fe 50 3c 54 6b 40 9d 8e a6 bf |. H..-.Pd| | 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='| | 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst| | 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'| | a7 fc 1c 5a f9 3b a7 b1 3f 2a 6b 21 54 69 e4 eb |...Z.;..?*k!Ti..| | 4e eb 6c 4b 00 00 00 00 00 00 00 00 00 00 00 0b |N.lK............| ssl_decrypt_record found padding 11 final len 372 checking mac (len 352, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 352, seq = 0, nxtseq = 352 association_find: TCP port 4459 found 0x3355860 dissect_ssl3_record decrypted len 352 decrypted app data fragment[352]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:20 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 34 35 20 2d 20 44 48 45 2d 52 |x00,0x45 - DHE-R| | 53 41 2d 43 41 4d 45 4c 4c 49 41 31 32 38 2d 53 |SA-CAMELLIA128-S| | 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 43 61 6d 65 6c 6c 69 61 28 31 32 38 29 20 4d |=Camellia(128) M| | 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1| dissect_ssl3_record found association 0x3355860 dissect_ssl enter frame #310 (first time) conversation = 0x7f2686946260, ssl_session = 0x7f265a958080 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | cf b8 ca bd a3 1f f3 22 06 c0 bb 62 fd 9c f0 e8 |......."...b....| | 22 c1 81 23 87 c5 ab 55 45 99 2f 03 8e a7 1b 8f |"..#...UE./.....| Plaintext[32]: | 01 00 75 dc 97 b5 4c de 24 e9 f9 8e 48 52 91 f5 |..u...L.$...HR..| | 82 4e c4 4b 1c 5d 00 00 00 00 00 00 00 00 00 09 |.N.K.]..........| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #312 (first time) conversation = 0x7f2686946260, ssl_session = 0x7f265a958080 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | b4 2e 17 e5 21 85 86 17 c2 16 19 0d 5d 46 10 38 |....!.......]F.8| | 8e 81 e2 4e 6b 0d c5 42 0d 7f 0b e8 ea 64 26 2b |...Nk..B.....d&+| Plaintext[32]: | 01 00 52 6b dd 81 88 a8 72 a2 ce 16 f9 05 b4 dc |..Rk....r.......| | 3d ff 0c 11 ce 79 00 00 00 00 00 00 00 00 00 09 |=....y..........| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 3) ssl_decrypt_record: mac ok dissect_ssl enter frame #317 (first time) ssl_session_init: initializing ptr 0x7f265a95a870 size 688 conversation = 0x7f26869465c0, ssl_session = 0x7f265a95a870 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 45432 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4463 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #319 (first time) conversation = 0x7f26869465c0, ssl_session = 0x7f265a95a870 record: offset = 0, reported_length_remaining = 907 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0x0084 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 821 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898 record: offset = 898, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 903 length 0 bytes, remaining 907 dissect_ssl enter frame #321 (first time) conversation = 0x7f26869465c0, ssl_session = 0x7f265a95a870 record: offset = 0, reported_length_remaining = 340 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 260, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 256 bytes, remaining 265 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf538198... looking for RSA pre-master15284a4d462ec1be6f154a748d055c28f45a491e46bb5076... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 ssl3_prf: sha1_hash(6) ssl3_prf: md5_hash(6) datalen 48 ssl3_prf: sha1_hash(7) ssl3_prf: md5_hash(7) datalen 48 ssl3_prf: sha1_hash(8) ssl3_prf: md5_hash(8) datalen 48 ssl3_prf: sha1_hash(9) ssl3_prf: md5_hash(9) datalen 48 key expansion[136]: | de c5 ee ad bf f0 b9 3f ab 69 cd 50 ba e7 36 0d |.......?.i.P..6.| | 7c 97 88 ca 7c 25 a7 40 4f d6 34 db 75 18 eb 93 ||...|%.@O.4.u...| | 58 7d 84 6f 60 a8 88 56 27 22 c0 d1 fb ae c6 9c |X}.o`..V'"......| | a6 a5 3a be 1f 77 67 ae 28 bb 5e 7d 6e 2e 4e ee |..:..wg.(.^}n.N.| | e8 39 f8 a6 ea b1 ee cf 47 d3 0c 42 eb 95 5d ad |.9......G..B..].| | 19 14 84 dd 02 8d 1d c2 52 dc 60 95 cd 93 e9 7b |........R.`....{| | c4 7d c1 6e 8e c4 cb 04 96 ce 85 13 cb 13 d6 67 |.}.n...........g| | 81 2c f5 60 50 5b 02 1b 4f 01 ad ef b8 6d ff c3 |.,.`P[..O....m..| | 2e 6c 80 58 67 0e 96 1e |.l.Xg... | Client MAC key[20]: | de c5 ee ad bf f0 b9 3f ab 69 cd 50 ba e7 36 0d |.......?.i.P..6.| | 7c 97 88 ca ||... | Server MAC key[20]: | 7c 25 a7 40 4f d6 34 db 75 18 eb 93 58 7d 84 6f ||%.@O.4.u...X}.o| | 60 a8 88 56 |`..V | Client Write key[32]: | 27 22 c0 d1 fb ae c6 9c a6 a5 3a be 1f 77 67 ae |'"........:..wg.| | 28 bb 5e 7d 6e 2e 4e ee e8 39 f8 a6 ea b1 ee cf |(.^}n.N..9......| Server Write key[32]: | 47 d3 0c 42 eb 95 5d ad 19 14 84 dd 02 8d 1d c2 |G..B..].........| | 52 dc 60 95 cd 93 e9 7b c4 7d c1 6e 8e c4 cb 04 |R.`....{.}.n....| Client Write IV[16]: | 96 ce 85 13 cb 13 d6 67 81 2c f5 60 50 5b 02 1b |.......g.,.`P[..| Server Write IV[16]: | 4f 01 ad ef b8 6d ff c3 2e 6c 80 58 67 0e 96 1e |O....m...l.Xg...| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: CAMELLIA256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: CAMELLIA256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | 7d a7 24 05 84 be 15 20 d4 89 1d f9 d9 96 57 26 |}.$.... ......W&| | db ff e3 64 b0 7f 6a d7 96 12 69 4e 6f 0a 07 be |...d..j...iNo...| ssl_save_session stored master secret[48]: | ea a7 77 66 75 b7 76 a5 00 b9 ff 42 7f 17 bb 1e |..wfu.v....B....| | 2e bd 14 f3 59 cc 35 4f e9 11 5b 75 0e c0 35 3e |....Y.5O..[u..5>| | 0b 6e c1 d3 81 e3 78 bc 16 25 fc 19 b2 2c c1 3b |.n....x..%...,.;| dissect_ssl3_handshake session keys successfully generated record: offset = 265, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 271, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 80 af 26 be b8 e9 8f c7 0a 76 a8 e2 06 ff a2 ab |..&......v......| | 67 f1 85 ad 9b 37 87 45 91 c4 01 a6 17 e2 1e 0d |g....7.E........| | af b5 45 ca e6 ab 05 7e 21 2b 53 b2 c5 1a 26 63 |..E....~!+S...&c| | 03 21 9e 48 38 f0 b2 3e 01 e2 a9 8e 05 5e 1b 26 |.!.H8..>.....^.&| Plaintext[64]: | 14 00 00 24 eb 6a 91 0a 42 fa 04 12 bd fe 4b 08 |...$.j..B.....K.| | 4b 2b 22 2c ff cc 25 d5 04 d4 ea 91 1b 00 50 ee |K+",..%.......P.| | eb bb 41 20 d2 3d 24 fd c8 0b 14 e5 da 34 09 a9 |..A .=$......4..| | 8b 41 fe a5 3e 54 28 23 f3 2d 00 ee 00 00 00 03 |.A..>T(#.-......| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #322 (first time) conversation = 0x7f26869465c0, ssl_session = 0x7f265a95a870 record: offset = 0, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 7c a8 eb 79 ef 8e 85 f3 41 a0 2d 3b 21 c5 53 08 ||..y....A.-;!.S.| | 44 2a eb 3f e0 56 7b 02 d0 58 77 14 9b 3b c4 91 |D*.?.V{..Xw..;..| | 61 43 1e 80 e9 55 8f 3b 91 7f e3 70 11 4c a3 97 |aC...U.;...p.L..| | f0 aa 81 fb 87 53 6c eb 58 e5 9d 57 8b 4a ea 5c |.....Sl.X..W.J.\| Plaintext[64]: | 14 00 00 24 18 a0 af f2 db db da 25 ac 7e 3b 96 |...$.......%.~;.| | f7 d9 11 b0 72 da 44 14 df b0 d7 ba e7 e4 e8 f6 |....r.D.........| | 61 a4 8e 97 dd 8b b5 d3 81 ec 9a 2c 48 da 47 20 |a..........,H.G | | c7 50 52 f9 10 6d 28 7b 4f 7d a5 a0 00 00 00 03 |.PR..m({O}......| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #323 (first time) conversation = 0x7f26869465c0, ssl_session = 0x7f265a95a870 record: offset = 0, reported_length_remaining = 138 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | e8 d6 8d 9d fa d4 1c 75 f8 c0 5b 12 9c bd 70 c4 |.......u..[...p.| | e1 93 3e 93 cd 1c 4b 05 88 4e 5a 94 86 65 89 cc |..>...K..NZ..e..| Plaintext[32]: | 03 62 d4 65 70 ef 48 ee 1d 97 f5 6d 8c 87 09 b2 |.b.ep.H....m....| | 74 5c 65 6c 00 00 00 00 00 00 00 00 00 00 00 0b |t\el............| ssl_decrypt_record found padding 11 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 45432 found (nil) association_find: TCP port 4463 found 0x33562c0 record: offset = 37, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 96, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 96 Ciphertext[96]: | 2e 80 d2 21 29 f7 18 eb 0c 8d ca 2d 24 eb b5 62 |...!)......-$..b| | dc 29 fe 0e 1c 40 56 f7 bd 6f a9 68 00 00 5b 75 |.)...@V..o.h..[u| | 50 2a b7 8a ea d6 90 5e 82 8a 44 4d 45 2f 9e 1e |P*.....^..DME/..| | d1 54 34 e9 e0 37 20 d9 1c f9 8b 62 01 bc af 35 |.T4..7 ....b...5| | 3a 6e 56 48 97 ac bd 7a 0b cf 0b 88 c0 e8 c6 38 |:nVH...z.......8| | 52 e7 e4 98 04 52 e8 91 22 54 55 ec 02 1e 6c 05 |R....R.."TU...l.| Plaintext[96]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 63 61 6d 65 6c 6c 69 61 32 35 |Host: camellia25| | 36 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c |6-sha.local.al.l| | 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 36 |ekensteyn.nl:446| | 33 0d 0a 0d 0a 82 5a 88 2c 4c d4 94 88 18 c9 64 |3.....Z.,L.....d| | 91 eb bd 43 f3 9f 9a f1 28 00 00 00 00 00 00 06 |...C....(.......| ssl_decrypt_record found padding 6 final len 89 checking mac (len 69, version 300, ct 23 seq 2) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 69, seq = 0, nxtseq = 69 association_find: TCP port 45432 found (nil) association_find: TCP port 4463 found 0x33562c0 dissect_ssl3_record decrypted len 69 decrypted app data fragment[69]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 63 61 6d 65 6c 6c 69 61 32 35 |Host: camellia25| | 36 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c |6-sha.local.al.l| | 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 36 |ekensteyn.nl:446| | 33 0d 0a 0d 0a |3.... | dissect_ssl3_record found association 0x33562c0 dissect_ssl enter frame #324 (first time) conversation = 0x7f26869465c0, ssl_session = 0x7f265a95a870 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | 44 a2 fb 7a 0e d8 02 6b 2b 51 65 ea 16 d3 ec 14 |D..z...k+Qe.....| | c5 23 a7 1d d2 22 15 bc 4e a3 9f 19 7b 69 3f 2a |.#..."..N...{i?*| | cf b7 86 57 ed 7c af 31 35 42 2d 5e 70 35 4d 9f |...W.|.15B-^p5M.| | 16 53 22 cb fa 47 49 18 1a 58 e7 a4 a5 b7 00 ac |.S"..GI..X......| | c5 05 ca 1a 49 46 19 e3 90 37 b6 8d 16 d7 3f 7d |....IF...7....?}| | fc 1d c1 f5 5c 0c a8 84 81 2e fd 3f fc 6f 15 49 |....\......?.o.I| | 84 6a 85 7d a0 d9 69 ec a0 a4 15 36 79 96 2d 08 |.j.}..i....6y.-.| | 16 0c d1 97 3c 50 d8 89 2a c4 11 14 17 a3 a3 40 |....Q&.....Y.c1...| | dd 33 e8 54 22 f5 f5 50 1c 1a 96 3d 66 27 d2 10 |.3.T"..P...=f'..| | 5b d6 d3 2a f4 37 b8 a6 f4 e7 8b 87 65 5c 58 4a |[..*.7......e\XJ| | a8 97 77 de 54 bb e1 42 62 cc 48 4b 69 98 e9 c1 |..w.T..Bb.HKi...| Plaintext[384]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:21 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 38 34 20 2d 20 43 41 4d 45 4c |x00,0x84 - CAMEL| | 4c 49 41 32 35 36 2d 53 48 41 20 20 20 20 20 20 |LIA256-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 43 61 6d 65 6c 6c 69 61 28 32 35 36 29 20 4d |=Camellia(256) M| | 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1| | 76 76 f9 0f 2a 8f a6 00 c0 c1 6f 74 94 64 4a de |vv..*.....ot.dJ.| | 9c 6d 6c 26 00 00 00 00 00 00 00 00 00 00 00 0b |.ml&............| ssl_decrypt_record found padding 11 final len 372 checking mac (len 352, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 352, seq = 0, nxtseq = 352 association_find: TCP port 4463 found 0x33562c0 dissect_ssl3_record decrypted len 352 decrypted app data fragment[352]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:21 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 38 34 20 2d 20 43 41 4d 45 4c |x00,0x84 - CAMEL| | 4c 49 41 32 35 36 2d 53 48 41 20 20 20 20 20 20 |LIA256-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 43 61 6d 65 6c 6c 69 61 28 32 35 36 29 20 4d |=Camellia(256) M| | 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1| dissect_ssl3_record found association 0x33562c0 dissect_ssl enter frame #325 (first time) conversation = 0x7f26869465c0, ssl_session = 0x7f265a95a870 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | d0 c6 65 92 99 12 9a d2 ae cf 68 de 7a 37 84 5d |..e.......h.z7.]| | ae be 5e 9e 60 b9 5f 16 c8 6c 9f 51 8e 00 b1 c7 |..^.`._..l.Q....| Plaintext[32]: | 01 00 ff 84 89 d3 26 30 e0 a4 cf 91 19 e3 f0 8b |......&0........| | 99 de 09 aa ff 03 00 00 00 00 00 00 00 00 00 09 |................| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #327 (first time) conversation = 0x7f26869465c0, ssl_session = 0x7f265a95a870 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | ae 60 16 c0 e8 8c 61 9a 3f 1d 0a 16 8b 6a 4a f1 |.`....a.?....jJ.| | 05 b0 19 b8 67 43 e8 c9 ae 18 d3 70 a3 b6 9b be |....gC.....p....| Plaintext[32]: | 01 00 99 b0 f8 5f ea a4 e2 31 ab 59 5d 43 02 a3 |....._...1.Y]C..| | 83 f8 f2 90 5e 9a 00 00 00 00 00 00 00 00 00 09 |....^...........| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 3) ssl_decrypt_record: mac ok dissect_ssl enter frame #332 (first time) ssl_session_init: initializing ptr 0x7f265a95d0a0 size 688 conversation = 0x7f2686946918, ssl_session = 0x7f265a95d0a0 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 45966 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4464 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #334 (first time) conversation = 0x7f2686946918, ssl_session = 0x7f265a95d0a0 record: offset = 0, reported_length_remaining = 1155 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0x0087 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 1069 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 735, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 731 bytes, remaining 826 record: offset = 826, reported_length_remaining = 329 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 315, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 831 length 311 bytes, remaining 1146 record: offset = 1146, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1151 length 0 bytes, remaining 1155 dissect_ssl enter frame #336 (first time) conversation = 0x7f2686946918, ssl_session = 0x7f265a95d0a0 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d... looking for RSA pre-master00809f76b66ed3ebe0b5f825182ea59988fed580b483d955... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 ssl3_prf: sha1_hash(6) ssl3_prf: md5_hash(6) datalen 48 ssl3_prf: sha1_hash(7) ssl3_prf: md5_hash(7) datalen 48 ssl3_prf: sha1_hash(8) ssl3_prf: md5_hash(8) datalen 48 ssl3_prf: sha1_hash(9) ssl3_prf: md5_hash(9) datalen 48 key expansion[136]: | dd b5 c7 cf 52 be ea 77 63 d4 ea ef 6f f7 76 1d |....R..wc...o.v.| | 04 55 06 7b e8 51 5b b0 de 10 1d fe 51 84 3c c7 |.U.{.Q[.....Q.<.| | 91 48 8a ec 7e 53 30 48 9d 1b 83 4b d1 59 f9 76 |.H..~S0H...K.Y.v| | 1d 31 a2 37 81 38 cf dd f0 95 cb 3f 21 80 6c de |.1.7.8.....?!.l.| | 63 9c 0b 3c 0b f1 6e bd 98 96 1e 41 e0 6a 2a 8b |c..<..n....A.j*.| | da fc ee dc 42 6d a0 a8 e0 b8 2c c2 8e c6 f1 8e |....Bm....,.....| | 38 fd a6 b5 8e b8 83 4f 80 c2 42 1e 6b 19 86 2a |8......O..B.k..*| | 73 26 7e f7 db f1 ab 7e d7 1b 1a 01 3b fc 9e c1 |s&~....~....;...| | ae 8b cd f3 c3 ae 82 a8 |........ | Client MAC key[20]: | dd b5 c7 cf 52 be ea 77 63 d4 ea ef 6f f7 76 1d |....R..wc...o.v.| | 04 55 06 7b |.U.{ | Server MAC key[20]: | e8 51 5b b0 de 10 1d fe 51 84 3c c7 91 48 8a ec |.Q[.....Q.<..H..| | 7e 53 30 48 |~S0H | Client Write key[32]: | 9d 1b 83 4b d1 59 f9 76 1d 31 a2 37 81 38 cf dd |...K.Y.v.1.7.8..| | f0 95 cb 3f 21 80 6c de 63 9c 0b 3c 0b f1 6e bd |...?!.l.c..<..n.| Server Write key[32]: | 98 96 1e 41 e0 6a 2a 8b da fc ee dc 42 6d a0 a8 |...A.j*.....Bm..| | e0 b8 2c c2 8e c6 f1 8e 38 fd a6 b5 8e b8 83 4f |..,.....8......O| Client Write IV[16]: | 80 c2 42 1e 6b 19 86 2a 73 26 7e f7 db f1 ab 7e |..B.k..*s&~....~| Server Write IV[16]: | d7 1b 1a 01 3b fc 9e c1 ae 8b cd f3 c3 ae 82 a8 |....;...........| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: CAMELLIA256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: CAMELLIA256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | 15 c3 09 9d 21 38 e5 80 b6 06 0c 20 36 d8 84 72 |....!8..... 6..r| | d6 70 b4 ec 67 9f ba 45 39 1c 83 1b 4f ce 49 ec |.p..g..E9...O.I.| ssl_save_session stored master secret[48]: | b6 a7 ac 05 2e 39 e4 62 5d 52 85 c8 62 c0 4a 31 |.....9.b]R..b.J1| | 98 50 4c 0b 45 ea c7 12 3b fe a2 25 f9 22 50 e8 |.PL.E...;..%."P.| | 8a 5a 8d 97 cd 9d c0 7e 80 db 2d 2f 8b ce 35 55 |.Z.....~..-/..5U| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | d5 77 ec ae 91 55 3c 7b 94 50 4d b1 9a 35 5f c8 |.w...U<{.PM..5_.| | 3b 78 8f 25 58 d6 92 b4 1f 91 e2 6b 18 34 2f 9f |;x.%X......k.4/.| | 1a b7 ce 49 93 0d 0d bf e6 3c 81 e8 08 37 29 78 |...I.....<...7)x| | d3 b9 e6 5f 43 ca 76 02 a5 9d af ed e1 83 ca df |..._C.v.........| Plaintext[64]: | 14 00 00 24 4d f0 59 84 6f f7 26 00 5a a4 1f 7f |...$M.Y.o.&.Z...| | 3b 48 86 37 44 8b 6e f0 2d a5 a4 76 fb 86 9b f9 |;H.7D.n.-..v....| | 85 ef ec 1e 98 2e 1c ad 60 c7 54 3e 5c 72 3d 8b |........`.T>\r=.| | 36 c3 83 b7 7e 0f a8 ff 96 e3 5a 49 00 00 00 03 |6...~.....ZI....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #337 (first time) conversation = 0x7f2686946918, ssl_session = 0x7f265a95d0a0 record: offset = 0, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | fe c7 29 46 75 dd 0a 06 8c e4 60 ee bf 9b 1a c0 |..)Fu.....`.....| | 68 c0 15 fd 00 1f 4b 13 04 b9 09 a2 21 39 5a 55 |h.....K.....!9ZU| | 34 5a a8 7a c9 15 2e 8b d0 23 b7 b2 c8 f5 3b ed |4Z.z.....#....;.| | af 76 51 83 d1 d7 73 9f d1 b4 62 c6 54 a4 f2 54 |.vQ...s...b.T..T| Plaintext[64]: | 14 00 00 24 c4 cd 3a ea fe 93 ea 0f 58 46 9e b6 |...$..:.....XF..| | 15 55 ec a5 4b c0 a3 e8 b0 8d 0d 51 29 4f 1c 10 |.U..K......Q)O..| | f7 6c c7 71 85 a9 3a bc a7 32 f2 0b 3e 69 e4 58 |.l.q..:..2..>i.X| | 1f a6 85 10 a8 17 bf a8 4b 76 77 02 00 00 00 03 |........Kvw.....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #338 (first time) conversation = 0x7f2686946918, ssl_session = 0x7f265a95d0a0 record: offset = 0, reported_length_remaining = 154 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 8a c7 aa a2 41 cf f2 b9 7a 45 c8 2b f4 8c 6e 41 |....A...zE.+..nA| | 20 74 dc 68 18 75 e4 fd a1 0a e7 d9 aa b7 7a 21 | t.h.u........z!| Plaintext[32]: | 46 8e ec ac f6 8e 5a 58 38 09 a5 8c e5 b4 e2 71 |F.....ZX8......q| | 73 79 d8 e3 00 00 00 00 00 00 00 00 00 00 00 0b |sy..............| ssl_decrypt_record found padding 11 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 45966 found (nil) association_find: TCP port 4464 found 0x33faac0 record: offset = 37, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | 8d fb cb 8c 85 da 94 7e 1c a6 67 68 95 22 aa f8 |.......~..gh."..| | 28 2f 83 b2 72 9a ba d3 61 ef 5c 28 d4 8f 5e c2 |(/..r...a.\(..^.| | e9 87 a9 9c c7 97 fc 9f 19 3f 46 f2 98 08 83 2d |.........?F....-| | 85 03 48 86 1f b0 47 75 aa c4 ca 68 8e e2 7c 12 |..H...Gu...h..|.| | 67 01 7f 49 cd 09 f8 52 ef 84 2e ec e5 ee 98 85 |g..I...R........| | ea 51 8f 09 2c 61 12 b8 1d aa 9b 00 84 5c 37 26 |.Q..,a.......\7&| | 09 a1 91 2b 27 9c eb 1f ce 1e 50 fd 7f 73 04 37 |...+'.....P..s.7| Plaintext[112]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 63 61 |Host: dhe-dss-ca| | 6d 65 6c 6c 69 61 32 35 36 2d 73 68 61 2e 6c 6f |mellia256-sha.lo| | 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey| | 6e 2e 6e 6c 3a 34 34 36 34 0d 0a 0d 0a 6f 4e 67 |n.nl:4464....oNg| | c0 7f 6f 3d 69 f5 24 1d d0 0b 7f 6a f9 56 d6 a9 |..o=i.$....j.V..| | f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0e |................| ssl_decrypt_record found padding 14 final len 97 checking mac (len 77, version 300, ct 23 seq 2) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 77, seq = 0, nxtseq = 77 association_find: TCP port 45966 found (nil) association_find: TCP port 4464 found 0x33faac0 dissect_ssl3_record decrypted len 77 decrypted app data fragment[77]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 63 61 |Host: dhe-dss-ca| | 6d 65 6c 6c 69 61 32 35 36 2d 73 68 61 2e 6c 6f |mellia256-sha.lo| | 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey| | 6e 2e 6e 6c 3a 34 34 36 34 0d 0a 0d 0a |n.nl:4464.... | dissect_ssl3_record found association 0x33faac0 dissect_ssl enter frame #339 (first time) conversation = 0x7f2686946918, ssl_session = 0x7f265a95d0a0 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | de 24 94 be fd e1 ac 9d 66 9e 37 bd 67 0f f9 4f |.$......f.7.g..O| | e4 0e 20 eb 7a 24 4c 5f 09 67 6b ca c8 d3 76 c4 |.. .z$L_.gk...v.| | d3 2d be 0b a3 5e 5d 62 e9 ed 36 d0 10 f2 5c 7b |.-...^]b..6...\{| | d7 f3 ff e2 d8 62 9d 00 8f 97 db d0 cf 5f e2 8f |.....b......._..| | 1f d3 18 e9 d6 ab 41 08 45 02 f0 92 b6 39 d3 3a |......A.E....9.:| | ac 24 7f fa 9a 10 18 2e a7 eb 89 b0 00 2e 23 3c |.$............#<| | ed 95 d5 40 8d e5 4e 38 e1 2a df 0c 2b ca 53 f9 |...@..N8.*..+.S.| | 90 14 bb e3 af 0b e5 8e 3f a9 8c db 89 56 3e ec |........?....V>.| | 9a 4b 69 b3 e2 ed c9 12 87 b9 9d 47 30 30 b3 be |.Ki........G00..| | e2 9e 6a 36 30 b9 e4 21 85 80 fc 7c 5b ea 7c d5 |..j60..!...|[.|.| | a2 21 22 77 84 6d c1 9a c9 58 d9 7d 6c 49 cb aa |.!"w.m...X.}lI..| | 95 d6 b7 e0 ed 6d ce d3 cc 02 d0 dd d4 d9 91 42 |.....m.........B| | d2 38 ee e9 1c 89 8b c4 04 f3 0e 15 57 15 c5 05 |.8..........W...| | 7b 82 ff da 94 d2 5a 31 98 fa c8 c9 7e ff 20 1c |{.....Z1....~. .| | fe 93 3d 96 1b fa 85 4f a5 60 40 63 8d a5 b7 a2 |..=....O.`@c....| | 1e d7 f2 55 87 c9 84 71 c9 5d 74 84 7b b1 b4 02 |...U...q.]t.{...| | 6b bc 06 59 11 24 4e ff c7 b3 67 69 cf a0 8b 15 |k..Y.$N...gi....| | 67 00 b9 23 d0 54 7f 12 4d 07 15 8a e9 d4 c8 c3 |g..#.T..M.......| | ed 37 3c f2 00 cf 0f 96 cd f3 46 43 34 04 ac eb |.7<.......FC4...| | 16 a0 85 58 8b 6f bf bd 74 a4 00 86 85 81 26 ca |...X.o..t.....&.| | cb e9 ca a9 00 95 02 30 ee c5 3b 1b a2 01 ec 2e |.......0..;.....| | 1f 16 d2 ee 56 bd b0 aa fc 5c f6 08 33 23 8e cf |....V....\..3#..| | 9d ba 9b c5 bf 5f 6a d6 11 c0 57 1d cd 2a 69 d1 |....._j...W..*i.| | 91 79 75 8d 4f ef 85 22 03 45 6a ed 1f 7f 21 f1 |.yu.O..".Ej...!.| Plaintext[384]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:21 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 38 37 20 2d 20 44 48 45 2d 44 |x00,0x87 - DHE-D| | 53 53 2d 43 41 4d 45 4c 4c 49 41 32 35 36 2d 53 |SS-CAMELLIA256-S| | 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc| | 3d 43 61 6d 65 6c 6c 69 61 28 32 35 36 29 20 4d |=Camellia(256) M| | 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1| | 66 1e ed 1d d6 ba ad 53 0c 48 9b 68 cf 59 71 bb |f......S.H.h.Yq.| | c1 cb 5a 39 00 00 00 00 00 00 00 00 00 00 00 0b |..Z9............| ssl_decrypt_record found padding 11 final len 372 checking mac (len 352, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 352, seq = 0, nxtseq = 352 association_find: TCP port 4464 found 0x33faac0 dissect_ssl3_record decrypted len 352 decrypted app data fragment[352]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:21 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 38 37 20 2d 20 44 48 45 2d 44 |x00,0x87 - DHE-D| | 53 53 2d 43 41 4d 45 4c 4c 49 41 32 35 36 2d 53 |SS-CAMELLIA256-S| | 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc| | 3d 43 61 6d 65 6c 6c 69 61 28 32 35 36 29 20 4d |=Camellia(256) M| | 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1| dissect_ssl3_record found association 0x33faac0 dissect_ssl enter frame #340 (first time) conversation = 0x7f2686946918, ssl_session = 0x7f265a95d0a0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 4d 82 89 a1 01 5d b7 aa e9 8a f1 d0 1b cd 4a 50 |M....]........JP| | 23 48 99 e9 5a 22 1f 20 9d c3 71 2d 53 42 ac 5d |#H..Z". ..q-SB.]| Plaintext[32]: | 01 00 8d 89 fa 6b 27 57 56 73 1b f5 a1 34 8e a8 |.....k'WVs...4..| | e7 a1 48 5a 7c 31 00 00 00 00 00 00 00 00 00 09 |..HZ|1..........| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #342 (first time) conversation = 0x7f2686946918, ssl_session = 0x7f265a95d0a0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 2a e8 2d 47 41 17 86 dd 58 53 95 72 73 d3 3b 44 |*.-GA...XS.rs.;D| | 5a 2e d0 73 30 2f 6f 2c 93 5f df bf 5b cb 86 3a |Z..s0/o,._..[..:| Plaintext[32]: | 01 00 31 17 7e 4b a5 69 a3 21 bf 08 37 ca 45 60 |..1.~K.i.!..7.E`| | 40 59 49 ef 74 73 00 00 00 00 00 00 00 00 00 09 |@YI.ts..........| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 3) ssl_decrypt_record: mac ok dissect_ssl enter frame #347 (first time) ssl_session_init: initializing ptr 0x7f265a95f890 size 688 conversation = 0x7f2686946c78, ssl_session = 0x7f265a95f890 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 56308 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4465 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #349 (first time) conversation = 0x7f2686946c78, ssl_session = 0x7f265a95f890 record: offset = 0, reported_length_remaining = 1437 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0x0088 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 1351 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898 record: offset = 898, reported_length_remaining = 539 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 525, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 903 length 521 bytes, remaining 1428 record: offset = 1428, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1433 length 0 bytes, remaining 1437 dissect_ssl enter frame #351 (first time) conversation = 0x7f2686946c78, ssl_session = 0x7f265a95f890 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aa... looking for RSA pre-master0080270d0ced1717f69c19e90ca47cc62028d259c1550d4a... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 ssl3_prf: sha1_hash(6) ssl3_prf: md5_hash(6) datalen 48 ssl3_prf: sha1_hash(7) ssl3_prf: md5_hash(7) datalen 48 ssl3_prf: sha1_hash(8) ssl3_prf: md5_hash(8) datalen 48 ssl3_prf: sha1_hash(9) ssl3_prf: md5_hash(9) datalen 48 key expansion[136]: | 52 13 68 e3 5b d3 b4 08 7a 1b 54 79 c6 43 1f 72 |R.h.[...z.Ty.C.r| | 60 5d f1 82 13 f3 ef 8a 48 92 94 d6 04 ae b7 96 |`]......H.......| | 25 57 f9 90 fb 8d f5 4d c2 58 4c ba ef 04 d1 5b |%W.....M.XL....[| | 28 91 a4 9b 6e 6d 0b 91 48 32 cb 4b 71 8f 12 7d |(...nm..H2.Kq..}| | 29 7d dc ee 8d 6a d1 ce 6e 9a 6c 24 13 f1 a5 0e |)}...j..n.l$....| | 81 4c 3d 31 6a 3d 03 b2 c0 a6 ee fb a9 21 7b b8 |.L=1j=.......!{.| | a8 fe 1e e0 12 0a b0 27 37 eb 26 c4 6d a8 b5 d5 |.......'7.&.m...| | d1 90 44 7e 76 5b 99 79 53 89 c9 2e c2 6a 49 d8 |..D~v[.yS....jI.| | d2 04 4a cd 69 1f e1 e8 |..J.i... | Client MAC key[20]: | 52 13 68 e3 5b d3 b4 08 7a 1b 54 79 c6 43 1f 72 |R.h.[...z.Ty.C.r| | 60 5d f1 82 |`].. | Server MAC key[20]: | 13 f3 ef 8a 48 92 94 d6 04 ae b7 96 25 57 f9 90 |....H.......%W..| | fb 8d f5 4d |...M | Client Write key[32]: | c2 58 4c ba ef 04 d1 5b 28 91 a4 9b 6e 6d 0b 91 |.XL....[(...nm..| | 48 32 cb 4b 71 8f 12 7d 29 7d dc ee 8d 6a d1 ce |H2.Kq..})}...j..| Server Write key[32]: | 6e 9a 6c 24 13 f1 a5 0e 81 4c 3d 31 6a 3d 03 b2 |n.l$.....L=1j=..| | c0 a6 ee fb a9 21 7b b8 a8 fe 1e e0 12 0a b0 27 |.....!{........'| Client Write IV[16]: | 37 eb 26 c4 6d a8 b5 d5 d1 90 44 7e 76 5b 99 79 |7.&.m.....D~v[.y| Server Write IV[16]: | 53 89 c9 2e c2 6a 49 d8 d2 04 4a cd 69 1f e1 e8 |S....jI...J.i...| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: CAMELLIA256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: CAMELLIA256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | b3 78 f0 b7 00 db a8 70 89 a6 35 d5 13 13 2a 76 |.x.....p..5...*v| | 4b da 48 74 6c f7 7b dc 89 05 ca ca 57 72 a5 e9 |K.Htl.{.....Wr..| ssl_save_session stored master secret[48]: | 2e 24 d1 37 9d a1 c2 42 97 d5 dc e0 66 bb 80 71 |.$.7...B....f..q| | 59 66 d2 cf d9 33 8c 6e bb 48 60 4e e5 6f c6 65 |Yf...3.n.H`N.o.e| | 9d 43 34 f2 38 8f 24 a4 6c 88 54 d1 4d d1 48 50 |.C4.8.$.l.T.M.HP| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | a8 1b 41 24 3c 22 27 51 53 08 41 d4 17 82 bb 40 |..A$<"'QS.A....@| | 71 a9 56 84 4a e5 f2 87 cf 81 ac a5 d8 f3 03 42 |q.V.J..........B| | 60 a3 30 ec 65 dd 9e e3 22 42 70 8a 38 f2 1c 72 |`.0.e..."Bp.8..r| | ba 6c 62 4a 28 9f 6b 49 69 53 cf be bf 76 2d 6a |.lbJ(.kIiS...v-j| Plaintext[64]: | 14 00 00 24 8a da da 93 75 54 7e 61 31 db c6 3b |...$....uT~a1..;| | a6 15 a7 e4 41 d6 e0 d0 d9 e5 02 66 14 20 9e ff |....A......f. ..| | 01 22 6e 28 c7 aa 84 25 c6 7d 04 d8 9c e7 15 82 |."n(...%.}......| | 65 2e f4 a2 87 08 4d 4b 4e f0 31 5e 00 00 00 03 |e.....MKN.1^....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #352 (first time) conversation = 0x7f2686946c78, ssl_session = 0x7f265a95f890 record: offset = 0, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 6c 3a 30 9d b8 15 cb cb 19 26 ec b1 1b 54 bc f2 |l:0......&...T..| | da f8 47 bb 15 14 6a 89 87 17 12 6e 58 ee 13 6c |..G...j....nX..l| | ed 0f 7d de c2 78 52 4b fb 9c ce 00 ec 6d 50 f4 |..}..xRK.....mP.| | 6d c4 e4 50 93 fb 7c 16 f6 ed da 89 73 07 d5 e1 |m..P..|.....s...| Plaintext[64]: | 14 00 00 24 43 f6 31 e2 66 d1 80 f6 29 2d e4 de |...$C.1.f...)-..| | a1 cc f0 43 c5 39 f8 a9 81 ad e1 22 38 f7 cf a2 |...C.9....."8...| | f2 94 3a 0a cb f3 2e 85 a1 6c 0f 80 21 b3 de c6 |..:......l..!...| | 1a 31 b8 ed 8a d9 02 45 9c 92 53 73 00 00 00 03 |.1.....E..Ss....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #353 (first time) conversation = 0x7f2686946c78, ssl_session = 0x7f265a95f890 record: offset = 0, reported_length_remaining = 154 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 50 9d b8 7a 5e f5 6f ce 20 82 68 b8 83 6c 5d ef |P..z^.o. .h..l].| | 35 1d 88 0f 60 16 40 75 9e ca 96 18 34 85 b9 d3 |5...`.@u....4...| Plaintext[32]: | ac 9a 3c 85 65 f1 16 ed 2c 14 af bf 9d 07 4c b0 |..<.e...,.....L.| | 72 ab 5f cc 00 00 00 00 00 00 00 00 00 00 00 0b |r._.............| ssl_decrypt_record found padding 11 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 56308 found (nil) association_find: TCP port 4465 found 0x33fab50 record: offset = 37, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | 6c 8c fb 6f 9d 7b 28 aa d8 15 d7 e0 05 15 49 09 |l..o.{(.......I.| | 4d 49 1b 97 0c 17 1e b3 72 03 e2 62 55 3b 3a a6 |MI......r..bU;:.| | 0f 7d f0 26 98 ee c2 cb e7 9b ce 03 4c 7f 40 ad |.}.&........L.@.| | 17 de 94 20 e6 41 f8 cf 59 01 c0 da 7c 8f cc 2f |... .A..Y...|../| | b7 58 ae bb 23 c8 ff 19 99 f1 9a c9 30 1b 44 b4 |.X..#.......0.D.| | ff e4 84 08 67 13 7b 9c d7 eb 46 99 d3 5c 4f 59 |....g.{...F..\OY| | b0 57 b9 78 9e dc f9 df cd 0e 8e a9 a0 4e e1 2b |.W.x.........N.+| Plaintext[112]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 63 61 |Host: dhe-rsa-ca| | 6d 65 6c 6c 69 61 32 35 36 2d 73 68 61 2e 6c 6f |mellia256-sha.lo| | 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey| | 6e 2e 6e 6c 3a 34 34 36 35 0d 0a 0d 0a 45 b0 2f |n.nl:4465....E./| | 05 54 98 f4 77 34 d0 04 cf db 5d 3d 6c e9 c0 e3 |.T..w4....]=l...| | ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0e |................| ssl_decrypt_record found padding 14 final len 97 checking mac (len 77, version 300, ct 23 seq 2) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 77, seq = 0, nxtseq = 77 association_find: TCP port 56308 found (nil) association_find: TCP port 4465 found 0x33fab50 dissect_ssl3_record decrypted len 77 decrypted app data fragment[77]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 63 61 |Host: dhe-rsa-ca| | 6d 65 6c 6c 69 61 32 35 36 2d 73 68 61 2e 6c 6f |mellia256-sha.lo| | 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey| | 6e 2e 6e 6c 3a 34 34 36 35 0d 0a 0d 0a |n.nl:4465.... | dissect_ssl3_record found association 0x33fab50 dissect_ssl enter frame #354 (first time) conversation = 0x7f2686946c78, ssl_session = 0x7f265a95f890 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | 96 83 d2 6a a6 af ad 15 00 65 15 34 79 b0 2c 88 |...j.....e.4y.,.| | 6c 80 7a 93 30 22 f7 e0 42 c9 6a 09 5d 4d 5b 22 |l.z.0"..B.j.]M["| | dd e8 59 bd f1 48 65 41 e9 0f 49 e6 12 f6 da 9c |..Y..HeA..I.....| | b6 36 c8 db 95 48 42 be 9b 98 c3 ba a6 d8 93 b3 |.6...HB.........| | 30 8d 51 e1 bb 79 41 6f 82 d4 2b f0 94 90 71 b6 |0.Q..yAo..+...q.| | be 15 a8 51 17 83 08 12 99 39 57 e2 07 08 4d 4d |...Q.....9W...MM| | 37 f2 2c cf fe 40 be a8 36 04 e7 5a cc e2 0f a4 |7.,..@..6..Z....| | 29 2a 61 72 0e f4 72 00 41 68 48 26 59 c0 3f ef |)*ar..r.AhH&Y.?.| | 6e 26 62 9c 60 2f 7b 17 a5 51 70 29 7d 4b 2f d0 |n&b.`/{..Qp)}K/.| | e0 68 d9 8e e1 34 08 01 d0 30 8d 16 9f 33 10 5d |.h...4...0...3.]| | 17 f1 93 b5 bd df a5 eb 6f 06 19 b0 ba 2b ac bc |........o....+..| | e6 c2 23 ca 35 5c a1 99 b4 67 8b 86 57 d8 17 cf |..#.5\...g..W...| | f9 cd 77 0b 3a a4 bb 9f b6 11 f8 b0 74 29 02 8c |..w.:.......t)..| | 76 ab 29 c5 2a 8e ef 9f 55 aa f1 e6 54 1d 30 68 |v.).*...U...T.0h| | 5d da 85 3d 93 f5 a0 4b bd 15 19 7e e4 f0 be 4f |]..=...K...~...O| | 7d ed ec d4 c7 2a 16 2a a5 ec b1 28 df e0 60 37 |}....*.*...(..`7| | 43 3a 74 85 f6 1f f6 05 1a b4 d2 61 a7 2c e5 c5 |C:t........a.,..| | 8d a7 29 f8 51 30 5d f4 67 23 b5 53 73 f4 01 29 |..).Q0].g#.Ss..)| | 43 30 c6 63 5c ef 38 21 4a 93 85 9d 4d 04 46 5d |C0.c\.8!J...M.F]| | 08 99 95 99 0d 94 21 33 4c 9a c8 15 19 04 48 53 |......!3L.....HS| | fa a5 33 bf 5f 36 dd de 24 df a6 55 63 67 a9 cd |..3._6..$..Ucg..| | 50 98 52 0c 5a 6b a7 4c f6 44 22 cf 46 d9 be 2c |P.R.Zk.L.D".F..,| | 38 80 17 a6 b4 b7 38 b2 94 53 4d e6 31 23 db bb |8.....8..SM.1#..| | 20 e7 de c2 46 6d 10 f1 dd c3 68 72 49 4d 0a 32 | ...Fm....hrIM.2| Plaintext[384]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:21 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 38 38 20 2d 20 44 48 45 2d 52 |x00,0x88 - DHE-R| | 53 41 2d 43 41 4d 45 4c 4c 49 41 32 35 36 2d 53 |SA-CAMELLIA256-S| | 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 43 61 6d 65 6c 6c 69 61 28 32 35 36 29 20 4d |=Camellia(256) M| | 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1| | 5c 4b a9 dd 8d a4 e3 0e 11 33 a0 1e 92 e5 6b 21 |\K.......3....k!| | ac d0 bb 8e 00 00 00 00 00 00 00 00 00 00 00 0b |................| ssl_decrypt_record found padding 11 final len 372 checking mac (len 352, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 352, seq = 0, nxtseq = 352 association_find: TCP port 4465 found 0x33fab50 dissect_ssl3_record decrypted len 352 decrypted app data fragment[352]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:21 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 38 38 20 2d 20 44 48 45 2d 52 |x00,0x88 - DHE-R| | 53 41 2d 43 41 4d 45 4c 4c 49 41 32 35 36 2d 53 |SA-CAMELLIA256-S| | 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 43 61 6d 65 6c 6c 69 61 28 32 35 36 29 20 4d |=Camellia(256) M| | 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1| dissect_ssl3_record found association 0x33fab50 dissect_ssl enter frame #355 (first time) conversation = 0x7f2686946c78, ssl_session = 0x7f265a95f890 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | e5 a8 37 71 ec 7b d3 cb 90 4c f3 af 41 59 5b 9c |..7q.{...L..AY[.| | 74 b3 26 d0 35 8c 31 57 30 91 9a 25 80 0c b2 a1 |t.&.5.1W0..%....| Plaintext[32]: | 01 00 16 f4 b2 d4 a1 f5 3b 8b 50 de 99 38 15 b7 |........;.P..8..| | 3a 4f dc 11 60 da 00 00 00 00 00 00 00 00 00 09 |:O..`...........| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #357 (first time) conversation = 0x7f2686946c78, ssl_session = 0x7f265a95f890 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | d5 0e 93 2d d5 82 99 a1 19 2b 5d 49 b0 36 c8 19 |...-.....+]I.6..| | e0 ab 77 6e ce 8a 9e bb 26 bf 17 69 56 4f 3b bf |..wn....&..iVO;.| Plaintext[32]: | 01 00 f1 55 a0 28 eb 5e 55 0e b9 75 47 62 33 87 |...U.(.^U..uGb3.| | 24 35 f5 61 50 44 00 00 00 00 00 00 00 00 00 09 |$5.aPD..........| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 3) ssl_decrypt_record: mac ok dissect_ssl enter frame #362 (first time) ssl_session_init: initializing ptr 0x7f265a962080 size 688 conversation = 0x7f2686946fd8, ssl_session = 0x7f265a962080 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 46652 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4470 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #364 (first time) conversation = 0x7f2686946fd8, ssl_session = 0x7f265a962080 record: offset = 0, reported_length_remaining = 907 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0x0096 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 821 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898 record: offset = 898, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 903 length 0 bytes, remaining 907 dissect_ssl enter frame #366 (first time) conversation = 0x7f2686946fd8, ssl_session = 0x7f265a962080 record: offset = 0, reported_length_remaining = 340 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 260, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 256 bytes, remaining 265 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e74764... looking for RSA pre-mastera3b81f035d1a021f9c64064c1aa318f73236099700f9e432... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 ssl3_prf: sha1_hash(6) ssl3_prf: md5_hash(6) datalen 48 ssl3_prf: sha1_hash(7) ssl3_prf: md5_hash(7) datalen 48 key expansion[104]: | 77 2a d9 e2 67 d9 ae 26 20 fd 04 20 a7 5d ba de |w*..g..& .. .]..| | 62 53 76 3a 49 e6 c2 8b dd 0a 71 96 d3 27 8e 75 |bSv:I.....q..'.u| | f8 6b 8f cb e5 50 51 4b fa 00 8e cc bc 12 8f f2 |.k...PQK........| | 5a 22 1d bc 4e b0 20 4c 37 ca a8 b2 f3 82 0b 01 |Z"..N. L7.......| | be e8 2f 8b 19 99 b6 dd 99 ed 8e e2 99 7e a3 f7 |../..........~..| | 45 10 18 1d 18 67 8e 3a 68 bf bf 72 8c 8a 35 12 |E....g.:h..r..5.| | 81 5d 93 81 0d 45 1f 27 |.]...E.' | Client MAC key[20]: | 77 2a d9 e2 67 d9 ae 26 20 fd 04 20 a7 5d ba de |w*..g..& .. .]..| | 62 53 76 3a |bSv: | Server MAC key[20]: | 49 e6 c2 8b dd 0a 71 96 d3 27 8e 75 f8 6b 8f cb |I.....q..'.u.k..| | e5 50 51 4b |.PQK | Client Write key[16]: | fa 00 8e cc bc 12 8f f2 5a 22 1d bc 4e b0 20 4c |........Z"..N. L| Server Write key[16]: | 37 ca a8 b2 f3 82 0b 01 be e8 2f 8b 19 99 b6 dd |7........./.....| Client Write IV[16]: | 99 ed 8e e2 99 7e a3 f7 45 10 18 1d 18 67 8e 3a |.....~..E....g.:| Server Write IV[16]: | 68 bf bf 72 8c 8a 35 12 81 5d 93 81 0d 45 1f 27 |h..r..5..]...E.'| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: SEED decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: SEED decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | 8b c8 fa dd 2c 31 88 b1 86 d5 af 4a 5a 43 b8 bd |....,1.....JZC..| | 60 26 36 a5 1d 0e 82 21 ab c0 ae 0c 71 fa 1b 4d |`&6....!....q..M| ssl_save_session stored master secret[48]: | 81 0d 99 70 d5 5a bb 4d 34 d2 7a bc 38 a0 f2 d9 |...p.Z.M4.z.8...| | 4b b3 2b 4a 3b ca 51 2e 36 44 0d 2c 9d e9 4f 60 |K.+J;.Q.6D.,..O`| | a7 75 39 ad ca a7 79 81 c7 e4 5a 64 a4 4d 35 bf |.u9...y...Zd.M5.| dissect_ssl3_handshake session keys successfully generated record: offset = 265, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 271, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 29 10 5c b3 89 20 b5 b7 e9 5a 33 a1 53 4a 66 6b |).\.. ...Z3.SJfk| | 8c 5b db f9 ca ca f1 53 e0 e9 35 ee 96 a2 77 b1 |.[.....S..5...w.| | 96 6f 93 bf 16 3c f3 fc 18 b7 8a a3 42 11 3f 15 |.o...<......B.?.| | 3e 1d 10 80 75 46 08 51 c1 dd 0a 18 33 a7 0f 2e |>...uF.Q....3...| Plaintext[64]: | 14 00 00 24 23 c3 03 9d 17 12 a0 b2 9f cc 90 a0 |...$#...........| | b2 1d 89 64 54 7e b4 4a 3f 34 e9 3d 7f fb 86 cd |...dT~.J?4.=....| | 40 80 1b 9b b7 68 26 68 f7 2e be 73 13 1b 49 2a |@....h&h...s..I*| | 78 5b d9 70 91 82 34 1c 6e ae 84 87 00 00 00 03 |x[.p..4.n.......| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #367 (first time) conversation = 0x7f2686946fd8, ssl_session = 0x7f265a962080 record: offset = 0, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | bd a2 07 ba e6 25 27 38 0c 2b 0b e4 54 a6 23 72 |.....%'8.+..T.#r| | 1f b9 0b 60 22 ec 30 44 bf 01 fb f3 3e 2d 3d fb |...`".0D....>-=.| | 5a 0d 7d dc 45 6a d9 eb 0a 0f 9d 07 ff 7f ef dc |Z.}.Ej..........| | af 25 a9 e5 32 82 f0 26 cc 2b 2b 58 07 9c 68 58 |.%..2..&.++X..hX| Plaintext[64]: | 14 00 00 24 70 e8 83 47 03 d5 8f 4b d5 96 ce aa |...$p..G...K....| | 90 56 70 7d 50 ed 77 24 62 2f 08 47 61 ae 0e 8c |.Vp}P.w$b/.Ga...| | 59 be fb b8 d6 56 a6 24 8a 16 74 4f 33 8b 2d 1a |Y....V.$..tO3.-.| | 7f ff 16 77 9b 42 cf 01 1f f9 1c 0b 00 00 00 03 |...w.B..........| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #368 (first time) conversation = 0x7f2686946fd8, ssl_session = 0x7f265a962080 record: offset = 0, reported_length_remaining = 138 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | d9 97 b1 ce cc 73 6e 4d 8e 2a 97 39 ab 55 ea c3 |.....snM.*.9.U..| | 3a 89 93 02 d6 6e 7b 92 b7 b0 63 fc 54 b5 46 45 |:....n{...c.T.FE| Plaintext[32]: | 3f 1b 73 6f 37 41 d4 3f 96 19 4f 3f 19 d7 80 bc |?.so7A.?..O?....| | 1f 0e 01 ab 00 00 00 00 00 00 00 00 00 00 00 0b |................| ssl_decrypt_record found padding 11 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 46652 found (nil) association_find: TCP port 4470 found 0x33fae20 record: offset = 37, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 96, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 96 Ciphertext[96]: | ee 33 c6 8c 8f f4 b0 9a 18 a9 ca c2 a9 83 70 5a |.3............pZ| | 40 0a db 0b 80 08 f2 47 e4 48 15 54 15 c8 cb a7 |@......G.H.T....| | bd 71 5d 05 d7 99 6e f0 fa e8 ae 07 8f 4c a7 9e |.q]...n......L..| | 44 93 7e 66 db 2e ec 8a 2a a5 db c6 89 d5 72 fd |D.~f....*.....r.| | c8 ab dc 64 52 01 5d e7 d2 51 cb bd 95 6f 84 e6 |...dR.]..Q...o..| | 13 07 c7 c5 4b 3d c0 53 3a 7f 87 24 3d 41 39 4a |....K=.S:..$=A9J| Plaintext[96]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 73 65 65 64 2d 73 68 61 2e 6c |Host: seed-sha.l| | 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 |ocal.al.lekenste| | 79 6e 2e 6e 6c 3a 34 34 37 30 0d 0a 0d 0a be 64 |yn.nl:4470.....d| | 86 6e 8b dc 51 73 26 d0 f2 3f 3b 83 13 a6 5b 1e |.n..Qs&..?;...[.| | 12 f9 00 00 00 00 00 00 00 00 00 00 00 00 00 0d |................| ssl_decrypt_record found padding 13 final len 82 checking mac (len 62, version 300, ct 23 seq 2) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 62, seq = 0, nxtseq = 62 association_find: TCP port 46652 found (nil) association_find: TCP port 4470 found 0x33fae20 dissect_ssl3_record decrypted len 62 decrypted app data fragment[62]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 73 65 65 64 2d 73 68 61 2e 6c |Host: seed-sha.l| | 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 |ocal.al.lekenste| | 79 6e 2e 6e 6c 3a 34 34 37 30 0d 0a 0d 0a |yn.nl:4470.... | dissect_ssl3_record found association 0x33fae20 dissect_ssl enter frame #369 (first time) conversation = 0x7f2686946fd8, ssl_session = 0x7f265a962080 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | 31 7e 99 82 29 51 6b 8f 0f 68 ae 2f b2 91 da f6 |1~..)Qk..h./....| | 27 4e 8a 53 71 7c d5 fb d1 41 05 5e 59 b2 47 1b |'N.Sq|...A.^Y.G.| | 73 d9 4c bb 1a a7 19 4e d2 d9 e5 01 af 3e 80 3b |s.L....N.....>.;| | be 01 ea 49 2f 1b ff b0 39 aa 6b fc d8 9c d5 13 |...I/...9.k.....| | 99 2d 85 8c fe cd b6 30 1c a0 a5 f9 10 bd 80 97 |.-.....0........| | 48 f2 b1 81 44 6f 40 8b b7 3c a4 21 de 1b d6 44 |H...Do@..<.!...D| | 08 14 f8 b0 e2 9c 1a a9 e8 8b 23 6a 5d c3 ce a9 |..........#j]...| | 39 48 a3 5c 0b 30 18 2f 10 6f f8 fe c4 d8 10 17 |9H.\.0./.o......| | 20 ea b6 83 d9 f9 77 3e e6 b2 09 b8 d9 49 83 44 | .....w>.....I.D| | 32 b5 45 7d 63 5b 96 f8 4a b9 88 50 ee aa 56 59 |2.E}c[..J..P..VY| | 30 67 1e 0a 4b 2e 67 ac 29 62 eb d2 f0 21 88 c3 |0g..K.g.)b...!..| | d9 17 ff 31 ac 03 ff 4e 5c 10 01 70 a8 38 1e a0 |...1...N\..p.8..| | 5a 23 7f fb 06 0f e7 a0 27 d0 9c a4 2b 90 df 6b |Z#......'...+..k| | cb 96 d6 ff 83 1e 7c 83 6e dd a6 87 c9 2f 2d 3f |......|.n..../-?| | 3d d1 14 49 a2 30 8d 7b 68 ed 4f d0 32 0f 4a b5 |=..I.0.{h.O.2.J.| | e9 f2 db a4 86 31 2c 11 8b 9d 27 55 f7 56 f6 14 |.....1,...'U.V..| | a5 89 ef e4 ab b4 c4 eb 9b 93 51 75 d5 1e a8 60 |..........Qu...`| | da 73 4e 37 10 b6 f6 2a 6a 40 c3 ee 90 f2 8d 69 |.sN7...*j@.....i| | ca 0c f2 c9 2d b9 8e df 97 a7 01 f0 06 3c 2b fa |....-........<+.| | 57 c7 88 81 63 45 5c 00 f1 b9 5d 19 9d ff 8b 03 |W...cE\...].....| | 81 31 36 8c 4d 7b f5 56 75 51 e4 8e f7 3a b9 51 |.16.M{.VuQ...:.Q| | d8 9a 8e f1 a7 63 c4 9a 8a 6e b1 46 4f 12 b6 95 |.....c...n.FO...| | c3 87 42 49 58 40 7a a2 6f e4 bd 9a 0b 9e 0a 7f |..BIX@z.o.......| | 36 2d 08 b7 e9 c0 52 c2 ef d6 08 01 e8 33 61 79 |6-....R......3ay| Plaintext[384]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:21 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 39 36 20 2d 20 53 45 45 44 2d |x00,0x96 - SEED-| | 53 48 41 20 20 20 20 20 20 20 20 20 20 20 20 20 |SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 53 45 45 44 28 31 32 38 29 20 4d 61 63 3d 53 |=SEED(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1...C| | 5e fd dc 46 92 da d3 7e 3b 07 04 cb e9 4b 4b 62 |^..F...~;....KKb| | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f |................| ssl_decrypt_record found padding 15 final len 368 checking mac (len 348, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348 association_find: TCP port 4470 found 0x33fae20 dissect_ssl3_record decrypted len 348 decrypted app data fragment[348]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:21 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 39 36 20 2d 20 53 45 45 44 2d |x00,0x96 - SEED-| | 53 48 41 20 20 20 20 20 20 20 20 20 20 20 20 20 |SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 53 45 45 44 28 31 32 38 29 20 4d 61 63 3d 53 |=SEED(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1 | dissect_ssl3_record found association 0x33fae20 dissect_ssl enter frame #370 (first time) conversation = 0x7f2686946fd8, ssl_session = 0x7f265a962080 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 33 3e 78 bf 46 ef 2a eb 23 79 d7 64 53 7d cb e2 |3>x.F.*.#y.dS}..| | 05 cc d6 e0 0d 4f 05 de f7 11 0c 0b 8d 80 b7 a1 |.....O..........| Plaintext[32]: | 01 00 29 97 23 f3 61 d6 63 76 2e 4d a2 73 fa 46 |..).#.a.cv.M.s.F| | b1 8a 26 b9 5a c0 00 00 00 00 00 00 00 00 00 09 |..&.Z...........| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #372 (first time) conversation = 0x7f2686946fd8, ssl_session = 0x7f265a962080 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | e3 67 c9 d9 df f0 53 fc 8a 55 c6 a9 05 40 16 9a |.g....S..U...@..| | 67 27 8b 14 64 99 c8 a2 d0 67 e7 08 c5 b5 cf 35 |g'..d....g.....5| Plaintext[32]: | 01 00 8a 08 b6 ca 2a 91 5a b0 44 76 0f 62 10 86 |......*.Z.Dv.b..| | f5 d9 85 98 f2 be 00 00 00 00 00 00 00 00 00 09 |................| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 3) ssl_decrypt_record: mac ok dissect_ssl enter frame #377 (first time) ssl_session_init: initializing ptr 0x7f265a9648d0 size 688 conversation = 0x7f2686947328, ssl_session = 0x7f265a9648d0 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 59945 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4471 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #379 (first time) conversation = 0x7f2686947328, ssl_session = 0x7f265a9648d0 record: offset = 0, reported_length_remaining = 1155 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0x0099 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 1069 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 735, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 731 bytes, remaining 826 record: offset = 826, reported_length_remaining = 329 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 315, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 831 length 311 bytes, remaining 1146 record: offset = 1146, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1151 length 0 bytes, remaining 1155 dissect_ssl enter frame #381 (first time) conversation = 0x7f2686947328, ssl_session = 0x7f265a9648d0 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822... looking for RSA pre-master008058019e6ee7bbd131f56d378653bab5bae6b0f32976c0... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971568edf373b61bc5ad23adced91be40231158d90cf25c26bd04b2bf8e5 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822a2f3d6e9c8c521a0 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02 found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 ssl3_prf: sha1_hash(6) ssl3_prf: md5_hash(6) datalen 48 ssl3_prf: sha1_hash(7) ssl3_prf: md5_hash(7) datalen 48 key expansion[104]: | a2 f3 41 b5 99 80 64 21 bc 41 19 e2 c8 cf 2c 0a |..A...d!.A....,.| | e6 5a 42 42 c4 72 d6 d3 a2 51 23 fd fb 95 82 8f |.ZBB.r...Q#.....| | 66 cc d5 88 c8 3b 52 88 4d 26 a8 5a c0 73 45 a0 |f....;R.M&.Z.sE.| | fd 5b 9b 48 ef f8 cb 6b b7 01 7d 7e 0b be 6f 7e |.[.H...k..}~..o~| | b4 60 2f 28 df 2c 5f 4b d3 56 75 82 0c 6d 24 a1 |.`/(.,_K.Vu..m$.| | e3 75 40 5d 33 76 a8 e1 a1 85 05 af 82 9f 54 e2 |.u@]3v........T.| | dd 33 e1 b6 92 c3 95 e4 |.3...... | Client MAC key[20]: | a2 f3 41 b5 99 80 64 21 bc 41 19 e2 c8 cf 2c 0a |..A...d!.A....,.| | e6 5a 42 42 |.ZBB | Server MAC key[20]: | c4 72 d6 d3 a2 51 23 fd fb 95 82 8f 66 cc d5 88 |.r...Q#.....f...| | c8 3b 52 88 |.;R. | Client Write key[16]: | 4d 26 a8 5a c0 73 45 a0 fd 5b 9b 48 ef f8 cb 6b |M&.Z.sE..[.H...k| Server Write key[16]: | b7 01 7d 7e 0b be 6f 7e b4 60 2f 28 df 2c 5f 4b |..}~..o~.`/(.,_K| Client Write IV[16]: | d3 56 75 82 0c 6d 24 a1 e3 75 40 5d 33 76 a8 e1 |.Vu..m$..u@]3v..| Server Write IV[16]: | a1 85 05 af 82 9f 54 e2 dd 33 e1 b6 92 c3 95 e4 |......T..3......| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: SEED decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: SEED decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | e8 42 b9 5d 1b a5 e4 ad 74 75 cf 8b 7d b2 42 5a |.B.]....tu..}.BZ| | 5a 99 1d 1e fe 2d f3 f1 fb 58 6a f1 dd 71 21 f1 |Z....-...Xj..q!.| ssl_save_session stored master secret[48]: | 37 93 4c dc b8 1b ac ff 4e 07 04 57 94 e0 97 51 |7.L.....N..W...Q| | 77 a0 ce 42 70 a1 c8 db fd 0d 38 02 91 82 55 5e |w..Bp.....8...U^| | bb 88 8a db de 71 8d a0 58 6c 3d bd 17 4e 0f 02 |.....q..Xl=..N..| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 82 8a 47 18 e6 58 5f 0a 4b fc 8a f5 6a cb a8 40 |..G..X_.K...j..@| | fd 9a 65 c7 f1 29 77 5c 07 5c 87 36 bb 5c 92 da |..e..)w\.\.6.\..| | 39 c2 8b bc c6 d2 41 cb cc e4 82 c0 9a 0b 1c 30 |9.....A........0| | e9 b4 78 96 f2 96 a7 70 d9 b5 b9 31 6c 7e 29 b4 |..x....p...1l~).| Plaintext[64]: | 14 00 00 24 30 10 e8 77 bb af d5 53 b7 7d f0 60 |...$0..w...S.}.`| | 3e 7b 26 85 c4 60 35 4a 2b 71 32 85 cb f3 9d 6f |>{&..`5J+q2....o| | 11 4c c6 7a 46 99 7f f5 5c 3a f8 b0 8d cc d1 f5 |.L.zF...\:......| | 14 81 ca aa 70 8c 0b f0 ca 32 0d 24 00 00 00 03 |....p....2.$....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #382 (first time) conversation = 0x7f2686947328, ssl_session = 0x7f265a9648d0 record: offset = 0, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | a4 1f 1b d5 55 1c c1 e5 e1 cc 14 c0 db 38 a9 ed |....U........8..| | df 21 86 31 8e 97 00 f8 a8 e8 16 a1 1f cb 02 eb |.!.1............| | d0 7c 83 fb 25 08 dd 6c 6d d9 b4 e1 56 b0 22 eb |.|..%..lm...V.".| | 03 a4 32 51 33 85 57 29 13 ff 31 97 28 92 f6 b8 |..2Q3.W)..1.(...| Plaintext[64]: | 14 00 00 24 47 6c b9 e8 28 61 6a e5 f6 c7 1e d9 |...$Gl..(aj.....| | 9b 8b ea e1 8a 31 a3 e9 26 44 59 49 25 55 ea 01 |.....1..&DYI%U..| | 31 74 cc 8a 66 92 1d 01 a5 2d e7 8a ef da 9d b9 |1t..f....-......| | 0a 50 51 ae ff be 54 fa 7e 88 1b 7b 00 00 00 03 |.PQ...T.~..{....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #383 (first time) conversation = 0x7f2686947328, ssl_session = 0x7f265a9648d0 record: offset = 0, reported_length_remaining = 138 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | c7 22 0d e4 0f c5 40 f2 29 42 c4 1b ea 3f 48 ff |."....@.)B...?H.| | b2 81 ac f7 4c 9b 11 74 c9 57 da 74 a3 6b f8 45 |....L..t.W.t.k.E| Plaintext[32]: | 58 e3 53 65 a8 41 2b fc 9d 63 fa 88 98 77 9d 70 |X.Se.A+..c...w.p| | 26 85 21 6d 00 00 00 00 00 00 00 00 00 00 00 0b |&.!m............| ssl_decrypt_record found padding 11 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 59945 found (nil) association_find: TCP port 4471 found 0x33faeb0 record: offset = 37, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 96, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 96 Ciphertext[96]: | 75 82 74 86 51 26 1f 7d 77 31 bd 79 ce 30 b3 10 |u.t.Q&.}w1.y.0..| | d7 77 90 a7 b3 61 d1 35 d8 d0 be 86 8d 25 46 67 |.w...a.5.....%Fg| | ae f8 6a 85 49 47 2e 06 cb c0 e3 27 97 18 d7 d2 |..j.IG.....'....| | f5 99 09 f9 98 b5 38 4a 59 f8 fe 36 a0 89 97 5c |......8JY..6...\| | 0c 68 17 48 97 1f 69 61 20 3e 18 0c d8 7b 80 ea |.h.H..ia >...{..| | de 96 d3 19 b2 82 ed 0e dd d5 83 6f 69 c1 91 09 |...........oi...| Plaintext[96]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 73 65 |Host: dhe-dss-se| | 65 64 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e |ed-sha.local.al.| | 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 |lekensteyn.nl:44| | 37 31 0d 0a 0d 0a 5a fa 5b 84 06 57 a8 cb 48 c6 |71....Z.[..W..H.| | 55 dc a5 2e d6 3d ea fc d2 79 00 00 00 00 00 05 |U....=...y......| ssl_decrypt_record found padding 5 final len 90 checking mac (len 70, version 300, ct 23 seq 2) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 70, seq = 0, nxtseq = 70 association_find: TCP port 59945 found (nil) association_find: TCP port 4471 found 0x33faeb0 dissect_ssl3_record decrypted len 70 decrypted app data fragment[70]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 73 65 |Host: dhe-dss-se| | 65 64 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e |ed-sha.local.al.| | 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 |lekensteyn.nl:44| | 37 31 0d 0a 0d 0a |71.... | dissect_ssl3_record found association 0x33faeb0 dissect_ssl enter frame #384 (first time) conversation = 0x7f2686947328, ssl_session = 0x7f265a9648d0 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | 83 50 b1 03 83 d8 e1 48 af 02 60 1a de 91 a6 a7 |.P.....H..`.....| | 55 39 0f b7 8e fe 2b 67 f4 c5 4e 16 a2 e0 4c 57 |U9....+g..N...LW| | 48 69 e4 fb 46 92 b6 96 21 ea 23 4d dd b5 63 f5 |Hi..F...!.#M..c.| | 0e be a1 d6 ce 71 1f de 29 49 6e 29 29 7a 29 74 |.....q..)In))z)t| | 9b ec 55 16 78 0a da b3 b1 9f 78 af 8a df bb e8 |..U.x.....x.....| | 5e 8d c9 f4 01 e8 16 7a 81 fc 86 f3 5f 41 68 28 |^......z...._Ah(| | f8 d9 b7 41 58 ba d1 4b 6c af 97 40 4b 9c 4b 88 |...AX..Kl..@K.K.| | 6f d1 23 de 69 4d a1 87 a0 cb 75 75 bb 5d b8 67 |o.#.iM....uu.].g| | 54 95 bb c9 c7 c8 0d 8d dc 80 e9 09 b0 f1 53 fd |T.............S.| | 88 43 a8 ba 14 12 ff e8 40 1a f2 f8 a2 e8 bf 56 |.C......@......V| | 6c b7 6b e5 2f 62 b5 41 b8 dc 9e 13 08 ba 34 12 |l.k./b.A......4.| | a8 28 80 3d 69 9a 30 19 79 1d 99 69 3f e0 51 49 |.(.=i.0.y..i?.QI| | 28 17 dc 3d e3 82 e2 a1 34 56 c9 1f fe e7 81 25 |(..=....4V.....%| | 52 27 93 5d b4 37 8d ff 56 99 34 a7 3c e4 fd b9 |R'.].7..V.4.<...| | cc 78 85 00 92 be 5d 73 00 2b 8e b9 02 a0 14 fb |.x....]s.+......| | a9 6f 20 66 ef a7 93 0a e6 0e 8f 6a 32 81 4f ca |.o f.......j2.O.| | 41 f6 a9 24 a7 88 75 fc 3e 7a d9 c3 2b 2f fd b6 |A..$..u.>z..+/..| | cf e2 77 b2 29 f4 da 20 6e 80 b7 46 86 08 b2 73 |..w.).. n..F...s| | 96 2e ac b6 dd ad dc 2f d2 28 28 c5 66 8a 35 bd |......./.((.f.5.| | 25 a9 06 c3 3c 00 a4 cb 09 2c fc b9 14 c1 bc 66 |%...<....,.....f| | 32 2e 6b 09 01 ce 98 d5 04 6e 98 30 4b 65 c9 01 |2.k......n.0Ke..| | 93 17 ae 52 4a 3d 9f a0 9f c7 6b c3 77 6e bf f0 |...RJ=....k.wn..| | ed f1 84 bd 4c ec 6f a8 25 07 ea bf 80 97 bb 93 |....L.o.%.......| | 80 24 09 4e 8f 5a 7c ff 97 d7 7a a9 1a e2 4a 44 |.$.N.Z|...z...JD| Plaintext[384]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:21 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 39 39 20 2d 20 44 48 45 2d 44 |x00,0x99 - DHE-D| | 53 53 2d 53 45 45 44 2d 53 48 41 20 20 20 20 20 |SS-SEED-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc| | 3d 53 45 45 44 28 31 32 38 29 20 4d 61 63 3d 53 |=SEED(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1.].-| | 41 61 03 b1 11 5a 6a f0 b5 04 de f0 d5 86 12 49 |Aa...Zj........I| | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f |................| ssl_decrypt_record found padding 15 final len 368 checking mac (len 348, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348 association_find: TCP port 4471 found 0x33faeb0 dissect_ssl3_record decrypted len 348 decrypted app data fragment[348]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:21 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 39 39 20 2d 20 44 48 45 2d 44 |x00,0x99 - DHE-D| | 53 53 2d 53 45 45 44 2d 53 48 41 20 20 20 20 20 |SS-SEED-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc| | 3d 53 45 45 44 28 31 32 38 29 20 4d 61 63 3d 53 |=SEED(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1 | dissect_ssl3_record found association 0x33faeb0 dissect_ssl enter frame #385 (first time) conversation = 0x7f2686947328, ssl_session = 0x7f265a9648d0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 1f 0c 4e 12 9b 11 71 07 91 2c f9 99 32 03 3e 55 |..N...q..,..2.>U| | 82 bd e0 00 24 70 2f aa 8e 1d 97 ff 5f 2c 82 75 |....$p/....._,.u| Plaintext[32]: | 01 00 18 e3 99 72 42 13 47 cd 38 bd a0 68 33 c3 |.....rB.G.8..h3.| | 26 2b 3e 2b d1 bb 00 00 00 00 00 00 00 00 00 09 |&+>+............| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #387 (first time) conversation = 0x7f2686947328, ssl_session = 0x7f265a9648d0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 9d 0d 92 e6 dd 0b 77 b5 a0 b0 07 8b 73 16 30 26 |......w.....s.0&| | 67 cd 53 11 2e 75 8e ef 79 a6 1d 02 2f bd b3 d3 |g.S..u..y.../...| Plaintext[32]: | 01 00 61 b0 b8 66 66 15 4e c4 36 d4 96 55 2c 4e |..a..ff.N.6..U,N| | 2b a3 d6 53 c5 05 00 00 00 00 00 00 00 00 00 09 |+..S............| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 3) ssl_decrypt_record: mac ok dissect_ssl enter frame #392 (first time) ssl_session_init: initializing ptr 0x7f265a9670b0 size 688 conversation = 0x7f2686947680, ssl_session = 0x7f265a9670b0 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 34124 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4472 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #394 (first time) conversation = 0x7f2686947680, ssl_session = 0x7f265a9670b0 record: offset = 0, reported_length_remaining = 1437 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0x009A -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 1351 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898 record: offset = 898, reported_length_remaining = 539 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 525, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 903 length 521 bytes, remaining 1428 record: offset = 1428, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1433 length 0 bytes, remaining 1437 dissect_ssl enter frame #396 (first time) conversation = 0x7f2686947680, ssl_session = 0x7f265a9670b0 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 52349715790ce6d17391606acd8b094886563f27a8996fa6... looking for RSA pre-master0080ab63b848965c0e404e86cd067d30a0b332dfb34de8dd... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971568edf373b61bc5ad23adced91be40231158d90cf25c26bd04b2bf8e5 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822a2f3d6e9c8c521a0 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715064b708db7aa9cef48ec8a9bf517e7392e7ee9a35062ce7bb2523787 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715790ce6d17391606acd8b094886563f27a8996fa6c96e2b99876c41a9 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3 found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 ssl3_prf: sha1_hash(6) ssl3_prf: md5_hash(6) datalen 48 ssl3_prf: sha1_hash(7) ssl3_prf: md5_hash(7) datalen 48 key expansion[104]: | 1e 94 f5 56 f6 64 04 e7 c9 2e 9e c0 11 b4 b0 69 |...V.d.........i| | 5e ad c0 1c af 26 9d a6 02 e1 fc 2d 5e a0 ee 4b |^....&.....-^..K| | 13 e8 fa 40 6b 4c 20 2f 22 43 04 97 0c d1 70 cc |...@kL /"C....p.| | 47 8a 0b 76 0f 8d 5d 78 bc 00 1f bc 6c 52 52 0a |G..v..]x....lRR.| | 9b 9e f6 8c 0d 47 2c d0 94 d9 de a7 0c 19 b6 45 |.....G,........E| | 64 83 df 04 bc 6e 30 66 94 db ce 7a 4f 10 c4 08 |d....n0f...zO...| | d6 1d 5a a6 63 48 d6 27 |..Z.cH.' | Client MAC key[20]: | 1e 94 f5 56 f6 64 04 e7 c9 2e 9e c0 11 b4 b0 69 |...V.d.........i| | 5e ad c0 1c |^... | Server MAC key[20]: | af 26 9d a6 02 e1 fc 2d 5e a0 ee 4b 13 e8 fa 40 |.&.....-^..K...@| | 6b 4c 20 2f |kL / | Client Write key[16]: | 22 43 04 97 0c d1 70 cc 47 8a 0b 76 0f 8d 5d 78 |"C....p.G..v..]x| Server Write key[16]: | bc 00 1f bc 6c 52 52 0a 9b 9e f6 8c 0d 47 2c d0 |....lRR......G,.| Client Write IV[16]: | 94 d9 de a7 0c 19 b6 45 64 83 df 04 bc 6e 30 66 |.......Ed....n0f| Server Write IV[16]: | 94 db ce 7a 4f 10 c4 08 d6 1d 5a a6 63 48 d6 27 |...zO.....Z.cH.'| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: SEED decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: SEED decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | 35 0c b4 73 8f bb fc a0 d5 0c c1 f8 76 47 5a 45 |5..s........vGZE| | 60 f3 0f ca f3 7d b2 db c9 81 bf 73 1e 93 47 7d |`....}.....s..G}| ssl_save_session stored master secret[48]: | 66 f4 0e fa 23 0e 9a 7d 5c 6f c2 53 b4 78 3d d1 |f...#..}\o.S.x=.| | a2 4e e1 6c 7e e9 b5 59 0b f4 3d bf b5 56 b0 13 |.N.l~..Y..=..V..| | be e0 c9 0e 56 d4 59 a4 01 98 bf 81 d3 a6 0f f3 |....V.Y.........| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 51 17 1e 8b 96 be f9 63 f9 5b b6 2c d0 d6 b2 dd |Q......c.[.,....| | b2 df 42 25 53 d4 a8 21 4f 47 66 d9 c5 ba 19 ac |..B%S..!OGf.....| | c9 63 bd d1 a9 0b 7d c1 42 83 1e 96 17 0a 74 fd |.c....}.B.....t.| | 70 69 5d 9d e1 08 0b c2 74 2f 95 c8 f1 9a e7 63 |pi].....t/.....c| Plaintext[64]: | 14 00 00 24 50 f5 0a 9f e5 5e 55 e8 b8 c7 46 e3 |...$P....^U...F.| | be 76 eb 7d 35 ec 32 12 0a a9 a1 3e 52 69 0f 79 |.v.}5.2....>Ri.y| | 25 8a 54 18 68 bb 2d 12 fd 5f 8c f1 10 2f 90 b8 |%.T.h.-.._.../..| | 41 9e 8b f9 52 87 25 95 23 fb 56 cf 00 00 00 03 |A...R.%.#.V.....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #397 (first time) conversation = 0x7f2686947680, ssl_session = 0x7f265a9670b0 record: offset = 0, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 96 52 bc 52 f5 df 7f 51 ce fb 9f 62 6e e7 56 20 |.R.R...Q...bn.V | | 8b 37 12 c9 3a c0 76 69 e8 0f ad 66 50 37 da 4c |.7..:.vi...fP7.L| | 31 24 a7 2b 96 a8 fc d9 1f 12 cc 69 a1 57 c2 85 |1$.+.......i.W..| | 1a 7f 4e c3 df 00 83 ad c2 c2 ad da 8a c7 d5 41 |..N............A| Plaintext[64]: | 14 00 00 24 39 8e 9d a6 28 0c 6f fe 05 da a1 a1 |...$9...(.o.....| | 50 6d b8 4c 97 c9 2d 8b fa 75 3e 6c 58 74 39 9f |Pm.L..-..u>lXt9.| | c8 45 42 15 4d a4 4a 1b a0 10 b1 94 ee f6 ee a4 |.EB.M.J.........| | ef 14 21 21 75 f0 0a 89 76 14 30 fa 00 00 00 03 |..!!u...v.0.....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #398 (first time) conversation = 0x7f2686947680, ssl_session = 0x7f265a9670b0 record: offset = 0, reported_length_remaining = 138 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 0d 12 11 ba 94 e8 2a 05 1f a4 3f 8a 98 e0 95 46 |......*...?....F| | 58 c6 9a c9 13 96 75 d5 63 36 91 34 95 92 f5 f2 |X.....u.c6.4....| Plaintext[32]: | 65 87 68 fc 87 75 77 2f c4 59 b1 38 e1 dd 96 c8 |e.h..uw/.Y.8....| | bb 63 56 ae 00 00 00 00 00 00 00 00 00 00 00 0b |.cV.............| ssl_decrypt_record found padding 11 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 34124 found (nil) association_find: TCP port 4472 found 0x33faf40 record: offset = 37, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 96, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 96 Ciphertext[96]: | 2f 3c 44 e6 d5 4d 7e f8 67 7a 9a 02 34 d3 f9 92 |/docum| | 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca| | 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.| | 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 37 e2 f6 0b |nl'7...| | f3 f8 64 c6 ee 7b 68 2e c0 51 49 75 a9 1d 76 04 |..d..{h..QIu..v.| | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f |................| ssl_decrypt_record found padding 15 final len 368 checking mac (len 348, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348 association_find: TCP port 4472 found 0x33faf40 dissect_ssl3_record decrypted len 348 decrypted app data fragment[348]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:21 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 39 41 20 2d 20 44 48 45 2d 52 |x00,0x9A - DHE-R| | 53 41 2d 53 45 45 44 2d 53 48 41 20 20 20 20 20 |SA-SEED-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 53 45 45 44 28 31 32 38 29 20 4d 61 63 3d 53 |=SEED(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1 | dissect_ssl3_record found association 0x33faf40 dissect_ssl enter frame #400 (first time) conversation = 0x7f2686947680, ssl_session = 0x7f265a9670b0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | fe 86 f8 b9 54 f3 3c d9 68 13 9a f3 66 e4 3d 6c |....T.<.h...f.=l| | d4 1c cb 9f 7f e9 b3 66 e9 f5 03 eb 93 35 c8 65 |.......f.....5.e| Plaintext[32]: | 01 00 68 64 f0 76 79 c3 62 1b 85 a8 93 08 22 2a |..hd.vy.b....."*| | ec 13 65 62 ff ee 00 00 00 00 00 00 00 00 00 09 |..eb............| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #402 (first time) conversation = 0x7f2686947680, ssl_session = 0x7f265a9670b0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | ee 9a 0b f3 31 dc 31 06 e2 45 9f f4 0e e2 45 7d |....1.1..E....E}| | 01 bc 24 63 49 69 6d 82 07 f3 ee e0 8c 4a 86 ea |..$cIim......J..| Plaintext[32]: | 01 00 c0 10 f4 bb 0b 1d ea 13 33 aa 75 f3 4a 90 |..........3.u.J.| | ee 61 39 a7 a1 9a 00 00 00 00 00 00 00 00 00 09 |.a9.............| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 3) ssl_decrypt_record: mac ok dissect_ssl enter frame #407 (first time) ssl_session_init: initializing ptr 0x7f265a969850 size 688 conversation = 0x7f26869479d8, ssl_session = 0x7f265a969850 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 33655 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4479 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #409 (first time) conversation = 0x7f26869479d8, ssl_session = 0x7f265a969850 record: offset = 0, reported_length_remaining = 580 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0xC002 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 494 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 480, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 476 bytes, remaining 571 record: offset = 571, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 576 length 0 bytes, remaining 580 dissect_ssl enter frame #411 (first time) conversation = 0x7f26869479d8, ssl_session = 0x7f265a969850 record: offset = 0, reported_length_remaining = 178 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 102, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 98 bytes, remaining 107 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 5234971618d66ee5fc31f776c8a738bc8fa9f814928f8101... looking for RSA pre-master6104b27e809142b6c4c4bbc1426d7dcb4c7a7ca32d86026d... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971568edf373b61bc5ad23adced91be40231158d90cf25c26bd04b2bf8e5 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822a2f3d6e9c8c521a0 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715064b708db7aa9cef48ec8a9bf517e7392e7ee9a35062ce7bb2523787 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715790ce6d17391606acd8b094886563f27a8996fa6c96e2b99876c41a9 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715331fb5a174085ae52bbe3d725ace224182d655998abe8023d7f2bc0a 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971614ca4762f9bd4dbd73b749b3de5971deaff2aded5e287130aa5cfce8 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971618d66ee5fc31f776c8a738bc8fa9f814928f810132568d2d13f7d3c6 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75 found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 key expansion[72]: | f8 60 cd db 08 3a a1 af 86 cf c2 6a 6d 0e 8c 4c |.`...:.....jm..L| | b8 e5 f3 2a c0 c8 cc 89 53 6c 04 03 e9 3b 68 dd |...*....Sl...;h.| | 51 d0 d0 d0 9d 09 6c 78 7c fb 3d 9b f8 a2 6c 73 |Q.....lx|.=...ls| | 38 40 c2 29 f8 5f 82 16 15 cb e2 a7 16 7d 56 19 |8@.)._.......}V.| | da 03 8c 84 14 46 88 37 |.....F.7 | Client MAC key[20]: | f8 60 cd db 08 3a a1 af 86 cf c2 6a 6d 0e 8c 4c |.`...:.....jm..L| | b8 e5 f3 2a |...* | Server MAC key[20]: | c0 c8 cc 89 53 6c 04 03 e9 3b 68 dd 51 d0 d0 d0 |....Sl...;h.Q...| | 9d 09 6c 78 |..lx | Client Write key[16]: | 7c fb 3d 9b f8 a2 6c 73 38 40 c2 29 f8 5f 82 16 ||.=...ls8@.)._..| Server Write key[16]: | 15 cb e2 a7 16 7d 56 19 da 03 8c 84 14 46 88 37 |.....}V......F.7| Client Write IV[8]: | 00 00 00 00 00 00 00 00 |........ | Server Write IV[8]: | 30 62 76 03 00 00 00 00 |0bv..... | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: ARCFOUR decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: ARCFOUR decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | fc 0f 3d 50 65 d2 25 d1 a2 f7 1d dd cf c7 c8 b8 |..=Pe.%.........| | 31 41 94 6e 7e 7b 74 23 b2 42 e5 53 1e a3 06 c2 |1A.n~{t#.B.S....| ssl_save_session stored master secret[48]: | 8d f0 3f 66 86 32 bb 32 07 28 e1 74 31 5a 97 ee |..?f.2.2.(.t1Z..| | c8 e9 16 71 45 fc e1 04 60 57 f2 2d cc ba 9e 01 |...qE...`W.-....| | 87 10 cf dd 4e f4 e6 9c aa 61 a4 f8 f3 0b bb 75 |....N....a.....u| dissect_ssl3_handshake session keys successfully generated record: offset = 107, reported_length_remaining = 71 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 113, reported_length_remaining = 65 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 60, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 60 Ciphertext[60]: | db 80 58 29 85 59 9d 60 79 b7 68 33 97 4e a5 ad |..X).Y.`y.h3.N..| | 8e d3 5e 2b 8b 05 74 6d ea 25 4f 24 e7 fe b0 23 |..^+..tm.%O$...#| | 55 82 22 b9 c0 bf 4f db 83 55 0e af bc 94 9a 1c |U."...O..U......| | 56 91 bd 30 5a 22 7f 00 6c a4 36 75 |V..0Z"..l.6u | Plaintext[60]: | 14 00 00 24 c3 c0 ff 4d 1d 20 37 93 5f c4 da 01 |...$...M. 7._...| | 43 cf 6a 19 cd fe d6 9e ca f6 2d e7 9c 23 1c 7c |C.j.......-..#.|| | 97 58 b7 2d b5 41 e3 a5 9b 47 82 0a d5 84 a3 6e |.X.-.A...G.....n| | a0 bb 6c 32 9a 36 41 d4 1d 62 f0 9a |..l2.6A..b.. | checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #412 (first time) conversation = 0x7f26869479d8, ssl_session = 0x7f265a969850 record: offset = 0, reported_length_remaining = 71 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 65 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 60, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 60 Ciphertext[60]: | 6a ae d5 9b 79 7d 58 c9 f6 77 a1 47 8a 43 50 b3 |j...y}X..w.G.CP.| | 5a fb e7 e1 2e f1 a3 ca 3d 9a ed ca 53 a2 a9 a1 |Z.......=...S...| | c4 83 a1 34 1c f0 4d 96 66 84 53 76 42 62 e7 2b |...4..M.f.SvBb.+| | 9c b5 77 21 b7 7b 31 d6 49 2c 1b 1b |..w!.{1.I,.. | Plaintext[60]: | 14 00 00 24 a6 96 3c d6 9b db 9d f9 dd 08 14 1c |...$..<.........| | 16 54 eb b5 3c 40 09 4c a1 cc 4e eb 62 02 9d 08 |.T..<@.L..N.b...| | 60 0a fa 57 1d 45 b6 10 83 53 e8 eb 25 53 b7 ad |`..W.E...S..%S..| | c5 0e 9b f4 41 0e f2 c8 1a 4c 1f 5c |....A....L.\ | checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #413 (first time) conversation = 0x7f26869479d8, ssl_session = 0x7f265a969850 record: offset = 0, reported_length_remaining = 97 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 92, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 92 Ciphertext[92]: | 7c bf 0f 21 93 cc 46 5b 89 30 8a 5f 71 22 da 63 ||..!..F[.0._q".c| | 99 9d 6f c3 28 1b a2 0a c6 e8 0d d4 e7 15 60 b8 |..o.(.........`.| | c1 21 67 49 b9 4e 72 05 b0 b6 7b 92 a2 11 7f 3d |.!gI.Nr...{....=| | 75 43 e3 f7 3f 7e 34 fd 7c 83 f0 c1 e7 27 1d f2 |uC..?~4.|....'..| | d9 0d ab 67 08 6f dc b8 60 2f 63 11 8d 69 5b c9 |...g.o..`/c..i[.| | 5d 10 38 b2 a7 8c b8 a9 49 e6 72 df |].8.....I.r. | Plaintext[92]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa| | 2d 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |-rc4-sha.local.a| | 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:| | 34 34 37 39 0d 0a 0d 0a c8 ed 99 88 9d f7 65 86 |4479..........e.| | d0 7f fb 2f a1 ec eb 05 01 1f a0 de |.../........ | checking mac (len 72, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 72, seq = 0, nxtseq = 72 association_find: TCP port 33655 found (nil) association_find: TCP port 4479 found 0x345d8a0 dissect_ssl3_record decrypted len 72 decrypted app data fragment[72]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa| | 2d 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |-rc4-sha.local.a| | 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:| | 34 34 37 39 0d 0a 0d 0a |4479.... | dissect_ssl3_record found association 0x345d8a0 dissect_ssl enter frame #414 (first time) conversation = 0x7f26869479d8, ssl_session = 0x7f265a969850 record: offset = 0, reported_length_remaining = 375 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 370, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 370 Ciphertext[370]: | 50 c0 ad 81 7b 70 09 c9 24 33 f7 1a ee fa 1f 73 |P...{p..$3.....s| | fc 24 54 2b 3b b0 4a 1e b1 86 95 8f a0 c5 2d e0 |.$T+;.J.......-.| | de 67 de e4 d8 f9 07 54 0b 2a 0a 52 e8 a9 8a d7 |.g.....T.*.R....| | 47 a1 81 65 48 b0 1d 37 72 46 35 c0 8f ee be b4 |G..eH..7rF5.....| | a1 c3 d2 68 3d 27 bc 3b ad 77 18 60 41 66 19 bd |...h='.;.w.`Af..| | 86 8e 6b a8 8a 07 df 7b e2 6f 45 0f 0d 75 75 07 |..k....{.oE..uu.| | d6 3a eb 40 37 df 3d 63 f7 b1 75 76 e1 00 fd ed |.:.@7.=c..uv....| | c3 9d fb b8 3c 11 34 47 35 4f 0b 60 0d c8 ac 01 |....<.4G5O.`....| | 27 64 61 ec 58 e9 ee bb a2 7a de 0e 0b 2a 11 af |'da.X....z...*..| | 56 89 0b 4c ff d9 a0 31 b3 d9 0f bc c1 09 0c c5 |V..L...1........| | 67 30 8c 92 5e 3a 15 d6 57 06 84 49 80 9c e2 3b |g0..^:..W..I...;| | 18 20 7c 6b a1 e1 e5 b8 df 3a 41 c8 d0 bc ec ff |. |k.....:A.....| | 0a 97 3e 75 6b 46 9e e4 ee bf 0e 1c 5d 58 01 56 |..>ukF......]X.V| | 58 09 ce cb 96 03 38 cf 5b 6f 48 d4 38 2d 96 86 |X.....8.[oH.8-..| | 6e 4a a6 fc 52 f9 1f c2 13 ba ca 0e d2 41 08 91 |nJ..R........A..| | 9e ce 7b e3 c4 47 4f f4 8f 1e 5a 26 0c 0b d7 eb |..{..GO...Z&....| | 45 d6 45 b5 fc b1 5a 06 23 22 a6 0c eb 2e fe 76 |E.E...Z.#".....v| | ac 9b f9 74 02 f0 d2 a4 fd a6 1a f4 a9 4d 54 0b |...t.........MT.| | 07 c4 86 14 46 b3 7b 85 84 4f 33 4b 64 92 be be |....F.{..O3Kd...| | 21 53 3a 47 14 72 6a 68 12 76 ca 50 b6 8b 78 63 |!S:G.rjh.v.P..xc| | 2d fa eb 26 18 c3 a0 b4 99 5b 3b 88 4e cf f5 2f |-..&.....[;.N../| | d1 55 a0 69 00 e8 f5 0f c0 d5 64 15 2d f3 4d c0 |.U.i......d.-.M.| | 83 5b db 48 1d 42 d7 55 82 3a 97 d4 94 3c 2c 9d |.[.H.B.U.:...<,.| | 9a af |.. | Plaintext[370]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:22 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 30 32 20 2d 20 45 43 44 48 2d |xC0,0x02 - ECDH-| | 45 43 44 53 41 2d 52 43 34 2d 53 48 41 20 20 20 |ECDSA-RC4-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH| | 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E| | 6e 63 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 |nc=RC4(128) Mac| | 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1._| | ed 4b 1e a8 be 14 56 c3 bc 2c 27 1a 06 30 9c 5f |.K....V..,'..0._| | 4f e4 |O. | checking mac (len 350, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 350, seq = 0, nxtseq = 350 association_find: TCP port 4479 found 0x345d8a0 dissect_ssl3_record decrypted len 350 decrypted app data fragment[350]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:22 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 30 32 20 2d 20 45 43 44 48 2d |xC0,0x02 - ECDH-| | 45 43 44 53 41 2d 52 43 34 2d 53 48 41 20 20 20 |ECDSA-RC4-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH| | 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E| | 6e 63 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 |nc=RC4(128) Mac| | 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1 | dissect_ssl3_record found association 0x345d8a0 dissect_ssl enter frame #415 (first time) conversation = 0x7f26869479d8, ssl_session = 0x7f265a969850 record: offset = 0, reported_length_remaining = 27 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 22, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 22 Ciphertext[22]: | 95 6c b2 62 87 72 f1 db 4b 8b c9 e9 f3 79 2e c6 |.l.b.r..K....y..| | 01 25 98 e4 7d dd |.%..}. | Plaintext[22]: | 01 00 36 2a 2b 07 60 cf e2 77 62 85 d0 9f c3 02 |..6*+.`..wb.....| | f1 c2 45 ac 0d d5 |..E... | checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #417 (first time) conversation = 0x7f26869479d8, ssl_session = 0x7f265a969850 record: offset = 0, reported_length_remaining = 27 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 22, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 22 Ciphertext[22]: | 0e 1c 56 1b 02 3a 13 f2 1b ab 00 cb 8d 66 0d e7 |..V..:.......f..| | 66 a9 1f 8d 64 dc |f...d. | Plaintext[22]: | 01 00 c7 c6 ef bc 01 bf 0f 98 0d d2 66 1d 83 91 |............f...| | c5 1d d3 a3 72 aa |....r. | checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #422 (first time) ssl_session_init: initializing ptr 0x7f265a96bfc0 size 688 conversation = 0x7f2686947d30, ssl_session = 0x7f265a96bfc0 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 45042 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4480 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #424 (first time) conversation = 0x7f2686947d30, ssl_session = 0x7f265a96bfc0 record: offset = 0, reported_length_remaining = 580 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0xC003 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 494 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 480, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 476 bytes, remaining 571 record: offset = 571, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 576 length 0 bytes, remaining 580 dissect_ssl enter frame #426 (first time) conversation = 0x7f2686947d30, ssl_session = 0x7f265a96bfc0 record: offset = 0, reported_length_remaining = 182 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 102, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 98 bytes, remaining 107 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 52349716d5b1c0e0cc0bcb19610b6161a0c61d611a310905... looking for RSA pre-master6104a21bd003208777a9d262e2c77f1c5b7868535c99346f... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971568edf373b61bc5ad23adced91be40231158d90cf25c26bd04b2bf8e5 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822a2f3d6e9c8c521a0 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715064b708db7aa9cef48ec8a9bf517e7392e7ee9a35062ce7bb2523787 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715790ce6d17391606acd8b094886563f27a8996fa6c96e2b99876c41a9 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715331fb5a174085ae52bbe3d725ace224182d655998abe8023d7f2bc0a 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971614ca4762f9bd4dbd73b749b3de5971deaff2aded5e287130aa5cfce8 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971618d66ee5fc31f776c8a738bc8fa9f814928f810132568d2d13f7d3c6 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497165c84a778f75147dcfa77cc53cae36771b51e8449eba9fb5ed19cbfb1 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716d5b1c0e0cc0bcb19610b6161a0c61d611a3109055501508d5b53cc04 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3 found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 ssl3_prf: sha1_hash(6) ssl3_prf: md5_hash(6) datalen 48 ssl3_prf: sha1_hash(7) ssl3_prf: md5_hash(7) datalen 48 key expansion[104]: | b5 82 38 42 8a 7f 22 27 10 59 3b f3 97 e1 75 70 |..8B.."'.Y;...up| | b7 08 49 fe e3 88 8e e8 1f 0c 47 9f bc 82 11 ed |..I.......G.....| | c6 c2 52 f9 23 17 3a a1 5e 0b 8b f0 3c e8 45 0d |..R.#.:.^...<.E.| | ab 6a 04 8e 55 8c ba 07 3e d1 46 f3 5b 5a 8a 65 |.j..U...>.F.[Z.e| | 9c ea 1e ec 5b 21 49 32 6f 60 c6 15 f4 9a 1a 11 |....[!I2o`......| | ef 6e e0 57 45 f8 80 d1 81 fd 16 b3 70 c4 3d d7 |.n.WE.......p.=.| | b0 bf b8 5d 3f 26 9a c6 |...]?&.. | Client MAC key[20]: | b5 82 38 42 8a 7f 22 27 10 59 3b f3 97 e1 75 70 |..8B.."'.Y;...up| | b7 08 49 fe |..I. | Server MAC key[20]: | e3 88 8e e8 1f 0c 47 9f bc 82 11 ed c6 c2 52 f9 |......G.......R.| | 23 17 3a a1 |#.:. | Client Write key[24]: | 5e 0b 8b f0 3c e8 45 0d ab 6a 04 8e 55 8c ba 07 |^...<.E..j..U...| | 3e d1 46 f3 5b 5a 8a 65 |>.F.[Z.e | Server Write key[24]: | 9c ea 1e ec 5b 21 49 32 6f 60 c6 15 f4 9a 1a 11 |....[!I2o`......| | ef 6e e0 57 45 f8 80 d1 |.n.WE... | Client Write IV[8]: | 81 fd 16 b3 70 c4 3d d7 |....p.=. | Server Write IV[8]: | b0 bf b8 5d 3f 26 9a c6 |...]?&.. | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | f7 b9 9c 55 b1 32 ff 56 19 56 85 0b 2f 95 57 29 |...U.2.V.V../.W)| | b5 c1 9d aa 6b 7b 60 21 81 d2 2d a9 d2 d2 74 9e |....k{`!..-...t.| ssl_save_session stored master secret[48]: | 91 9b b0 82 07 92 15 a5 74 ff 74 2b c9 76 ae 56 |........t.t+.v.V| | 1e 8a 13 85 c6 bc 38 d8 80 f6 51 9d 7e 0d f4 ad |......8...Q.~...| | 35 6c 57 9f db 81 b2 4a b5 77 01 d3 9f 0a 78 c3 |5lW....J.w....x.| dissect_ssl3_handshake session keys successfully generated record: offset = 107, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 113, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 43 3a a8 78 40 c2 26 28 d5 79 a5 15 f8 25 f0 60 |C:.x@.&(.y...%.`| | d9 2d 04 0e a4 8c ee 76 24 ea 08 70 11 12 4b 04 |.-.....v$..p..K.| | 3d a9 1b 74 23 76 b1 3c d4 fb 41 30 69 39 ff 01 |=..t#v.<..A0i9..| | e0 90 24 6e 42 70 91 1e 87 2e c8 4b ec d5 df d6 |..$nBp.....K....| Plaintext[64]: | 14 00 00 24 d5 44 83 94 e9 9e dc 07 01 9b 0f c9 |...$.D..........| | 10 d2 f5 6c 10 97 7e b9 67 f2 ea 36 6d 95 03 db |...l..~.g..6m...| | b9 5e f2 cc d5 b6 21 6e aa de cd d4 4f b8 7c fe |.^....!n....O.|.| | 09 54 a2 0e b2 81 9e 7d 08 9a b0 22 00 00 00 03 |.T.....}..."....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #427 (first time) conversation = 0x7f2686947d30, ssl_session = 0x7f265a96bfc0 record: offset = 0, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | d0 1a ad 02 b2 32 f7 d0 3b 36 45 19 ac d0 ea 1a |.....2..;6E.....| | d3 80 ce 44 92 74 4c 31 35 c1 07 55 a6 7a 44 f0 |...D.tL15..U.zD.| | db 6b 38 e2 b3 25 98 d2 65 2a e6 93 df 83 53 08 |.k8..%..e*....S.| | b7 98 a3 04 75 2f 4a f2 1b 62 6e d3 21 5b 80 f7 |....u/J..bn.![..| Plaintext[64]: | 14 00 00 24 c5 1f 46 9f 63 fd a7 81 4c ea 69 42 |...$..F.c...L.iB| | fd b5 e6 55 36 7d e6 55 b9 45 a9 0d 62 1a df 9f |...U6}.U.E..b...| | b7 e2 22 63 ac 45 69 53 5d fd c3 60 ca 43 dc d7 |.."c.EiS]..`.C..| | 3e e8 02 d1 0a 1d 5a 5a 6f d4 fd 75 00 00 00 03 |>.....ZZo..u....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #428 (first time) conversation = 0x7f2686947d30, ssl_session = 0x7f265a96bfc0 record: offset = 0, reported_length_remaining = 138 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 24, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 24 Ciphertext[24]: | 6a 89 0e a2 05 76 50 f7 f5 c1 5f be 5a 7f 65 94 |j....vP..._.Z.e.| | 94 f8 72 b7 99 d6 63 d5 |..r...c. | Plaintext[24]: | e6 12 1c 44 a4 c8 62 42 22 a5 fc c2 06 cf 04 2c |...D..bB"......,| | cb eb 2e 85 00 00 00 03 |........ | ssl_decrypt_record found padding 3 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 45042 found (nil) association_find: TCP port 4480 found 0x345d930 record: offset = 29, reported_length_remaining = 109 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 104, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 104 Ciphertext[104]: | 0c bc e0 ef 49 3f f3 41 8d c3 36 71 17 70 6a db |....I?.A..6q.pj.| | 27 8d 10 6f b1 6a 49 23 f4 ba 3c 3e 2b d8 94 e6 |'..o.jI#..<>+...| | 5f 7e 51 f0 97 4a ad b6 7a 0d 6f f9 d7 00 23 6f |_~Q..J..z.o...#o| | a8 df ce 11 e6 2c b1 12 42 ab d6 e8 42 32 06 06 |.....,..B...B2..| | f8 2e ee ea 71 89 4a 79 2f 72 45 8a 70 a6 94 77 |....q.Jy/rE.p..w| | 3a 51 d9 69 0a 72 40 a7 75 30 07 10 83 9d a0 86 |:Q.i.r@.u0......| | d8 79 31 2c c8 19 ee 44 |.y1,...D | Plaintext[104]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa| | 2d 64 65 73 2d 63 62 63 33 2d 73 68 61 2e 6c 6f |-des-cbc3-sha.lo| | 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey| | 6e 2e 6e 6c 3a 34 34 38 30 0d 0a 0d 0a 2e 53 71 |n.nl:4480.....Sq| | 63 49 ef 2c 43 f9 b5 0c 23 7b b2 f0 1e 44 5f b5 |cI.,C...#{...D_.| | 59 00 00 00 00 00 00 06 |Y....... | ssl_decrypt_record found padding 6 final len 97 checking mac (len 77, version 300, ct 23 seq 2) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 77, seq = 0, nxtseq = 77 association_find: TCP port 45042 found (nil) association_find: TCP port 4480 found 0x345d930 dissect_ssl3_record decrypted len 77 decrypted app data fragment[77]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa| | 2d 64 65 73 2d 63 62 63 33 2d 73 68 61 2e 6c 6f |-des-cbc3-sha.lo| | 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey| | 6e 2e 6e 6c 3a 34 34 38 30 0d 0a 0d 0a |n.nl:4480.... | dissect_ssl3_record found association 0x345d930 dissect_ssl enter frame #429 (first time) conversation = 0x7f2686947d30, ssl_session = 0x7f265a96bfc0 record: offset = 0, reported_length_remaining = 381 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 376, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 376 Ciphertext[376]: | a9 57 98 35 02 36 9b 78 a1 22 6e ed ed 6d 54 61 |.W.5.6.x."n..mTa| | e4 4a 1e dd e5 09 f5 de 39 6e 56 d9 d1 50 49 a2 |.J......9nV..PI.| | d9 15 5c 73 07 ed e2 00 46 de bc fd 55 c7 d5 5d |..\s....F...U..]| | 6a d0 5a 9b 2e 65 cf 04 af 1b 1d 5d c3 bf 9c 69 |j.Z..e.....]...i| | 34 bd 85 9e 32 c3 bc 05 4c 33 44 1f 68 20 65 aa |4...2...L3D.h e.| | 2b 6d 25 22 a7 98 3d 06 0e 80 df 21 e1 b8 fd 49 |+m%"..=....!...I| | 9f a6 a7 89 07 db 98 18 97 08 7d ff 30 e1 50 f1 |..........}.0.P.| | 21 ed 67 73 91 79 be c4 08 fa 78 e0 62 46 38 d0 |!.gs.y....x.bF8.| | a5 7a 28 9d 2e b3 6a 06 58 96 32 f7 7b b2 e8 d2 |.z(...j.X.2.{...| | 92 07 91 df f2 9c 91 6f 59 45 ba 60 cd 04 12 c8 |.......oYE.`....| | 09 fe bc 11 9c 19 eb 5d 7b a8 85 c4 8a df a4 32 |.......]{......2| | ae c1 48 55 6c 43 25 b4 ac 5a 89 63 66 a8 3e 4a |..HUlC%..Z.cf.>J| | 74 4e 00 75 9a 90 b1 fc 81 2a 35 e0 c1 9c 8e b0 |tN.u.....*5.....| | 7c 5b 7e b4 5b 07 29 d7 b4 b5 f2 cc d1 a3 eb 3d ||[~.[.)........=| | 88 4f 42 5a f7 10 65 cf 97 6d 48 c3 d5 2b a7 80 |.OBZ..e..mH..+..| | 0e 79 d8 8e b5 88 57 2d 42 7f de 6f 43 79 f0 92 |.y....W-B..oCy..| | a8 82 13 9c 01 86 77 6b 9f 44 a5 9b f2 71 fa f5 |......wk.D...q..| | 88 59 f7 3f c6 17 2e 04 be ac 41 81 25 26 09 e2 |.Y.?......A.%&..| | cb d1 86 cc eb 2e cc d1 2d 35 ea f4 7f 2b 10 f3 |........-5...+..| | 17 ce 4c 29 6a 94 3f ba d4 9f db 16 b9 0d 81 3c |..L)j.?........<| | 21 83 c6 da f3 21 5c 42 18 6a d5 06 0c 45 ff 84 |!....!\B.j...E..| | c5 0b 33 1b 3c 3d 2f a1 4c 47 c9 87 6a 2a b7 9e |..3.<=/.LG..j*..| | 8b 9d 66 ed 9a 4f 8f a3 e7 4e eb 7f 4a ff a9 c0 |..f..O...N..J...| | 17 e6 6d 37 9e 6d 01 5b |..m7.m.[ | Plaintext[376]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:22 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 30 33 20 2d 20 45 43 44 48 2d |xC0,0x03 - ECDH-| | 45 43 44 53 41 2d 44 45 53 2d 43 42 43 33 2d 53 |ECDSA-DES-CBC3-S| | 48 41 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 |HA SSLv3 Kx=ECDH| | 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E| | 6e 63 3d 33 44 45 53 28 31 36 38 29 20 4d 61 63 |nc=3DES(168) Mac| | 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1:.| | 59 76 dd 7b e4 6b 54 c3 6a a7 48 4a cf b4 a3 e5 |Yv.{.kT.j.HJ....| | d9 0b 00 00 00 00 00 05 |........ | ssl_decrypt_record found padding 5 final len 370 checking mac (len 350, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 350, seq = 0, nxtseq = 350 association_find: TCP port 4480 found 0x345d930 dissect_ssl3_record decrypted len 350 decrypted app data fragment[350]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:22 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 30 33 20 2d 20 45 43 44 48 2d |xC0,0x03 - ECDH-| | 45 43 44 53 41 2d 44 45 53 2d 43 42 43 33 2d 53 |ECDSA-DES-CBC3-S| | 48 41 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 |HA SSLv3 Kx=ECDH| | 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E| | 6e 63 3d 33 44 45 53 28 31 36 38 29 20 4d 61 63 |nc=3DES(168) Mac| | 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1 | dissect_ssl3_record found association 0x345d930 dissect_ssl enter frame #430 (first time) conversation = 0x7f2686947d30, ssl_session = 0x7f265a96bfc0 record: offset = 0, reported_length_remaining = 29 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 24, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 24 Ciphertext[24]: | 4e f4 41 da 90 f9 b3 5b c7 ce 91 d5 0a 30 ca ab |N.A....[.....0..| | cc 00 75 71 36 e4 e2 43 |..uq6..C | Plaintext[24]: | 01 00 c8 7d 19 36 1a 13 54 c3 8d 1f db 0d 20 f4 |...}.6..T..... .| | eb 64 5c f5 ea f2 00 01 |.d\..... | ssl_decrypt_record found padding 1 final len 22 checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #432 (first time) conversation = 0x7f2686947d30, ssl_session = 0x7f265a96bfc0 record: offset = 0, reported_length_remaining = 29 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 24, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 24 Ciphertext[24]: | 23 91 27 d7 e8 7c 31 6d f9 f7 da 42 5d f0 5c 4e |#.'..|1m...B].\N| | 29 d3 bb ad 2e a6 fc 18 |)....... | Plaintext[24]: | 01 00 70 c1 63 00 48 5f c9 87 f3 46 5b 3d ea 49 |..p.c.H_...F[=.I| | 02 6b 60 df 15 21 00 01 |.k`..!.. | ssl_decrypt_record found padding 1 final len 22 checking mac (len 2, version 300, ct 21 seq 3) ssl_decrypt_record: mac ok dissect_ssl enter frame #437 (first time) ssl_session_init: initializing ptr 0x7f265a96e740 size 688 conversation = 0x7f2686948090, ssl_session = 0x7f265a96e740 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 34763 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4481 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #439 (first time) conversation = 0x7f2686948090, ssl_session = 0x7f265a96e740 record: offset = 0, reported_length_remaining = 580 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0xC004 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 494 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 480, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 476 bytes, remaining 571 record: offset = 571, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 576 length 0 bytes, remaining 580 dissect_ssl enter frame #441 (first time) conversation = 0x7f2686948090, ssl_session = 0x7f265a96e740 record: offset = 0, reported_length_remaining = 182 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 102, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 98 bytes, remaining 107 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 52349716fb2b23f18526271e78e3279be8200762333aa441... looking for RSA pre-master6104dcbebaeb774575f0636e72b821ad452adbc4042bd399... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971568edf373b61bc5ad23adced91be40231158d90cf25c26bd04b2bf8e5 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822a2f3d6e9c8c521a0 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715064b708db7aa9cef48ec8a9bf517e7392e7ee9a35062ce7bb2523787 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715790ce6d17391606acd8b094886563f27a8996fa6c96e2b99876c41a9 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715331fb5a174085ae52bbe3d725ace224182d655998abe8023d7f2bc0a 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971614ca4762f9bd4dbd73b749b3de5971deaff2aded5e287130aa5cfce8 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971618d66ee5fc31f776c8a738bc8fa9f814928f810132568d2d13f7d3c6 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497165c84a778f75147dcfa77cc53cae36771b51e8449eba9fb5ed19cbfb1 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716d5b1c0e0cc0bcb19610b6161a0c61d611a3109055501508d5b53cc04 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716fb2b23f18526271e78e3279be8200762333aa441bfe3e350d788a297 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298 found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 ssl3_prf: sha1_hash(6) ssl3_prf: md5_hash(6) datalen 48 ssl3_prf: sha1_hash(7) ssl3_prf: md5_hash(7) datalen 48 key expansion[104]: | 69 92 f0 9e df 91 75 c6 86 e7 29 9e 3b 89 a7 97 |i.....u...).;...| | cc b3 be 87 96 b8 db a2 d9 a4 7b e9 13 23 64 0b |..........{..#d.| | 67 53 bb 73 1a a3 9d 1f 89 75 15 57 57 20 ab 49 |gS.s.....u.WW .I| | a6 fe 60 bb f4 26 6b 90 c0 ea 14 6c 8b 64 e3 2a |..`..&k....l.d.*| | bc a5 33 79 f6 de aa 0f 3b bd 00 b3 10 4a 52 db |..3y....;....JR.| | 99 05 ab 1a 3d 6b d8 50 8f ac b5 57 44 f8 af 06 |....=k.P...WD...| | ea 48 27 e5 6f 10 2e 02 |.H'.o... | Client MAC key[20]: | 69 92 f0 9e df 91 75 c6 86 e7 29 9e 3b 89 a7 97 |i.....u...).;...| | cc b3 be 87 |.... | Server MAC key[20]: | 96 b8 db a2 d9 a4 7b e9 13 23 64 0b 67 53 bb 73 |......{..#d.gS.s| | 1a a3 9d 1f |.... | Client Write key[16]: | 89 75 15 57 57 20 ab 49 a6 fe 60 bb f4 26 6b 90 |.u.WW .I..`..&k.| Server Write key[16]: | c0 ea 14 6c 8b 64 e3 2a bc a5 33 79 f6 de aa 0f |...l.d.*..3y....| Client Write IV[16]: | 3b bd 00 b3 10 4a 52 db 99 05 ab 1a 3d 6b d8 50 |;....JR.....=k.P| Server Write IV[16]: | 8f ac b5 57 44 f8 af 06 ea 48 27 e5 6f 10 2e 02 |...WD....H'.o...| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | 2d 8b f1 9c 1c 52 f9 8a ed 5e 17 c0 7a 73 6e 85 |-....R...^..zsn.| | 35 8b 56 0b 39 d3 ed 58 b4 df a7 ce 63 8a a0 5e |5.V.9..X....c..^| ssl_save_session stored master secret[48]: | e8 7d 8c 6d 99 a1 d7 f4 d9 7e 83 e0 34 ea 06 b0 |.}.m.....~..4...| | 8f 88 6d 8b a7 1f f7 b8 96 74 98 10 06 aa 37 7b |..m......t....7{| | 74 ce 88 53 82 64 b2 66 0f 89 54 ed b4 52 a2 98 |t..S.d.f..T..R..| dissect_ssl3_handshake session keys successfully generated record: offset = 107, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 113, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 14 8a 3e 07 56 39 e1 91 fe 0c 8c 0e eb 30 32 67 |..>.V9.......02g| | 9f e5 91 b9 e9 52 6a e9 66 51 f8 da 5d 8f 54 d8 |.....Rj.fQ..].T.| | 6b 8e 91 88 94 34 2c 3a b3 92 74 74 1b b3 82 1c |k....4,:..tt....| | 64 e6 3f a1 c8 f7 4c 8f 36 18 6c 4c 72 6d 9c de |d.?...L.6.lLrm..| Plaintext[64]: | 14 00 00 24 11 1d 34 ef 97 42 7b 77 5f 8f 03 a2 |...$..4..B{w_...| | d0 8b c5 2d a6 cf 21 74 cf 35 42 0e 80 60 7a f9 |...-..!t.5B..`z.| | e4 50 e4 75 0a 37 ec 6c da e4 4a ad 83 a0 d9 1e |.P.u.7.l..J.....| | 6a 26 8f bd 3b e4 32 dc 9f b1 58 49 00 00 00 03 |j&..;.2...XI....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #442 (first time) conversation = 0x7f2686948090, ssl_session = 0x7f265a96e740 record: offset = 0, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 86 05 27 be bf be 05 18 55 72 cf 19 23 f3 00 46 |..'.....Ur..#..F| | 48 e3 ca 47 17 39 9d 12 04 88 12 11 aa 8b a9 82 |H..G.9..........| | 7f 66 74 98 e8 b3 df b2 94 6b 9e 8d f2 ed a0 1e |.ft......k......| | 89 ba a7 8a fc 2a 34 29 86 a7 f0 5b ef 88 0b a2 |.....*4)...[....| Plaintext[64]: | 14 00 00 24 52 51 98 25 3a 57 ca 13 b9 d0 ce d2 |...$RQ.%:W......| | d0 78 72 9e 64 aa 8d d0 24 8f 52 ae 05 f2 e3 ba |.xr.d...$.R.....| | 3a 5c aa 79 9e 01 ae a9 7c e2 5f 5c f7 7b cf 23 |:\.y....|._\.{.#| | ac a0 c6 09 22 46 71 3c d1 a3 84 67 00 00 00 03 |...."Fq<...g....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #443 (first time) conversation = 0x7f2686948090, ssl_session = 0x7f265a96e740 record: offset = 0, reported_length_remaining = 138 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 38 5c 67 14 ae 01 2f e9 5e fa fc 96 32 9b 85 a6 |8\g.../.^...2...| | ad c5 64 04 94 a1 94 5b 84 97 fc 1f 11 ab c1 6d |..d....[.......m| Plaintext[32]: | 42 6a 00 bf 9d b2 ff 1a d0 63 f5 49 10 02 9b bd |Bj.......c.I....| | 58 ac 6e 49 00 00 00 00 00 00 00 00 00 00 00 0b |X.nI............| ssl_decrypt_record found padding 11 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 34763 found (nil) association_find: TCP port 4481 found 0x345d9c0 record: offset = 37, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 96, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 96 Ciphertext[96]: | db 4f 30 0c ec a8 51 73 4a aa 89 e1 4e 46 d6 74 |.O0...QsJ...NF.t| | fc f7 c9 30 d7 19 d8 f9 e1 e6 85 f9 c7 a5 1f 03 |...0............| | 8f 84 a3 25 96 24 09 f5 44 6a ef 43 67 78 7c 49 |...%.$..Dj.Cgx|I| | 6a e2 a3 ca 5b e3 8c c9 e1 27 6c 6f ad 80 79 c8 |j...[....'lo..y.| | 3f b8 12 a8 3a e5 16 29 42 4c df 2e d3 4d 37 d6 |?...:..)BL...M7.| | b6 68 6a e0 86 a0 f8 f7 e9 f2 57 c6 c4 e6 59 2b |.hj.......W...Y+| Plaintext[96]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa| | 2d 61 65 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 |-aes128-sha.loca| | 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.| | 6e 6c 3a 34 34 38 31 0d 0a 0d 0a 8f 37 4a de 8c |nl:4481.....7J..| | db bd 9c 36 da 0c 68 6b 70 9c b0 a0 a1 83 e8 00 |...6..hkp.......| ssl_decrypt_record found padding 0 final len 95 checking mac (len 75, version 300, ct 23 seq 2) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 75, seq = 0, nxtseq = 75 association_find: TCP port 34763 found (nil) association_find: TCP port 4481 found 0x345d9c0 dissect_ssl3_record decrypted len 75 decrypted app data fragment[75]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa| | 2d 61 65 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 |-aes128-sha.loca| | 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.| | 6e 6c 3a 34 34 38 31 0d 0a 0d 0a |nl:4481.... | dissect_ssl3_record found association 0x345d9c0 dissect_ssl enter frame #444 (first time) conversation = 0x7f2686948090, ssl_session = 0x7f265a96e740 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | a2 4b 75 a3 d0 a1 34 5b 4f 62 f1 ba 5c 71 3a b2 |.Ku...4[Ob..\q:.| | b4 71 16 69 66 03 8c 84 b0 44 20 c4 38 f9 26 e5 |.q.if....D .8.&.| | af c0 8a a9 64 d6 cc ec 75 18 cf 32 34 79 40 49 |....d...u..24y@I| | 3d da 90 d4 f9 b3 be fc 39 c2 10 f3 28 48 b5 d2 |=.......9...(H..| | 6e ca 8f 08 ee 17 e0 6d 32 bc 9a 6f d2 e3 e2 3e |n......m2..o...>| | eb bb b6 63 ab 3f 57 52 9e bd a5 a5 af c5 1f e3 |...c.?WR........| | e2 54 84 3f 66 cd f8 2e 1e 6d 5c c0 d4 20 68 a0 |.T.?f....m\.. h.| | f2 64 2a 92 0a 97 35 b1 a6 5a 5d 53 d2 c5 97 db |.d*...5..Z]S....| | e6 57 94 9d 13 34 fc ee 29 dd 88 4e bb 56 c5 6d |.W...4..)..N.V.m| | 5c 08 4c f8 a5 61 b9 4b 89 07 16 73 d8 d3 8e b6 |\.L..a.K...s....| | 47 f5 5f d7 83 d2 91 3d 63 f8 2e 68 d9 dd 0e 9c |G._....=c..h....| | 8b f8 9e f3 dd 1f 52 f6 ec 5a 16 c0 dc 31 75 f3 |......R..Z...1u.| | 04 86 30 77 08 ef 36 25 e3 28 94 15 54 48 4a 19 |..0w..6%.(..THJ.| | 68 02 12 db f5 27 f2 42 53 75 8f d1 4a 94 7c 5d |h....'.BSu..J.|]| | 46 6f cc 55 2d 54 cf ca df 7b 35 b3 9d c8 23 ab |Fo.U-T...{5...#.| | 8e 5c 68 6a 47 e1 d3 ad 11 90 ef 9c 79 f3 6e 42 |.\hjG.......y.nB| | f5 be 76 5d 04 ae 7a d8 04 90 54 ff 84 ac 58 b0 |..v]..z...T...X.| | 5d eb b8 48 52 cb 8a 2f f1 7b 31 c5 12 68 50 34 |]..HR../.{1..hP4| | dc 17 c5 56 77 d6 6c 9b d1 60 87 c4 c0 03 73 e7 |...Vw.l..`....s.| | 42 86 92 f0 fc 28 91 9e 35 a1 83 ea 24 e6 78 9a |B....(..5...$.x.| | de 22 2d e3 9d bb c4 40 9f c4 f8 e8 02 36 98 02 |."-....@.....6..| | 9e 10 fc 66 10 df 4a b4 a9 56 53 24 bd 5b db 25 |...f..J..VS$.[.%| | 52 b1 d9 58 82 7a be ea 9a 64 be 51 c9 52 93 a5 |R..X.z...d.Q.R..| | 61 8d d5 1d 20 70 28 24 84 fc 0f d5 9a 37 b2 28 |a... p($.....7.(| Plaintext[384]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:22 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 30 34 20 2d 20 45 43 44 48 2d |xC0,0x04 - ECDH-| | 45 43 44 53 41 2d 41 45 53 31 32 38 2d 53 48 41 |ECDSA-AES128-SHA| | 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH| | 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E| | 6e 63 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 |nc=AES(128) Mac| | 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA11.| | 4e 83 26 de 79 21 70 43 e2 73 c3 de d5 3d 4c 4f |N.&.y!pC.s...=LO| | 44 df 00 00 00 00 00 00 00 00 00 00 00 00 00 0d |D...............| ssl_decrypt_record found padding 13 final len 370 checking mac (len 350, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 350, seq = 0, nxtseq = 350 association_find: TCP port 4481 found 0x345d9c0 dissect_ssl3_record decrypted len 350 decrypted app data fragment[350]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:22 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 30 34 20 2d 20 45 43 44 48 2d |xC0,0x04 - ECDH-| | 45 43 44 53 41 2d 41 45 53 31 32 38 2d 53 48 41 |ECDSA-AES128-SHA| | 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH| | 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E| | 6e 63 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 |nc=AES(128) Mac| | 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1 | dissect_ssl3_record found association 0x345d9c0 dissect_ssl enter frame #445 (first time) conversation = 0x7f2686948090, ssl_session = 0x7f265a96e740 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 3d da d0 95 ba c3 02 e3 83 40 f1 a4 d0 e2 dd da |=........@......| | 3a 61 d8 28 10 f7 80 ba 89 7d 26 a0 6d 19 6b bf |:a.(.....}&.m.k.| Plaintext[32]: | 01 00 95 dd d4 0d 31 bf c6 ea f1 a9 8c 42 fd 29 |......1......B.)| | 53 52 b7 96 fe fd 00 00 00 00 00 00 00 00 00 09 |SR..............| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #447 (first time) conversation = 0x7f2686948090, ssl_session = 0x7f265a96e740 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | fb 05 a2 81 5a cb 4e 42 1e 4a 07 2d 44 95 da 5b |....Z.NB.J.-D..[| | 21 51 e1 38 a1 91 9c 9b 2f 35 c1 91 d2 59 8b 50 |!Q.8..../5...Y.P| Plaintext[32]: | 01 00 33 69 60 8c d3 fc 4a db 2c 83 0f 99 52 06 |..3i`...J.,...R.| | a8 b5 3c 50 25 67 00 00 00 00 00 00 00 00 00 09 |.. state 0x01 dissect_ssl enter frame #454 (first time) conversation = 0x7f26869483f0, ssl_session = 0x7f265a970f00 record: offset = 0, reported_length_remaining = 580 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0xC005 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 494 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 480, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 476 bytes, remaining 571 record: offset = 571, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 576 length 0 bytes, remaining 580 dissect_ssl enter frame #456 (first time) conversation = 0x7f26869483f0, ssl_session = 0x7f265a970f00 record: offset = 0, reported_length_remaining = 182 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 102, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 98 bytes, remaining 107 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 523497161056a154f59d2d185ee4c09f9469c0af6f588a4e... looking for RSA pre-master6104da42fca8fb2b9867a2cc88604edbc52a3599d036eb77... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971568edf373b61bc5ad23adced91be40231158d90cf25c26bd04b2bf8e5 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822a2f3d6e9c8c521a0 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715064b708db7aa9cef48ec8a9bf517e7392e7ee9a35062ce7bb2523787 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715790ce6d17391606acd8b094886563f27a8996fa6c96e2b99876c41a9 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715331fb5a174085ae52bbe3d725ace224182d655998abe8023d7f2bc0a 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971614ca4762f9bd4dbd73b749b3de5971deaff2aded5e287130aa5cfce8 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971618d66ee5fc31f776c8a738bc8fa9f814928f810132568d2d13f7d3c6 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497165c84a778f75147dcfa77cc53cae36771b51e8449eba9fb5ed19cbfb1 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716d5b1c0e0cc0bcb19610b6161a0c61d611a3109055501508d5b53cc04 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716fb2b23f18526271e78e3279be8200762333aa441bfe3e350d788a297 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716e114ef8c729d3959e2b6e238e9ac4b7cf212b5b2e0116c18c8a7d447 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497161056a154f59d2d185ee4c09f9469c0af6f588a4e8783243504b51b86 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 ssl3_prf: sha1_hash(6) ssl3_prf: md5_hash(6) datalen 48 ssl3_prf: sha1_hash(7) ssl3_prf: md5_hash(7) datalen 48 ssl3_prf: sha1_hash(8) ssl3_prf: md5_hash(8) datalen 48 ssl3_prf: sha1_hash(9) ssl3_prf: md5_hash(9) datalen 48 key expansion[136]: | d7 e7 9c 52 01 79 08 36 6b 93 96 b2 5f 14 c2 93 |...R.y.6k..._...| | 21 67 3a 51 a4 ed 45 0b 75 d5 b3 08 c7 bc 40 c3 |!g:Q..E.u.....@.| | 41 7f ec c8 a9 f4 23 6e c1 09 eb bb b6 34 03 74 |A.....#n.....4.t| | ef 15 5d 8a a3 eb 0f c7 52 17 8e 4e de ca 08 93 |..].....R..N....| | b5 c2 03 3a b8 f7 f4 c3 6d ba 65 fb 97 e0 35 54 |...:....m.e...5T| | ad df 38 78 8c c0 95 5d d4 23 1b ab ea 16 19 5b |..8x...].#.....[| | 6a 3c 4b 02 4e fb 6d 6d e1 fb ef e2 77 75 6d 96 |jr..5NVM..!.3| | c2 0c 1d 6a 7b b1 76 7b 55 5d 7a d0 a5 32 2b 1a |...j{.v{U]z..2+.| | c9 b9 00 b4 03 30 b0 2b d2 75 ca 24 a5 59 af e2 |.....0.+.u.$.Y..| | f0 a8 01 81 8e fc 42 61 e6 38 ed 24 10 dc fd 21 |......Ba.8.$...!| Plaintext[64]: | 14 00 00 24 08 8b 3d f7 71 02 45 44 ce 3f d0 d9 |...$..=.q.ED.?..| | 23 8f d6 59 05 59 22 01 f5 ef cc 35 3f f8 9e e4 |#..Y.Y"....5?...| | af f0 64 11 34 72 bd a1 aa 23 bf 95 51 96 42 21 |..d.4r...#..Q.B!| | f4 22 7b 80 b9 b7 17 05 da 4e 12 7e 00 00 00 03 |."{......N.~....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #458 (first time) conversation = 0x7f26869483f0, ssl_session = 0x7f265a970f00 record: offset = 0, reported_length_remaining = 138 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 48 b6 32 ad 6e 93 7b e9 c6 10 fe af 1b 7f 94 83 |H.2.n.{.........| | 67 ea f8 0a 54 fe 95 37 f5 15 a8 f4 77 33 2f 6b |g...T..7....w3/k| Plaintext[32]: | 94 c3 c0 45 fd 71 41 8f 06 b8 23 0b 48 53 fc 50 |...E.qA...#.HS.P| | d1 60 7b e7 00 00 00 00 00 00 00 00 00 00 00 0b |.`{.............| ssl_decrypt_record found padding 11 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 60347 found (nil) association_find: TCP port 4482 found 0x345da50 record: offset = 37, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 96, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 96 Ciphertext[96]: | f5 82 d3 b7 71 42 74 27 d0 d2 cf 58 9f 48 58 73 |....qBt'...X.HXs| | e2 68 c8 f5 ab 99 f7 a0 d5 de 7b 8b 1b dd ac f6 |.h........{.....| | 68 65 3c c9 9b 8b f4 05 10 a3 26 e8 83 21 6c 5e |he<.......&..!l^| | b8 f0 26 23 fb 72 c4 c3 9f f8 ec e3 c3 f7 47 d6 |..&#.r........G.| | b8 d5 a3 61 25 aa 83 6e cd 57 9a 69 f7 b2 cc 5b |...a%..n.W.i...[| | 41 c6 b9 94 a6 f2 4c 0f 3b 62 7a 2c e2 d4 35 8e |A.....L.;bz,..5.| Plaintext[96]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa| | 2d 61 65 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 |-aes256-sha.loca| | 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.| | 6e 6c 3a 34 34 38 32 0d 0a 0d 0a 95 48 47 58 41 |nl:4482.....HGXA| | f6 b7 29 eb 31 e0 d6 18 97 5f 65 81 b3 f8 a1 00 |..).1...._e.....| ssl_decrypt_record found padding 0 final len 95 checking mac (len 75, version 300, ct 23 seq 2) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 75, seq = 0, nxtseq = 75 association_find: TCP port 60347 found (nil) association_find: TCP port 4482 found 0x345da50 dissect_ssl3_record decrypted len 75 decrypted app data fragment[75]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa| | 2d 61 65 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 |-aes256-sha.loca| | 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.| | 6e 6c 3a 34 34 38 32 0d 0a 0d 0a |nl:4482.... | dissect_ssl3_record found association 0x345da50 dissect_ssl enter frame #459 (first time) conversation = 0x7f26869483f0, ssl_session = 0x7f265a970f00 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | 0c 46 b2 8c 64 d4 e4 6d a4 17 f8 37 f9 43 9a de |.F..d..m...7.C..| | d3 de f6 7c cb cf d8 ab 81 ca f3 4e cc 14 c1 94 |...|.......N....| | 59 20 fe 27 a1 0d d4 b0 64 53 f1 2a 1c 7f be a6 |Y .'....dS.*....| | 65 e7 80 c0 33 3b de 22 e6 64 b1 df d2 9f e3 9a |e...3;.".d......| | cb 28 12 da 48 b5 b6 7e 3e 9d 89 93 30 eb 15 04 |.(..H..~>...0...| | d9 41 63 a4 62 ee ca 3f 8c 6b 04 47 48 5c e9 58 |.Ac.b..?.k.GH\.X| | aa b8 95 ad 73 31 fc 99 7a 9e af b7 d1 3e ff 36 |....s1..z....>.6| | 76 85 0d 3e f4 14 07 f3 72 3a ef 9c 53 66 f7 dd |v..>....r:..Sf..| | 69 be 73 a9 65 b5 bd e3 4b 87 5a 72 92 f1 49 8e |i.s.e...K.Zr..I.| | 87 fe 62 71 ed 18 9d a7 23 94 14 d2 72 c9 b9 e2 |..bq....#...r...| | 95 c2 a3 98 06 72 e5 26 ff af 29 7c 4d f2 f7 78 |.....r.&..)|M..x| | 6c fe 3d 7f 1c 85 a3 21 32 e6 7a 95 39 a0 10 75 |l.=....!2.z.9..u| | 25 0d 00 3e 40 86 9f 54 57 75 d8 a9 ba 69 75 36 |%..>@..TWu...iu6| | 96 11 52 b9 cb 12 1b e7 07 6a 9a 4a 02 4c 65 85 |..R......j.J.Le.| | 05 59 8d 74 1d b2 bb 77 c6 5c aa 5b cc f7 bd 74 |.Y.t...w.\.[...t| | ab bf bb 2e 0a 6c dc d2 6d f8 6b d4 6c 65 de 46 |.....l..m.k.le.F| | 7b 33 0c 09 11 56 47 65 24 16 11 9d 30 f7 27 23 |{3...VGe$...0.'#| | 85 45 d2 a1 5e e1 68 dc d2 2f 94 91 a1 88 f6 a3 |.E..^.h../......| | 62 e4 14 c7 89 d9 7c a3 2d 3d c8 1a a8 ba 02 ad |b.....|.-=......| | 5a ac 7f 2a 7c a5 1e 5f dc 7d ed 9d 8b 13 65 b6 |Z..*|.._.}....e.| | 87 3d ed 6b 2f 09 c8 52 7e c1 d6 38 44 af fe 7b |.=.k/..R~..8D..{| | fb e1 40 de c2 b6 a5 6b 9e 0e 25 3e 43 57 73 3d |..@....k..%>CWs=| | a6 21 e4 c8 da 84 7e d2 1a ff 25 53 e8 33 98 19 |.!....~...%S.3..| | d3 94 c9 2a f5 8d a9 fe 4e b7 3c c3 3c 1c fa cf |...*....N.<.<...| Plaintext[384]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:22 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 30 35 20 2d 20 45 43 44 48 2d |xC0,0x05 - ECDH-| | 45 43 44 53 41 2d 41 45 53 32 35 36 2d 53 48 41 |ECDSA-AES256-SHA| | 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH| | 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E| | 6e 63 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 |nc=AES(256) Mac| | 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1..| | e7 d5 d3 39 cd c6 05 e0 4b 2a 7d b9 03 d2 bf 66 |...9....K*}....f| | 00 91 00 00 00 00 00 00 00 00 00 00 00 00 00 0d |................| ssl_decrypt_record found padding 13 final len 370 checking mac (len 350, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 350, seq = 0, nxtseq = 350 association_find: TCP port 4482 found 0x345da50 dissect_ssl3_record decrypted len 350 decrypted app data fragment[350]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:22 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 30 35 20 2d 20 45 43 44 48 2d |xC0,0x05 - ECDH-| | 45 43 44 53 41 2d 41 45 53 32 35 36 2d 53 48 41 |ECDSA-AES256-SHA| | 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH| | 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E| | 6e 63 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 |nc=AES(256) Mac| | 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1 | dissect_ssl3_record found association 0x345da50 dissect_ssl enter frame #460 (first time) conversation = 0x7f26869483f0, ssl_session = 0x7f265a970f00 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | ff 47 73 57 c4 1b 72 4b 85 a6 0a 28 c0 84 8f e0 |.GsW..rK...(....| | 44 c9 91 69 3e b7 13 ab 1e 46 d8 c7 f8 61 2b 15 |D..i>....F...a+.| Plaintext[32]: | 01 00 65 bd aa 5e 0e 3e b6 fe b8 48 09 58 37 a0 |..e..^.>...H.X7.| | 8f 09 90 a7 f9 04 00 00 00 00 00 00 00 00 00 09 |................| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #462 (first time) conversation = 0x7f26869483f0, ssl_session = 0x7f265a970f00 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 65 e3 b2 c5 bc 2b 1c 7d 72 79 35 53 34 8b 5e ac |e....+.}ry5S4.^.| | 67 d2 93 7f 23 03 14 67 6a 24 6d 66 67 b9 5a 3f |g...#..gj$mfg.Z?| Plaintext[32]: | 01 00 2c 3c 1f 04 39 71 f0 aa f0 96 ab 9a 05 41 |..,<..9q.......A| | 3e cd d4 36 85 61 00 00 00 00 00 00 00 00 00 09 |>..6.a..........| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 3) ssl_decrypt_record: mac ok dissect_ssl enter frame #467 (first time) ssl_session_init: initializing ptr 0x7f265a9736c0 size 688 conversation = 0x7f2686948750, ssl_session = 0x7f265a9736c0 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 42282 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4483 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #469 (first time) conversation = 0x7f2686948750, ssl_session = 0x7f265a9736c0 record: offset = 0, reported_length_remaining = 763 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0xC007 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 677 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 480, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 476 bytes, remaining 571 record: offset = 571, reported_length_remaining = 192 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 178, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 576 length 174 bytes, remaining 754 record: offset = 754, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 759 length 0 bytes, remaining 763 dissect_ssl enter frame #471 (first time) conversation = 0x7f2686948750, ssl_session = 0x7f265a9736c0 record: offset = 0, reported_length_remaining = 146 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 70, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 52349717c69164e151a28d72939e3acd50c81c72d48489c0... looking for RSA pre-master410450e94aaac0f7210244abddfdfb0f19b8595d0168eda3... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971568edf373b61bc5ad23adced91be40231158d90cf25c26bd04b2bf8e5 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822a2f3d6e9c8c521a0 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715064b708db7aa9cef48ec8a9bf517e7392e7ee9a35062ce7bb2523787 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715790ce6d17391606acd8b094886563f27a8996fa6c96e2b99876c41a9 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715331fb5a174085ae52bbe3d725ace224182d655998abe8023d7f2bc0a 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971614ca4762f9bd4dbd73b749b3de5971deaff2aded5e287130aa5cfce8 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971618d66ee5fc31f776c8a738bc8fa9f814928f810132568d2d13f7d3c6 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497165c84a778f75147dcfa77cc53cae36771b51e8449eba9fb5ed19cbfb1 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716d5b1c0e0cc0bcb19610b6161a0c61d611a3109055501508d5b53cc04 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716fb2b23f18526271e78e3279be8200762333aa441bfe3e350d788a297 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716e114ef8c729d3959e2b6e238e9ac4b7cf212b5b2e0116c18c8a7d447 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497161056a154f59d2d185ee4c09f9469c0af6f588a4e8783243504b51b86 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716eb24840713b5a9817fbc8cf71d9db1fcfb410da480bb4f09e655975a 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717c69164e151a28d72939e3acd50c81c72d48489c0c5c8414a6d2e3d62 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 key expansion[72]: | c9 78 f8 5d 27 64 c2 ea bc 48 bf 2d d7 02 0a 1f |.x.]'d...H.-....| | 57 35 a5 cb d4 c1 c1 c5 fd 6c 82 59 ac ac 31 24 |W5.......l.Y..1$| | 96 f6 17 cd 8f 6e 2f b5 00 4a 0b f7 9a 1a 3c d9 |.....n/..J....<.| | 9c 20 d7 28 7b 4c ad 51 9b ad d8 be 43 08 bb 71 |. .({L.Q....C..q| | 98 13 58 dd 71 16 71 51 |..X.q.qQ | Client MAC key[20]: | c9 78 f8 5d 27 64 c2 ea bc 48 bf 2d d7 02 0a 1f |.x.]'d...H.-....| | 57 35 a5 cb |W5.. | Server MAC key[20]: | d4 c1 c1 c5 fd 6c 82 59 ac ac 31 24 96 f6 17 cd |.....l.Y..1$....| | 8f 6e 2f b5 |.n/. | Client Write key[16]: | 00 4a 0b f7 9a 1a 3c d9 9c 20 d7 28 7b 4c ad 51 |.J....<.. .({L.Q| Server Write key[16]: | 9b ad d8 be 43 08 bb 71 98 13 58 dd 71 16 71 51 |....C..q..X.q.qQ| Client Write IV[8]: | 00 00 00 00 00 00 00 00 |........ | Server Write IV[8]: | e0 65 76 03 00 00 00 00 |.ev..... | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: ARCFOUR decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: ARCFOUR decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | 07 00 d9 24 de cc ec 1a 6b d5 5a ee ef f6 55 cc |...$....k.Z...U.| | c2 c2 36 88 50 f6 c1 30 6a bd 53 56 df 5f 80 62 |..6.P..0j.SV._.b| ssl_save_session stored master secret[48]: | 46 75 96 42 7d 0f 4f e4 40 d0 02 de 21 59 3b 8d |Fu.B}.O.@...!Y;.| | 9b 01 fe 08 cc 75 2f a9 61 fb 8a 55 f5 da 73 c6 |.....u/.a..U..s.| | aa 36 c9 af 4d 22 bb 37 1d bf 9b b5 c5 07 66 ef |.6..M".7......f.| dissect_ssl3_handshake session keys successfully generated record: offset = 75, reported_length_remaining = 71 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 81, reported_length_remaining = 65 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 60, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 60 Ciphertext[60]: | e7 67 f3 fc ff b1 11 eb e0 05 92 38 90 50 62 91 |.g.........8.Pb.| | 89 d0 56 04 91 bc da d7 70 83 a2 0a 70 e7 50 db |..V.....p...p.P.| | 5a 45 6c de e8 69 38 f1 fb d7 20 c0 c1 ee 4d 34 |ZEl..i8... ...M4| | 36 be 04 28 2d 80 b0 b3 58 26 c1 d6 |6..(-...X&.. | Plaintext[60]: | 14 00 00 24 4a 60 ff 91 65 5d 27 f1 f2 97 25 c0 |...$J`..e]'...%.| | b4 f2 b1 66 90 36 9a 52 e8 24 fb 1c 7c 5e c0 66 |...f.6.R.$..|^.f| | 2b 74 37 f2 86 60 f4 0c 4f 52 39 a0 97 93 bf 39 |+t7..`..OR9....9| | 14 b7 64 a6 9e e1 31 7e f8 27 63 c1 |..d...1~.'c. | checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #472 (first time) conversation = 0x7f2686948750, ssl_session = 0x7f265a9736c0 record: offset = 0, reported_length_remaining = 71 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 65 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 60, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 60 Ciphertext[60]: | 65 de 70 e2 8d df 63 38 d8 76 17 aa 26 8c 7c 4a |e.p...c8.v..&.|J| | 2b 07 5d 64 8c b8 be 5a 9f 38 18 32 28 ab 4c 29 |+.]d...Z.8.2(.L)| | ed 69 fb 57 26 a0 35 be fc c3 65 cf 8f 12 be ca |.i.W&.5...e.....| | 37 ee e9 2b b4 c0 a5 bf 29 1b 25 bf |7..+....).%. | Plaintext[60]: | 14 00 00 24 e1 ee 0c c3 1a 3c c7 6c eb 52 9d 7c |...$.....<.l.R.|| | 48 0f 2b ce d1 0d 73 c0 b2 37 5d cf 15 03 5c 44 |H.+...s..7]...\D| | 6c 0d 06 33 bc 45 09 dc 2b 43 1e c3 6d eb 65 cf |l..3.E..+C..m.e.| | 84 1e cf 57 0c 8c d8 fb 2c e9 78 3e |...W....,.x> | checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #473 (first time) conversation = 0x7f2686948750, ssl_session = 0x7f265a9736c0 record: offset = 0, reported_length_remaining = 98 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 93, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 93 Ciphertext[93]: | 49 26 88 96 1e 47 35 a3 03 ca 92 ea c5 02 99 b7 |I&...G5.........| | e0 9d 54 9a bf 1d a4 4d 86 f8 0e 0c 8c 5c d0 93 |..T....M.....\..| | d1 9c f7 bf 6c 13 69 6e c6 1e bd e9 90 11 dc 09 |....l.in........| | df 2c f0 ca e2 3b ed dc fe 48 0e 23 7e bb dc 2b |.,...;...H.#~..+| | 55 68 d6 b8 71 cb 80 1c 94 84 c2 66 e1 ad fe 87 |Uh..q......f....| | 4f dd cd b1 d7 da ac 63 b0 e5 64 76 84 |O......c..dv. | Plaintext[93]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds| | 61 2d 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e |a-rc4-sha.local.| | 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c |al.lekensteyn.nl| | 3a 34 34 38 33 0d 0a 0d 0a 28 d7 41 c2 ab 3c f0 |:4483....(.A..<.| | 23 b2 a5 ad 00 87 29 33 43 41 24 af b6 |#.....)3CA$.. | checking mac (len 73, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 73, seq = 0, nxtseq = 73 association_find: TCP port 42282 found (nil) association_find: TCP port 4483 found 0x345dae0 dissect_ssl3_record decrypted len 73 decrypted app data fragment[73]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds| | 61 2d 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e |a-rc4-sha.local.| | 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c |al.lekensteyn.nl| | 3a 34 34 38 33 0d 0a 0d 0a |:4483.... | dissect_ssl3_record found association 0x345dae0 dissect_ssl enter frame #474 (first time) conversation = 0x7f2686948750, ssl_session = 0x7f265a9736c0 record: offset = 0, reported_length_remaining = 374 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 369, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 369 Ciphertext[369]: | b4 11 97 89 51 fa 8b ba e8 ed 1b a7 92 ff 2e e8 |....Q...........| | 3b 2f 3e 2d a5 7e c2 4c fa 69 03 8f ee 96 fe cf |;/>-.~.L.i......| | ff 27 04 92 b1 95 9f 31 c4 a1 64 1b 0d 46 42 71 |.'.....1..d..FBq| | 5d 07 17 e0 d2 ab ff 91 72 93 df 26 1e 4a e1 05 |].......r..&.J..| | 17 8e 9d 1d 72 0b 17 6e c5 53 34 13 d3 53 5a 67 |....r..n.S4..SZg| | e3 8d 50 f7 9d 37 41 c1 55 fd a3 ff 0a df fa 67 |..P..7A.U......g| | 64 33 02 03 e9 8d c5 e7 9e 17 55 9a 8e d1 6f 63 |d3........U...oc| | 7a b1 0b b7 af f7 7a 79 14 2c 30 5d 44 ea 03 e0 |z.....zy.,0]D...| | 11 03 1e 49 91 ff 7e 19 a7 b8 23 cc 14 c4 c4 9c |...I..~...#.....| | f5 64 08 2a 03 28 fc d9 c3 00 8a 81 07 2c 36 67 |.d.*.(.......,6g| | 53 e7 f4 a6 ae fd c8 15 7d 62 24 65 d5 ee e3 bc |S.......}b$e....| | ce 57 29 80 90 81 87 91 60 a8 5b 4a d2 3e b1 3d |.W).....`.[J.>.=| | 98 47 eb 80 40 69 f6 48 f0 37 59 7b c0 e2 be 42 |.G..@i.H.7Y{...B| | 1e 33 18 1f a6 a7 a4 00 4a 42 b6 95 09 fd 6a 47 |.3......JB....jG| | 23 dd 75 4b 8b 3c 78 5b 00 5a 7c 5c 0a 93 69 d1 |#.uK...@.I*[...n..| | db 86 49 65 62 fa 43 52 e1 e8 5d 60 0d 3f 7d 68 |..Ieb.CR..]`.?}h| | 01 de a7 c3 4f 56 a6 ac 18 c0 3e da 21 1d c8 40 |....OV....>.!..@| | 92 9e 0b 0d 23 dd 68 c8 ca 75 be 73 94 98 80 a8 |....#.h..u.s....| | 1b 27 31 15 2f c1 ff 3b 4a e6 7c 68 21 19 6c 3c |.'1./..;J.|h!.l<| | da 11 67 df 07 1e 41 21 3c 47 41 7b fe 15 50 9b |..g...A!docu| | 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 |ment.domain='loc| | 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn| | 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e ff 87 5a |.nl'..Z| | a4 f1 c2 e7 2a 65 34 aa 22 f4 76 62 29 dc f5 74 |....*e4.".vb)..t| | 12 |. | checking mac (len 349, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 349, seq = 0, nxtseq = 349 association_find: TCP port 4483 found 0x345dae0 dissect_ssl3_record decrypted len 349 decrypted app data fragment[349]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:23 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 32 0d 0a 43 6f 6e 6e 65 63 74 |th: 142..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 30 37 20 2d 20 45 43 44 48 45 |xC0,0x07 - ECDHE| | 2d 45 43 44 53 41 2d 52 43 34 2d 53 48 41 20 20 |-ECDSA-RC4-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH| | 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 6e | Au=ECDSA En| | 63 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d |c=RC4(128) Mac=| | 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 |SHA1 | dissect_ssl3_record found association 0x345dae0 dissect_ssl enter frame #475 (first time) conversation = 0x7f2686948750, ssl_session = 0x7f265a9736c0 record: offset = 0, reported_length_remaining = 27 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 22, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 22 Ciphertext[22]: | e9 cb bf 35 91 a3 f8 4c 59 19 05 b6 6d 97 a1 15 |...5...LY...m...| | 13 11 85 95 aa 53 |.....S | Plaintext[22]: | 01 00 6a ef e6 46 98 b2 ce 07 5d 8a 44 81 b7 82 |..j..F....].D...| | 3a b2 22 d8 1b d1 |:."... | checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #477 (first time) conversation = 0x7f2686948750, ssl_session = 0x7f265a9736c0 record: offset = 0, reported_length_remaining = 27 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 22, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 22 Ciphertext[22]: | f9 2e 5a 06 ff 85 74 c2 c8 19 b8 3c 91 a4 4a df |..Z...t....<..J.| | 2a 81 c1 72 bb 4a |*..r.J | Plaintext[22]: | 01 00 fa 0c e0 3b 25 dc f6 5e 66 09 21 d3 39 cb |.....;%..^f.!.9.| | ea 91 dc c6 f2 82 |...... | checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #482 (first time) ssl_session_init: initializing ptr 0x7f265a975dd0 size 688 conversation = 0x7f2686948aa8, ssl_session = 0x7f265a975dd0 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 36004 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4484 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #484 (first time) conversation = 0x7f2686948aa8, ssl_session = 0x7f265a975dd0 record: offset = 0, reported_length_remaining = 763 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0xC008 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 677 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 480, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 476 bytes, remaining 571 record: offset = 571, reported_length_remaining = 192 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 178, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 576 length 174 bytes, remaining 754 record: offset = 754, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 759 length 0 bytes, remaining 763 dissect_ssl enter frame #486 (first time) conversation = 0x7f2686948aa8, ssl_session = 0x7f265a975dd0 record: offset = 0, reported_length_remaining = 150 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 70, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 52349717e2661941933437161045002d21486fe34e7a6a86... looking for RSA pre-master41041a0c2f48f1e2329f14c836b578df11e10d5f2653f35f... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971568edf373b61bc5ad23adced91be40231158d90cf25c26bd04b2bf8e5 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822a2f3d6e9c8c521a0 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715064b708db7aa9cef48ec8a9bf517e7392e7ee9a35062ce7bb2523787 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715790ce6d17391606acd8b094886563f27a8996fa6c96e2b99876c41a9 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715331fb5a174085ae52bbe3d725ace224182d655998abe8023d7f2bc0a 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971614ca4762f9bd4dbd73b749b3de5971deaff2aded5e287130aa5cfce8 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971618d66ee5fc31f776c8a738bc8fa9f814928f810132568d2d13f7d3c6 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497165c84a778f75147dcfa77cc53cae36771b51e8449eba9fb5ed19cbfb1 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716d5b1c0e0cc0bcb19610b6161a0c61d611a3109055501508d5b53cc04 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716fb2b23f18526271e78e3279be8200762333aa441bfe3e350d788a297 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716e114ef8c729d3959e2b6e238e9ac4b7cf212b5b2e0116c18c8a7d447 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497161056a154f59d2d185ee4c09f9469c0af6f588a4e8783243504b51b86 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716eb24840713b5a9817fbc8cf71d9db1fcfb410da480bb4f09e655975a 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717c69164e151a28d72939e3acd50c81c72d48489c0c5c8414a6d2e3d62 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497170f4d7595e4dd322804591e101abc2f8458461bd60bcd7efeb43c19f7 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717e2661941933437161045002d21486fe34e7a6a8661ca1a945c2376dd 17ACC42B028145A2CD35A64E821F89388E625194A652E88E8246CC089A7C51E4E05F90F9ACFB5EDA64A633A3EFD3F3E1 found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 ssl3_prf: sha1_hash(6) ssl3_prf: md5_hash(6) datalen 48 ssl3_prf: sha1_hash(7) ssl3_prf: md5_hash(7) datalen 48 key expansion[104]: | bd 19 4e d0 f7 ea 6a ef ab fc 24 f3 74 03 07 c1 |..N...j...$.t...| | 96 d5 71 24 0a ae 45 6e 28 0c e5 56 e8 c8 99 3d |..q$..En(..V...=| | 13 cc 3d 9b ff 05 dd 60 53 d4 2c 5b 9c 2b 83 87 |..=....`S.,[.+..| | 2f e7 bd dc af 61 66 f2 cc 9a b4 7a 9a aa 15 a7 |/....af....z....| | 79 d9 11 12 99 1a 11 2c 94 27 8a 25 f3 8f 3e f7 |y......,.'.%..>.| | 2b a7 1b 12 68 4e 57 3e 61 23 0c 0c d5 a8 d6 82 |+...hNW>a#......| | b4 12 55 66 6a 3d eb 8c |..Ufj=.. | Client MAC key[20]: | bd 19 4e d0 f7 ea 6a ef ab fc 24 f3 74 03 07 c1 |..N...j...$.t...| | 96 d5 71 24 |..q$ | Server MAC key[20]: | 0a ae 45 6e 28 0c e5 56 e8 c8 99 3d 13 cc 3d 9b |..En(..V...=..=.| | ff 05 dd 60 |...` | Client Write key[24]: | 53 d4 2c 5b 9c 2b 83 87 2f e7 bd dc af 61 66 f2 |S.,[.+../....af.| | cc 9a b4 7a 9a aa 15 a7 |...z.... | Server Write key[24]: | 79 d9 11 12 99 1a 11 2c 94 27 8a 25 f3 8f 3e f7 |y......,.'.%..>.| | 2b a7 1b 12 68 4e 57 3e |+...hNW> | Client Write IV[8]: | 61 23 0c 0c d5 a8 d6 82 |a#...... | Server Write IV[8]: | b4 12 55 66 6a 3d eb 8c |..Ufj=.. | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | 66 2f 21 b1 49 a6 60 44 7a 63 2c e7 fd 63 9a f2 |f/!.I.`Dzc,..c..| | 0a 50 e1 c9 3c 27 8a 54 ba 5b 2e d9 96 06 32 bd |.P..<'.T.[....2.| ssl_save_session stored master secret[48]: | 17 ac c4 2b 02 81 45 a2 cd 35 a6 4e 82 1f 89 38 |...+..E..5.N...8| | 8e 62 51 94 a6 52 e8 8e 82 46 cc 08 9a 7c 51 e4 |.bQ..R...F...|Q.| | e0 5f 90 f9 ac fb 5e da 64 a6 33 a3 ef d3 f3 e1 |._....^.d.3.....| dissect_ssl3_handshake session keys successfully generated record: offset = 75, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 81, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 31 fe 15 e3 66 78 e6 c6 2b a4 17 8e 8d 1f ee 4f |1...fx..+......O| | 7d af fc 1e 1b 6b 3e 02 54 08 5b 3a 30 89 61 f1 |}....k>.T.[:0.a.| | fd 97 69 56 9c fa b3 3c c9 2f d0 c4 0d d1 21 b4 |..iV...<./....!.| | d1 04 8e f2 fd e4 e1 ae e7 46 c7 61 09 08 1c 3c |.........F.a...<| Plaintext[64]: | 14 00 00 24 96 5d 44 6e ac 25 2a d4 6e 6f d7 f8 |...$.]Dn.%*.no..| | 6c 0c d3 4d d8 f1 6f 42 46 56 48 a0 cc 7b ab fa |l..M..oBFVH..{..| | 4f e6 df 4a 0c 2c 4e ae 76 32 36 b0 dc bc 18 f1 |O..J.,N.v26.....| | 25 9b 24 97 d2 12 80 85 1b c9 1b da 00 00 00 03 |%.$.............| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #487 (first time) conversation = 0x7f2686948aa8, ssl_session = 0x7f265a975dd0 record: offset = 0, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 05 fc ae 66 9a 98 94 a1 5d 34 5b 31 d8 4a 74 d0 |...f....]4[1.Jt.| | 1a 34 7d 03 7d 0e 39 8a 88 78 68 fc 28 84 f8 2c |.4}.}.9..xh.(..,| | 2b 2c 0c 8d 24 4c ff eb a6 82 f7 d9 d6 67 8a 9b |+,..$L.......g..| | 36 a7 ee 34 e1 e1 9d 9c 9c d0 1b 62 24 8e 97 7d |6..4.......b$..}| Plaintext[64]: | 14 00 00 24 7a c1 ee e2 e3 ce 06 aa a9 8c 5f 71 |...$z........._q| | 74 50 9f 94 98 1b f9 40 a5 52 6a e8 9b 17 f6 25 |tP.....@.Rj....%| | f6 9d dc 3d 48 63 0f 1e 2f 40 cd b6 d1 e0 3a eb |...=Hc../@....:.| | e5 1e c3 a3 c0 94 c1 93 15 46 d6 33 00 00 00 03 |.........F.3....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #488 (first time) conversation = 0x7f2686948aa8, ssl_session = 0x7f265a975dd0 record: offset = 0, reported_length_remaining = 138 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 24, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 24 Ciphertext[24]: | 3b 70 27 8a 8d 93 d0 ff 2e 42 47 5c 8d ec 44 e9 |;p'......BG\..D.| | cf dd 15 4d 77 b4 25 9e |...Mw.%. | Plaintext[24]: | c3 80 7a 69 13 34 2e 0f 47 a7 6a c6 6f a2 cd 26 |..zi.4..G.j.o..&| | 29 eb 8a b3 00 00 00 03 |)....... | ssl_decrypt_record found padding 3 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 36004 found (nil) association_find: TCP port 4484 found 0x345db70 record: offset = 29, reported_length_remaining = 109 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 104, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 104 Ciphertext[104]: | 6f 68 aa 91 66 45 c2 55 06 c7 0a 1e 4d 23 fb cd |oh..fE.U....M#..| | 54 e0 10 19 4e 14 ad 3f 7f 8b 20 d1 a0 a1 9f cf |T...N..?.. .....| | 11 d7 ff ae 79 ff a4 3f b7 46 3c f3 1b f5 5a 3a |....y..?.F<...Z:| | 94 e7 71 2b 55 d6 22 0b 91 08 7b b1 19 91 0f 2a |..q+U."...{....*| | 02 ad 7e 75 4d 6c 9c 24 d8 e9 6c e2 86 ac 54 ee |..~uMl.$..l...T.| | 1c 40 db bf be 96 b5 36 e0 13 7e 39 a8 da fa e1 |.@.....6..~9....| | 9a 2b 0b 21 dc 65 80 ab |.+.!.e.. | Plaintext[104]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds| | 61 2d 64 65 73 2d 63 62 63 33 2d 73 68 61 2e 6c |a-des-cbc3-sha.l| | 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 |ocal.al.lekenste| | 79 6e 2e 6e 6c 3a 34 34 38 34 0d 0a 0d 0a 34 ab |yn.nl:4484....4.| | 68 fd 9f 19 71 c3 32 65 37 ba ab 6c d7 bd f8 92 |h...q.2e7..l....| | b8 73 00 00 00 00 00 05 |.s...... | ssl_decrypt_record found padding 5 final len 98 checking mac (len 78, version 300, ct 23 seq 2) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 78, seq = 0, nxtseq = 78 association_find: TCP port 36004 found (nil) association_find: TCP port 4484 found 0x345db70 dissect_ssl3_record decrypted len 78 decrypted app data fragment[78]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds| | 61 2d 64 65 73 2d 63 62 63 33 2d 73 68 61 2e 6c |a-des-cbc3-sha.l| | 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 |ocal.al.lekenste| | 79 6e 2e 6e 6c 3a 34 34 38 34 0d 0a 0d 0a |yn.nl:4484.... | dissect_ssl3_record found association 0x345db70 dissect_ssl enter frame #489 (first time) conversation = 0x7f2686948aa8, ssl_session = 0x7f265a975dd0 record: offset = 0, reported_length_remaining = 381 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 376, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 376 Ciphertext[376]: | 53 46 11 26 7f 52 f0 c6 05 61 69 e9 6b 96 52 b8 |SF.&.R...ai.k.R.| | d0 a6 99 44 61 b8 de 9b cb 6a 49 ff 78 8a 2e 76 |...Da....jI.x..v| | 18 78 e9 08 0b f4 5e 9d 7f 38 21 22 3a be 2e 68 |.x....^..8!":..h| | 9d 68 83 26 8f 11 23 c6 82 82 dc 7f 51 71 11 b5 |.h.&..#.....Qq..| | 32 f6 f9 e5 a4 b3 db b2 29 1b cb 1d f2 14 0e 95 |2.......).......| | f3 68 cf 13 69 2a 96 95 f1 e4 87 35 2b 89 0d 93 |.h..i*.....5+...| | 38 c4 c7 c4 af f6 85 f0 15 ae 2a f3 52 fb 1f 8e |8.........*.R...| | a3 36 40 d7 5e bb 18 78 8f 4f 14 93 fb f7 df 58 |.6@.^..x.O.....X| | 13 02 a9 eb bb ae bc c3 57 2c 62 07 2c bf f1 12 |........W,b.,...| | ec 99 ea d4 d7 79 c7 34 57 96 dd e3 95 9c 68 70 |.....y.4W.....hp| | 7f ff 71 43 5b 05 0f a6 6c 81 e2 76 10 a0 5c f8 |..qC[...l..v..\.| | 60 e5 fa bf a2 cb 19 0d cd ed 69 45 fd fd c1 05 |`.........iE....| | b5 cf 04 44 57 c0 39 e8 43 69 d6 23 00 f2 75 45 |...DW.9.Ci.#..uE| | e5 65 4f 53 d0 7b e0 f9 32 16 9c 7f 91 2e 2e d9 |.eOS.{..2.......| | 29 28 8a 55 cd 85 a2 cf b7 de f6 c4 cb 5a 65 af |)(.U.........Ze.| | c9 0a 1e 75 6d 6a 9f 19 76 5c 73 a4 28 78 48 73 |...umj..v\s.(xHs| | 7b 1b d0 7d e5 d2 7f 72 bb dd db e2 2c 13 53 06 |{..}...r....,.S.| | 13 bf 23 d1 d8 05 78 50 e1 42 f0 b7 d9 db 1e 9a |..#...xP.B......| | 45 83 4d 16 5b 46 fe 6a 83 f7 dc e4 e7 9d 49 2b |E.M.[F.j......I+| | 8f f0 72 5f c7 c8 af 5f 89 c1 b6 8d 9c e2 d2 44 |..r_..._.......D| | ed 25 85 1c fb 9e af 7c a9 3a 60 e5 17 1b 55 18 |.%.....|.:`...U.| | c0 d8 c6 25 f3 0e 78 0c 5b d3 08 91 2e a1 08 8c |...%..x.[.......| | 53 d7 bf 43 8f b7 e3 db 60 b2 12 b7 50 4a 43 13 |S..C....`...PJC.| | 37 f5 b7 ae 4e 07 e6 ff |7...N... | Plaintext[376]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:23 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 30 38 20 2d 20 45 43 44 48 45 |xC0,0x08 - ECDHE| | 2d 45 43 44 53 41 2d 44 45 53 2d 43 42 43 33 2d |-ECDSA-DES-CBC3-| | 53 48 41 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 |SHA SSLv3 Kx=ECD| | 48 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 |H Au=ECDSA E| | 6e 63 3d 33 44 45 53 28 31 36 38 29 20 4d 61 63 |nc=3DES(168) Mac| | 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1..| | b8 c7 9f 5c 70 df 90 11 6f 59 ff 15 85 78 62 af |...\p...oY...xb.| | 55 76 00 00 00 00 00 05 |Uv...... | ssl_decrypt_record found padding 5 final len 370 checking mac (len 350, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 350, seq = 0, nxtseq = 350 association_find: TCP port 4484 found 0x345db70 dissect_ssl3_record decrypted len 350 decrypted app data fragment[350]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:23 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 30 38 20 2d 20 45 43 44 48 45 |xC0,0x08 - ECDHE| | 2d 45 43 44 53 41 2d 44 45 53 2d 43 42 43 33 2d |-ECDSA-DES-CBC3-| | 53 48 41 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 |SHA SSLv3 Kx=ECD| | 48 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 |H Au=ECDSA E| | 6e 63 3d 33 44 45 53 28 31 36 38 29 20 4d 61 63 |nc=3DES(168) Mac| | 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1 | dissect_ssl3_record found association 0x345db70 dissect_ssl enter frame #490 (first time) conversation = 0x7f2686948aa8, ssl_session = 0x7f265a975dd0 record: offset = 0, reported_length_remaining = 29 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 24, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 24 Ciphertext[24]: | 6d 3c 62 53 f7 05 f1 bd bb e2 03 6d 8c 17 6b 04 |m state 0x01 dissect_ssl enter frame #499 (first time) conversation = 0x7f2686948e08, ssl_session = 0x7f265a978570 record: offset = 0, reported_length_remaining = 763 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0xC009 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 677 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 480, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 476 bytes, remaining 571 record: offset = 571, reported_length_remaining = 192 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 178, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 576 length 174 bytes, remaining 754 record: offset = 754, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 759 length 0 bytes, remaining 763 dissect_ssl enter frame #501 (first time) conversation = 0x7f2686948e08, ssl_session = 0x7f265a978570 record: offset = 0, reported_length_remaining = 150 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 70, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 52349717cca5aebe07984142824e3d3001e6ffe94357805d... looking for RSA pre-master4104c0ef088268c1b47123d937c022c72b4bdabf267180dd... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971568edf373b61bc5ad23adced91be40231158d90cf25c26bd04b2bf8e5 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822a2f3d6e9c8c521a0 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715064b708db7aa9cef48ec8a9bf517e7392e7ee9a35062ce7bb2523787 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715790ce6d17391606acd8b094886563f27a8996fa6c96e2b99876c41a9 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715331fb5a174085ae52bbe3d725ace224182d655998abe8023d7f2bc0a 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971614ca4762f9bd4dbd73b749b3de5971deaff2aded5e287130aa5cfce8 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971618d66ee5fc31f776c8a738bc8fa9f814928f810132568d2d13f7d3c6 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497165c84a778f75147dcfa77cc53cae36771b51e8449eba9fb5ed19cbfb1 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716d5b1c0e0cc0bcb19610b6161a0c61d611a3109055501508d5b53cc04 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716fb2b23f18526271e78e3279be8200762333aa441bfe3e350d788a297 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716e114ef8c729d3959e2b6e238e9ac4b7cf212b5b2e0116c18c8a7d447 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497161056a154f59d2d185ee4c09f9469c0af6f588a4e8783243504b51b86 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716eb24840713b5a9817fbc8cf71d9db1fcfb410da480bb4f09e655975a 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717c69164e151a28d72939e3acd50c81c72d48489c0c5c8414a6d2e3d62 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497170f4d7595e4dd322804591e101abc2f8458461bd60bcd7efeb43c19f7 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717e2661941933437161045002d21486fe34e7a6a8661ca1a945c2376dd 17ACC42B028145A2CD35A64E821F89388E625194A652E88E8246CC089A7C51E4E05F90F9ACFB5EDA64A633A3EFD3F3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497173cddbc719a19ffd337851a366f113d29ece8ba061d3bb98208e99435 17ACC42B028145A2CD35A64E821F89388E625194A652E88E8246CC089A7C51E4E05F90F9ACFB5EDA64A633A3EFD3F3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717cca5aebe07984142824e3d3001e6ffe94357805d9921b6fda7ae8cde 4B7A19DDE31871A980B9C9DB2826C10777E901D1433A424029FA2703B1BC87AF05A7294E33278FDA439FD75B61E0D913 found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 ssl3_prf: sha1_hash(6) ssl3_prf: md5_hash(6) datalen 48 ssl3_prf: sha1_hash(7) ssl3_prf: md5_hash(7) datalen 48 key expansion[104]: | b2 78 f3 07 7e 37 30 9d ed b9 08 54 89 04 c2 89 |.x..~70....T....| | f6 24 18 9a a7 bb ce b8 77 ac 64 f7 8b 06 ba bb |.$......w.d.....| | c9 33 5d c2 e7 53 49 af 21 91 77 97 41 49 8f ba |.3]..SI.!.w.AI..| | 69 f3 97 5a d3 37 30 bd 95 1d f1 35 5e 8f 15 e8 |i..Z.70....5^...| | 2e 79 6f 79 99 ad 7e 31 36 0a c6 89 7b d2 62 3c |.yoy..~16...{.b<| | 4c 30 09 d5 1b d3 0e a4 eb e7 4d 12 e3 68 ff 8a |L0........M..h..| | ec e1 89 9e 11 08 7c a8 |......|. | Client MAC key[20]: | b2 78 f3 07 7e 37 30 9d ed b9 08 54 89 04 c2 89 |.x..~70....T....| | f6 24 18 9a |.$.. | Server MAC key[20]: | a7 bb ce b8 77 ac 64 f7 8b 06 ba bb c9 33 5d c2 |....w.d......3].| | e7 53 49 af |.SI. | Client Write key[16]: | 21 91 77 97 41 49 8f ba 69 f3 97 5a d3 37 30 bd |!.w.AI..i..Z.70.| Server Write key[16]: | 95 1d f1 35 5e 8f 15 e8 2e 79 6f 79 99 ad 7e 31 |...5^....yoy..~1| Client Write IV[16]: | 36 0a c6 89 7b d2 62 3c 4c 30 09 d5 1b d3 0e a4 |6...{.b./..G.5Gi.Y6l| | a4 2e c0 ce a7 44 4a 8b 60 92 a0 61 d9 ab 31 e9 |.....DJ.`..a..1.| | 60 4d 6e 40 48 8a e8 ce 5f 8f 1c 1a ef 3f 23 3a |`Mn@H..._....?#:| | 95 b4 fa a6 d4 24 ed 88 39 be cf df 8d 3f d9 8f |.....$..9....?..| Plaintext[64]: | 14 00 00 24 d0 c7 5a cd bd 36 94 dd a7 b2 95 c5 |...$..Z..6......| | 01 17 3b 24 ae b4 21 0c 8c da 86 23 a1 bc d4 16 |..;$..!....#....| | de dc c6 49 7b f8 22 ef d5 55 a7 79 53 23 b5 4d |...I{."..U.yS#.M| | f7 28 b5 50 55 d5 36 cf 47 6f 3c a2 00 00 00 03 |.(.PU.6.Go<.....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #502 (first time) conversation = 0x7f2686948e08, ssl_session = 0x7f265a978570 record: offset = 0, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 79 69 d0 ef 4d fe 2e 10 6d 64 d2 1c 91 e5 b1 fc |yi..M...md......| | 77 79 8c a1 88 72 bf 5d c2 fd e7 28 29 12 a3 6b |wy...r.]...()..k| | a0 e5 bf 88 b4 73 36 e8 48 86 b0 e1 f0 cf 1a b8 |.....s6.H.......| | 89 65 a4 87 ce 37 a6 59 de 54 e1 bd 9b 5f 0b 7b |.e...7.Y.T..._.{| Plaintext[64]: | 14 00 00 24 56 cb 2f 3f 36 86 7e 03 47 00 ee 82 |...$V./?6.~.G...| | 7e ec 5d 40 61 11 3c 22 ec 0f 89 69 bc 0e a2 3e |~.]@a.<"...i...>| | 9f 2d b6 58 29 74 f4 1f f6 af 92 75 10 27 2f 75 |.-.X)t.....u.'/u| | 62 9e cc 94 52 3a 0d 83 df 72 c3 99 00 00 00 03 |b...R:...r......| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #503 (first time) conversation = 0x7f2686948e08, ssl_session = 0x7f265a978570 record: offset = 0, reported_length_remaining = 154 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | f0 0c 46 79 12 41 53 93 56 a3 4a 45 d5 c2 2e e4 |..Fy.AS.V.JE....| | 1d 06 3a dd 14 eb 71 db c4 11 ce 88 50 d5 a7 2f |..:...q.....P../| Plaintext[32]: | 1f ce 5d 7e 40 0c ff 25 9a de eb 19 99 35 78 0f |..]~@..%.....5x.| | 00 e5 22 16 00 00 00 00 00 00 00 00 00 00 00 0b |..".............| ssl_decrypt_record found padding 11 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 39102 found (nil) association_find: TCP port 4485 found 0x345dc00 record: offset = 37, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | a5 0c a3 c2 6d a4 ca be 5c a4 f3 13 6a bf a0 41 |....m...\...j..A| | 76 18 0d 72 63 0a ca 8c 7d 85 b1 e2 ca 88 2c 22 |v..rc...}.....,"| | 27 80 0a ab 0e e2 42 4c ca 7c 09 c4 b5 36 14 04 |'.....BL.|...6..| | 0e 43 96 5c 95 4b a8 8e 78 59 b2 02 e8 ae 54 9f |.C.\.K..xY....T.| | 40 26 3e bf ca 8a 3b b9 c9 87 de a2 83 ed 55 ec |@&>...;.......U.| | 98 08 6f 16 9f ee a6 9c 7a a4 13 88 70 2f 77 2f |..o.....z...p/w/| | 51 94 ec 68 eb db a7 77 fd ff ee 84 4f c9 72 2e |Q..h...w....O.r.| Plaintext[112]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds| | 61 2d 61 65 73 31 32 38 2d 73 68 61 2e 6c 6f 63 |a-aes128-sha.loc| | 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn| | 2e 6e 6c 3a 34 34 38 35 0d 0a 0d 0a d0 2e dd f3 |.nl:4485........| | 8f c4 3f d5 21 59 6c 70 63 e7 16 96 50 e2 9c 74 |..?.!Ylpc...P..t| | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f |................| ssl_decrypt_record found padding 15 final len 96 checking mac (len 76, version 300, ct 23 seq 2) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 76, seq = 0, nxtseq = 76 association_find: TCP port 39102 found (nil) association_find: TCP port 4485 found 0x345dc00 dissect_ssl3_record decrypted len 76 decrypted app data fragment[76]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds| | 61 2d 61 65 73 31 32 38 2d 73 68 61 2e 6c 6f 63 |a-aes128-sha.loc| | 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn| | 2e 6e 6c 3a 34 34 38 35 0d 0a 0d 0a |.nl:4485.... | dissect_ssl3_record found association 0x345dc00 dissect_ssl enter frame #504 (first time) conversation = 0x7f2686948e08, ssl_session = 0x7f265a978570 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | 30 cd 30 21 02 b2 00 fe ad 87 fa 9a 29 16 36 4e |0.0!........).6N| | 09 30 a4 09 c3 c6 9e 04 a0 2c b1 95 09 33 c2 b5 |.0.......,...3..| | ef 1d 3f 6b 06 4a fc 51 ac 18 5b 44 ef c4 4e ad |..?k.J.Q..[D..N.| | df 88 54 a2 37 61 86 18 63 df 87 40 e5 2a ba e6 |..T.7a..c..@.*..| | 81 69 21 16 20 c8 d8 57 65 e2 13 8b 63 b8 cb e6 |.i!. ..We...c...| | 54 e1 92 d2 e7 bf ba bf 72 79 69 a5 a2 47 ce 61 |T.......ryi..G.a| | 45 e0 f1 3b 68 f0 11 a0 86 fa 23 8f c9 63 d5 98 |E..;h.....#..c..| | 15 7f 2c 3d 85 27 7c ce 79 ab fb c1 ad 3e 8b 95 |..,=.'|.y....>..| | da bc dd a3 65 57 b3 55 19 f1 53 96 4f 20 0e f9 |....eW.U..S.O ..| | 4f 8f 5d 99 63 c5 3e df 5b f5 fd bc bd bf 42 20 |O.].c.>.[.....B | | 67 03 6e f5 15 c7 6d 33 03 68 25 71 4d c5 14 cd |g.n...m3.h%qM...| | a3 a8 1f bc 93 97 fd 01 e1 3d eb 77 16 7b ef 9d |.........=.w.{..| | c0 50 56 32 d9 5f 90 3b a1 25 30 6d c6 59 2b 3f |.PV2._.;.%0m.Y+?| | 84 b8 9e a8 f6 be 19 8b fb b9 e8 f6 37 fc 40 5b |............7.@[| | 06 54 48 e4 ce 38 e4 5f 50 f5 e2 c4 3b 52 bb da |.TH..8._P...;R..| | 86 a5 5e b1 c4 cc 57 22 77 29 9c 49 58 d6 f9 93 |..^...W"w).IX...| | 0f 7d b7 df 21 3a 9c ca 6e d0 d2 6b 15 83 b8 fb |.}..!:..n..k....| | dc cc 79 8b 5f fc c7 41 13 5a e6 cb cf c0 f6 7f |..y._..A.Z......| | 44 66 bf 02 57 0a 09 60 e8 3f e7 07 61 95 ff e0 |Df..W..`.?..a...| | d0 6e ff 95 d4 d0 15 d5 9e 4b 59 73 01 96 7b c3 |.n.......KYs..{.| | 9e 29 09 e4 54 f7 41 69 45 78 60 0d 92 28 b1 ff |.)..T.AiEx`..(..| | cd 6d 10 c0 ca c0 61 17 0b 49 e2 8f 2e 5c 0a 05 |.m....a..I...\..| | ed 31 ec 20 79 b6 57 dc 48 7c 25 fd 28 aa 18 ef |.1. y.W.H|%.(...| | 74 49 a5 f1 4c 89 1d b0 d9 92 cb 11 b5 b8 f1 73 |tI..L..........s| Plaintext[384]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:23 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 32 0d 0a 43 6f 6e 6e 65 63 74 |th: 142..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 30 39 20 2d 20 45 43 44 48 45 |xC0,0x09 - ECDHE| | 2d 45 43 44 53 41 2d 41 45 53 31 32 38 2d 53 48 |-ECDSA-AES128-SH| | 41 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 |A SSLv3 Kx=ECDH| | 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 6e | Au=ECDSA En| | 63 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d |c=AES(128) Mac=| | 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 |SHA1.pX| | fb f3 1a 47 ea 92 42 c4 4f d6 0f ec 2a 12 0e 34 |...G..B.O...*..4| | a1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0e |................| ssl_decrypt_record found padding 14 final len 369 checking mac (len 349, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 349, seq = 0, nxtseq = 349 association_find: TCP port 4485 found 0x345dc00 dissect_ssl3_record decrypted len 349 decrypted app data fragment[349]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:23 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 32 0d 0a 43 6f 6e 6e 65 63 74 |th: 142..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 30 39 20 2d 20 45 43 44 48 45 |xC0,0x09 - ECDHE| | 2d 45 43 44 53 41 2d 41 45 53 31 32 38 2d 53 48 |-ECDSA-AES128-SH| | 41 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 |A SSLv3 Kx=ECDH| | 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 6e | Au=ECDSA En| | 63 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d |c=AES(128) Mac=| | 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 |SHA1 | dissect_ssl3_record found association 0x345dc00 dissect_ssl enter frame #505 (first time) conversation = 0x7f2686948e08, ssl_session = 0x7f265a978570 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 88 31 7c 7b 2f e7 98 b0 fb 69 1c 40 55 1a f3 d4 |.1|{/....i.@U...| | 46 86 22 4c 2d 26 9f 0b e4 0e d0 a8 f0 ee 9a 3e |F."L-&.........>| Plaintext[32]: | 01 00 c1 06 87 d9 9d 85 07 39 3f 57 4e c1 ac 1a |.........9?WN...| | bf ec 9c 65 e4 4e 00 00 00 00 00 00 00 00 00 09 |...e.N..........| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #507 (first time) conversation = 0x7f2686948e08, ssl_session = 0x7f265a978570 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 30 bd 30 0f 09 a5 a9 c7 6a 41 cf 8d 41 e4 04 45 |0.0.....jA..A..E| | c9 4a 15 c4 68 06 a1 2d 60 cf da ba 4f cc 5c f6 |.J..h..-`...O.\.| Plaintext[32]: | 01 00 0c e8 b5 07 a2 17 ab 24 93 a1 85 f5 a3 bf |.........$......| | ab 0e ca 87 41 ef 00 00 00 00 00 00 00 00 00 09 |....A...........| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 3) ssl_decrypt_record: mac ok dissect_ssl enter frame #512 (first time) ssl_session_init: initializing ptr 0x7f265a97ad10 size 688 conversation = 0x7f2686949168, ssl_session = 0x7f265a97ad10 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 47638 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4486 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #514 (first time) conversation = 0x7f2686949168, ssl_session = 0x7f265a97ad10 record: offset = 0, reported_length_remaining = 763 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0xC00A -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 677 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 480, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 476 bytes, remaining 571 record: offset = 571, reported_length_remaining = 192 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 178, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 576 length 174 bytes, remaining 754 record: offset = 754, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 759 length 0 bytes, remaining 763 dissect_ssl enter frame #516 (first time) conversation = 0x7f2686949168, ssl_session = 0x7f265a97ad10 record: offset = 0, reported_length_remaining = 150 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 70, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 52349717bef5fab2b90e6f815efc43f47d8866cf66948076... looking for RSA pre-master41043e482f50f1441b7ae7f11a591a27912a4dae82a18703... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971568edf373b61bc5ad23adced91be40231158d90cf25c26bd04b2bf8e5 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822a2f3d6e9c8c521a0 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715064b708db7aa9cef48ec8a9bf517e7392e7ee9a35062ce7bb2523787 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715790ce6d17391606acd8b094886563f27a8996fa6c96e2b99876c41a9 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715331fb5a174085ae52bbe3d725ace224182d655998abe8023d7f2bc0a 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971614ca4762f9bd4dbd73b749b3de5971deaff2aded5e287130aa5cfce8 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971618d66ee5fc31f776c8a738bc8fa9f814928f810132568d2d13f7d3c6 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497165c84a778f75147dcfa77cc53cae36771b51e8449eba9fb5ed19cbfb1 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716d5b1c0e0cc0bcb19610b6161a0c61d611a3109055501508d5b53cc04 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716fb2b23f18526271e78e3279be8200762333aa441bfe3e350d788a297 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716e114ef8c729d3959e2b6e238e9ac4b7cf212b5b2e0116c18c8a7d447 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497161056a154f59d2d185ee4c09f9469c0af6f588a4e8783243504b51b86 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716eb24840713b5a9817fbc8cf71d9db1fcfb410da480bb4f09e655975a 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717c69164e151a28d72939e3acd50c81c72d48489c0c5c8414a6d2e3d62 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497170f4d7595e4dd322804591e101abc2f8458461bd60bcd7efeb43c19f7 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717e2661941933437161045002d21486fe34e7a6a8661ca1a945c2376dd 17ACC42B028145A2CD35A64E821F89388E625194A652E88E8246CC089A7C51E4E05F90F9ACFB5EDA64A633A3EFD3F3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497173cddbc719a19ffd337851a366f113d29ece8ba061d3bb98208e99435 17ACC42B028145A2CD35A64E821F89388E625194A652E88E8246CC089A7C51E4E05F90F9ACFB5EDA64A633A3EFD3F3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717cca5aebe07984142824e3d3001e6ffe94357805d9921b6fda7ae8cde 4B7A19DDE31871A980B9C9DB2826C10777E901D1433A424029FA2703B1BC87AF05A7294E33278FDA439FD75B61E0D913 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717f85b9be404f7806b79d1995328a944e720d6b49e54b2af77ed5a29bd 4B7A19DDE31871A980B9C9DB2826C10777E901D1433A424029FA2703B1BC87AF05A7294E33278FDA439FD75B61E0D913 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717cb4121a28b8b1d3c958de85b51e5c13544f0d01b636ff0d495c1a31a C3729D1A5D656DDF61B6F99671773F20326605D5598DC93B0AFAD35270CB20B8EAD4FB3D8C84E7F6CFF139F84575B65C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717bef5fab2b90e6f815efc43f47d8866cf66948076cf8283ce92caa99f C3729D1A5D656DDF61B6F99671773F20326605D5598DC93B0AFAD35270CB20B8EAD4FB3D8C84E7F6CFF139F84575B65C found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 ssl3_prf: sha1_hash(6) ssl3_prf: md5_hash(6) datalen 48 ssl3_prf: sha1_hash(7) ssl3_prf: md5_hash(7) datalen 48 ssl3_prf: sha1_hash(8) ssl3_prf: md5_hash(8) datalen 48 ssl3_prf: sha1_hash(9) ssl3_prf: md5_hash(9) datalen 48 key expansion[136]: | 71 f9 5e 06 cd 40 97 ee 81 ae da 38 03 ad bd 00 |q.^..@.....8....| | 9c 93 29 b8 c5 3f 5f 2e 51 0d f6 4a b1 75 f2 e2 |..)..?_.Q..J.u..| | 43 52 ad 74 1a d8 7a af 02 f0 35 fe 5a 06 54 d7 |CR.t..z...5.Z.T.| | 35 04 07 3d 0d 98 1a 86 06 83 41 9a 9a cd ab fd |5..=......A.....| | a5 db c0 44 d2 e0 3d 95 05 bd 63 dc 57 49 67 4b |...D..=...c.WIgK| | 3e cd 13 78 0b a9 38 ec 18 80 49 8f 00 0d e1 1e |>..x..8...I.....| | 6a 58 da a6 3f d0 a2 84 74 88 48 da 1c 16 07 8a |jX..?...t.H.....| | 07 2a 40 be 5c 1d 33 aa ad 06 0e 78 de 79 94 6f |.*@.\.3....x.y.o| | 9e a4 cb 1d 60 3b 84 06 |....`;.. | Client MAC key[20]: | 71 f9 5e 06 cd 40 97 ee 81 ae da 38 03 ad bd 00 |q.^..@.....8....| | 9c 93 29 b8 |..). | Server MAC key[20]: | c5 3f 5f 2e 51 0d f6 4a b1 75 f2 e2 43 52 ad 74 |.?_.Q..J.u..CR.t| | 1a d8 7a af |..z. | Client Write key[32]: | 02 f0 35 fe 5a 06 54 d7 35 04 07 3d 0d 98 1a 86 |..5.Z.T.5..=....| | 06 83 41 9a 9a cd ab fd a5 db c0 44 d2 e0 3d 95 |..A........D..=.| Server Write key[32]: | 05 bd 63 dc 57 49 67 4b 3e cd 13 78 0b a9 38 ec |..c.WIgK>..x..8.| | 18 80 49 8f 00 0d e1 1e 6a 58 da a6 3f d0 a2 84 |..I.....jX..?...| Client Write IV[16]: | 74 88 48 da 1c 16 07 8a 07 2a 40 be 5c 1d 33 aa |t.H......*@.\.3.| Server Write IV[16]: | ad 06 0e 78 de 79 94 6f 9e a4 cb 1d 60 3b 84 06 |...x.y.o....`;..| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | a5 3a 9f c6 44 1d 5a 69 ac f7 5f f7 9e f2 38 ed |.:..D.Zi.._...8.| | 03 9c 7e b3 d5 0b 3c 14 ad 0d 05 1e f7 bc 64 13 |..~...<.......d.| ssl_save_session stored master secret[48]: | c3 72 9d 1a 5d 65 6d df 61 b6 f9 96 71 77 3f 20 |.r..]em.a...qw? | | 32 66 05 d5 59 8d c9 3b 0a fa d3 52 70 cb 20 b8 |2f..Y..;...Rp. .| | ea d4 fb 3d 8c 84 e7 f6 cf f1 39 f8 45 75 b6 5c |...=......9.Eu.\| dissect_ssl3_handshake session keys successfully generated record: offset = 75, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 81, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 7d 5a 5f 6a 5e d0 28 49 b5 e5 10 e6 0d 11 f4 48 |}Z_j^.(I.......H| | 5c 1f c1 86 98 64 14 b5 59 9b e2 ee 2f 8a 9a 3e |\....d..Y.../..>| | ca d7 6e bb 04 3e 8a f7 d6 69 5e 4d 43 51 5f 74 |..n..>...i^MCQ_t| | 63 18 5e f9 2f cc 5e 9e ff 78 5b 09 87 21 91 c3 |c.^./.^..x[..!..| Plaintext[64]: | 14 00 00 24 48 7f e3 65 c5 b5 de 86 1d e6 62 66 |...$H..e......bf| | 7d 8f 2d 6a cc 84 15 b8 23 1a bc c4 a9 9c f9 8b |}.-j....#.......| | 03 ce cd ca 9b 16 db 73 57 7e 01 1a 1f eb b6 04 |.......sW~......| | 96 bb 99 45 86 34 62 b8 55 d2 e8 69 00 00 00 03 |...E.4b.U..i....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #517 (first time) conversation = 0x7f2686949168, ssl_session = 0x7f265a97ad10 record: offset = 0, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | a3 30 5c a5 a3 18 56 90 53 5c ff 57 36 3a b8 fe |.0\...V.S\.W6:..| | f5 e7 f1 9b 39 af 25 e0 87 a3 f1 84 98 f7 64 ed |....9.%.......d.| | 52 ab 4b 37 62 95 af 54 e2 fa fc 37 c1 eb e0 e9 |R.K7b..T...7....| | 94 71 0e 67 58 74 c6 50 91 5b 7d 2e 48 d3 fa 39 |.q.gXt.P.[}.H..9| Plaintext[64]: | 14 00 00 24 17 65 20 47 0e 73 a7 1f 8c 2e 22 3e |...$.e G.s....">| | 1a 2b c8 52 7a 7d f1 ec ef 09 00 fe 9e 84 37 c1 |.+.Rz}........7.| | 55 7d de c7 49 bc 1f 13 4d dd 0b 1b 79 9d 93 b6 |U}..I...M...y...| | e2 a6 88 4f 29 42 c3 90 94 47 fb b5 00 00 00 03 |...O)B...G......| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #518 (first time) conversation = 0x7f2686949168, ssl_session = 0x7f265a97ad10 record: offset = 0, reported_length_remaining = 154 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 43 67 52 72 e5 0a 0d 3c 34 b2 84 e2 b7 7f 21 e0 |CgRr...<4.....!.| | fb 2c 58 a0 8f dc c8 f5 ad b7 09 89 95 58 49 67 |.,X..........XIg| Plaintext[32]: | 8e dc 88 24 7f 72 fe 6c b7 f1 d9 fd d2 0e 23 5f |...$.r.l......#_| | a8 6b 20 6d 00 00 00 00 00 00 00 00 00 00 00 0b |.k m............| ssl_decrypt_record found padding 11 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 47638 found (nil) association_find: TCP port 4486 found 0x345dc90 record: offset = 37, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | 42 8b f6 f0 a3 c2 85 26 70 81 a9 76 e0 81 34 bd |B......&p..v..4.| | b5 b3 91 b5 61 91 ef 55 1e 5e 4b c2 1f 94 95 73 |....a..U.^K....s| | fb 94 e9 26 f9 1e 96 df ff 90 ef ef fa 4e ab 12 |...&.........N..| | e7 be e0 2c 69 e9 9b 64 55 c8 b6 b5 f6 d2 94 02 |...,i..dU.......| | b3 43 40 72 81 d3 04 55 0e c4 59 65 02 c1 c5 25 |.C@r...U..Ye...%| | 6e 18 af 20 ff 3a 94 6f 11 e2 00 6e 28 a6 6a 8a |n.. .:.o...n(.j.| | fe d4 e3 ef dd 12 4e 26 87 e3 92 d2 31 55 61 3f |......N&....1Ua?| Plaintext[112]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds| | 61 2d 61 65 73 32 35 36 2d 73 68 61 2e 6c 6f 63 |a-aes256-sha.loc| | 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn| | 2e 6e 6c 3a 34 34 38 36 0d 0a 0d 0a aa 44 ba d2 |.nl:4486.....D..| | 8a f2 13 34 87 79 24 cc 41 64 65 e3 86 4d 10 89 |...4.y$.Ade..M..| | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f |................| ssl_decrypt_record found padding 15 final len 96 checking mac (len 76, version 300, ct 23 seq 2) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 76, seq = 0, nxtseq = 76 association_find: TCP port 47638 found (nil) association_find: TCP port 4486 found 0x345dc90 dissect_ssl3_record decrypted len 76 decrypted app data fragment[76]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds| | 61 2d 61 65 73 32 35 36 2d 73 68 61 2e 6c 6f 63 |a-aes256-sha.loc| | 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn| | 2e 6e 6c 3a 34 34 38 36 0d 0a 0d 0a |.nl:4486.... | dissect_ssl3_record found association 0x345dc90 dissect_ssl enter frame #519 (first time) conversation = 0x7f2686949168, ssl_session = 0x7f265a97ad10 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | 14 50 8e 31 b8 7b c8 23 94 59 8b 79 6d 61 b2 8d |.P.1.{.#.Y.yma..| | 5b d2 4b e4 23 73 b8 0e b1 c9 b4 b2 88 e8 eb 86 |[.K.#s..........| | 06 32 3f 5c 51 b7 4b 15 9e a1 59 e7 2a 51 ba d6 |.2?\Q.K...Y.*Q..| | 0a 52 65 33 00 20 0c d9 a8 e4 68 47 72 cf 5e 3f |.Re3. ....hGr.^?| | ff 71 7e db be 8d c5 04 b6 f3 39 11 0e 85 3d 93 |.q~.......9...=.| | 1e 40 8e 8d 63 54 89 82 d1 18 2d ae e8 f4 63 df |.@..cT....-...c.| | 5e b2 f8 cd d7 f5 af be d8 a6 ce 3a f7 10 dc a5 |^..........:....| | f7 e0 90 55 9b 6b 11 d5 72 38 f9 27 6f a5 08 fb |...U.k..r8.'o...| | 81 be d9 67 b5 e2 fd 14 ec 11 79 5d 95 7c ee 00 |...g......y].|..| | ba 00 cc b4 27 eb 0a 5f 32 20 5a 03 80 d6 d5 a8 |....'.._2 Z.....| | 9c 43 30 65 2c 42 33 84 b3 7b 8c 59 b5 59 37 01 |.C0e,B3..{.Y.Y7.| | 95 61 ba 63 d5 f0 8f 21 37 98 a9 6d 3d 51 fc 40 |.a.c...!7..m=Q.@| | 9d a7 a2 d7 fe 4a 8d 34 e7 aa cc d1 88 69 6c ca |.....J.4.....il.| | 00 43 29 01 2a 6e 96 39 c2 94 ad 48 a9 33 c0 58 |.C).*n.9...H.3.X| | d3 1d b8 f5 d3 cd e7 01 23 15 b7 1d 9e fd 77 08 |........#.....w.| | 03 72 16 3d d1 53 fb 30 85 25 57 87 bc a6 a6 1d |.r.=.S.0.%W.....| | 37 ae 8f 63 e5 ce 20 9e a5 75 38 71 34 18 1b c5 |7..c.. ..u8q4...| | ea 9f 3e 85 da 4c 30 6c ad f9 f3 1f 01 37 4f 4a |..>..L0l.....7OJ| | a6 61 42 55 8c 09 e9 4b 0c c1 ff 10 66 43 7a 9a |.aBU...K....fCz.| | 36 20 20 7b e7 31 a3 47 5c 48 16 94 ff 10 23 70 |6 {.1.G\H....#p| | dd 79 38 1b 87 e7 5f a0 fb 4f 03 5b f1 26 43 5f |.y8..._..O.[.&C_| | d7 f2 f9 31 5e 42 dc 39 28 25 f8 6a ec d7 68 95 |...1^B.9(%.j..h.| | 46 ec b9 37 77 a1 c2 16 e0 10 17 ed 81 da 42 65 |F..7w.........Be| | 35 1d d8 ee 10 8d ea d6 e8 13 5f 71 7a b7 58 b6 |5........._qz.X.| Plaintext[384]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:23 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 32 0d 0a 43 6f 6e 6e 65 63 74 |th: 142..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 30 41 20 2d 20 45 43 44 48 45 |xC0,0x0A - ECDHE| | 2d 45 43 44 53 41 2d 41 45 53 32 35 36 2d 53 48 |-ECDSA-AES256-SH| | 41 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 |A SSLv3 Kx=ECDH| | 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 6e | Au=ECDSA En| | 63 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d |c=AES(256) Mac=| | 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 |SHA1.Sn| | 63 e8 99 3a 1a ab ea c6 df 13 2c 0c 6f c9 7c 2e |c..:......,.o.|.| | 52 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0e |R...............| ssl_decrypt_record found padding 14 final len 369 checking mac (len 349, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 349, seq = 0, nxtseq = 349 association_find: TCP port 4486 found 0x345dc90 dissect_ssl3_record decrypted len 349 decrypted app data fragment[349]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:23 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 32 0d 0a 43 6f 6e 6e 65 63 74 |th: 142..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 30 41 20 2d 20 45 43 44 48 45 |xC0,0x0A - ECDHE| | 2d 45 43 44 53 41 2d 41 45 53 32 35 36 2d 53 48 |-ECDSA-AES256-SH| | 41 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 |A SSLv3 Kx=ECDH| | 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 6e | Au=ECDSA En| | 63 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d |c=AES(256) Mac=| | 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 |SHA1 | dissect_ssl3_record found association 0x345dc90 dissect_ssl enter frame #520 (first time) conversation = 0x7f2686949168, ssl_session = 0x7f265a97ad10 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 5c 59 e1 95 5a 56 f6 24 6d 18 fe 45 5f 4c 3b a7 |\Y..ZV.$m..E_L;.| | 6c 6f aa 2a 0e 9e b6 fc 13 69 52 fc 8c 1c 06 ec |lo.*.....iR.....| Plaintext[32]: | 01 00 ea b4 f7 90 5f c3 30 8a b6 b6 bf f4 f5 19 |......_.0.......| | 15 20 82 1a 40 da 00 00 00 00 00 00 00 00 00 09 |. ..@...........| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #522 (first time) conversation = 0x7f2686949168, ssl_session = 0x7f265a97ad10 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 50 3c 92 91 12 43 df 88 cf 32 d5 56 ad 1e cb ff |P<...C...2.V....| | 33 cd 48 06 ff af 5e e4 3f 3a a9 f9 fb 27 fb 42 |3.H...^.?:...'.B| Plaintext[32]: | 01 00 6e 8f f2 c4 4a dc b5 6d d6 87 44 0c b6 8a |..n...J..m..D...| | 48 1b 6d 65 df 31 00 00 00 00 00 00 00 00 00 09 |H.me.1..........| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 3) ssl_decrypt_record: mac ok dissect_ssl enter frame #527 (first time) ssl_session_init: initializing ptr 0x7f265a97d4b0 size 688 conversation = 0x7f26869494c8, ssl_session = 0x7f265a97d4b0 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 56973 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4491 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #529 (first time) conversation = 0x7f26869494c8, ssl_session = 0x7f265a97d4b0 record: offset = 0, reported_length_remaining = 1243 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0xC011 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 1157 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898 record: offset = 898, reported_length_remaining = 345 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 331, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 903 length 327 bytes, remaining 1234 record: offset = 1234, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1239 length 0 bytes, remaining 1243 dissect_ssl enter frame #531 (first time) conversation = 0x7f26869494c8, ssl_session = 0x7f265a97d4b0 record: offset = 0, reported_length_remaining = 146 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 70, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 52349717d3e7c40d9f5dce297ef3957ff642aa7c1834f35e... looking for RSA pre-master41047af1c204389b48a0422e0249bf82288f6d97c4cd9076... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971568edf373b61bc5ad23adced91be40231158d90cf25c26bd04b2bf8e5 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822a2f3d6e9c8c521a0 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715064b708db7aa9cef48ec8a9bf517e7392e7ee9a35062ce7bb2523787 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715790ce6d17391606acd8b094886563f27a8996fa6c96e2b99876c41a9 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715331fb5a174085ae52bbe3d725ace224182d655998abe8023d7f2bc0a 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971614ca4762f9bd4dbd73b749b3de5971deaff2aded5e287130aa5cfce8 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971618d66ee5fc31f776c8a738bc8fa9f814928f810132568d2d13f7d3c6 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497165c84a778f75147dcfa77cc53cae36771b51e8449eba9fb5ed19cbfb1 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716d5b1c0e0cc0bcb19610b6161a0c61d611a3109055501508d5b53cc04 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716fb2b23f18526271e78e3279be8200762333aa441bfe3e350d788a297 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716e114ef8c729d3959e2b6e238e9ac4b7cf212b5b2e0116c18c8a7d447 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497161056a154f59d2d185ee4c09f9469c0af6f588a4e8783243504b51b86 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716eb24840713b5a9817fbc8cf71d9db1fcfb410da480bb4f09e655975a 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717c69164e151a28d72939e3acd50c81c72d48489c0c5c8414a6d2e3d62 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497170f4d7595e4dd322804591e101abc2f8458461bd60bcd7efeb43c19f7 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717e2661941933437161045002d21486fe34e7a6a8661ca1a945c2376dd 17ACC42B028145A2CD35A64E821F89388E625194A652E88E8246CC089A7C51E4E05F90F9ACFB5EDA64A633A3EFD3F3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497173cddbc719a19ffd337851a366f113d29ece8ba061d3bb98208e99435 17ACC42B028145A2CD35A64E821F89388E625194A652E88E8246CC089A7C51E4E05F90F9ACFB5EDA64A633A3EFD3F3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717cca5aebe07984142824e3d3001e6ffe94357805d9921b6fda7ae8cde 4B7A19DDE31871A980B9C9DB2826C10777E901D1433A424029FA2703B1BC87AF05A7294E33278FDA439FD75B61E0D913 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717f85b9be404f7806b79d1995328a944e720d6b49e54b2af77ed5a29bd 4B7A19DDE31871A980B9C9DB2826C10777E901D1433A424029FA2703B1BC87AF05A7294E33278FDA439FD75B61E0D913 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717cb4121a28b8b1d3c958de85b51e5c13544f0d01b636ff0d495c1a31a C3729D1A5D656DDF61B6F99671773F20326605D5598DC93B0AFAD35270CB20B8EAD4FB3D8C84E7F6CFF139F84575B65C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717bef5fab2b90e6f815efc43f47d8866cf66948076cf8283ce92caa99f C3729D1A5D656DDF61B6F99671773F20326605D5598DC93B0AFAD35270CB20B8EAD4FB3D8C84E7F6CFF139F84575B65C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497172caed990bc6f6fd864e5915c3c76e330ea2685fa4beadea445e68c43 53AB43C6AF0EC95E92901056CD7C13256F74C65CE7ADE750D502CBCD760B95827AB780193D1258AADAC87CC24477CE56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717d3e7c40d9f5dce297ef3957ff642aa7c1834f35e2d6650484275824d 53AB43C6AF0EC95E92901056CD7C13256F74C65CE7ADE750D502CBCD760B95827AB780193D1258AADAC87CC24477CE56 found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 key expansion[72]: | 00 68 8b b0 e4 3a f4 14 1e 6c 3e e0 b9 a6 4c 20 |.h...:...l>...L | | b7 ea 26 40 4a 05 84 0f 33 1c 56 76 29 6f bd ca |..&@J...3.Vv)o..| | 51 44 e5 bf 41 14 71 22 ca 9d a8 38 56 fd 47 ec |QD..A.q"...8V.G.| | 47 24 05 e5 8c c4 e2 7a 83 46 ff 7d d0 be 6f ca |G$.....z.F.}..o.| | a3 47 51 d0 dc 45 c2 1e |.GQ..E.. | Client MAC key[20]: | 00 68 8b b0 e4 3a f4 14 1e 6c 3e e0 b9 a6 4c 20 |.h...:...l>...L | | b7 ea 26 40 |..&@ | Server MAC key[20]: | 4a 05 84 0f 33 1c 56 76 29 6f bd ca 51 44 e5 bf |J...3.Vv)o..QD..| | 41 14 71 22 |A.q" | Client Write key[16]: | ca 9d a8 38 56 fd 47 ec 47 24 05 e5 8c c4 e2 7a |...8V.G.G$.....z| Server Write key[16]: | 83 46 ff 7d d0 be 6f ca a3 47 51 d0 dc 45 c2 1e |.F.}..o..GQ..E..| Client Write IV[8]: | 00 00 00 00 00 00 00 00 |........ | Server Write IV[8]: | 40 65 76 03 00 00 00 00 |@ev..... | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: ARCFOUR decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: ARCFOUR decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | cd d3 63 76 fe a8 df 9d d9 26 e1 6d 79 da d2 ec |..cv.....&.my...| | 61 d1 4f e3 4f 7b 3a 99 74 47 75 cd 79 95 6d 1c |a.O.O{:.tGu.y.m.| ssl_save_session stored master secret[48]: | 53 ab 43 c6 af 0e c9 5e 92 90 10 56 cd 7c 13 25 |S.C....^...V.|.%| | 6f 74 c6 5c e7 ad e7 50 d5 02 cb cd 76 0b 95 82 |ot.\...P....v...| | 7a b7 80 19 3d 12 58 aa da c8 7c c2 44 77 ce 56 |z...=.X...|.Dw.V| dissect_ssl3_handshake session keys successfully generated record: offset = 75, reported_length_remaining = 71 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 81, reported_length_remaining = 65 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 60, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 60 Ciphertext[60]: | f6 da 99 f7 b1 e3 6e a8 ee f9 c6 cf eb 65 c0 9c |......n......e..| | b4 b3 88 55 13 0b b3 ed ac eb bf 5f 09 6e 0c b8 |...U......._.n..| | 6a 75 c1 29 7b c0 64 1d 36 0a a4 5e 65 ae f1 95 |ju.){.d.6..^e...| | b4 6e 05 4a 8b 34 4d 91 67 cd d2 a1 |.n.J.4M.g... | Plaintext[60]: | 14 00 00 24 c9 7b 69 f1 be cd 31 90 7e c9 b9 4e |...$.{i...1.~..N| | f6 3d 12 fb 4b 61 ea 80 4e e5 b7 3a e9 bc e6 6e |.=..Ka..N..:...n| | c5 aa 59 f4 ed 3e 1f 8d cd da 4a 93 a3 5d bf 49 |..Y..>....J..].I| | ba a5 5b 4f 14 53 77 c2 78 ef 16 1f |..[O.Sw.x... | checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #532 (first time) conversation = 0x7f26869494c8, ssl_session = 0x7f265a97d4b0 record: offset = 0, reported_length_remaining = 71 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 65 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 60, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 60 Ciphertext[60]: | 84 92 29 82 33 87 1b 0d 60 5c e1 a8 d1 90 fe e2 |..).3...`\......| | c0 d9 b2 7c c1 9a 1f 1d 61 68 fc eb b3 12 00 ac |...|....ah......| | 9e cf d6 d9 0f f6 81 26 56 eb 4f ec 6f 43 08 05 |.......&V.O.oC..| | 25 3f 82 c2 55 4b 56 0f c8 7c 21 0b |%?..UKV..|!. | Plaintext[60]: | 14 00 00 24 f8 08 1e bf 20 a7 de 75 18 1b ca b4 |...$.... ..u....| | de 3c 9f 12 60 74 0a 8f 79 27 53 99 81 f8 a3 4b |.<..`t..y'S....K| | a4 7d 8f 3c 96 1a 45 4b 9a c8 6f 29 64 02 bd 61 |.}.<..EK..o)d..a| | fd eb 5a cd e6 7c 92 be fe 70 83 3f |..Z..|...p.? | checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #533 (first time) conversation = 0x7f26869494c8, ssl_session = 0x7f265a97d4b0 record: offset = 0, reported_length_remaining = 96 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 91, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 91 Ciphertext[91]: | 45 f4 86 2b 21 bd 98 3b c1 39 dc 8e 43 df c3 6f |E..+!..;.9..C..o| | 67 be 75 43 46 d5 5c cd 23 a8 96 b1 f2 80 6a e4 |g.uCF.\.#.....j.| | 09 a7 b1 1d dc 6c ec 36 33 30 bd b2 0a bd 66 e5 |.....l.630....f.| | 8d da fc a1 4c 83 dc 77 28 3c 85 ca e4 37 4a 45 |....L..w(<...7JE| | 0e 43 d3 4c 5b 94 41 26 3f 8e 1a f2 78 55 d8 79 |.C.L[.A&?...xU.y| | ae 50 4e 9c 3f dc 62 01 cf 04 43 |.PN.?.b...C | Plaintext[91]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-| | 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c |rc4-sha.local.al| | 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 |.lekensteyn.nl:4| | 34 39 31 0d 0a 0d 0a 4d e9 22 0d fc f0 d9 f1 46 |491....M.".....F| | 70 65 65 65 a0 f6 db 10 68 f1 9a |peee....h.. | checking mac (len 71, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 71, seq = 0, nxtseq = 71 association_find: TCP port 56973 found (nil) association_find: TCP port 4491 found 0x345e560 dissect_ssl3_record decrypted len 71 decrypted app data fragment[71]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-| | 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c |rc4-sha.local.al| | 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 |.lekensteyn.nl:4| | 34 39 31 0d 0a 0d 0a |491.... | dissect_ssl3_record found association 0x345e560 dissect_ssl enter frame #534 (first time) conversation = 0x7f26869494c8, ssl_session = 0x7f265a97d4b0 record: offset = 0, reported_length_remaining = 373 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 368, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 368 Ciphertext[368]: | eb c9 b7 c3 72 a5 1e 67 1a 95 1e 97 7c 68 cf 53 |....r..g....|h.S| | 49 7e 17 dd a6 4f ce 82 37 f6 cd e5 d3 22 f9 5d |I~...O..7....".]| | 39 e3 c5 bb f5 58 e0 3f be d3 e7 b5 b6 ea 3b 98 |9....X.?......;.| | 3a c4 69 56 87 f6 f2 42 af 7b c4 df 86 b9 3b a9 |:.iV...B.{....;.| | aa b5 0e 83 47 5c 8c b2 b2 86 4e dd b0 29 75 1e |....G\....N..)u.| | 23 19 57 cc b6 eb 29 a7 98 28 c5 47 66 3a ae 14 |#.W...)..(.Gf:..| | 99 25 f7 80 af e4 2b da 52 c4 90 e2 96 c9 dc ca |.%....+.R.......| | 27 d2 d1 b3 ab da 6d d5 e0 05 c2 84 fd 28 f7 fd |'.....m......(..| | 6b ba 12 9e a4 77 61 59 4d 1b 38 3d 5f 7e f7 80 |k....waYM.8=_~..| | 06 b6 07 3e fd 8e f2 39 32 68 18 11 f5 21 50 25 |...>...92h...!P%| | ae 6d 99 f3 d1 b3 20 f2 96 72 b0 c9 2e 40 7d a1 |.m.... ..r...@}.| | 5c 48 6b 77 af dd a3 de 9a 47 e2 32 06 d3 2b 8f |\Hkw.....G.2..+.| | 46 56 54 72 c6 90 b9 80 8c 49 bd 69 09 b0 b0 00 |FVTr.....I.i....| | 78 e7 73 a8 4c 32 81 9c 26 e7 5d 99 3c ec e5 0e |x.s.L2..&.].<...| | fd 64 dd f6 cf eb 98 be 80 a2 1d 5d 2e f4 95 0c |.d.........]....| | d3 96 46 80 38 84 04 5c 81 3d 17 74 b2 52 1f ba |..F.8..\.=.t.R..| | 66 65 98 b5 3e 61 9b da d8 cf d5 8b 23 c2 60 54 |fe..>a......#.`T| | c7 94 85 9d be 5f 2b 80 f4 48 f0 2c 84 9c 45 2b |....._+..H.,..E+| | 0b 9e fb 77 26 c8 24 b6 38 a4 8a 3d bf c9 d7 be |...w&.$.8..=....| | 5d 1d 6a e4 b3 05 a7 e7 86 3d 22 66 08 70 ea 16 |].j......="f.p..| | a1 08 5f c5 ea cc 41 09 67 19 06 2a c1 9c 71 81 |.._...A.g..*..q.| | e1 bd 29 46 17 35 67 d0 8f db d7 e2 19 1f c0 c7 |..)F.5g.........| | f3 b8 87 35 fc b9 ba ca cd 45 ca ea 3f 64 d0 b7 |...5.....E..?d..| Plaintext[368]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:23 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 31 31 20 2d 20 45 43 44 48 45 |xC0,0x11 - ECDHE| | 2d 52 53 41 2d 52 43 34 2d 53 48 41 20 20 20 20 |-RSA-RC4-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH| | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 53 |=RC4(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1!...| | b7 56 91 46 13 22 9f c2 b2 6a a1 18 ce 83 77 64 |.V.F."...j....wd| checking mac (len 348, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348 association_find: TCP port 4491 found 0x345e560 dissect_ssl3_record decrypted len 348 decrypted app data fragment[348]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:23 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 31 31 20 2d 20 45 43 44 48 45 |xC0,0x11 - ECDHE| | 2d 52 53 41 2d 52 43 34 2d 53 48 41 20 20 20 20 |-RSA-RC4-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH| | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 53 |=RC4(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1 | dissect_ssl3_record found association 0x345e560 dissect_ssl enter frame #535 (first time) conversation = 0x7f26869494c8, ssl_session = 0x7f265a97d4b0 record: offset = 0, reported_length_remaining = 27 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 22, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 22 Ciphertext[22]: | 6a 9d 0f bb 14 3c 9a 4e 79 c7 33 ef 56 c0 b2 0a |j....<.Ny.3.V...| | 5b 0a 49 60 fb 82 |[.I`.. | Plaintext[22]: | 01 00 6c b9 ab 67 e9 02 fc 20 ec 0f 35 eb 73 69 |..l..g... ..5.si| | 97 b5 b8 06 6d 80 |....m. | checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #537 (first time) conversation = 0x7f26869494c8, ssl_session = 0x7f265a97d4b0 record: offset = 0, reported_length_remaining = 27 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 22, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 22 Ciphertext[22]: | 29 7d fd 9c a5 d8 0c 1d 31 c6 70 09 23 52 31 f7 |)}......1.p.#R1.| | b2 ba b4 58 06 64 |...X.d | Plaintext[22]: | 01 00 98 b3 42 9f 69 93 62 1e bf d0 db e4 fd 13 |....B.i.b.......| | 93 94 98 97 23 69 |....#i | checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #542 (first time) ssl_session_init: initializing ptr 0x7f265a97fc00 size 688 conversation = 0x7f2686949820, ssl_session = 0x7f265a97fc00 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 34064 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4492 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #544 (first time) conversation = 0x7f2686949820, ssl_session = 0x7f265a97fc00 record: offset = 0, reported_length_remaining = 1243 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0xC012 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 1157 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898 record: offset = 898, reported_length_remaining = 345 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 331, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 903 length 327 bytes, remaining 1234 record: offset = 1234, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1239 length 0 bytes, remaining 1243 dissect_ssl enter frame #546 (first time) conversation = 0x7f2686949820, ssl_session = 0x7f265a97fc00 record: offset = 0, reported_length_remaining = 150 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 70, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 52349718114a5b6aa1df4b82da1ca6b23be2327fe8a2ee52... looking for RSA pre-master41040bb3ea7211d51feb313d489bc77f34c1e4bae58e8033... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971568edf373b61bc5ad23adced91be40231158d90cf25c26bd04b2bf8e5 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822a2f3d6e9c8c521a0 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715064b708db7aa9cef48ec8a9bf517e7392e7ee9a35062ce7bb2523787 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715790ce6d17391606acd8b094886563f27a8996fa6c96e2b99876c41a9 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715331fb5a174085ae52bbe3d725ace224182d655998abe8023d7f2bc0a 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971614ca4762f9bd4dbd73b749b3de5971deaff2aded5e287130aa5cfce8 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971618d66ee5fc31f776c8a738bc8fa9f814928f810132568d2d13f7d3c6 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497165c84a778f75147dcfa77cc53cae36771b51e8449eba9fb5ed19cbfb1 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716d5b1c0e0cc0bcb19610b6161a0c61d611a3109055501508d5b53cc04 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716fb2b23f18526271e78e3279be8200762333aa441bfe3e350d788a297 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716e114ef8c729d3959e2b6e238e9ac4b7cf212b5b2e0116c18c8a7d447 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497161056a154f59d2d185ee4c09f9469c0af6f588a4e8783243504b51b86 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716eb24840713b5a9817fbc8cf71d9db1fcfb410da480bb4f09e655975a 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717c69164e151a28d72939e3acd50c81c72d48489c0c5c8414a6d2e3d62 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497170f4d7595e4dd322804591e101abc2f8458461bd60bcd7efeb43c19f7 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717e2661941933437161045002d21486fe34e7a6a8661ca1a945c2376dd 17ACC42B028145A2CD35A64E821F89388E625194A652E88E8246CC089A7C51E4E05F90F9ACFB5EDA64A633A3EFD3F3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497173cddbc719a19ffd337851a366f113d29ece8ba061d3bb98208e99435 17ACC42B028145A2CD35A64E821F89388E625194A652E88E8246CC089A7C51E4E05F90F9ACFB5EDA64A633A3EFD3F3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717cca5aebe07984142824e3d3001e6ffe94357805d9921b6fda7ae8cde 4B7A19DDE31871A980B9C9DB2826C10777E901D1433A424029FA2703B1BC87AF05A7294E33278FDA439FD75B61E0D913 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717f85b9be404f7806b79d1995328a944e720d6b49e54b2af77ed5a29bd 4B7A19DDE31871A980B9C9DB2826C10777E901D1433A424029FA2703B1BC87AF05A7294E33278FDA439FD75B61E0D913 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717cb4121a28b8b1d3c958de85b51e5c13544f0d01b636ff0d495c1a31a C3729D1A5D656DDF61B6F99671773F20326605D5598DC93B0AFAD35270CB20B8EAD4FB3D8C84E7F6CFF139F84575B65C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717bef5fab2b90e6f815efc43f47d8866cf66948076cf8283ce92caa99f C3729D1A5D656DDF61B6F99671773F20326605D5598DC93B0AFAD35270CB20B8EAD4FB3D8C84E7F6CFF139F84575B65C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497172caed990bc6f6fd864e5915c3c76e330ea2685fa4beadea445e68c43 53AB43C6AF0EC95E92901056CD7C13256F74C65CE7ADE750D502CBCD760B95827AB780193D1258AADAC87CC24477CE56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717d3e7c40d9f5dce297ef3957ff642aa7c1834f35e2d6650484275824d 53AB43C6AF0EC95E92901056CD7C13256F74C65CE7ADE750D502CBCD760B95827AB780193D1258AADAC87CC24477CE56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349718114a5b6aa1df4b82da1ca6b23be2327fe8a2ee52127ec7161141088e 2E71B5A062F0F5779D07CA0FA38C4370C256668DAFD1D2AB152ED5072434040346E46F2CAA6F4E2A8BE9B3FFF34377F2 found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 ssl3_prf: sha1_hash(6) ssl3_prf: md5_hash(6) datalen 48 ssl3_prf: sha1_hash(7) ssl3_prf: md5_hash(7) datalen 48 key expansion[104]: | 8a b9 79 4e 2c c9 9f bb 0f 31 33 81 b4 1c d7 8a |..yN,....13.....| | 4e 89 f9 7e ea 97 b2 66 c7 a2 4e 52 84 2d a1 97 |N..~...f..NR.-..| | c6 0c 11 a0 38 9c 3b 5e 9a 1a 62 3d 38 5f 20 7a |....8.;^..b=8_ z| | 18 bb c1 7c 06 71 7e 24 f4 8d 61 a1 74 0f 0f e0 |...|.q~$..a.t...| | bc f8 23 3d 39 9a f3 c0 7a 45 f2 66 3d 7c dc 07 |..#=9...zE.f=|..| | df 0d 91 e9 b6 88 47 b9 18 e7 2a 90 b9 11 c9 00 |......G...*.....| | 1a b0 9f a0 65 98 99 bd |....e... | Client MAC key[20]: | 8a b9 79 4e 2c c9 9f bb 0f 31 33 81 b4 1c d7 8a |..yN,....13.....| | 4e 89 f9 7e |N..~ | Server MAC key[20]: | ea 97 b2 66 c7 a2 4e 52 84 2d a1 97 c6 0c 11 a0 |...f..NR.-......| | 38 9c 3b 5e |8.;^ | Client Write key[24]: | 9a 1a 62 3d 38 5f 20 7a 18 bb c1 7c 06 71 7e 24 |..b=8_ z...|.q~$| | f4 8d 61 a1 74 0f 0f e0 |..a.t... | Server Write key[24]: | bc f8 23 3d 39 9a f3 c0 7a 45 f2 66 3d 7c dc 07 |..#=9...zE.f=|..| | df 0d 91 e9 b6 88 47 b9 |......G. | Client Write IV[8]: | 18 e7 2a 90 b9 11 c9 00 |..*..... | Server Write IV[8]: | 1a b0 9f a0 65 98 99 bd |....e... | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | b4 8f 85 45 d9 42 62 cb 1f 6c 5f 92 17 70 61 06 |...E.Bb..l_..pa.| | 3b 27 da 4c c9 a6 c1 63 7e b4 dd 4a c9 4c a8 ac |;'.L...c~..J.L..| ssl_save_session stored master secret[48]: | 2e 71 b5 a0 62 f0 f5 77 9d 07 ca 0f a3 8c 43 70 |.q..b..w......Cp| | c2 56 66 8d af d1 d2 ab 15 2e d5 07 24 34 04 03 |.Vf.........$4..| | 46 e4 6f 2c aa 6f 4e 2a 8b e9 b3 ff f3 43 77 f2 |F.o,.oN*.....Cw.| dissect_ssl3_handshake session keys successfully generated record: offset = 75, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 81, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | eb 6a 66 e6 ca a7 1c c1 1c 34 ff d6 18 57 ea bf |.jf......4...W..| | 56 6a c2 6e 4b 02 89 7a 12 27 2f 91 a9 68 b4 ad |Vj.nK..z.'/..h..| | 43 58 87 02 88 42 05 1f 1c 45 a2 e8 7b 41 fc 91 |CX...B...E..{A..| | 0f 98 a9 d1 7c 45 d0 40 a2 8e ef d2 fb 84 a5 19 |....|E.@........| Plaintext[64]: | 14 00 00 24 a5 2a 6a 39 dc 3b d3 78 2d 32 9c 3e |...$.*j9.;.x-2.>| | e4 6e c7 50 5c b3 24 a8 eb 0b f5 d3 31 a8 7e 35 |.n.P\.$.....1.~5| | 4b 93 d5 41 5c 9b 4c f9 89 e9 df e4 95 54 f8 c0 |K..A\.L......T..| | aa 9d d2 da 01 79 62 31 7d 58 78 27 00 00 00 03 |.....yb1}Xx'....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #547 (first time) conversation = 0x7f2686949820, ssl_session = 0x7f265a97fc00 record: offset = 0, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 25 95 47 ee 60 76 93 82 37 93 8c b9 7f 7a 2f 96 |%.G.`v..7....z/.| | 42 72 f1 ca 25 dc 33 e8 ce 60 dd 63 71 59 33 0e |Br..%.3..`.cqY3.| | 35 82 59 73 47 b2 15 27 84 06 0a d1 36 2e 2e 13 |5.YsG..'....6...| | 64 e5 cc cd ba 27 44 d3 d2 f5 70 6d 88 85 6e 97 |d....'D...pm..n.| Plaintext[64]: | 14 00 00 24 47 8e 92 d4 d4 e4 5d 47 22 17 09 c7 |...$G.....]G"...| | 09 79 0b 49 c1 a8 e3 c3 84 10 b3 e2 c1 38 2e f1 |.y.I.........8..| | fe 9f af a8 00 34 72 f7 9b 2d 57 3c 4e db 5b 47 |.....4r..-W| | dd b6 fa c4 ae 49 ed 23 98 29 1b 07 25 af f5 2f |.....I.#.)..%../| | 00 00 00 00 00 00 00 07 |........ | ssl_decrypt_record found padding 7 final len 96 checking mac (len 76, version 300, ct 23 seq 2) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 76, seq = 0, nxtseq = 76 association_find: TCP port 34064 found (nil) association_find: TCP port 4492 found 0x345e5f0 dissect_ssl3_record decrypted len 76 decrypted app data fragment[76]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-| | 64 65 73 2d 63 62 63 33 2d 73 68 61 2e 6c 6f 63 |des-cbc3-sha.loc| | 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn| | 2e 6e 6c 3a 34 34 39 32 0d 0a 0d 0a |.nl:4492.... | dissect_ssl3_record found association 0x345e5f0 dissect_ssl enter frame #549 (first time) conversation = 0x7f2686949820, ssl_session = 0x7f265a97fc00 record: offset = 0, reported_length_remaining = 381 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 376, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 376 Ciphertext[376]: | d8 64 ad eb b2 69 48 c8 c2 c0 b0 f9 45 7c 88 27 |.d...iH.....E|.'| | 56 a4 ff c4 47 7b 5d 1f d1 1b 20 71 f6 42 5c d5 |V...G{]... q.B\.| | 7f 25 d2 f4 49 8f 9a 8c 19 8b 4a 0a cf 14 c9 a1 |.%..I.....J.....| | 38 7d f0 16 58 95 5d fa 2a fb 14 2c 12 43 3c a5 |8}..X.].*..,.C<.| | a5 28 2f 42 68 c7 56 9a 9e f5 63 8b d7 80 98 a2 |.(/Bh.V...c.....| | 5b 85 1a 1c ed 86 0b 4f 4a 2a f1 18 c5 b4 e0 f9 |[......OJ*......| | 30 bf 98 f3 df 16 52 36 ff b6 36 f7 f2 93 03 d5 |0.....R6..6.....| | f7 48 7c 24 52 54 c3 c2 db 3b 38 b3 50 d9 a9 56 |.H|$RT...;8.P..V| | ea 6e 89 16 2f 82 00 8a aa 48 42 e2 17 10 35 1c |.n../....HB...5.| | 35 96 9f 4e e5 42 25 dc 1a f5 e6 0e c9 2c 93 57 |5..N.B%......,.W| | f5 38 76 b1 91 2b 66 77 b5 0e eb 2c f4 cc 86 89 |.8v..+fw...,....| | 23 58 fb 0e 34 84 d5 07 74 89 29 23 70 be 2c 63 |#X..4...t.)#p.,c| | 13 b0 e3 66 07 eb 24 9b b3 5b de ad 3a 9f 3f 28 |...f..$..[..:.?(| | 19 ca 7b e3 c1 69 28 2a d1 1f f7 ae 00 59 e9 e0 |..{..i(*.....Y..| | fb d2 5e f8 9a f3 4b b2 97 d2 10 ff 63 88 71 16 |..^...K.....c.q.| | fd d0 10 bb 34 fc b3 34 88 35 70 cf 28 1e 0b b7 |....4..4.5p.(...| | af 11 6f df 39 1e 15 1c 5f 48 4c ac 65 e8 4e 96 |..o.9..._HL.e.N.| | be ef 7c ad 6e e9 64 75 75 86 cf 62 88 58 4e ac |..|.n.duu..b.XN.| | f6 39 99 07 eb 98 7f e3 1b 6b c1 8a a1 f0 c9 c5 |.9.......k......| | fc 8c 49 ea c5 18 ef f2 21 cd 6c de 68 70 d2 6f |..I.....!.l.hp.o| | 8d 93 6e 2c 17 c1 18 af a6 5c c1 15 e8 77 09 a6 |..n,.....\...w..| | 49 1c 36 44 cd 60 30 4c fe 44 e0 dc f7 90 0a bb |I.6D.`0L.D......| | bc 0f ed a2 10 1c d0 22 47 46 d6 3c 6a e1 58 d1 |......."GF.docum| | 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca| | 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.| | 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 53 e6 bc e5 |nl'S...| | 65 56 b7 ef af 83 3b 89 81 26 36 be 00 1d 13 1f |eV....;..&6.....| | 00 00 00 00 00 00 00 07 |........ | ssl_decrypt_record found padding 7 final len 368 checking mac (len 348, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348 association_find: TCP port 4492 found 0x345e5f0 dissect_ssl3_record decrypted len 348 decrypted app data fragment[348]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:24 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 31 32 20 2d 20 45 43 44 48 45 |xC0,0x12 - ECDHE| | 2d 52 53 41 2d 44 45 53 2d 43 42 43 33 2d 53 48 |-RSA-DES-CBC3-SH| | 41 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 |A SSLv3 Kx=ECDH| | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 33 44 45 53 28 31 36 38 29 20 4d 61 63 3d 53 |=3DES(168) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1 | dissect_ssl3_record found association 0x345e5f0 dissect_ssl enter frame #550 (first time) conversation = 0x7f2686949820, ssl_session = 0x7f265a97fc00 record: offset = 0, reported_length_remaining = 29 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 24, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 24 Ciphertext[24]: | ce 23 c8 00 45 4c eb cc 39 ef e7 00 aa a8 d9 ad |.#..EL..9.......| | 59 f7 ea 7e 57 22 ed db |Y..~W".. | Plaintext[24]: | 01 00 4a c5 44 46 a6 02 e3 dc 2f fe ea b9 07 0e |..J.DF..../.....| | 63 21 b3 74 e4 4b 00 01 |c!.t.K.. | ssl_decrypt_record found padding 1 final len 22 checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #552 (first time) conversation = 0x7f2686949820, ssl_session = 0x7f265a97fc00 record: offset = 0, reported_length_remaining = 29 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 24, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 24 Ciphertext[24]: | ec 38 31 74 8d 16 75 73 30 24 d4 b0 48 f4 72 14 |.81t..us0$..H.r.| | 3a 17 9d c2 17 90 ec 91 |:....... | Plaintext[24]: | 01 00 7f 00 0d d1 1a 5f 87 9f 00 5c 31 73 56 87 |......._...\1sV.| | 2b 0e 57 a2 e4 a1 00 01 |+.W..... | ssl_decrypt_record found padding 1 final len 22 checking mac (len 2, version 300, ct 21 seq 3) ssl_decrypt_record: mac ok dissect_ssl enter frame #557 (first time) ssl_session_init: initializing ptr 0x7f265a9823a0 size 688 conversation = 0x7f2686949b80, ssl_session = 0x7f265a9823a0 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 54766 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4493 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #559 (first time) conversation = 0x7f2686949b80, ssl_session = 0x7f265a9823a0 record: offset = 0, reported_length_remaining = 1243 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0xC013 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 1157 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898 record: offset = 898, reported_length_remaining = 345 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 331, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 903 length 327 bytes, remaining 1234 record: offset = 1234, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1239 length 0 bytes, remaining 1243 dissect_ssl enter frame #561 (first time) conversation = 0x7f2686949b80, ssl_session = 0x7f265a9823a0 record: offset = 0, reported_length_remaining = 150 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 70, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 52349718abbab324bf6f28598d5af5b8b95ce8eac2ea293a... looking for RSA pre-master4104317f74638211f2f6218b77f33284b44813aa22364dfe... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971568edf373b61bc5ad23adced91be40231158d90cf25c26bd04b2bf8e5 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822a2f3d6e9c8c521a0 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715064b708db7aa9cef48ec8a9bf517e7392e7ee9a35062ce7bb2523787 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715790ce6d17391606acd8b094886563f27a8996fa6c96e2b99876c41a9 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715331fb5a174085ae52bbe3d725ace224182d655998abe8023d7f2bc0a 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971614ca4762f9bd4dbd73b749b3de5971deaff2aded5e287130aa5cfce8 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971618d66ee5fc31f776c8a738bc8fa9f814928f810132568d2d13f7d3c6 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497165c84a778f75147dcfa77cc53cae36771b51e8449eba9fb5ed19cbfb1 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716d5b1c0e0cc0bcb19610b6161a0c61d611a3109055501508d5b53cc04 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716fb2b23f18526271e78e3279be8200762333aa441bfe3e350d788a297 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716e114ef8c729d3959e2b6e238e9ac4b7cf212b5b2e0116c18c8a7d447 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497161056a154f59d2d185ee4c09f9469c0af6f588a4e8783243504b51b86 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716eb24840713b5a9817fbc8cf71d9db1fcfb410da480bb4f09e655975a 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717c69164e151a28d72939e3acd50c81c72d48489c0c5c8414a6d2e3d62 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497170f4d7595e4dd322804591e101abc2f8458461bd60bcd7efeb43c19f7 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717e2661941933437161045002d21486fe34e7a6a8661ca1a945c2376dd 17ACC42B028145A2CD35A64E821F89388E625194A652E88E8246CC089A7C51E4E05F90F9ACFB5EDA64A633A3EFD3F3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497173cddbc719a19ffd337851a366f113d29ece8ba061d3bb98208e99435 17ACC42B028145A2CD35A64E821F89388E625194A652E88E8246CC089A7C51E4E05F90F9ACFB5EDA64A633A3EFD3F3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717cca5aebe07984142824e3d3001e6ffe94357805d9921b6fda7ae8cde 4B7A19DDE31871A980B9C9DB2826C10777E901D1433A424029FA2703B1BC87AF05A7294E33278FDA439FD75B61E0D913 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717f85b9be404f7806b79d1995328a944e720d6b49e54b2af77ed5a29bd 4B7A19DDE31871A980B9C9DB2826C10777E901D1433A424029FA2703B1BC87AF05A7294E33278FDA439FD75B61E0D913 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717cb4121a28b8b1d3c958de85b51e5c13544f0d01b636ff0d495c1a31a C3729D1A5D656DDF61B6F99671773F20326605D5598DC93B0AFAD35270CB20B8EAD4FB3D8C84E7F6CFF139F84575B65C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717bef5fab2b90e6f815efc43f47d8866cf66948076cf8283ce92caa99f C3729D1A5D656DDF61B6F99671773F20326605D5598DC93B0AFAD35270CB20B8EAD4FB3D8C84E7F6CFF139F84575B65C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497172caed990bc6f6fd864e5915c3c76e330ea2685fa4beadea445e68c43 53AB43C6AF0EC95E92901056CD7C13256F74C65CE7ADE750D502CBCD760B95827AB780193D1258AADAC87CC24477CE56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717d3e7c40d9f5dce297ef3957ff642aa7c1834f35e2d6650484275824d 53AB43C6AF0EC95E92901056CD7C13256F74C65CE7ADE750D502CBCD760B95827AB780193D1258AADAC87CC24477CE56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349718114a5b6aa1df4b82da1ca6b23be2327fe8a2ee52127ec7161141088e 2E71B5A062F0F5779D07CA0FA38C4370C256668DAFD1D2AB152ED5072434040346E46F2CAA6F4E2A8BE9B3FFF34377F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349718626c958f65c36cdc2f6517db0f369951c5f8c41fbf45248538b6d050 2E71B5A062F0F5779D07CA0FA38C4370C256668DAFD1D2AB152ED5072434040346E46F2CAA6F4E2A8BE9B3FFF34377F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497185c750857e25775f2a635b1d3706ead2cc8bc625ed41c1063c7dd7965 5685F53D47E7C8D547AE4C8DE89E0CF111B2179F691ED289C46BAAF99AF6613775AF03977EEDFF56D583D175C5EFAAC6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349718abbab324bf6f28598d5af5b8b95ce8eac2ea293a4285ba3c4e6be2f7 5685F53D47E7C8D547AE4C8DE89E0CF111B2179F691ED289C46BAAF99AF6613775AF03977EEDFF56D583D175C5EFAAC6 found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 ssl3_prf: sha1_hash(6) ssl3_prf: md5_hash(6) datalen 48 ssl3_prf: sha1_hash(7) ssl3_prf: md5_hash(7) datalen 48 key expansion[104]: | 31 5f eb c8 e8 58 05 67 07 2b a6 93 cc 71 a3 4e |1_...X.g.+...q.N| | 9c 99 f3 c7 8e b7 be 85 6e 4f e3 c3 6e c0 66 3c |........nO..n.f<| | 8b 59 44 5b e3 ba 65 7a fc f4 03 63 96 36 a2 fb |.YD[..ez...c.6..| | bc 23 73 39 92 e9 1d f2 a3 4d b0 85 20 91 52 51 |.#s9.....M.. .RQ| | 00 2c 37 f3 c1 11 01 e4 1b 68 f1 a8 9f a1 8b 98 |.,7......h......| | 8a dc 09 68 2d d4 d4 ef 16 ff 2e ac f2 26 05 f5 |...h-........&..| | df 55 17 98 89 51 ea 4e |.U...Q.N | Client MAC key[20]: | 31 5f eb c8 e8 58 05 67 07 2b a6 93 cc 71 a3 4e |1_...X.g.+...q.N| | 9c 99 f3 c7 |.... | Server MAC key[20]: | 8e b7 be 85 6e 4f e3 c3 6e c0 66 3c 8b 59 44 5b |....nO..n.f<.YD[| | e3 ba 65 7a |..ez | Client Write key[16]: | fc f4 03 63 96 36 a2 fb bc 23 73 39 92 e9 1d f2 |...c.6...#s9....| Server Write key[16]: | a3 4d b0 85 20 91 52 51 00 2c 37 f3 c1 11 01 e4 |.M.. .RQ.,7.....| Client Write IV[16]: | 1b 68 f1 a8 9f a1 8b 98 8a dc 09 68 2d d4 d4 ef |.h.........h-...| Server Write IV[16]: | 16 ff 2e ac f2 26 05 f5 df 55 17 98 89 51 ea 4e |.....&...U...Q.N| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[32]: | a3 e1 fa 8c 1b af e2 ff 18 ef e7 04 dc 10 02 c5 |................| | 58 cb 9e 44 c1 a0 b0 7e 95 7c 12 aa c8 ba 6d 94 |X..D...~.|....m.| ssl_save_session stored master secret[48]: | 56 85 f5 3d 47 e7 c8 d5 47 ae 4c 8d e8 9e 0c f1 |V..=G...G.L.....| | 11 b2 17 9f 69 1e d2 89 c4 6b aa f9 9a f6 61 37 |....i....k....a7| | 75 af 03 97 7e ed ff 56 d5 83 d1 75 c5 ef aa c6 |u...~..V...u....| dissect_ssl3_handshake session keys successfully generated record: offset = 75, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 81, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 0f 89 4b e2 30 a0 35 ba fa 99 96 47 d6 d9 8b a1 |..K.0.5....G....| | 9a 86 78 0e f4 ca 64 c7 9e dd 4f 9a 13 82 26 fe |..x...d...O...&.| | b5 01 fb 22 ad 36 79 cc cb 01 d2 0d 0a a4 ae bd |...".6y.........| | 04 2f 2d 18 8e f8 29 1a 08 0b 54 2b ce fb b3 5a |./-...)...T+...Z| Plaintext[64]: | 14 00 00 24 b6 79 39 92 b2 93 9b d3 15 9c e2 06 |...$.y9.........| | e0 33 92 14 9d 3d 3c ec c3 54 f6 f2 c2 ed 08 6c |.3...=<..T.....l| | 68 8b cf a2 70 26 d1 53 9d 12 3a d3 6e a4 5a da |h...p&.S..:.n.Z.| | 0f 11 2d d6 4c 19 cc ec 2d ff 84 f2 00 00 00 03 |..-.L...-.......| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #562 (first time) conversation = 0x7f2686949b80, ssl_session = 0x7f265a9823a0 record: offset = 0, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 2e 3c 24 d0 23 b0 ad 65 4f 20 82 7e 24 23 b7 df |.<$.#..eO .~$#..| | 66 21 c4 04 91 c0 e0 5c 9f 0e 90 d7 c3 f7 97 5a |f!.....\.......Z| | 85 22 36 74 c7 9c c6 99 43 76 2c 35 22 56 d2 6a |."6t....Cv,5"V.j| | 13 f6 a4 43 d3 36 a8 b6 54 e1 bc ec 80 3e d9 e2 |...C.6..T....>..| Plaintext[64]: | 14 00 00 24 48 b3 17 09 1f 85 b9 14 b1 79 2b b7 |...$H........y+.| | a8 fe fd 19 65 72 cf 56 bc 35 76 4e 35 83 48 bf |....er.V.5vN5.H.| | f4 22 89 89 f1 d0 bc 1b 82 2f 20 e8 d2 af 52 01 |."......./ ...R.| | 75 9e a4 3d 9c f5 c4 2d cb 03 98 71 00 00 00 03 |u..=...-...q....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #563 (first time) conversation = 0x7f2686949b80, ssl_session = 0x7f265a9823a0 record: offset = 0, reported_length_remaining = 138 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | a6 e8 84 6c f0 4a cc 4e a5 f0 6a ff ec a7 61 74 |...l.J.N..j...at| | 7c 16 71 ec 54 f8 18 f4 ee 2b 4e 7b a0 ef 8e 08 ||.q.T....+N{....| Plaintext[32]: | 56 fb 3d 9f b4 e6 2b 2f 2e 50 05 67 5f 12 f6 70 |V.=...+/.P.g_..p| | 56 8c e7 4a 00 00 00 00 00 00 00 00 00 00 00 0b |V..J............| ssl_decrypt_record found padding 11 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 54766 found (nil) association_find: TCP port 4493 found 0x345e680 record: offset = 37, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 96, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 96 Ciphertext[96]: | 7d 0e 2a 05 00 e5 eb ce e4 82 fc bc 20 3b c7 bd |}.*......... ;..| | e9 34 86 84 78 bd 6d 48 74 d6 a0 85 ff 91 0d aa |.4..x.mHt.......| | bd 2e f6 df a9 bc 50 3d df ad 45 de 56 56 3e df |......P=..E.VV>.| | 92 cf ef 4c 79 84 0e df d3 d1 b9 3f 87 64 64 66 |...Ly......?.ddf| | bd 8a ab 9a 06 7e 78 6d d0 88 c7 79 27 ad b0 d8 |.....~xm...y'...| | 6c ef 92 92 83 ef e6 0b 2f 1b 2c fc 67 de 4d 2e |l......./.,.g.M.| Plaintext[96]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-| | 61 65 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 6c |aes128-sha.local| | 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n| | 6c 3a 34 34 39 33 0d 0a 0d 0a 88 c1 81 3d 11 57 |l:4493.......=.W| | 2d 94 33 8f 88 ea e8 a0 cd bd a2 06 07 4b 00 01 |-.3..........K..| ssl_decrypt_record found padding 1 final len 94 checking mac (len 74, version 300, ct 23 seq 2) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 74, seq = 0, nxtseq = 74 association_find: TCP port 54766 found (nil) association_find: TCP port 4493 found 0x345e680 dissect_ssl3_record decrypted len 74 decrypted app data fragment[74]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-| | 61 65 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 6c |aes128-sha.local| | 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n| | 6c 3a 34 34 39 33 0d 0a 0d 0a |l:4493.... | dissect_ssl3_record found association 0x345e680 dissect_ssl enter frame #564 (first time) conversation = 0x7f2686949b80, ssl_session = 0x7f265a9823a0 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | 8e 9a 50 d4 a6 3d 4e 67 8a 97 f9 c4 fb 75 c1 93 |..P..=Ng.....u..| | b0 5d d9 4f 5f 7c 8f ca 4b 70 73 09 64 86 6a 9f |.].O_|..Kps.d.j.| | 4a 36 17 2b 5a 79 ac 13 95 e6 bc 03 5d 21 68 cd |J6.+Zy......]!h.| | 8a eb c8 0d 1d 85 05 0a b2 30 8f 94 27 0f 81 f9 |.........0..'...| | 2d 37 61 a5 97 6e 44 37 d3 2d b2 b7 3e 21 ab 5a |-7a..nD7.-..>!.Z| | d2 c3 98 fb 61 d2 9a 8d 38 10 8c 43 e5 11 13 55 |....a...8..C...U| | 45 7c 09 cc 35 35 56 5a bf b0 4c f9 af 9b 8f bf |E|..55VZ..L.....| | 11 21 e0 5a 8f aa 5b d9 c7 2a 44 b5 78 fc 2c b4 |.!.Z..[..*D.x.,.| | 52 12 24 28 7b a1 b6 f0 d3 12 f9 0b 68 66 e0 d8 |R.$({.......hf..| | bc 71 9d 07 ec 7e 2f fe 09 97 3f 83 29 a1 5b dd |.q...~/...?.).[.| | b6 6e 82 2a 7a 0a 47 26 51 e2 4b 92 b9 50 92 09 |.n.*z.G&Q.K..P..| | 01 49 32 bb 63 3f 4b 40 61 0b 8c 04 a5 b7 15 c0 |.I2.c?K@a.......| | b8 84 99 b4 ea b4 a4 9f 4d a0 16 0e 0f 30 6a 9e |........M....0j.| | 30 67 a3 0e 95 ab 3e de 59 9e c5 cc 95 54 7c 90 |0g....>.Y....T|.| | ed cb 65 7a 6b f6 50 99 2a 91 89 bb 3d 81 1e 2d |..ezk.P.*...=..-| | 46 3e c4 0c 5d d2 b0 6e 98 ed 19 f2 6c 29 e5 ec |F>..]..n....l)..| | fe e6 e8 94 fb 2c 9e 2b 18 6b 62 cd e7 ab 73 63 |.....,.+.kb...sc| | 0d e6 d6 60 4a 8a 52 4c 50 75 69 ba 86 f9 f1 c6 |...`J.RLPui.....| | b2 9c d1 6a 70 4a 34 dc 2a 59 0b 46 37 66 1f 4b |...jpJ4.*Y.F7f.K| | 1e e1 6c a5 60 6d dc 1f 76 36 d8 e2 bc 54 48 6c |..l.`m..v6...THl| | c2 ec 67 7f db 06 ff 0e a9 c1 ad 97 ec 8f 27 af |..g...........'.| | 6a 5b 85 44 8d 45 98 fc ff 0f 54 7f dd c5 ce 29 |j[.D.E....T....)| | 3f 38 6f 06 79 f3 e9 c6 a1 ab 98 cb 40 0c 1a af |?8o.y.......@...| | 61 8f f4 9d 8c d9 e6 31 c7 50 22 4a 31 5a 5f ed |a......1.P"J1Z_.| Plaintext[384]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:24 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 31 33 20 2d 20 45 43 44 48 45 |xC0,0x13 - ECDHE| | 2d 52 53 41 2d 41 45 53 31 32 38 2d 53 48 41 20 |-RSA-AES128-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH| | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1.!..| | dc e4 78 60 4b 68 d8 ea ef bf a0 20 e1 e6 e5 72 |..x`Kh..... ...r| | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f |................| ssl_decrypt_record found padding 15 final len 368 checking mac (len 348, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348 association_find: TCP port 4493 found 0x345e680 dissect_ssl3_record decrypted len 348 decrypted app data fragment[348]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:24 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 31 33 20 2d 20 45 43 44 48 45 |xC0,0x13 - ECDHE| | 2d 52 53 41 2d 41 45 53 31 32 38 2d 53 48 41 20 |-RSA-AES128-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH| | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1 | dissect_ssl3_record found association 0x345e680 dissect_ssl enter frame #565 (first time) conversation = 0x7f2686949b80, ssl_session = 0x7f265a9823a0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | b8 2d 57 4c f4 bd fc 21 b9 9a 22 6b 0e 3a 96 53 |.-WL...!.."k.:.S| | 00 93 c4 da 55 fe 6e cb a6 a1 ff 74 62 89 0b db |....U.n....tb...| Plaintext[32]: | 01 00 44 6d 7e f0 30 e7 bc 66 49 11 41 42 95 5f |..Dm~.0..fI.AB._| | 89 6b ff f2 29 06 00 00 00 00 00 00 00 00 00 09 |.k..)...........| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 2) ssl_decrypt_record: mac ok dissect_ssl enter frame #567 (first time) conversation = 0x7f2686949b80, ssl_session = 0x7f265a9823a0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | c5 e4 18 73 f7 0f b9 73 1b f5 bd 90 e7 13 88 1f |...s...s........| | 91 a8 48 76 18 1c 08 5e cd c8 d9 c1 5d 9a b2 53 |..Hv...^....]..S| Plaintext[32]: | 01 00 a3 95 72 70 81 3e c0 b0 2b d8 ac 58 0b 84 |....rp.>..+..X..| | 4b 4b e8 5a 95 6c 00 00 00 00 00 00 00 00 00 09 |KK.Z.l..........| ssl_decrypt_record found padding 9 final len 22 checking mac (len 2, version 300, ct 21 seq 3) ssl_decrypt_record: mac ok dissect_ssl enter frame #572 (first time) ssl_session_init: initializing ptr 0x7f265a984b00 size 688 conversation = 0x7f2686949ee0, ssl_session = 0x7f265a984b00 record: offset = 0, reported_length_remaining = 153 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 148, ssl state 0x00 association_find: TCP port 40985 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 144 bytes, remaining 153 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4494 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #574 (first time) conversation = 0x7f2686949ee0, ssl_session = 0x7f265a984b00 record: offset = 0, reported_length_remaining = 1243 dissect_ssl3_record found version 0x0300 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 dissect_ssl3_hnd_srv_hello found CIPHER 0xC014 -> state 0x17 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57) dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 86, reported_length_remaining = 1157 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 91 length 803 bytes, remaining 898 record: offset = 898, reported_length_remaining = 345 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 331, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 903 length 327 bytes, remaining 1234 record: offset = 1234, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1239 length 0 bytes, remaining 1243 dissect_ssl enter frame #576 (first time) conversation = 0x7f2686949ee0, ssl_session = 0x7f265a984b00 record: offset = 0, reported_length_remaining = 150 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 70, ssl state 0x17 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 trying to use SSL keylog in /tmp/snif/ssl3/premaster.txt looking for CLIENT_RANDOM 52349718c617ad5c130abc00e675f2c6cff25c02b23ca290... looking for RSA pre-master4104959a3f6259576abc33b9c79fb43bf5c6c8caef546651... checking keylog line: CLIENT_RANDOM 523497106095997f6ef5dc06df7724fe8c60dd11caef929aee6fd55c62b05612 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710b7f5abeda00bb538ff8009913bf3969d46748f18961dbb6caafb69ed 1958650F357479295554DA62F8F30C5FF938D6F8307F41BF901F2A94FC8A03F6D09EBB32FF546BD63DA5167A019E115E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710feae10352f05ffd9fbb1a68d275c51686ba9ca3dd763ef70e94647f4 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497109a2a58fb127d8e52611ce11d3810d5fd8d29689876ae9e896c28bb59 AD1209325C2A530AFFFF2E3D3558DFAC5F9D4CFCDE9691871EF83302C2758BE9B5F3F6BF4BF9F48E016599EE9B3E4AC1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349710f1c7a0e36f2fda4b40059e0b8022b314ea8dbab270e1f0cd9f6c6158 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497102b45ab55e621e5cd9bea7b2454767f9be71a967e8765aa1615438b54 070C19D8FBD8666515D0A469EE51D5B26E4DFC970AEFDF1BE6061D5840FA5F1662F34C5118EC2705085EDCD4B0FCCBB2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711720fa9e658b557ac90c34b3af7e56a44bec403dac0590a41df828642 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971117d82ea2ba1f579dfb1eb44125e10a6335f8e60ebeefddfbb4164814 9530C19C4841723BB83AEADBD0B4D7B5468A9BF3B9379257BAFBD3F8A1BFF9E9A90C9D123C5E0386C8E30D71ADD1A2B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971166f006ddfbf0992718c045aaff1c9d02c3f5dbbd953c7c9892fcac70 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497116ba75ed30fcc34b5e35f095317f007e7be3bc1c3bda6f0f438861221 0C9DA033B52C5B8E8AF856E8E400CB4DB6D05678F5913BF0F46B2AFF9025F6968E5EA3072312B9D12D3484AB5607AE0E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971167a3722f71cab022193ed1051e00539436ceef7977f0fff5d69be789 CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971137a17f1c9e184bf01113087ab90f7710d8f9857a0b2ff488f390262e CAFA4D43128091207F8EB6F2F0F801CDBF1E4CD834DA0AEBAF2366369EF1FCF83F81CF770553EC15B10967D93A9284E8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711cc99fa054c460cac4b6a5440489f8eacb6b779570741e55adf017e87 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711b266684952a33b1c2a1830a1041775b511f2ece63ddd9c7366a37a9f 95CC6FA69623483654DFA32E725B3E2BA0AE4D29982015B196E8645909089C906E420B070BBF004835DCFA6B900E5866 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497110f44e1a37bf03884cd5c8416f74e8d17dc1c8b7086f03d3d5f1c7c9a 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349711289d50fa9e742b40d0d10a5b1bb40a5e16a57360eebd9682f85cf035 929C3016CF0F05C1E86B1DCDA3A9ACBFA836A3D1A22FABCEDE259735E5859993BBFECCE9458D89929173602F5FAF35A7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497122a4b47c8a88dc15fccb7a417bfe791fb3f1af8d8a7074bc018382a77 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497121c0450834321e0bb615f428b03e34b69e6a699229b6ad517eb2421ac 49544630BD016F2F0430C4AAAFCB18ADC81CA008804B1B9151A7A91763F0629E6CA2E59692AEBA5A6AA48A1CEADAC7DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712184c23d4e6c0f77a47e98b9c5bcd17077e1b5a8657bf19e6a4c77e97 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497129a4412cd829929ec8614cf2c64391939740a301bd441bf534732547d 4A4CC602AE6B522AB5C70EEED594FF3BEBEA0D49A9D7318CD65081C029473F9F9D823340BD732F53CF8FDE188134655C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971295c90bf0d580faa4aebbdb050524fe4bbffc48f6365007ae7d711b29 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712a4cb434904d604e969b1f8ae237bd35b4078b84fea2fc77ad42be2df 26E47DA9543580C84F02B9340E9503A586BA81F8CD34F8A81F9007400ED06A796E5AC0F68D2F495610CF6920B9C75CEA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971265a90f5a2ac796b8bd99fbb54dbfa8a7473e5929e39404469f8cef78 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349712f7fa3bfb7f0b6b0993ee7f14492c48c58ac7383ef4f66c4d91f25031 AB748208A69972C22C065923F43DD83AB2F86BEBE30EC05B2A171AF13856ADF21CAA06EFC9D6588D6CDB38F6EC981367 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713367552eaeff3f909debc083e474082ac0d0f237495b41695c758e534 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713db6bb0750f4a7dfa92db8561d89915f0c0f8457e545892be26933b70 A1507A7E7D5CCAA79D73D0DE8816E5FFB50E99AB685231C64294130BAFE090ED1B24928E12AF266429E8DF438622F0FC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713705d725244096064ea8f59ba668c7d0906750719ba247e78e19343c8 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497138e7a6faf341fe74f2ff6b16b635496beeb6983a19309deecda206991 56B01F4E1E6804B25BD6DA77E215F23CF4866C7D0CAEE462D88BF46BE117005EA782A0DEE0993322989F0B154E8841A3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135239730130659677302287806ee7c78a923609cdabb22de9a4d88a23 EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713443de4628719cc0792fd8d3eab02192c0081002e035ecbf294196bcc EDF998B596941515FB94A71089A6110E637510C3F2295E05E548D383368BB2A4AB1492051E4528326EDFB76FD3F1531D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349713f96601667cbbeee625adb4178ccad1725f816fda09809ad22af5342f C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497134071c762250a94681e7160d1ed6fa20c557a7146393e8962058a4964 C4881965718F74C6F1E1C7FBAF0BDBDC138E06E290BE433A2A7CCB45D2BA3140155EEF534537EDD394AA04F1C395A7A4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497135553b2fb326c898c2628b7d8316e982b34be4773b2ef96159a9edb3b E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971371ac3703f94866cf5e8a940ff26f64b472cbc81de6c09b3d00146e04 E962B6BD1516EF95E9B1D66D4621F20AAF55BC1F52C7EC571162C34F9022927B320190A045EF7DA311441BE72EF8E480 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714cfbb0f58fdbd8c4f501d1310008376563fe6975b2942053e195f2647 FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714660f3110188fa739958548790837b9a680b353d722cfca6afabd7d8c FEE109C9423B8B31C05B8127DD448B385A411979DCA3B57742FB61D33F44EA7B562418EDDE262F5BD6CB1D7F948F4641 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971407cb6d00faedd7a072e7e711f0b937f008e15083ba04d2600f6d2d4e 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971482e2b22cdbbd0209c29168b3027cfe1ff79dc8c444d72439e39b307d 75FDE106BFF274562C49E12E7C10BAD1574E7C59345EE400477A5DD165FC91724E155A5F9D6B6CDE48454EBFD92EB205 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971486bce027efd32bfcfcb094aca4a88de74f24279c52684406a861a4a5 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714618c1cc7b10a37f2142d86d7903464adc5d9ab5c505d7a2dfaefda04 53C13C3C1C131708F3420643BB7BFE1EC01DAC210D7FED48D50C56156CD358E9A284CB8D6C3BBA70AA86A54FC4DC2312 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971420962da5becef95f364be7960747c1a69300211a1e3e81da1fcb7e4d 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349714fd6470ab0333631c9d4de891ea4828804596a47d277de19ca6bb5866 65CC164259702E78489F6C4F9F3FD2B3ABF9FC5DBC43E7592F7670F8780DE9F33B205DDCB45902B8CCAF48B59A80B9AC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971598eb63ea8595c5e953108929f153b007b4187ec4f701e792eecef778 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715bdba2ec2e8701d6be5680a04af013eaacf5381983f81440d30e38773 EAA7776675B776A500B9FF427F17BB1E2EBD14F359CC354FE9115B750EC0353E0B6EC1D381E378BC1625FC19B22CC13B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715d31da56014c769ace436bde856cf7bcc5180d8d1ca1188b02c4c6ab9 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715880ec956f3feb6e2f9f918633011bd493e5a880d4d5a183a26dd6583 B6A7AC052E39E4625D5285C862C04A3198504C0B45EAC7123BFEA225F92250E88A5A8D97CD9DC07E80DB2D2F8BCE3555 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497159a414e245ceaf08b980797b5f10c25600bb476aae1ed68917f51109e 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715335db40348e68b7e340873b34421f4cc8e3421b38c6966a2376e2534 2E24D1379DA1C24297D5DCE066BB80715966D2CFD9338C6EBB48604EE56FC6659D4334F2388F24A46C8854D14DD14850 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715a057bcf4bc37fa3d7cebcd377a38fb5738e7476415ea8e28cf147758 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971568edf373b61bc5ad23adced91be40231158d90cf25c26bd04b2bf8e5 810D9970D55ABB4D34D27ABC38A0F2D94BB32B4A3BCA512E36440D2C9DE94F60A77539ADCAA77981C7E45A64A44D35BF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715962d4af8406926fe2e6cdde32c19ed2cf9f37822a2f3d6e9c8c521a0 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715064b708db7aa9cef48ec8a9bf517e7392e7ee9a35062ce7bb2523787 37934CDCB81BACFF4E07045794E0975177A0CE4270A1C8DBFD0D38029182555EBB888ADBDE718DA0586C3DBD174E0F02 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715790ce6d17391606acd8b094886563f27a8996fa6c96e2b99876c41a9 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349715331fb5a174085ae52bbe3d725ace224182d655998abe8023d7f2bc0a 66F40EFA230E9A7D5C6FC253B4783DD1A24EE16C7EE9B5590BF43DBFB556B013BEE0C90E56D459A40198BF81D3A60FF3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971614ca4762f9bd4dbd73b749b3de5971deaff2aded5e287130aa5cfce8 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234971618d66ee5fc31f776c8a738bc8fa9f814928f810132568d2d13f7d3c6 8DF03F668632BB320728E174315A97EEC8E9167145FCE1046057F22DCCBA9E018710CFDD4EF4E69CAA61A4F8F30BBB75 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497165c84a778f75147dcfa77cc53cae36771b51e8449eba9fb5ed19cbfb1 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716d5b1c0e0cc0bcb19610b6161a0c61d611a3109055501508d5b53cc04 919BB082079215A574FF742BC976AE561E8A1385C6BC38D880F6519D7E0DF4AD356C579FDB81B24AB57701D39F0A78C3 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716fb2b23f18526271e78e3279be8200762333aa441bfe3e350d788a297 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716e114ef8c729d3959e2b6e238e9ac4b7cf212b5b2e0116c18c8a7d447 E87D8C6D99A1D7F4D97E83E034EA06B08F886D8BA71FF7B89674981006AA377B74CE88538264B2660F8954EDB452A298 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497161056a154f59d2d185ee4c09f9469c0af6f588a4e8783243504b51b86 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349716eb24840713b5a9817fbc8cf71d9db1fcfb410da480bb4f09e655975a 6D9488FFF690F6BF5215B9805E9CFBF145463807CDB76DF94AE21A2F3C0CD566AD78F0A014116687B16CB2FCE5EC300A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717c69164e151a28d72939e3acd50c81c72d48489c0c5c8414a6d2e3d62 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497170f4d7595e4dd322804591e101abc2f8458461bd60bcd7efeb43c19f7 467596427D0F4FE440D002DE21593B8D9B01FE08CC752FA961FB8A55F5DA73C6AA36C9AF4D22BB371DBF9BB5C50766EF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717e2661941933437161045002d21486fe34e7a6a8661ca1a945c2376dd 17ACC42B028145A2CD35A64E821F89388E625194A652E88E8246CC089A7C51E4E05F90F9ACFB5EDA64A633A3EFD3F3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497173cddbc719a19ffd337851a366f113d29ece8ba061d3bb98208e99435 17ACC42B028145A2CD35A64E821F89388E625194A652E88E8246CC089A7C51E4E05F90F9ACFB5EDA64A633A3EFD3F3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717cca5aebe07984142824e3d3001e6ffe94357805d9921b6fda7ae8cde 4B7A19DDE31871A980B9C9DB2826C10777E901D1433A424029FA2703B1BC87AF05A7294E33278FDA439FD75B61E0D913 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717f85b9be404f7806b79d1995328a944e720d6b49e54b2af77ed5a29bd 4B7A19DDE31871A980B9C9DB2826C10777E901D1433A424029FA2703B1BC87AF05A7294E33278FDA439FD75B61E0D913 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717cb4121a28b8b1d3c958de85b51e5c13544f0d01b636ff0d495c1a31a C3729D1A5D656DDF61B6F99671773F20326605D5598DC93B0AFAD35270CB20B8EAD4FB3D8C84E7F6CFF139F84575B65C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717bef5fab2b90e6f815efc43f47d8866cf66948076cf8283ce92caa99f C3729D1A5D656DDF61B6F99671773F20326605D5598DC93B0AFAD35270CB20B8EAD4FB3D8C84E7F6CFF139F84575B65C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497172caed990bc6f6fd864e5915c3c76e330ea2685fa4beadea445e68c43 53AB43C6AF0EC95E92901056CD7C13256F74C65CE7ADE750D502CBCD760B95827AB780193D1258AADAC87CC24477CE56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349717d3e7c40d9f5dce297ef3957ff642aa7c1834f35e2d6650484275824d 53AB43C6AF0EC95E92901056CD7C13256F74C65CE7ADE750D502CBCD760B95827AB780193D1258AADAC87CC24477CE56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349718114a5b6aa1df4b82da1ca6b23be2327fe8a2ee52127ec7161141088e 2E71B5A062F0F5779D07CA0FA38C4370C256668DAFD1D2AB152ED5072434040346E46F2CAA6F4E2A8BE9B3FFF34377F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349718626c958f65c36cdc2f6517db0f369951c5f8c41fbf45248538b6d050 2E71B5A062F0F5779D07CA0FA38C4370C256668DAFD1D2AB152ED5072434040346E46F2CAA6F4E2A8BE9B3FFF34377F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 523497185c750857e25775f2a635b1d3706ead2cc8bc625ed41c1063c7dd7965 5685F53D47E7C8D547AE4C8DE89E0CF111B2179F691ED289C46BAAF99AF6613775AF03977EEDFF56D583D175C5EFAAC6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349718abbab324bf6f28598d5af5b8b95ce8eac2ea293a4285ba3c4e6be2f7 5685F53D47E7C8D547AE4C8DE89E0CF111B2179F691ED289C46BAAF99AF6613775AF03977EEDFF56D583D175C5EFAAC6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349718e6b6d3a218ad1e415c3fa505b4c3e4d7aba48c5fb96df36fdff37e6c DE5744B132A5B614761C9354987C146F82889F6155CE373832E19B74A1C67226353FE8D33D83B7DE4D73E947C6434780 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 52349718c617ad5c130abc00e675f2c6cff25c02b23ca290596ca0ac06802dcb DE5744B132A5B614761C9354987C146F82889F6155CE373832E19B74A1C67226353FE8D33D83B7DE4D73E947C6434780 found master secret in key log ssl_generate_keyring_material sess key generation ssl3_prf: sha1_hash(1) ssl3_prf: md5_hash(1) datalen 48 ssl3_prf: sha1_hash(2) ssl3_prf: md5_hash(2) datalen 48 ssl3_prf: sha1_hash(3) ssl3_prf: md5_hash(3) datalen 48 ssl3_prf: sha1_hash(4) ssl3_prf: md5_hash(4) datalen 48 ssl3_prf: sha1_hash(5) ssl3_prf: md5_hash(5) datalen 48 ssl3_prf: sha1_hash(6) ssl3_prf: md5_hash(6) datalen 48 ssl3_prf: sha1_hash(7) ssl3_prf: md5_hash(7) datalen 48 ssl3_prf: sha1_hash(8) ssl3_prf: md5_hash(8) datalen 48 ssl3_prf: sha1_hash(9) ssl3_prf: md5_hash(9) datalen 48 key expansion[136]: | 12 67 de c9 6c 4f 0c 9d 91 8d 90 36 23 ae 8f 0b |.g..lO.....6#...| | 11 bd fd 99 52 f2 81 71 cf cd d7 39 7b f5 89 39 |....R..q...9{..9| | 15 15 e8 99 4a be a1 f9 b7 cb 0f 74 3d fa bd e5 |....J......t=...| | 08 23 02 a4 98 92 46 85 6b 8e 7f a5 5a e9 11 d6 |.#....F.k...Z...| | 84 ab a0 a7 de 5b 40 23 c6 44 49 f4 e8 b6 10 83 |.....[@#.DI.....| | ad dd 69 27 9f 53 aa b6 a5 ad b7 29 70 8b 2e 0d |..i'.S.....)p...| | 89 d1 b6 09 be 8e 86 cd 0c 98 eb 32 be aa 12 bf |...........2....| | 15 83 b0 68 35 58 d4 ad 3c 4a cd d6 a0 9d fe c1 |...h5X../..^.`..0..| | f9 c8 d0 77 9c 12 9d 20 6a ef a9 5f 3c bd ae bf |...w... j.._<...| ssl_save_session stored master secret[48]: | de 57 44 b1 32 a5 b6 14 76 1c 93 54 98 7c 14 6f |.WD.2...v..T.|.o| | 82 88 9f 61 55 ce 37 38 32 e1 9b 74 a1 c6 72 26 |...aU.782..t..r&| | 35 3f e8 d3 3d 83 b7 de 4d 73 e9 47 c6 43 47 80 |5?..=...Ms.G.CG.| dissect_ssl3_handshake session keys successfully generated record: offset = 75, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 81, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 21 4e 06 16 36 4d 8c 04 aa d0 da 25 63 24 7a 52 |!N..6M.....%c$zR| | 0c 6c 0f 8c 02 0e ae 6a ff 4b 97 d2 21 d0 e5 00 |.l.....j.K..!...| | dd 0b 66 eb bc 77 ef 4c 81 7a 59 74 98 91 a6 20 |..f..w.L.zYt... | | 2d 0b 1c ee 70 1a 45 9b c4 53 7a a0 d7 05 9f 91 |-...p.E..Sz.....| Plaintext[64]: | 14 00 00 24 dd 95 da e1 38 00 cc 84 2c d1 eb 23 |...$....8...,..#| | 6e 4b b4 08 f0 ff 61 5b 0d a5 54 09 4e 93 6e 97 |nK....a[..T.N.n.| | 31 fc bb 52 01 0a 5e 81 9f 7b 42 e4 8f 3e 13 5d |1..R..^..{B..>.]| | 9b 98 cf 23 a0 1e 99 49 af f3 66 39 00 00 00 03 |...#...I..f9....| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #577 (first time) conversation = 0x7f2686949ee0, ssl_session = 0x7f265a984b00 record: offset = 0, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 08 aa df 27 28 66 a6 23 94 dc 50 27 81 d6 fb 68 |...'(f.#..P'...h| | 0c df 86 87 c7 74 09 76 ff de b5 e7 bd 4e 6d 88 |.....t.v.....Nm.| | ba 99 a7 b2 65 20 31 e4 00 6b e6 11 fb 64 31 6f |....e 1..k...d1o| | 33 42 86 b0 c8 2f 86 b1 21 9b 8c bf 6d e3 c5 c8 |3B.../..!...m...| Plaintext[64]: | 14 00 00 24 ea bd 1a e8 eb 17 c6 11 0c 82 cd 46 |...$...........F| | 81 7c 15 a3 e3 6e fe 67 71 79 e9 04 fa 02 c9 37 |.|...n.gqy.....7| | 8c 0d 73 5a ec a2 fc 64 93 18 48 f1 06 41 c4 3d |..sZ...d..H..A.=| | d9 06 96 54 3a 36 75 cb ec 44 c6 d7 00 00 00 03 |...T:6u..D......| ssl_decrypt_record found padding 3 final len 60 checking mac (len 40, version 300, ct 22 seq 0) ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 36 bytes, remaining 40 dissect_ssl enter frame #578 (first time) conversation = 0x7f2686949ee0, ssl_session = 0x7f265a984b00 record: offset = 0, reported_length_remaining = 138 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 4c 61 d2 cc 9f cb 0d 2c 7a 9a d4 00 cc f8 c7 fb |La.....,z.......| | aa e9 4f d0 1e 3f 5d bd d8 9f 4d 28 86 92 32 a1 |..O..?]...M(..2.| Plaintext[32]: | 30 d5 98 2d fd 36 2a 13 9e 0c b6 28 99 4f 81 87 |0..-.6*....(.O..| | 04 44 e7 f5 00 00 00 00 00 00 00 00 00 00 00 0b |.D..............| ssl_decrypt_record found padding 11 final len 20 checking mac (len 0, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 0, seq = 0, nxtseq = 0 association_find: TCP port 40985 found (nil) association_find: TCP port 4494 found 0x345e710 record: offset = 37, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 96, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 96 Ciphertext[96]: | c7 53 d9 7d cb ae 07 fe 3f e5 e5 43 9c 43 cb c9 |.S.}....?..C.C..| | ce f6 3a 65 7e 69 6e 75 00 5d 87 c6 db e5 29 91 |..:e~inu.]....).| | a4 17 a0 bd 0e 40 0b 19 ee f0 8f 89 22 7b 63 2e |.....@......"{c.| | 7b db ee e5 16 5e 23 01 9f 94 77 f5 45 04 14 b4 |{....^#...w.E...| | d7 6c 06 3b a8 54 cb 02 e4 54 99 21 d0 f3 68 3f |.l.;.T...T.!..h?| | 79 d1 3d aa 2b c6 be 58 34 d6 70 62 1f 90 1d e2 |y.=.+..X4.pb....| Plaintext[96]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-| | 61 65 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 6c |aes256-sha.local| | 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n| | 6c 3a 34 34 39 34 0d 0a 0d 0a 5e 07 34 4e cb 96 |l:4494....^.4N..| | ac b2 26 63 d6 d9 c9 1e 2e b6 2e 94 de ce 00 01 |..&c............| ssl_decrypt_record found padding 1 final len 94 checking mac (len 74, version 300, ct 23 seq 2) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 74, seq = 0, nxtseq = 74 association_find: TCP port 40985 found (nil) association_find: TCP port 4494 found 0x345e710 dissect_ssl3_record decrypted len 74 decrypted app data fragment[74]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-| | 61 65 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 6c |aes256-sha.local| | 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n| | 6c 3a 34 34 39 34 0d 0a 0d 0a |l:4494.... | dissect_ssl3_record found association 0x345e710 dissect_ssl enter frame #579 (first time) conversation = 0x7f2686949ee0, ssl_session = 0x7f265a984b00 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | 64 8b 54 62 5d b4 6e d3 d4 b4 c2 c7 59 0a 4d 35 |d.Tb].n.....Y.M5| | 6f 4a 08 8c 69 2d 4f c9 a1 50 f8 72 90 57 67 a0 |oJ..i-O..P.r.Wg.| | 9e 89 a8 e5 c3 b8 01 e3 ff 88 c8 db 82 af 0b 1e |................| | 87 1f 0d d2 fb 0d 78 71 59 d8 8d fd 56 c9 bd 0a |......xqY...V...| | c7 d0 c0 9e 85 17 e4 89 8d 27 6b e2 63 0a 14 e4 |.........'k.c...| | 49 3a 3a fd c0 f7 b6 e8 c5 2e 5d 44 2c f6 fe 74 |I::.......]D,..t| | b3 12 56 7d 7e f2 82 8b 30 45 de 4f 69 ee b7 7d |..V}~...0E.Oi..}| | a8 27 14 ea 17 49 1e 12 bf 1d 10 ea c3 bb 01 95 |.'...I..........| | 6c 65 9c 46 a0 43 cb 89 25 23 9d a5 dd f2 c3 fb |le.F.C..%#......| | a9 50 24 6c 10 d1 04 ee a6 be 43 91 88 c2 ed ef |.P$l......C.....| | cc 1e 2d 4e 31 a5 fc 95 58 cf 0c c0 ee ff d6 b8 |..-N1...X.......| | 2d 86 22 f2 5d 63 3c ed 1e 4e 99 9d 30 f3 97 76 |-.".]c<..N..0..v| | f4 c5 4f d5 9f 87 b9 78 5d b3 a9 24 fc a2 0d 54 |..O....x]..$...T| | 1e d7 70 1f 4c c8 9c 84 ca f9 bf 47 01 70 5c 98 |..p.L......G.p\.| | 5f bb d8 c3 24 4b b9 a4 07 52 3f c9 d0 4b 64 aa |_...$K...R?..Kd.| | e3 6a 94 27 20 d8 9d 30 30 fa 52 51 b8 0a 9e a9 |.j.' ..00.RQ....| | 14 ad b7 5d 92 7c c9 32 40 ed ea 61 07 f5 a8 df |...].|.2@..a....| | a1 0b d0 c0 df ea 51 83 d5 56 bf f0 2f 27 47 8c |......Q..V../'G.| | b7 e9 59 a1 bb 1c ee 1d 7c ac 90 a2 73 56 08 3d |..Y.....|...sV.=| | 6f d6 19 6f 8d 8c d2 e2 48 b9 c2 16 05 84 60 ba |o..o....H.....`.| | 3a 25 c5 4a b9 18 59 d7 99 17 60 8f 57 45 85 96 |:%.J..Y...`.WE..| | 78 66 a4 51 de 2a 0c 06 35 55 8a 2d 89 de c3 5c |xf.Q.*..5U.-...\| | 3d 90 dc 0b 58 a7 83 94 0a 79 8a 9f 71 20 f6 7a |=...X....y..q .z| | 2d 68 d0 3f f4 e2 7d 12 b3 4c 30 ff 5d fb eb b8 |-h.?..}..L0.]...| Plaintext[384]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:24 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 31 34 20 2d 20 45 43 44 48 45 |xC0,0x14 - ECDHE| | 2d 52 53 41 2d 41 45 53 32 35 36 2d 53 48 41 20 |-RSA-AES256-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH| | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1m.Y.| | a9 f2 fb 28 4d 30 51 8d 1c ad 55 78 22 3d 0a 54 |...(M0Q...Ux"=.T| | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f |................| ssl_decrypt_record found padding 15 final len 368 checking mac (len 348, version 300, ct 23 seq 1) ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348 association_find: TCP port 4494 found 0x345e710 dissect_ssl3_record decrypted len 348 decrypted app data fragment[348]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 37 3a | 14 Sep 2013 17:| | 30 34 3a 32 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |04:24 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 31 34 20 2d 20 45 43 44 48 45 |xC0,0x14 - ECDHE| | 2d 52 53 41 2d 41 45 53 32 35 36 2d 53 48 41 20 |-RSA-AES256-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH| | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1 | dissect_ssl3_record found association 0x345e710 dissect_ssl enter frame #580 (first time) conversation = 0x7f2686949ee0, ssl_session = 0x7f265a984b00 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 16 14 1b 0c 3c 76 4b af 80 12 56 06 fe 91 6f d6 |....document.domai| | 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |n='local.al.leke| | 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 |nsteyn.nl' | dissect_ssl3_record found association 0x3451b20 dissect_ssl enter frame #12 (already visited) conversation = 0x7f2686942088, ssl_session = (nil) record: offset = 0, reported_length_remaining = 23 dissect_ssl3_record: content_type 21 Alert dissect_ssl enter frame #14 (already visited) conversation = 0x7f2686942088, ssl_session = (nil) record: offset = 0, reported_length_remaining = 23 dissect_ssl3_record: content_type 21 Alert