Wireshark SSL debug log dissect_ssl enter frame #4 (first time) ssl_session_init: initializing ptr 0x7facc380f060 size 688 conversation = 0x7facef996088, ssl_session = 0x7facc380f060 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 40165 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4434 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #6 (first time) conversation = 0x7facef996088, ssl_session = 0x7facc380f060 record: offset = 0, reported_length_remaining = 1224 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session can't find stored session trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 found master secret in key log cannot find master secret in keylog file either dissect_ssl3_hnd_srv_hello found CIPHER 0x0003 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 6f d8 d0 b4 a1 99 96 05 3c ac 68 66 95 39 c4 82 |o.......<.hf.9..| | a6 0f cf d3 2d 89 14 f9 61 da 94 ea 47 73 d9 c8 |....-...a...Gs..| | 8e 25 b0 97 4b 5c c3 18 a4 b3 ff 4d c7 74 0f 67 |.%..K\.....M.t.g| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 1f fd b7 80 db 61 46 f3 84 58 44 19 39 6c c0 1f |.....aF..XD.9l..| | bd 66 13 4b 3a 85 73 46 b1 b4 62 7b 5c 52 34 bf |.f.K:.sF..b{\R4.| | 1f 39 94 6c bb 0b fb 60 9d 20 7f 48 d6 55 05 ec |.9.l...`. .H.U..| | e7 f9 a7 a3 ab 3d ae 14 bd 78 af 32 08 |.....=...x.2. | hash out[64]: | 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....| | a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G| | b9 f7 1b 5e 87 bd 24 1f e8 5a 3a b1 41 12 b0 59 |...^..$..Z:.A..Y| | 20 5c 13 97 4d 9b 2b 47 f9 60 9c 41 a8 dd c3 8b | \..M.+G.`.A....| PRF out[64]: | 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....| | a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G| | b9 f7 1b 5e 87 bd 24 1f e8 5a 3a b1 41 12 b0 59 |...^..$..Z:.A..Y| | 20 5c 13 97 4d 9b 2b 47 f9 60 9c 41 a8 dd c3 8b | \..M.+G.`.A....| key expansion[64]: | 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....| | a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G| | b9 f7 1b 5e 87 bd 24 1f e8 5a 3a b1 41 12 b0 59 |...^..$..Z:.A..Y| | 20 5c 13 97 4d 9b 2b 47 f9 60 9c 41 a8 dd c3 8b | \..M.+G.`.A....| ssl_generate_keyring_material PRF(key_c) tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 ) tls_hash: hash secret[5]: | b9 f7 1b 5e 87 |...^. | tls_hash: hash seed[80]: | 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key| | 52 34 bf 1f 39 94 6c bb 0b fb 60 9d 20 7f 48 d6 |R4..9.l...`. .H.| | 55 05 ec e7 f9 a7 a3 ab 3d ae 14 bd 78 af 32 08 |U.......=...x.2.| | 52 34 bf 1f fd b7 80 db 61 46 f3 84 58 44 19 39 |R4......aF..XD.9| | 6c c0 1f bd 66 13 4b 3a 85 73 46 b1 b4 62 7b 5c |l...f.K:.sF..b{\| hash out[32]: | f9 f8 f5 03 39 4c e2 08 90 84 78 0d 7d 2c f4 14 |....9L....x.},..| | 11 40 d4 b9 d1 f3 d9 a5 8c e7 8a 33 09 d3 86 40 |.@.........3...@| PRF out[32]: | f9 f8 f5 03 39 4c e2 08 90 84 78 0d 7d 2c f4 14 |....9L....x.},..| | 11 40 d4 b9 d1 f3 d9 a5 8c e7 8a 33 09 d3 86 40 |.@.........3...@| ssl_generate_keyring_material PRF(key_s) tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 ) tls_hash: hash secret[5]: | bd 24 1f e8 5a |.$..Z | tls_hash: hash seed[80]: | 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key| | 52 34 bf 1f 39 94 6c bb 0b fb 60 9d 20 7f 48 d6 |R4..9.l...`. .H.| | 55 05 ec e7 f9 a7 a3 ab 3d ae 14 bd 78 af 32 08 |U.......=...x.2.| | 52 34 bf 1f fd b7 80 db 61 46 f3 84 58 44 19 39 |R4......aF..XD.9| | 6c c0 1f bd 66 13 4b 3a 85 73 46 b1 b4 62 7b 5c |l...f.K:.sF..b{\| hash out[32]: | 2e c2 9b f3 fa bb 6d 9e d8 cf 2f 2d ac 20 de 09 |......m.../-. ..| | 00 ee 94 bf a9 91 34 5e 45 4e ef 41 2e f8 68 11 |......4^EN.A..h.| PRF out[32]: | 2e c2 9b f3 fa bb 6d 9e d8 cf 2f 2d ac 20 de 09 |......m.../-. ..| | 00 ee 94 bf a9 91 34 5e 45 4e ef 41 2e f8 68 11 |......4^EN.A..h.| Client MAC key[16]: | 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....| Server MAC key[16]: | a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G| Client Write key[16]: | f9 f8 f5 03 39 4c e2 08 90 84 78 0d 7d 2c f4 14 |....9L....x.},..| Server Write key[16]: | 2e c2 9b f3 fa bb 6d 9e d8 cf 2f 2d ac 20 de 09 |......m.../-. ..| Client Write IV[8]: | 01 00 00 00 00 00 00 00 |........ | Server Write IV[8]: | 52 11 00 00 00 00 00 00 |R....... | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: ARCFOUR decoder initialized (digest len 16) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: ARCFOUR decoder initialized (digest len 16) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 1161 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 349 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 335, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 880 length 331 bytes, remaining 1215 record: offset = 1215, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1220 length 0 bytes, remaining 1224 dissect_ssl enter frame #8 (first time) conversation = 0x7facef996088, ssl_session = 0x7facc380f060 record: offset = 0, reported_length_remaining = 118 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 70, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab... looking for RSA pre-masteraaf9896cd26391408e582a9fe4c1454d18e1935c79f420c9... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 6f d8 d0 b4 a1 99 96 05 3c ac 68 66 95 39 c4 82 |o.......<.hf.9..| | a6 0f cf d3 2d 89 14 f9 61 da 94 ea 47 73 d9 c8 |....-...a...Gs..| | 8e 25 b0 97 4b 5c c3 18 a4 b3 ff 4d c7 74 0f 67 |.%..K\.....M.t.g| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 1f fd b7 80 db 61 46 f3 84 58 44 19 39 6c c0 1f |.....aF..XD.9l..| | bd 66 13 4b 3a 85 73 46 b1 b4 62 7b 5c 52 34 bf |.f.K:.sF..b{\R4.| | 1f 39 94 6c bb 0b fb 60 9d 20 7f 48 d6 55 05 ec |.9.l...`. .H.U..| | e7 f9 a7 a3 ab 3d ae 14 bd 78 af 32 08 |.....=...x.2. | hash out[64]: | 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....| | a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G| | b9 f7 1b 5e 87 bd 24 1f e8 5a 3a b1 41 12 b0 59 |...^..$..Z:.A..Y| | 20 5c 13 97 4d 9b 2b 47 f9 60 9c 41 a8 dd c3 8b | \..M.+G.`.A....| PRF out[64]: | 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....| | a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G| | b9 f7 1b 5e 87 bd 24 1f e8 5a 3a b1 41 12 b0 59 |...^..$..Z:.A..Y| | 20 5c 13 97 4d 9b 2b 47 f9 60 9c 41 a8 dd c3 8b | \..M.+G.`.A....| key expansion[64]: | 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....| | a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G| | b9 f7 1b 5e 87 bd 24 1f e8 5a 3a b1 41 12 b0 59 |...^..$..Z:.A..Y| | 20 5c 13 97 4d 9b 2b 47 f9 60 9c 41 a8 dd c3 8b | \..M.+G.`.A....| ssl_generate_keyring_material PRF(key_c) tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 ) tls_hash: hash secret[5]: | b9 f7 1b 5e 87 |...^. | tls_hash: hash seed[80]: | 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key| | 52 34 bf 1f 39 94 6c bb 0b fb 60 9d 20 7f 48 d6 |R4..9.l...`. .H.| | 55 05 ec e7 f9 a7 a3 ab 3d ae 14 bd 78 af 32 08 |U.......=...x.2.| | 52 34 bf 1f fd b7 80 db 61 46 f3 84 58 44 19 39 |R4......aF..XD.9| | 6c c0 1f bd 66 13 4b 3a 85 73 46 b1 b4 62 7b 5c |l...f.K:.sF..b{\| hash out[32]: | f9 f8 f5 03 39 4c e2 08 90 84 78 0d 7d 2c f4 14 |....9L....x.},..| | 11 40 d4 b9 d1 f3 d9 a5 8c e7 8a 33 09 d3 86 40 |.@.........3...@| PRF out[32]: | f9 f8 f5 03 39 4c e2 08 90 84 78 0d 7d 2c f4 14 |....9L....x.},..| | 11 40 d4 b9 d1 f3 d9 a5 8c e7 8a 33 09 d3 86 40 |.@.........3...@| ssl_generate_keyring_material PRF(key_s) tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 ) tls_hash: hash secret[5]: | bd 24 1f e8 5a |.$..Z | tls_hash: hash seed[80]: | 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key| | 52 34 bf 1f 39 94 6c bb 0b fb 60 9d 20 7f 48 d6 |R4..9.l...`. .H.| | 55 05 ec e7 f9 a7 a3 ab 3d ae 14 bd 78 af 32 08 |U.......=...x.2.| | 52 34 bf 1f fd b7 80 db 61 46 f3 84 58 44 19 39 |R4......aF..XD.9| | 6c c0 1f bd 66 13 4b 3a 85 73 46 b1 b4 62 7b 5c |l...f.K:.sF..b{\| hash out[32]: | 2e c2 9b f3 fa bb 6d 9e d8 cf 2f 2d ac 20 de 09 |......m.../-. ..| | 00 ee 94 bf a9 91 34 5e 45 4e ef 41 2e f8 68 11 |......4^EN.A..h.| PRF out[32]: | 2e c2 9b f3 fa bb 6d 9e d8 cf 2f 2d ac 20 de 09 |......m.../-. ..| | 00 ee 94 bf a9 91 34 5e 45 4e ef 41 2e f8 68 11 |......4^EN.A..h.| Client MAC key[16]: | 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....| Server MAC key[16]: | a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G| Client Write key[16]: | f9 f8 f5 03 39 4c e2 08 90 84 78 0d 7d 2c f4 14 |....9L....x.},..| Server Write key[16]: | 2e c2 9b f3 fa bb 6d 9e d8 cf 2f 2d ac 20 de 09 |......m.../-. ..| Client Write IV[8]: | 00 00 00 00 00 00 00 00 |........ | Server Write IV[8]: | 20 bb 73 03 00 00 00 00 | .s..... | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: ARCFOUR decoder initialized (digest len 16) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: ARCFOUR decoder initialized (digest len 16) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 6f d8 d0 b4 a1 99 96 05 3c ac 68 66 95 39 c4 82 |o.......<.hf.9..| | a6 0f cf d3 2d 89 14 f9 61 da 94 ea 47 73 d9 c8 |....-...a...Gs..| | 8e 25 b0 97 4b 5c c3 18 a4 b3 ff 4d c7 74 0f 67 |.%..K\.....M.t.g| dissect_ssl3_handshake session keys successfully generated record: offset = 75, reported_length_remaining = 43 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 81, reported_length_remaining = 37 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | ab 1f 53 b0 d4 2c d5 d9 3a d2 9d 10 94 17 c2 c7 |..S..,..:.......| | 8f 46 0e 99 0b 6e eb a6 95 9e 9d 41 31 7a b5 71 |.F...n.....A1z.q| Plaintext[32]: | 14 00 00 0c 5d c6 d2 8c 1a 80 f1 2e fb 70 e7 68 |....]........p.h| | 91 a5 3e 01 f9 26 3e 50 36 b9 36 40 e6 c0 a1 1e |..>..&>P6.6@....| checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:MD5 md 1 Mac[16]: | 91 a5 3e 01 f9 26 3e 50 36 b9 36 40 e6 c0 a1 1e |..>..&>P6.6@....| ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #9 (first time) conversation = 0x7facef996088, ssl_session = 0x7facc380f060 record: offset = 0, reported_length_remaining = 218 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 43 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 37 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 7b 0f 3a 4f 01 75 7f c4 33 6f 0a bc a6 a2 50 67 |{.:O.u..3o....Pg| | a4 c8 58 70 89 81 ed 24 6d 43 34 8c 9c ca 15 e0 |..Xp...$mC4.....| Plaintext[32]: | 14 00 00 0c 0b 09 b9 f9 94 8b 80 5f e6 42 81 6b |..........._.B.k| | 88 89 9f 61 5e 5e f2 c5 c2 78 01 dd 25 ca 1d a0 |...a^^...x..%...| checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:MD5 md 1 Mac[16]: | 88 89 9f 61 5e 5e f2 c5 c2 78 01 dd 25 ca 1d a0 |...a^^...x..%...| ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #10 (first time) conversation = 0x7facef996088, ssl_session = 0x7facc380f060 record: offset = 0, reported_length_remaining = 86 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 81, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 81 Ciphertext[81]: | 3e 0d ba 3e 4a 7e 7a 46 bf b9 9c 3f 31 f8 b2 0f |>..>J~zF...?1...| | 69 64 7c 7a 30 22 ce 38 45 4b 81 31 00 a9 41 57 |id|z0".8EK.1..AW| | b4 dd 58 41 f0 0e 11 23 4b 29 44 47 46 73 b3 7f |..XA...#K)DGFs..| | ed 45 37 c9 3b 0c 33 4f 55 54 f0 21 c1 05 0b 19 |.E7.;.3OUT.!....| | 9a be 8f 5d c4 70 c9 60 74 b0 94 5b 23 ee 84 a6 |...].p.`t..[#...| | 48 |H | ssl_decrypt_record: allocating 113 bytes for decrypt data (old len 32) Plaintext[81]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 78 70 2d 72 63 34 2d 6d 64 |Host: exp-rc4-md| | 35 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |5.local.al.leken| | 73 74 65 79 6e 2e 6e 6c 3a 34 34 33 34 0d 0a 0d |steyn.nl:4434...| | 0a 43 22 01 05 2d d1 83 ca ea 87 04 a4 fa 4e f2 |.C"..-........N.| | 2f |/ | checking mac (len 65, version 303, ct 23 seq 1) tls_check_mac mac type:MD5 md 1 Mac[16]: | 43 22 01 05 2d d1 83 ca ea 87 04 a4 fa 4e f2 2f |C"..-........N./| ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 65, seq = 0, nxtseq = 65 association_find: TCP port 40165 found (nil) association_find: TCP port 4434 found 0x33f9600 dissect_ssl3_record decrypted len 65 decrypted app data fragment[65]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 78 70 2d 72 63 34 2d 6d 64 |Host: exp-rc4-md| | 35 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |5.local.al.leken| | 73 74 65 79 6e 2e 6e 6c 3a 34 34 33 34 0d 0a 0d |steyn.nl:4434...| | 0a |. | dissect_ssl3_record found association 0x33f9600 dissect_ssl enter frame #11 (first time) conversation = 0x7facef996088, ssl_session = 0x7facc380f060 record: offset = 0, reported_length_remaining = 376 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 371, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 371 Ciphertext[371]: | b6 de 1f 5a df ae ce 3e 4a 6e 21 25 a2 47 06 25 |...Z...>Jn!%.G.%| | f6 fd bb 49 e7 a4 6a bc 89 32 6f 22 14 eb 8f 3e |...I..j..2o"...>| | 05 bc d5 bf df b2 19 7b 64 fa 62 c5 96 15 7b 0a |.......{d.b...{.| | a6 50 cd d2 4c 3f 5c 2b 20 fc 8b d4 d9 2b db 99 |.P..L?\+ ....+..| | e4 14 36 ec 8d dd 42 74 20 e6 fa c6 34 1a d1 b6 |..6...Bt ...4...| | 2d 74 a1 00 7b 11 e2 a8 70 f1 96 63 32 0b 44 4f |-t..{...p..c2.DO| | b1 45 25 70 71 74 95 28 7f 55 5b e4 f3 39 df 53 |.E%pqt.(.U[..9.S| | 14 e4 5a 3a 43 f5 9d 0b 9d ad 81 ff 06 fe 57 eb |..Z:C.........W.| | f0 b9 e1 c9 14 45 1c 55 7b 26 da 08 6d a1 0b 71 |.....E.U{&..m..q| | a1 60 e9 c3 2e a1 a3 89 58 5e 21 6a 17 98 2d dd |.`......X^!j..-.| | b4 09 e8 af 88 2b 58 f1 66 23 38 95 f3 32 ad 59 |.....+X.f#8..2.Y| | 62 cf cb fc c3 84 fd 33 5a 45 5e 61 28 10 f3 2c |b......3ZE^a(..,| | 69 73 af 99 37 44 55 ab 1f 1d 17 be 38 cb f0 6b |is..7DU.....8..k| | 79 ea bf 8f 80 d4 49 6b 20 2c 57 c9 b1 48 d7 7a |y.....Ik ,W..H.z| | f9 f2 4a 56 cd 68 20 34 d9 47 27 fe 00 6b 19 07 |..JV.h 4.G'..k..| | 2c 55 ac 38 35 b1 98 e9 bb 02 ed ab 01 c9 38 2c |,U.85.........8,| | 87 2e b0 da d3 7d 5b 39 07 cb fb f3 6d 95 91 9c |.....}[9....m...| | 84 92 90 3c 34 7f ed aa 7e 22 e9 99 a5 b4 90 7b |...<4...~".....{| | 61 f9 6b 96 b7 3c a8 27 76 e6 87 35 d4 f9 67 67 |a.k..<.'v..5..gg| | f2 64 bb e3 6e a9 12 ab 42 e3 ca 14 90 44 c2 e6 |.d..n...B....D..| | 76 ad e2 f6 17 af a7 68 fd b0 21 95 f2 bb d6 b6 |v......h..!.....| | e2 fb 59 af 27 31 d9 f1 4d 2f fb d8 d8 b3 06 48 |..Y.'1..M/.....H| | ab 1a af 4d a3 79 58 19 a9 42 ce c2 e0 c1 bd 83 |...M.yX..B......| | dc 58 e3 |.X. | ssl_decrypt_record: allocating 403 bytes for decrypt data (old len 113) Plaintext[371]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:| | 35 35 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:11 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 38 0d 0a 43 6f 6e 6e 65 63 74 |th: 148..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 30 33 20 2d 20 45 58 50 2d 52 |x00,0x03 - EXP-R| | 43 34 2d 4d 44 35 20 20 20 20 20 20 20 20 20 20 |C4-MD5 | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 28 | SSLv3 Kx=RSA(| | 35 31 32 29 20 41 75 3d 52 53 41 20 20 45 6e 63 |512) Au=RSA Enc| | 3d 52 43 34 28 34 30 29 20 20 20 4d 61 63 3d 4d |=RC4(40) Mac=M| | 44 35 20 20 65 78 70 6f 72 74 3c 73 63 72 69 70 |D5 exportdocument.domai| | 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |n='local.al.leke| | 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 |nsteyn.nl'....;D..f..G-| | dd 1e eb |... | checking mac (len 355, version 303, ct 23 seq 1) tls_check_mac mac type:MD5 md 1 Mac[16]: | 0d a2 e5 83 3b 44 dd 1f 66 9a cf 47 2d dd 1e eb |....;D..f..G-...| ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 355, seq = 0, nxtseq = 355 association_find: TCP port 4434 found 0x33f9600 dissect_ssl3_record decrypted len 355 decrypted app data fragment[355]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:| | 35 35 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:11 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 38 0d 0a 43 6f 6e 6e 65 63 74 |th: 148..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 30 33 20 2d 20 45 58 50 2d 52 |x00,0x03 - EXP-R| | 43 34 2d 4d 44 35 20 20 20 20 20 20 20 20 20 20 |C4-MD5 | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 28 | SSLv3 Kx=RSA(| | 35 31 32 29 20 41 75 3d 52 53 41 20 20 45 6e 63 |512) Au=RSA Enc| | 3d 52 43 34 28 34 30 29 20 20 20 4d 61 63 3d 4d |=RC4(40) Mac=M| | 44 35 20 20 65 78 70 6f 72 74 3c 73 63 72 69 70 |D5 exportdocument.domai| | 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |n='local.al.leke| | 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 |nsteyn.nl' | dissect_ssl3_record found association 0x33f9600 dissect_ssl enter frame #12 (first time) conversation = 0x7facef996088, ssl_session = 0x7facc380f060 record: offset = 0, reported_length_remaining = 23 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 18, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 18 Ciphertext[18]: | 35 00 7c 44 00 05 fc 63 be 79 45 3f d5 59 a6 77 |5.|D...c.yE?.Y.w| | a4 7a |.z | Plaintext[18]: | 01 00 e5 61 34 97 13 16 55 c7 94 c8 99 8e 52 f3 |...a4...U.....R.| | 8f b2 |.. | checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:MD5 md 1 Mac[16]: | e5 61 34 97 13 16 55 c7 94 c8 99 8e 52 f3 8f b2 |.a4...U.....R...| ssl_decrypt_record: mac ok dissect_ssl enter frame #14 (first time) conversation = 0x7facef996088, ssl_session = 0x7facc380f060 record: offset = 0, reported_length_remaining = 23 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 18, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 18 Ciphertext[18]: | f9 ee 0f 6c 4b 2e f9 71 f6 c7 eb d5 b4 cb 78 2a |...lK..q......x*| | c7 a3 |.. | Plaintext[18]: | 01 00 7b 5b fa 88 33 5e a9 f5 a1 2b 80 f8 5a 58 |..{[..3^...+..ZX| | 1d a0 |.. | checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:MD5 md 1 Mac[16]: | 7b 5b fa 88 33 5e a9 f5 a1 2b 80 f8 5a 58 1d a0 |{[..3^...+..ZX..| ssl_decrypt_record: mac ok dissect_ssl enter frame #19 (first time) ssl_session_init: initializing ptr 0x7facc38119d0 size 688 conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 46195 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4435 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #21 (first time) conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0 record: offset = 0, reported_length_remaining = 884 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0004 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 6f d8 d0 b4 a1 99 96 05 3c ac 68 66 95 39 c4 82 |o.......<.hf.9..| | a6 0f cf d3 2d 89 14 f9 61 da 94 ea 47 73 d9 c8 |....-...a...Gs..| | 8e 25 b0 97 4b 5c c3 18 a4 b3 ff 4d c7 74 0f 67 |.%..K\.....M.t.g| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 1f 3a f5 89 bb b8 2b 3e a5 ed 30 dd 0d ec 14 7b |.:....+>..0....{| | 27 ae 1a 68 58 a9 ce a1 dc a5 ce bb 6a 52 34 bf |'..hX.......jR4.| | 1f 04 e5 5e f5 0c cc eb 09 8b f3 65 9b ac 1f 85 |...^.......e....| | 0e 9e da 36 4e bb d9 b5 c7 7d ab 03 ac |...6N....}... | hash out[64]: | 4d 58 fa 76 c6 fa be b0 3c bc 17 b6 fb 33 03 73 |MX.v....<....3.s| | 68 ff a0 a9 84 f6 55 62 42 9b 83 80 f9 01 be 91 |h.....UbB.......| | 32 fd 0d af 1e f6 86 88 f1 5a 06 2d 5b d3 da b1 |2........Z.-[...| | 0f 15 23 6d 77 18 6e 1f 5e 01 d8 98 4a 0d b4 db |..#mw.n.^...J...| PRF out[64]: | 4d 58 fa 76 c6 fa be b0 3c bc 17 b6 fb 33 03 73 |MX.v....<....3.s| | 68 ff a0 a9 84 f6 55 62 42 9b 83 80 f9 01 be 91 |h.....UbB.......| | 32 fd 0d af 1e f6 86 88 f1 5a 06 2d 5b d3 da b1 |2........Z.-[...| | 0f 15 23 6d 77 18 6e 1f 5e 01 d8 98 4a 0d b4 db |..#mw.n.^...J...| key expansion[64]: | 4d 58 fa 76 c6 fa be b0 3c bc 17 b6 fb 33 03 73 |MX.v....<....3.s| | 68 ff a0 a9 84 f6 55 62 42 9b 83 80 f9 01 be 91 |h.....UbB.......| | 32 fd 0d af 1e f6 86 88 f1 5a 06 2d 5b d3 da b1 |2........Z.-[...| | 0f 15 23 6d 77 18 6e 1f 5e 01 d8 98 4a 0d b4 db |..#mw.n.^...J...| Client MAC key[16]: | 4d 58 fa 76 c6 fa be b0 3c bc 17 b6 fb 33 03 73 |MX.v....<....3.s| Server MAC key[16]: | 68 ff a0 a9 84 f6 55 62 42 9b 83 80 f9 01 be 91 |h.....UbB.......| Client Write key[16]: | 32 fd 0d af 1e f6 86 88 f1 5a 06 2d 5b d3 da b1 |2........Z.-[...| Server Write key[16]: | 0f 15 23 6d 77 18 6e 1f 5e 01 d8 98 4a 0d b4 db |..#mw.n.^...J...| Client Write IV[8]: | 01 00 00 00 00 00 00 00 |........ | Server Write IV[8]: | 10 00 00 00 00 00 00 00 |........ | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: ARCFOUR decoder initialized (digest len 16) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: ARCFOUR decoder initialized (digest len 16) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 821 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884 dissect_ssl enter frame #23 (first time) conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0 record: offset = 0, reported_length_remaining = 310 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 262, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364e... looking for RSA pre-master808f0a3961b6859682b36eb63335dbdfe3e0ea7aa788787e... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | a0 49 fb 93 a7 82 0f 54 75 aa a1 e1 a4 8f b3 4b |.I.....Tu......K| | eb 28 a6 0d 3d aa eb 97 4a 0c e4 b7 39 eb 5a 8f |.(..=...J...9.Z.| | e0 5c f8 4b ed 98 7d b3 aa 4c 44 9d 67 2b b3 bc |.\.K..}..LD.g+..| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 1f 3a f5 89 bb b8 2b 3e a5 ed 30 dd 0d ec 14 7b |.:....+>..0....{| | 27 ae 1a 68 58 a9 ce a1 dc a5 ce bb 6a 52 34 bf |'..hX.......jR4.| | 1f 04 e5 5e f5 0c cc eb 09 8b f3 65 9b ac 1f 85 |...^.......e....| | 0e 9e da 36 4e bb d9 b5 c7 7d ab 03 ac |...6N....}... | hash out[64]: | ac 46 7e 11 24 8b 6a 8d b5 b4 ba 60 65 ad fb f5 |.F~.$.j....`e...| | aa 89 92 1f 82 63 e8 05 29 a3 a7 58 06 12 ba ed |.....c..)..X....| | d9 58 1d 87 d5 e0 39 1c b4 c1 50 86 10 89 8c ce |.X....9...P.....| | 2d 4b 94 fc b8 3b 51 ca 24 39 55 e1 1c 98 3c fb |-K...;Q.$9U...<.| PRF out[64]: | ac 46 7e 11 24 8b 6a 8d b5 b4 ba 60 65 ad fb f5 |.F~.$.j....`e...| | aa 89 92 1f 82 63 e8 05 29 a3 a7 58 06 12 ba ed |.....c..)..X....| | d9 58 1d 87 d5 e0 39 1c b4 c1 50 86 10 89 8c ce |.X....9...P.....| | 2d 4b 94 fc b8 3b 51 ca 24 39 55 e1 1c 98 3c fb |-K...;Q.$9U...<.| key expansion[64]: | ac 46 7e 11 24 8b 6a 8d b5 b4 ba 60 65 ad fb f5 |.F~.$.j....`e...| | aa 89 92 1f 82 63 e8 05 29 a3 a7 58 06 12 ba ed |.....c..)..X....| | d9 58 1d 87 d5 e0 39 1c b4 c1 50 86 10 89 8c ce |.X....9...P.....| | 2d 4b 94 fc b8 3b 51 ca 24 39 55 e1 1c 98 3c fb |-K...;Q.$9U...<.| Client MAC key[16]: | ac 46 7e 11 24 8b 6a 8d b5 b4 ba 60 65 ad fb f5 |.F~.$.j....`e...| Server MAC key[16]: | aa 89 92 1f 82 63 e8 05 29 a3 a7 58 06 12 ba ed |.....c..)..X....| Client Write key[16]: | d9 58 1d 87 d5 e0 39 1c b4 c1 50 86 10 89 8c ce |.X....9...P.....| Server Write key[16]: | 2d 4b 94 fc b8 3b 51 ca 24 39 55 e1 1c 98 3c fb |-K...;Q.$9U...<.| Client Write IV[8]: | 00 00 00 00 00 00 00 00 |........ | Server Write IV[8]: | 40 bd 73 03 00 00 00 00 |@.s..... | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: ARCFOUR decoder initialized (digest len 16) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: ARCFOUR decoder initialized (digest len 16) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | a0 49 fb 93 a7 82 0f 54 75 aa a1 e1 a4 8f b3 4b |.I.....Tu......K| | eb 28 a6 0d 3d aa eb 97 4a 0c e4 b7 39 eb 5a 8f |.(..=...J...9.Z.| | e0 5c f8 4b ed 98 7d b3 aa 4c 44 9d 67 2b b3 bc |.\.K..}..LD.g+..| dissect_ssl3_handshake session keys successfully generated record: offset = 267, reported_length_remaining = 43 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 273, reported_length_remaining = 37 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | e8 4a 32 ba 83 bb c0 cd 12 c5 82 7e f5 d4 95 6d |.J2........~...m| | 72 f4 32 fd e4 31 29 10 48 6a 07 2f 47 77 04 94 |r.2..1).Hj./Gw..| Plaintext[32]: | 14 00 00 0c c8 4b 0b 55 9f 72 f5 13 a3 e9 69 bf |.....K.U.r....i.| | 68 fa 37 4c 33 c0 84 93 2d 9a 1f 1b 17 99 2e 69 |h.7L3...-......i| checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:MD5 md 1 Mac[16]: | 68 fa 37 4c 33 c0 84 93 2d 9a 1f 1b 17 99 2e 69 |h.7L3...-......i| ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #24 (first time) conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0 record: offset = 0, reported_length_remaining = 218 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 43 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 37 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 44 03 b0 93 8e 51 2a 28 92 af d6 37 31 c9 4c 90 |D....Q*(...71.L.| | dc be 73 5e 73 74 bd ca 03 c8 ad 34 08 23 1c b4 |..s^st.....4.#..| Plaintext[32]: | 14 00 00 0c 18 0b 80 a3 9b d5 02 4c 96 a6 a1 65 |...........L...e| | 2d 4c 2b 2a 1a 7d ec 1b a4 cf 88 ba 6b d1 88 c3 |-L+*.}......k...| checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:MD5 md 1 Mac[16]: | 2d 4c 2b 2a 1a 7d ec 1b a4 cf 88 ba 6b d1 88 c3 |-L+*.}......k...| ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #25 (first time) conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0 record: offset = 0, reported_length_remaining = 82 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 77, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 77 Ciphertext[77]: | 60 6f e0 5f f0 8a 20 20 46 e7 f5 44 f8 57 c7 1d |`o._.. F..D.W..| | 00 82 b8 12 b4 3f 78 97 43 ef ac be dd 6a 76 29 |.....?x.C....jv)| | cb 31 5b 62 64 70 ed 86 fc 60 5c dd f3 8b d5 c0 |.1[bdp...`\.....| | 38 61 b7 a7 df be 5d 3a 30 66 19 54 be 3c 35 cd |8a....]:0f.T.<5.| | 14 27 47 24 73 56 61 84 0e 42 9c e5 5f |.'G$sVa..B.._ | Plaintext[77]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 72 63 34 2d 6d 64 35 2e 6c 6f |Host: rc4-md5.lo| | 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey| | 6e 2e 6e 6c 3a 34 34 33 35 0d 0a 0d 0a 21 89 fe |n.nl:4435....!..| | cc b4 9d bb 21 6f e7 c1 ec 46 98 bc 0a |....!o...F... | checking mac (len 61, version 303, ct 23 seq 1) tls_check_mac mac type:MD5 md 1 Mac[16]: | 21 89 fe cc b4 9d bb 21 6f e7 c1 ec 46 98 bc 0a |!......!o...F...| ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 61, seq = 0, nxtseq = 61 association_find: TCP port 46195 found (nil) association_find: TCP port 4435 found 0x34254c0 dissect_ssl3_record decrypted len 61 decrypted app data fragment[61]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 72 63 34 2d 6d 64 35 2e 6c 6f |Host: rc4-md5.lo| | 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey| | 6e 2e 6e 6c 3a 34 34 33 35 0d 0a 0d 0a |n.nl:4435.... | dissect_ssl3_record found association 0x34254c0 dissect_ssl enter frame #26 (first time) conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0 record: offset = 0, reported_length_remaining = 368 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 363, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 363 Ciphertext[363]: | e5 44 fb 83 4b 56 20 00 62 db a3 09 c9 55 30 0b |.D..KV .b....U0.| | 9e 0c 85 05 a6 a4 47 92 3a 04 7d 8c bc 71 1e 1c |......G.:.}..q..| | 6d a8 a6 40 d3 a6 42 64 e0 ea c7 b5 a9 92 dd 31 |m..@..Bd.......1| | fc 75 04 55 f1 24 8d 54 44 3e 8a f1 0f a6 8d a1 |.u.U.$.TD>......| | bb e1 20 7c 2e ee 89 5f 88 5c 9f 2c 41 ea b3 92 |.. |..._.\.,A...| | c1 99 6f 92 d2 ca 7b 66 3e bd f3 ce 94 1c 0e 20 |..o...{f>...... | | 03 75 48 62 b7 98 1c 70 fd 8c 66 80 ff 5d 91 c6 |.uHb...p..f..]..| | 39 9a 42 b8 92 bc 6c 97 bc 77 92 37 01 c5 24 59 |9.B...l..w.7..$Y| | 85 0b f1 a0 89 1e 46 53 58 6e f4 64 54 47 87 77 |......FSXn.dTG.w| | c7 eb f7 16 40 18 74 44 98 69 d3 49 cf b0 9a 83 |....@.tD.i.I....| | 86 b4 a0 46 c6 42 ce ee f0 f5 fb c2 47 19 d3 01 |...F.B......G...| | ce 90 3c ac 4a e1 82 f4 19 81 7c b8 dc db a5 34 |..<.J.....|....4| | 3c ac 6c 98 db 64 b1 8f 7e 8d 45 64 99 1e b7 c3 |<.l..d..~.Ed....| | 16 50 2c 09 57 61 d3 aa e8 f9 bd a2 cd 65 d1 1f |.P,.Wa.......e..| | d2 6c 3b f7 6c 57 2c 3c 9e 85 95 4b e9 b4 54 ee |.l;.lW,<...K..T.| | ba 85 bc 7e 92 dc 85 54 86 db ef b0 bd 76 2a d6 |...~...T.....v*.| | 8f d3 4a f0 e0 a9 ba 89 24 3d 6b 71 c1 31 7e 91 |..J.....$=kq.1~.| | c3 3e e1 4a da 23 5a 0a 2a 82 15 85 b0 b1 0e f0 |.>.J.#Z.*.......| | 64 88 a1 75 ad 0a 9c 9c b1 ab 12 a8 90 38 69 a9 |d..u.........8i.| | fd 3e cb 85 45 a1 32 42 fd ba 77 f7 53 74 f8 17 |.>..E.2B..w.St..| | ca 5f d6 d8 f8 99 99 85 47 14 e6 cd 4f 0f 76 d5 |._......G...O.v.| | 1d bc 93 22 53 75 56 a2 34 0f ed 53 d7 2b a5 27 |..."SuV.4..S.+.'| | 6a 17 c8 e0 f7 04 2a 86 da c3 33 |j.....*...3 | Plaintext[363]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:| | 35 35 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:11 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 30 0d 0a 43 6f 6e 6e 65 63 74 |th: 140..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 30 34 20 2d 20 52 43 34 2d 4d |x00,0x04 - RC4-M| | 44 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |D5 | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 4d |=RC4(128) Mac=M| | 44 35 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 |D5.2QF.| | 5e 73 d7 0d e3 e0 8c d5 61 f6 f4 |^s......a.. | checking mac (len 347, version 303, ct 23 seq 1) tls_check_mac mac type:MD5 md 1 Mac[16]: | 14 32 51 46 1a 5e 73 d7 0d e3 e0 8c d5 61 f6 f4 |.2QF.^s......a..| ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 347, seq = 0, nxtseq = 347 association_find: TCP port 4435 found 0x34254c0 dissect_ssl3_record decrypted len 347 decrypted app data fragment[347]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:| | 35 35 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:11 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 30 0d 0a 43 6f 6e 6e 65 63 74 |th: 140..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 30 34 20 2d 20 52 43 34 2d 4d |x00,0x04 - RC4-M| | 44 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |D5 | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 4d |=RC4(128) Mac=M| | 44 35 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 |D5 | dissect_ssl3_record found association 0x34254c0 dissect_ssl enter frame #27 (first time) conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0 record: offset = 0, reported_length_remaining = 23 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 18, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 18 Ciphertext[18]: | fa 16 da a9 91 b0 7c 04 81 10 a2 25 50 28 d2 07 |......|....%P(..| | ac 34 |.4 | Plaintext[18]: | 01 00 1a aa f5 db ef 42 e3 ab 17 38 f7 6e 70 92 |.......B...8.np.| | 34 a4 |4. | checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:MD5 md 1 Mac[16]: | 1a aa f5 db ef 42 e3 ab 17 38 f7 6e 70 92 34 a4 |.....B...8.np.4.| ssl_decrypt_record: mac ok dissect_ssl enter frame #29 (first time) conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0 record: offset = 0, reported_length_remaining = 23 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 18, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 18 Ciphertext[18]: | 69 b5 40 b5 50 76 16 cc 5b 06 0d 7f c4 24 6b 1a |i.@.Pv..[....$k.| | dc 72 |.r | Plaintext[18]: | 01 00 0f 25 35 6e b2 cf 16 93 94 d0 23 87 f3 62 |...%5n......#..b| | c0 36 |.6 | checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:MD5 md 1 Mac[16]: | 0f 25 35 6e b2 cf 16 93 94 d0 23 87 f3 62 c0 36 |.%5n......#..b.6| ssl_decrypt_record: mac ok dissect_ssl enter frame #34 (first time) ssl_session_init: initializing ptr 0x7facc3814390 size 688 conversation = 0x7facef996728, ssl_session = 0x7facc3814390 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 52548 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4436 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #36 (first time) conversation = 0x7facef996728, ssl_session = 0x7facc3814390 record: offset = 0, reported_length_remaining = 884 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0005 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | a0 49 fb 93 a7 82 0f 54 75 aa a1 e1 a4 8f b3 4b |.I.....Tu......K| | eb 28 a6 0d 3d aa eb 97 4a 0c e4 b7 39 eb 5a 8f |.(..=...J...9.Z.| | e0 5c f8 4b ed 98 7d b3 aa 4c 44 9d 67 2b b3 bc |.\.K..}..LD.g+..| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 1f 7d ed 32 19 50 18 7c 63 a3 14 53 53 50 07 85 |.}.2.P.|c..SSP..| | da ec b8 67 de ea 38 ad 61 71 fa 73 07 52 34 bf |...g..8.aq.s.R4.| | 1f 4f f7 89 84 11 88 84 23 d1 f6 01 ae 6c 17 7a |.O......#....l.z| | 9a b4 89 8e 3c 4e ed 7e fe 45 c4 39 f3 |......| | c2 f3 17 f7 24 52 a7 e5 34 fc 60 d5 6d dd 4f 14 |....$R..4.`.m.O.| | 59 cc 1b 0f f1 56 b1 0c 86 d6 8e 87 86 11 03 25 |Y....V.........%| | 82 92 c5 4a 93 cc 21 d4 d0 19 30 87 89 4c 43 26 |...J..!...0..LC&| | 95 3d 7e 3e c9 55 f7 51 f4 53 44 68 07 73 d2 91 |.=~>.U.Q.SDh.s..| | 98 c3 6a 70 eb dc ba 10 69 a6 5d 67 8a 94 8e 4b |..jp....i.]g...K| | eb 5c ff 7d 42 5b a3 e6 e2 ca bd 93 ee c4 63 86 |.\.}B[........c.| | 54 c7 32 94 38 72 e2 74 13 d6 af 28 df 08 a8 b3 |T.2.8r.t...(....| | 4c c2 ae 34 65 c5 4d 57 82 84 79 ed a4 73 ec 70 |L..4e.MW..y..s.p| Plaintext[368]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:| | 35 35 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:11 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 30 35 20 2d 20 52 43 34 2d 53 |x00,0x05 - RC4-S| | 48 41 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |HA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 53 |=RC4(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1...D| | d3 dc 6a bc 52 4d 8e 20 1b 2d f3 2d bf e3 39 c6 |..j.RM. .-.-..9.| checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | d9 c6 84 44 d3 dc 6a bc 52 4d 8e 20 1b 2d f3 2d |...D..j.RM. .-.-| | bf e3 39 c6 |..9. | ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348 association_find: TCP port 4436 found 0x342d9a0 dissect_ssl3_record decrypted len 348 decrypted app data fragment[348]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:| | 35 35 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:11 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 30 35 20 2d 20 52 43 34 2d 53 |x00,0x05 - RC4-S| | 48 41 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |HA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 53 |=RC4(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1 | dissect_ssl3_record found association 0x342d9a0 dissect_ssl enter frame #42 (first time) conversation = 0x7facef996728, ssl_session = 0x7facc3814390 record: offset = 0, reported_length_remaining = 27 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 22, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 22 Ciphertext[22]: | c3 a9 02 80 e9 7a a0 63 1f a4 c7 42 9e c7 dc 1f |.....z.c...B....| | d5 55 d1 72 c5 f9 |.U.r.. | Plaintext[22]: | 01 00 9b 64 97 83 c3 46 fb 9f 07 97 a0 5d 88 56 |...d...F.....].V| | d0 da 1c 60 1c 1c |...`.. | checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 9b 64 97 83 c3 46 fb 9f 07 97 a0 5d 88 56 d0 da |.d...F.....].V..| | 1c 60 1c 1c |.`.. | ssl_decrypt_record: mac ok dissect_ssl enter frame #44 (first time) conversation = 0x7facef996728, ssl_session = 0x7facc3814390 record: offset = 0, reported_length_remaining = 27 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 22, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 22 Ciphertext[22]: | 5b d4 68 03 7d 40 b8 58 7d ab 4d 7c f6 23 5a e4 |[.h.}@.X}.M|.#Z.| | 6e e1 65 3d d7 39 |n.e=.9 | Plaintext[22]: | 01 00 6b df 25 25 c9 a3 6b 1f d0 02 d3 60 14 4e |..k.%%..k....`.N| | 77 1d 22 f9 26 74 |w.".&t | checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 6b df 25 25 c9 a3 6b 1f d0 02 d3 60 14 4e 77 1d |k.%%..k....`.Nw.| | 22 f9 26 74 |".&t | ssl_decrypt_record: mac ok dissect_ssl enter frame #49 (first time) ssl_session_init: initializing ptr 0x7facc3816d50 size 688 conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 43026 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4437 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #51 (first time) conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50 record: offset = 0, reported_length_remaining = 1224 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0006 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | da 85 35 5e 4f 7b ab 4d 83 1d e9 25 f6 24 f5 9c |..5^O{.M...%.$..| | d9 2d f0 30 47 ed 06 0c c6 d9 18 ab 1d 43 9c 0e |.-.0G........C..| | b2 51 0b 20 26 44 f9 42 eb 25 a2 4f f5 49 70 9a |.Q. &D.B.%.O.Ip.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 20 ec c6 05 ca 3d 39 25 c8 c1 16 6a b2 3e e5 56 | ....=9%...j.>.V| | f1 a5 05 4a 95 0e 56 49 f3 e4 0d 3f 05 52 34 bf |...J..VI...?.R4.| | 20 a9 15 55 43 63 f9 42 76 45 02 b6 d1 aa 46 fb | ..UCc.BvE....F.| | 42 3e a2 31 f8 e1 0e aa 32 31 71 ad c4 |B>.1....21q.. | hash out[88]: | 91 8d 77 e8 85 cf 07 59 26 93 70 95 9d 3b 73 57 |..w....Y&.p..;sW| | b1 04 9c 47 0d f7 7c aa cf a0 16 1b e7 db af 5c |...G..|........\| | d5 2e 93 4b 06 19 5b 82 18 80 94 6b 52 9f e0 4c |...K..[....kR..L| | dc 83 1a 26 41 4f f0 50 25 4d b9 c9 e9 76 18 88 |...&AO.P%M...v..| | eb ab cd 1e 20 75 76 36 c6 15 70 29 1f ba 38 a2 |.... uv6..p)..8.| | 76 54 dc ae f4 3d f3 91 |vT...=.. | PRF out[88]: | 91 8d 77 e8 85 cf 07 59 26 93 70 95 9d 3b 73 57 |..w....Y&.p..;sW| | b1 04 9c 47 0d f7 7c aa cf a0 16 1b e7 db af 5c |...G..|........\| | d5 2e 93 4b 06 19 5b 82 18 80 94 6b 52 9f e0 4c |...K..[....kR..L| | dc 83 1a 26 41 4f f0 50 25 4d b9 c9 e9 76 18 88 |...&AO.P%M...v..| | eb ab cd 1e 20 75 76 36 c6 15 70 29 1f ba 38 a2 |.... uv6..p)..8.| | 76 54 dc ae f4 3d f3 91 |vT...=.. | key expansion[88]: | 91 8d 77 e8 85 cf 07 59 26 93 70 95 9d 3b 73 57 |..w....Y&.p..;sW| | b1 04 9c 47 0d f7 7c aa cf a0 16 1b e7 db af 5c |...G..|........\| | d5 2e 93 4b 06 19 5b 82 18 80 94 6b 52 9f e0 4c |...K..[....kR..L| | dc 83 1a 26 41 4f f0 50 25 4d b9 c9 e9 76 18 88 |...&AO.P%M...v..| | eb ab cd 1e 20 75 76 36 c6 15 70 29 1f ba 38 a2 |.... uv6..p)..8.| | 76 54 dc ae f4 3d f3 91 |vT...=.. | ssl_generate_keyring_material prf(iv_block) tls12_prf: tls_hash(hash_alg SHA256 secret_len 0 seed_len 72 ) tls_hash: hash secret[0]: tls_hash: hash seed[72]: | 49 56 20 62 6c 6f 63 6b 52 34 bf 20 a9 15 55 43 |IV blockR4. ..UC| | 63 f9 42 76 45 02 b6 d1 aa 46 fb 42 3e a2 31 f8 |c.BvE....F.B>.1.| | e1 0e aa 32 31 71 ad c4 52 34 bf 20 ec c6 05 ca |...21q..R4. ....| | 3d 39 25 c8 c1 16 6a b2 3e e5 56 f1 a5 05 4a 95 |=9%...j.>.V...J.| | 0e 56 49 f3 e4 0d 3f 05 |.VI...?. | hash out[16]: | fd 78 18 71 b0 eb fe a5 c0 3c 36 49 53 84 f8 e2 |.x.q.....<6IS...| PRF out[16]: | fd 78 18 71 b0 eb fe a5 c0 3c 36 49 53 84 f8 e2 |.x.q.....<6IS...| ssl_generate_keyring_material PRF(key_c) tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 ) tls_hash: hash secret[5]: | 18 80 94 6b 52 |...kR | tls_hash: hash seed[80]: | 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key| | 52 34 bf 20 a9 15 55 43 63 f9 42 76 45 02 b6 d1 |R4. ..UCc.BvE...| | aa 46 fb 42 3e a2 31 f8 e1 0e aa 32 31 71 ad c4 |.F.B>.1....21q..| | 52 34 bf 20 ec c6 05 ca 3d 39 25 c8 c1 16 6a b2 |R4. ....=9%...j.| | 3e e5 56 f1 a5 05 4a 95 0e 56 49 f3 e4 0d 3f 05 |>.V...J..VI...?.| hash out[32]: | 64 aa b3 91 c0 a1 9b 3f ba c5 49 55 ba 47 ec 81 |d......?..IU.G..| | 62 a7 d9 a7 d1 88 82 23 3f bc 66 bb f7 1d 8b ff |b......#?.f.....| PRF out[32]: | 64 aa b3 91 c0 a1 9b 3f ba c5 49 55 ba 47 ec 81 |d......?..IU.G..| | 62 a7 d9 a7 d1 88 82 23 3f bc 66 bb f7 1d 8b ff |b......#?.f.....| ssl_generate_keyring_material PRF(key_s) tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 ) tls_hash: hash secret[5]: | 9f e0 4c dc 83 |..L.. | tls_hash: hash seed[80]: | 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key| | 52 34 bf 20 a9 15 55 43 63 f9 42 76 45 02 b6 d1 |R4. ..UCc.BvE...| | aa 46 fb 42 3e a2 31 f8 e1 0e aa 32 31 71 ad c4 |.F.B>.1....21q..| | 52 34 bf 20 ec c6 05 ca 3d 39 25 c8 c1 16 6a b2 |R4. ....=9%...j.| | 3e e5 56 f1 a5 05 4a 95 0e 56 49 f3 e4 0d 3f 05 |>.V...J..VI...?.| hash out[32]: | 09 15 8d ab 03 df 8c 6c 57 d4 c7 c2 14 c9 5d d8 |.......lW.....].| | 54 81 7e de de 29 6f 9d 73 3d 22 6f a7 1f 99 11 |T.~..)o.s="o....| PRF out[32]: | 09 15 8d ab 03 df 8c 6c 57 d4 c7 c2 14 c9 5d d8 |.......lW.....].| | 54 81 7e de de 29 6f 9d 73 3d 22 6f a7 1f 99 11 |T.~..)o.s="o....| Client MAC key[20]: | 91 8d 77 e8 85 cf 07 59 26 93 70 95 9d 3b 73 57 |..w....Y&.p..;sW| | b1 04 9c 47 |...G | Server MAC key[20]: | 0d f7 7c aa cf a0 16 1b e7 db af 5c d5 2e 93 4b |..|........\...K| | 06 19 5b 82 |..[. | Client Write key[16]: | 64 aa b3 91 c0 a1 9b 3f ba c5 49 55 ba 47 ec 81 |d......?..IU.G..| Server Write key[16]: | 09 15 8d ab 03 df 8c 6c 57 d4 c7 c2 14 c9 5d d8 |.......lW.....].| Client Write IV[8]: | fd 78 18 71 b0 eb fe a5 |.x.q.... | Server Write IV[8]: | c0 3c 36 49 53 84 f8 e2 |.<6IS... | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: RC2 ssl_create_decoder can't find cipher RC2 ssl_generate_keyring_material can't init client decoder dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 63, reported_length_remaining = 1161 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x37 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 349 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 335, ssl state 0x37 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 880 length 331 bytes, remaining 1215 record: offset = 1215, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x37 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1220 length 0 bytes, remaining 1224 dissect_ssl enter frame #53 (first time) conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50 record: offset = 0, reported_length_remaining = 134 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 70, ssl state 0x37 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8... looking for RSA pre-master79a1d2e1fa7136af7a5de4145176273ffdbedd17620baa6d... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 0e b9 e2 59 80 8e 59 22 37 ec 51 b4 96 7b 67 ef |...Y..Y"7.Q..{g.| | 3b 18 f9 48 c1 b4 0d 7f 78 e3 70 15 49 4c 99 d9 |;..H....x.p.IL..| | 51 09 01 5c 42 ee 03 6d d5 9f 0a c4 5b 16 79 d8 |Q..\B..m....[.y.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 20 ec c6 05 ca 3d 39 25 c8 c1 16 6a b2 3e e5 56 | ....=9%...j.>.V| | f1 a5 05 4a 95 0e 56 49 f3 e4 0d 3f 05 52 34 bf |...J..VI...?.R4.| | 20 a9 15 55 43 63 f9 42 76 45 02 b6 d1 aa 46 fb | ..UCc.BvE....F.| | 42 3e a2 31 f8 e1 0e aa 32 31 71 ad c4 |B>.1....21q.. | hash out[88]: | d8 9b 94 b5 cd 8d 34 81 7c d7 4e 05 34 26 f8 c6 |......4.|.N.4&..| | 9f d3 ea 26 ff 51 b2 15 12 44 b2 ea 56 96 32 4f |...&.Q...D..V.2O| | f4 1d 64 80 18 30 43 d7 73 03 5d 6b 6d 4d 3d 4f |..d..0C.s.]kmM=O| | 82 10 1c 71 14 6a 59 b8 34 65 7a c3 ce 2f 3b 8c |...q.jY.4ez../;.| | 9e 29 6a 11 bf 0f 0c c9 f2 7a 10 a4 58 f2 27 aa |.)j......z..X.'.| | 9c a2 bb 59 ef 54 66 27 |...Y.Tf' | PRF out[88]: | d8 9b 94 b5 cd 8d 34 81 7c d7 4e 05 34 26 f8 c6 |......4.|.N.4&..| | 9f d3 ea 26 ff 51 b2 15 12 44 b2 ea 56 96 32 4f |...&.Q...D..V.2O| | f4 1d 64 80 18 30 43 d7 73 03 5d 6b 6d 4d 3d 4f |..d..0C.s.]kmM=O| | 82 10 1c 71 14 6a 59 b8 34 65 7a c3 ce 2f 3b 8c |...q.jY.4ez../;.| | 9e 29 6a 11 bf 0f 0c c9 f2 7a 10 a4 58 f2 27 aa |.)j......z..X.'.| | 9c a2 bb 59 ef 54 66 27 |...Y.Tf' | key expansion[88]: | d8 9b 94 b5 cd 8d 34 81 7c d7 4e 05 34 26 f8 c6 |......4.|.N.4&..| | 9f d3 ea 26 ff 51 b2 15 12 44 b2 ea 56 96 32 4f |...&.Q...D..V.2O| | f4 1d 64 80 18 30 43 d7 73 03 5d 6b 6d 4d 3d 4f |..d..0C.s.]kmM=O| | 82 10 1c 71 14 6a 59 b8 34 65 7a c3 ce 2f 3b 8c |...q.jY.4ez../;.| | 9e 29 6a 11 bf 0f 0c c9 f2 7a 10 a4 58 f2 27 aa |.)j......z..X.'.| | 9c a2 bb 59 ef 54 66 27 |...Y.Tf' | ssl_generate_keyring_material prf(iv_block) tls12_prf: tls_hash(hash_alg SHA256 secret_len 0 seed_len 72 ) tls_hash: hash secret[0]: tls_hash: hash seed[72]: | 49 56 20 62 6c 6f 63 6b 52 34 bf 20 a9 15 55 43 |IV blockR4. ..UC| | 63 f9 42 76 45 02 b6 d1 aa 46 fb 42 3e a2 31 f8 |c.BvE....F.B>.1.| | e1 0e aa 32 31 71 ad c4 52 34 bf 20 ec c6 05 ca |...21q..R4. ....| | 3d 39 25 c8 c1 16 6a b2 3e e5 56 f1 a5 05 4a 95 |=9%...j.>.V...J.| | 0e 56 49 f3 e4 0d 3f 05 |.VI...?. | hash out[16]: | fd 78 18 71 b0 eb fe a5 c0 3c 36 49 53 84 f8 e2 |.x.q.....<6IS...| PRF out[16]: | fd 78 18 71 b0 eb fe a5 c0 3c 36 49 53 84 f8 e2 |.x.q.....<6IS...| ssl_generate_keyring_material PRF(key_c) tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 ) tls_hash: hash secret[5]: | 73 03 5d 6b 6d |s.]km | tls_hash: hash seed[80]: | 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key| | 52 34 bf 20 a9 15 55 43 63 f9 42 76 45 02 b6 d1 |R4. ..UCc.BvE...| | aa 46 fb 42 3e a2 31 f8 e1 0e aa 32 31 71 ad c4 |.F.B>.1....21q..| | 52 34 bf 20 ec c6 05 ca 3d 39 25 c8 c1 16 6a b2 |R4. ....=9%...j.| | 3e e5 56 f1 a5 05 4a 95 0e 56 49 f3 e4 0d 3f 05 |>.V...J..VI...?.| hash out[32]: | 35 7b ce 65 d6 9e 23 69 00 a4 8e cd 1f c2 cf 70 |5{.e..#i.......p| | 7c 12 4c 4b 79 3b 80 12 02 e2 a5 c5 c0 fd 8c 46 ||.LKy;.........F| PRF out[32]: | 35 7b ce 65 d6 9e 23 69 00 a4 8e cd 1f c2 cf 70 |5{.e..#i.......p| | 7c 12 4c 4b 79 3b 80 12 02 e2 a5 c5 c0 fd 8c 46 ||.LKy;.........F| ssl_generate_keyring_material PRF(key_s) tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 ) tls_hash: hash secret[5]: | 4d 3d 4f 82 10 |M=O.. | tls_hash: hash seed[80]: | 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key| | 52 34 bf 20 a9 15 55 43 63 f9 42 76 45 02 b6 d1 |R4. ..UCc.BvE...| | aa 46 fb 42 3e a2 31 f8 e1 0e aa 32 31 71 ad c4 |.F.B>.1....21q..| | 52 34 bf 20 ec c6 05 ca 3d 39 25 c8 c1 16 6a b2 |R4. ....=9%...j.| | 3e e5 56 f1 a5 05 4a 95 0e 56 49 f3 e4 0d 3f 05 |>.V...J..VI...?.| hash out[32]: | d0 ec 57 99 be bf 45 98 40 55 12 72 70 b9 9e b5 |..W...E.@U.rp...| | 67 c2 33 9e 28 79 95 32 72 26 7e 67 fe ed 86 80 |g.3.(y.2r&~g....| PRF out[32]: | d0 ec 57 99 be bf 45 98 40 55 12 72 70 b9 9e b5 |..W...E.@U.rp...| | 67 c2 33 9e 28 79 95 32 72 26 7e 67 fe ed 86 80 |g.3.(y.2r&~g....| Client MAC key[20]: | d8 9b 94 b5 cd 8d 34 81 7c d7 4e 05 34 26 f8 c6 |......4.|.N.4&..| | 9f d3 ea 26 |...& | Server MAC key[20]: | ff 51 b2 15 12 44 b2 ea 56 96 32 4f f4 1d 64 80 |.Q...D..V.2O..d.| | 18 30 43 d7 |.0C. | Client Write key[16]: | 35 7b ce 65 d6 9e 23 69 00 a4 8e cd 1f c2 cf 70 |5{.e..#i.......p| Server Write key[16]: | d0 ec 57 99 be bf 45 98 40 55 12 72 70 b9 9e b5 |..W...E.@U.rp...| Client Write IV[8]: | fd 78 18 71 b0 eb fe a5 |.x.q.... | Server Write IV[8]: | c0 3c 36 49 53 84 f8 e2 |.<6IS... | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: RC2 ssl_create_decoder can't find cipher RC2 ssl_generate_keyring_material can't init client decoder dissect_ssl3_handshake can't generate keyring material record: offset = 75, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 81, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x37 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 74 offset 86 length 10589566 bytes, remaining 134 dissect_ssl enter frame #54 (first time) conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50 record: offset = 0, reported_length_remaining = 234 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x37 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x37 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 215 offset 186 length 3870598 bytes, remaining 234 dissect_ssl enter frame #55 (first time) conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50 record: offset = 0, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 96, ssl state 0x37 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available association_find: TCP port 43026 found (nil) association_find: TCP port 4437 found 0x2defbd0 dissect_ssl enter frame #56 (first time) conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x37 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available association_find: TCP port 4437 found 0x2defbd0 dissect_ssl enter frame #57 (first time) conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x37 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl enter frame #59 (first time) conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x37 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl enter frame #64 (first time) ssl_session_init: initializing ptr 0x7facc3818bb0 size 688 conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 53104 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4438 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #66 (first time) conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0 record: offset = 0, reported_length_remaining = 884 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0007 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | da 85 35 5e 4f 7b ab 4d 83 1d e9 25 f6 24 f5 9c |..5^O{.M...%.$..| | d9 2d f0 30 47 ed 06 0c c6 d9 18 ab 1d 43 9c 0e |.-.0G........C..| | b2 51 0b 20 26 44 f9 42 eb 25 a2 4f f5 49 70 9a |.Q. &D.B.%.O.Ip.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 20 4e 1c 59 33 ba 5a 5f a7 da 10 f3 59 03 c5 06 | N.Y3.Z_....Y...| | a1 8c 2d 47 61 34 80 6f 54 e8 00 c4 42 52 34 bf |..-Ga4.oT...BR4.| | 20 5e ad 31 4d 30 93 79 0a e2 ca 55 31 5b 5b de | ^.1M0.y...U1[[.| | ec 74 09 32 dc 2b 75 2f 76 f2 94 cc 73 |.t.2.+u/v...s | hash out[88]: | 86 ee a3 a5 35 87 c9 c5 30 73 07 c1 ad 39 62 7d |....5...0s...9b}| | 30 2f 04 49 c1 fd 09 90 43 b5 cc fc 7d e9 49 da |0/.I....C...}.I.| | 7c 52 cc 2c 1d 7a 08 be 1d 78 c1 3b d8 0b 4a da ||R.,.z...x.;..J.| | 1f 99 04 f8 bb f8 77 b9 e4 44 6c 9e fc 09 63 83 |......w..Dl...c.| | 54 c7 fa 1e 77 7a a1 3f 8b 79 54 db 51 41 6b 8e |T...wz.?.yT.QAk.| | 63 e8 4a 74 ae 33 e9 b4 |c.Jt.3.. | PRF out[88]: | 86 ee a3 a5 35 87 c9 c5 30 73 07 c1 ad 39 62 7d |....5...0s...9b}| | 30 2f 04 49 c1 fd 09 90 43 b5 cc fc 7d e9 49 da |0/.I....C...}.I.| | 7c 52 cc 2c 1d 7a 08 be 1d 78 c1 3b d8 0b 4a da ||R.,.z...x.;..J.| | 1f 99 04 f8 bb f8 77 b9 e4 44 6c 9e fc 09 63 83 |......w..Dl...c.| | 54 c7 fa 1e 77 7a a1 3f 8b 79 54 db 51 41 6b 8e |T...wz.?.yT.QAk.| | 63 e8 4a 74 ae 33 e9 b4 |c.Jt.3.. | key expansion[88]: | 86 ee a3 a5 35 87 c9 c5 30 73 07 c1 ad 39 62 7d |....5...0s...9b}| | 30 2f 04 49 c1 fd 09 90 43 b5 cc fc 7d e9 49 da |0/.I....C...}.I.| | 7c 52 cc 2c 1d 7a 08 be 1d 78 c1 3b d8 0b 4a da ||R.,.z...x.;..J.| | 1f 99 04 f8 bb f8 77 b9 e4 44 6c 9e fc 09 63 83 |......w..Dl...c.| | 54 c7 fa 1e 77 7a a1 3f 8b 79 54 db 51 41 6b 8e |T...wz.?.yT.QAk.| | 63 e8 4a 74 ae 33 e9 b4 |c.Jt.3.. | Client MAC key[20]: | 86 ee a3 a5 35 87 c9 c5 30 73 07 c1 ad 39 62 7d |....5...0s...9b}| | 30 2f 04 49 |0/.I | Server MAC key[20]: | c1 fd 09 90 43 b5 cc fc 7d e9 49 da 7c 52 cc 2c |....C...}.I.|R.,| | 1d 7a 08 be |.z.. | Client Write key[16]: | 1d 78 c1 3b d8 0b 4a da 1f 99 04 f8 bb f8 77 b9 |.x.;..J.......w.| Server Write key[16]: | e4 44 6c 9e fc 09 63 83 54 c7 fa 1e 77 7a a1 3f |.Dl...c.T...wz.?| Client Write IV[8]: | 8b 79 54 db 51 41 6b 8e |.yT.QAk. | Server Write IV[8]: | 63 e8 4a 74 ae 33 e9 b4 |c.Jt.3.. | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: IDEA decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: IDEA decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 821 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884 dissect_ssl enter frame #68 (first time) conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0 record: offset = 0, reported_length_remaining = 326 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 262, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc... looking for RSA pre-master1e816a2993b66faaadfc0adb44c121991b995cb2f6a087fd... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | bb 38 ed 61 82 aa 21 db 07 d3 8c 72 31 91 f0 5e |.8.a..!....r1..^| | 7e 79 af e4 52 3d a1 c5 97 e3 8b d2 f7 fb 66 16 |~y..R=........f.| | 78 d4 2b d7 a9 d9 29 7c 2f b1 6b bf 95 be f4 be |x.+...)|/.k.....| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 20 4e 1c 59 33 ba 5a 5f a7 da 10 f3 59 03 c5 06 | N.Y3.Z_....Y...| | a1 8c 2d 47 61 34 80 6f 54 e8 00 c4 42 52 34 bf |..-Ga4.oT...BR4.| | 20 5e ad 31 4d 30 93 79 0a e2 ca 55 31 5b 5b de | ^.1M0.y...U1[[.| | ec 74 09 32 dc 2b 75 2f 76 f2 94 cc 73 |.t.2.+u/v...s | hash out[88]: | e0 7d 25 a1 e9 2d 06 43 3d d6 a2 d2 38 22 9d 58 |.}%..-.C=...8".X| | 81 e8 b0 a8 a2 a3 3a 1d e8 c2 a8 cf 5c 55 9d 1f |......:.....\U..| | e2 11 0c b2 0a cb 9f 18 0a cb 83 a3 c8 85 12 10 |................| | a9 bc 14 c6 87 7f a0 04 86 5f d1 b0 90 d2 4a a0 |........._....J.| | b3 4f 05 eb 82 60 7c cc 08 40 48 fb 65 45 97 d5 |.O...`|..@H.eE..| | 04 b9 63 72 55 f8 82 11 |..crU... | PRF out[88]: | e0 7d 25 a1 e9 2d 06 43 3d d6 a2 d2 38 22 9d 58 |.}%..-.C=...8".X| | 81 e8 b0 a8 a2 a3 3a 1d e8 c2 a8 cf 5c 55 9d 1f |......:.....\U..| | e2 11 0c b2 0a cb 9f 18 0a cb 83 a3 c8 85 12 10 |................| | a9 bc 14 c6 87 7f a0 04 86 5f d1 b0 90 d2 4a a0 |........._....J.| | b3 4f 05 eb 82 60 7c cc 08 40 48 fb 65 45 97 d5 |.O...`|..@H.eE..| | 04 b9 63 72 55 f8 82 11 |..crU... | key expansion[88]: | e0 7d 25 a1 e9 2d 06 43 3d d6 a2 d2 38 22 9d 58 |.}%..-.C=...8".X| | 81 e8 b0 a8 a2 a3 3a 1d e8 c2 a8 cf 5c 55 9d 1f |......:.....\U..| | e2 11 0c b2 0a cb 9f 18 0a cb 83 a3 c8 85 12 10 |................| | a9 bc 14 c6 87 7f a0 04 86 5f d1 b0 90 d2 4a a0 |........._....J.| | b3 4f 05 eb 82 60 7c cc 08 40 48 fb 65 45 97 d5 |.O...`|..@H.eE..| | 04 b9 63 72 55 f8 82 11 |..crU... | Client MAC key[20]: | e0 7d 25 a1 e9 2d 06 43 3d d6 a2 d2 38 22 9d 58 |.}%..-.C=...8".X| | 81 e8 b0 a8 |.... | Server MAC key[20]: | a2 a3 3a 1d e8 c2 a8 cf 5c 55 9d 1f e2 11 0c b2 |..:.....\U......| | 0a cb 9f 18 |.... | Client Write key[16]: | 0a cb 83 a3 c8 85 12 10 a9 bc 14 c6 87 7f a0 04 |................| Server Write key[16]: | 86 5f d1 b0 90 d2 4a a0 b3 4f 05 eb 82 60 7c cc |._....J..O...`|.| Client Write IV[8]: | 08 40 48 fb 65 45 97 d5 |.@H.eE.. | Server Write IV[8]: | 04 b9 63 72 55 f8 82 11 |..crU... | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: IDEA decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: IDEA decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | bb 38 ed 61 82 aa 21 db 07 d3 8c 72 31 91 f0 5e |.8.a..!....r1..^| | 7e 79 af e4 52 3d a1 c5 97 e3 8b d2 f7 fb 66 16 |~y..R=........f.| | 78 d4 2b d7 a9 d9 29 7c 2f b1 6b bf 95 be f4 be |x.+...)|/.k.....| dissect_ssl3_handshake session keys successfully generated record: offset = 267, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 273, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 90 67 7f e3 85 ed c9 ce b8 59 1d 0e dd 63 72 c7 |.g.......Y...cr.| | dc 2c 7f b3 12 f5 35 3f e1 6e c9 86 1f c5 f9 f3 |.,....5?.n......| | 6d dc 27 9a 09 0b 33 6b 1a 7c d4 c8 c9 20 fb e3 |m.'...3k.|... ..| Plaintext[48]: | 23 d6 42 31 8c 7b 61 dd 14 00 00 0c fb 18 0a bd |#.B1.{a.........| | 93 02 8d 0d 90 9f 15 3e af c7 ad a0 87 09 fd c5 |.......>........| | 06 14 d2 0f ef 6d 65 7f d9 95 cc 08 03 03 03 03 |.....me.........| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | af c7 ad a0 87 09 fd c5 06 14 d2 0f ef 6d 65 7f |.............me.| | d9 95 cc 08 |.... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #69 (first time) conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0 record: offset = 0, reported_length_remaining = 234 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | d3 c0 58 c5 c6 54 86 69 26 a1 05 7b a0 51 56 27 |..X..T.i&..{.QV'| | 04 87 d5 d3 a1 aa 2a 0c b4 ff 67 18 5c d6 6c 7a |......*...g.\.lz| | 51 5e b2 ca 39 16 97 83 0f 7d 53 6b ce 1d f9 0c |Q^..9....}Sk....| Plaintext[48]: | 4c 1e 65 ed 4e 48 04 aa 14 00 00 0c 34 18 13 9c |L.e.NH......4...| | a0 66 7e c4 d8 16 e1 99 83 f4 97 23 d3 ab 38 ee |.f~........#..8.| | 48 cf 03 c3 fe 7a 83 45 fc 8e 76 93 03 03 03 03 |H....z.E..v.....| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 83 f4 97 23 d3 ab 38 ee 48 cf 03 c3 fe 7a 83 45 |...#..8.H....z.E| | fc 8e 76 93 |..v. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #70 (first time) conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0 record: offset = 0, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 96, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 96 Ciphertext[96]: | 35 ac 8b 9f 80 f7 30 f4 b4 b9 f5 76 f4 d9 1b 8c |5.....0....v....| | 0d e2 28 53 7d 25 da 5a 67 97 68 e2 25 fb d6 1c |..(S}%.Zg.h.%...| | a0 65 e1 8e 09 be af d4 83 56 7e 64 75 a6 01 95 |.e.......V~du...| | 77 aa a9 5b b3 5f 5b b4 fa 49 e8 75 17 db 93 24 |w..[._[..I.u...$| | ae 54 5f 7d bb ae 0a 71 ef 99 08 51 3f e8 7e b3 |.T_}...q...Q?.~.| | a7 4b 50 96 00 fe 30 ba a5 65 e9 c0 5c 73 30 5e |.KP...0..e..\s0^| Plaintext[96]: | 38 2c d3 47 db 0c 21 dc 47 45 54 20 2f 20 48 54 |8,.G..!.GET / HT| | 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 69 64 |TP/1.1..Host: id| | 65 61 2d 63 62 63 2d 73 68 61 2e 6c 6f 63 61 6c |ea-cbc-sha.local| | 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n| | 6c 3a 34 34 33 38 0d 0a 0d 0a 37 97 29 df 25 2d |l:4438....7.).%-| | 1b 20 23 1a 1f 82 38 b3 60 3a fc 86 56 bf 01 01 |. #...8.`:..V...| ssl_decrypt_record found padding 1 final len 94 checking mac (len 66, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 18 e2 ff 6a ca cb df 36 19 d5 8b 05 26 56 5e 1e |...j...6....&V^.| | fb 71 bc 39 |.q.9 | ssl_decrypt_record: mac failed association_find: TCP port 53104 found (nil) association_find: TCP port 4438 found 0x3425920 dissect_ssl enter frame #71 (first time) conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | a1 45 b9 97 64 d0 47 d9 9b c3 1c 2f da 94 38 67 |.E..d.G..../..8g| | fc 9d cb 2a f7 37 7d ae ca f8 f6 d4 ca bd 8d fe |...*.7}.........| | 5a fb 12 e4 04 95 ec d7 43 85 d6 5f 2d bb 01 b4 |Z.......C.._-...| | 3a 37 de a1 11 d4 46 d6 3d 12 06 44 f6 c7 95 95 |:7....F.=..D....| | 18 52 45 0a d6 6f 64 a6 3b 99 92 14 01 7d 83 1d |.RE..od.;....}..| | 13 65 5b ce 97 68 00 33 fd b1 16 38 5f a0 41 d5 |.e[..h.3...8_.A.| | 4c 30 57 4f 42 94 13 5f ca c8 6b ba 2e f6 a8 16 |L0WOB.._..k.....| | c9 59 8b 83 cd ff 6e b2 6a d8 d3 84 98 c5 32 62 |.Y....n.j.....2b| | 6c 31 4f f3 b9 40 4f 89 89 36 45 76 8e 58 c4 ed |l1O..@O..6Ev.X..| | ec ea 15 0e 52 24 24 c2 2c 35 85 c2 31 2d f9 9e |....R$$.,5..1-..| | 91 08 19 3f 3c 5c 5b 78 b3 ec 6f 01 b4 28 b4 ee |...?<\[x..o..(..| | ff 07 e5 53 66 17 d9 69 74 fe f8 23 24 e6 8e 97 |...Sf..it..#$...| | b5 9d b5 d7 a2 ec 43 eb d9 2b 19 2f f5 45 a5 13 |......C..+./.E..| | 3d 53 86 c2 47 fd 02 ca c0 5c d2 84 fb 93 58 b4 |=S..G....\....X.| | 39 34 31 50 b6 47 1d 65 d0 4f b5 41 6a 31 c6 6a |941P.G.e.O.Aj1.j| | 01 87 e5 23 a1 fe 62 cf 90 60 bf 60 44 e7 b1 31 |...#..b..`.`D..1| | b8 07 00 c4 7f 0d 80 9f d2 70 f5 52 2f 8d ad 9e |.........p.R/...| | ab e6 dc 66 b9 97 92 f1 4d 0b bb ec 74 ad 11 a6 |...f....M...t...| | b4 15 af 2e 7d 81 22 e5 12 57 ec 5b 9b 39 0d 81 |....}."..W.[.9..| | 9c ff b1 81 9e fb 35 6a 7d 48 75 49 77 1a b9 b4 |......5j}HuIw...| | 2b 08 30 cb 8c 0b a7 95 53 52 4e c5 c3 b7 0d 91 |+.0.....SRN.....| | df 15 dd 5d 83 44 34 f4 81 6c fd 05 7a 9b 7c 98 |...].D4..l..z.|.| | c9 49 4f 03 73 58 5f 03 f2 a9 da 64 85 eb 9f 0a |.IO.sX_....d....| | c7 13 0a 93 c7 66 c7 f3 d6 0f a6 f4 3a 2d 74 08 |.....f......:-t.| Plaintext[384]: | ae 8e 99 76 d9 61 ff 9b 48 54 54 50 2f 31 2e 31 |...v.a..HTTP/1.1| | 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:| | 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da| | 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep | | 32 30 31 33 20 31 39 3a 35 35 3a 31 32 20 47 4d |2013 19:55:12 GM| | 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:| | 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont| | 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.| | 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo| | 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu| | 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00| | 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach| | 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca| | 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 30 37 |che....0x00,0x07| | 20 2d 20 49 44 45 41 2d 43 42 43 2d 53 48 41 20 | - IDEA-CBC-SHA | | 20 20 20 20 20 20 20 20 20 20 20 53 53 4c 76 33 | SSLv3| | 20 4b 78 3d 52 53 41 20 20 20 20 20 20 41 75 3d | Kx=RSA Au=| | 52 53 41 20 20 45 6e 63 3d 49 44 45 41 28 31 32 |RSA Enc=IDEA(12| | 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 |8) Mac=SHA1document.doma| | 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek| | 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'....c.C..eW.| | f9 d7 5b 9b a0 83 d5 c7 07 07 07 07 07 07 07 07 |..[.............| ssl_decrypt_record found padding 7 final len 376 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 88 7d 45 11 65 2d 37 42 16 78 64 1b 34 d5 d5 9a |.}E.e-7B.xd.4...| | 35 e8 2f 09 |5./. | ssl_decrypt_record: mac failed association_find: TCP port 4438 found 0x3425920 dissect_ssl enter frame #72 (first time) conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | d3 1b 64 b4 30 6e 52 69 a1 2c ab 4b e5 73 dc ab |..d.0nRi.,.K.s..| | a2 d6 68 81 e9 f3 43 e1 f9 d0 ef be 05 1c b7 2b |..h...C........+| Plaintext[32]: | 65 12 ec 15 a5 91 75 fd 01 00 49 03 75 0e 63 6c |e.....u...I.u.cl| | 16 e4 09 2a 3b 1c bb 02 58 20 7b 2a 6d 6f 01 01 |...*;...X {*mo..| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 49 03 75 0e 63 6c 16 e4 09 2a 3b 1c bb 02 58 20 |I.u.cl...*;...X | | 7b 2a 6d 6f |{*mo | ssl_decrypt_record: mac ok dissect_ssl enter frame #74 (first time) conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 30 1a d1 69 69 23 95 42 88 f6 84 65 d7 7e cb da |0..ii#.B...e.~..| | 6e 01 48 45 9b d2 31 33 20 dd 4f e3 4e e8 87 35 |n.HE..13 .O.N..5| Plaintext[32]: | 72 1a 1f 8f 05 fb b5 47 01 00 e1 1f 21 eb 91 b4 |r......G....!...| | 62 ca b2 10 9b c5 0a 19 10 6b 61 9e c8 b3 01 01 |b........ka.....| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | e1 1f 21 eb 91 b4 62 ca b2 10 9b c5 0a 19 10 6b |..!...b........k| | 61 9e c8 b3 |a... | ssl_decrypt_record: mac ok dissect_ssl enter frame #79 (first time) ssl_session_init: initializing ptr 0x7facc381b170 size 688 conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 52165 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4439 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #81 (first time) conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170 record: offset = 0, reported_length_remaining = 1224 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0008 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | bb 38 ed 61 82 aa 21 db 07 d3 8c 72 31 91 f0 5e |.8.a..!....r1..^| | 7e 79 af e4 52 3d a1 c5 97 e3 8b d2 f7 fb 66 16 |~y..R=........f.| | 78 d4 2b d7 a9 d9 29 7c 2f b1 6b bf 95 be f4 be |x.+...)|/.k.....| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 20 72 01 2d fe 9c f1 2b b9 36 46 d4 ea 92 90 d8 | r.-...+.6F.....| | 38 3a 19 48 f0 0e 35 d8 dc 65 e4 c0 07 52 34 bf |8:.H..5..e...R4.| | 20 67 b7 88 04 84 02 72 40 18 18 2e ed 93 35 10 | g.....r@.....5.| | 1f 87 25 30 9f df 4e 9d 8e 72 d5 0b bf |..%0..N..r... | hash out[72]: | 60 0e 82 4a b3 76 1c 48 49 65 e6 f4 7e 22 e9 29 |`..J.v.HIe..~".)| | ab f6 5a dc bd bc bd 2f a0 ac 1e 8b 91 d2 6b 93 |..Z..../......k.| | 42 d6 9d 5a 3e 5e e2 02 2d 43 ce 68 92 b9 13 35 |B..Z>^..-C.h...5| | a1 ad 86 fc 66 59 3f 22 6c b6 11 60 fa 3c 57 7b |....fY?"l..`.^..-C.h...5| | a1 ad 86 fc 66 59 3f 22 6c b6 11 60 fa 3c 57 7b |....fY?"l..`.^..-C.h...5| | a1 ad 86 fc 66 59 3f 22 6c b6 11 60 fa 3c 57 7b |....fY?"l..`..F.a(a...| PRF out[32]: | 2f e0 62 90 e6 dc 26 9e 4b 61 89 1c de 01 76 a9 |/.b...&.Ka....v.| | aa e9 84 36 76 08 3e 8f 46 ac 61 28 61 a2 80 c0 |...6v.>.F.a(a...| ssl_generate_keyring_material PRF(key_s) tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 ) tls_hash: hash secret[5]: | b9 13 35 a1 ad |..5.. | tls_hash: hash seed[80]: | 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key| | 52 34 bf 20 67 b7 88 04 84 02 72 40 18 18 2e ed |R4. g.....r@....| | 93 35 10 1f 87 25 30 9f df 4e 9d 8e 72 d5 0b bf |.5...%0..N..r...| | 52 34 bf 20 72 01 2d fe 9c f1 2b b9 36 46 d4 ea |R4. r.-...+.6F..| | 92 90 d8 38 3a 19 48 f0 0e 35 d8 dc 65 e4 c0 07 |...8:.H..5..e...| hash out[32]: | 1d f8 a0 57 33 05 9d 5a 72 62 8c 88 9f 5a bb e6 |...W3..Zrb...Z..| | 70 eb 98 da c8 bd a3 f5 c5 11 b9 c8 32 36 1a 65 |p...........26.e| PRF out[32]: | 1d f8 a0 57 33 05 9d 5a 72 62 8c 88 9f 5a bb e6 |...W3..Zrb...Z..| | 70 eb 98 da c8 bd a3 f5 c5 11 b9 c8 32 36 1a 65 |p...........26.e| Client MAC key[20]: | 60 0e 82 4a b3 76 1c 48 49 65 e6 f4 7e 22 e9 29 |`..J.v.HIe..~".)| | ab f6 5a dc |..Z. | Server MAC key[20]: | bd bc bd 2f a0 ac 1e 8b 91 d2 6b 93 42 d6 9d 5a |.../......k.B..Z| | 3e 5e e2 02 |>^.. | Client Write key[8]: | 2f e0 62 90 e6 dc 26 9e |/.b...&. | Server Write key[8]: | 1d f8 a0 57 33 05 9d 5a |...W3..Z | Client Write IV[8]: | 1a 56 15 98 62 8c 1a c5 |.V..b... | Server Write IV[8]: | f6 02 d4 da b4 c4 b5 bb |........ | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 1161 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 349 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 335, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 880 length 331 bytes, remaining 1215 record: offset = 1215, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1220 length 0 bytes, remaining 1224 dissect_ssl enter frame #83 (first time) conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170 record: offset = 0, reported_length_remaining = 134 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 70, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309f... looking for RSA pre-mastera62989ead4a8a5e58bf2f6a2f811703a3d65165916bb8dda... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 8e 27 2f 89 e3 4d 48 21 c8 3a 6b 30 97 eb 80 00 |.'/..MH!.:k0....| | 4f 60 e2 ee fe b6 ea d0 38 e7 07 9d 35 a0 9f 92 |O`......8...5...| | e1 8b a9 91 31 87 14 7d 4b 72 62 9d de 00 d6 5f |....1..}Krb...._| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 20 72 01 2d fe 9c f1 2b b9 36 46 d4 ea 92 90 d8 | r.-...+.6F.....| | 38 3a 19 48 f0 0e 35 d8 dc 65 e4 c0 07 52 34 bf |8:.H..5..e...R4.| | 20 67 b7 88 04 84 02 72 40 18 18 2e ed 93 35 10 | g.....r@.....5.| | 1f 87 25 30 9f df 4e 9d 8e 72 d5 0b bf |..%0..N..r... | hash out[72]: | da bc 7a 95 4f fa e7 d6 24 12 d6 11 eb 59 74 4e |..z.O...$....YtN| | ce 25 7c b6 fb 2f c2 20 9b 0b ed bd 10 38 6e eb |.%|../. .....8n.| | 49 5b 72 32 ce 63 7c 2f a1 de 58 84 98 f9 5d b0 |I[r2.c|/..X...].| | 8c 6f 6a fe 78 b6 73 34 8d 6b 3d d8 9c ab a8 d7 |.oj.x.s4.k=.....| | 68 80 55 5d 85 34 6c c4 |h.U].4l. | PRF out[72]: | da bc 7a 95 4f fa e7 d6 24 12 d6 11 eb 59 74 4e |..z.O...$....YtN| | ce 25 7c b6 fb 2f c2 20 9b 0b ed bd 10 38 6e eb |.%|../. .....8n.| | 49 5b 72 32 ce 63 7c 2f a1 de 58 84 98 f9 5d b0 |I[r2.c|/..X...].| | 8c 6f 6a fe 78 b6 73 34 8d 6b 3d d8 9c ab a8 d7 |.oj.x.s4.k=.....| | 68 80 55 5d 85 34 6c c4 |h.U].4l. | key expansion[72]: | da bc 7a 95 4f fa e7 d6 24 12 d6 11 eb 59 74 4e |..z.O...$....YtN| | ce 25 7c b6 fb 2f c2 20 9b 0b ed bd 10 38 6e eb |.%|../. .....8n.| | 49 5b 72 32 ce 63 7c 2f a1 de 58 84 98 f9 5d b0 |I[r2.c|/..X...].| | 8c 6f 6a fe 78 b6 73 34 8d 6b 3d d8 9c ab a8 d7 |.oj.x.s4.k=.....| | 68 80 55 5d 85 34 6c c4 |h.U].4l. | ssl_generate_keyring_material prf(iv_block) tls12_prf: tls_hash(hash_alg SHA256 secret_len 0 seed_len 72 ) tls_hash: hash secret[0]: tls_hash: hash seed[72]: | 49 56 20 62 6c 6f 63 6b 52 34 bf 20 67 b7 88 04 |IV blockR4. g...| | 84 02 72 40 18 18 2e ed 93 35 10 1f 87 25 30 9f |..r@.....5...%0.| | df 4e 9d 8e 72 d5 0b bf 52 34 bf 20 72 01 2d fe |.N..r...R4. r.-.| | 9c f1 2b b9 36 46 d4 ea 92 90 d8 38 3a 19 48 f0 |..+.6F.....8:.H.| | 0e 35 d8 dc 65 e4 c0 07 |.5..e... | hash out[16]: | 1a 56 15 98 62 8c 1a c5 f6 02 d4 da b4 c4 b5 bb |.V..b...........| PRF out[16]: | 1a 56 15 98 62 8c 1a c5 f6 02 d4 da b4 c4 b5 bb |.V..b...........| ssl_generate_keyring_material PRF(key_c) tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 ) tls_hash: hash secret[5]: | a1 de 58 84 98 |..X.. | tls_hash: hash seed[80]: | 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key| | 52 34 bf 20 67 b7 88 04 84 02 72 40 18 18 2e ed |R4. g.....r@....| | 93 35 10 1f 87 25 30 9f df 4e 9d 8e 72 d5 0b bf |.5...%0..N..r...| | 52 34 bf 20 72 01 2d fe 9c f1 2b b9 36 46 d4 ea |R4. r.-...+.6F..| | 92 90 d8 38 3a 19 48 f0 0e 35 d8 dc 65 e4 c0 07 |...8:.H..5..e...| hash out[32]: | ef 0d 2b 13 ce 78 93 43 23 8d a0 88 0a d5 9b b3 |..+..x.C#.......| | 63 08 f6 d9 1c fa c4 ca e2 81 05 c6 cb 45 c3 95 |c............E..| PRF out[32]: | ef 0d 2b 13 ce 78 93 43 23 8d a0 88 0a d5 9b b3 |..+..x.C#.......| | 63 08 f6 d9 1c fa c4 ca e2 81 05 c6 cb 45 c3 95 |c............E..| ssl_generate_keyring_material PRF(key_s) tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 ) tls_hash: hash secret[5]: | f9 5d b0 8c 6f |.]..o | tls_hash: hash seed[80]: | 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key| | 52 34 bf 20 67 b7 88 04 84 02 72 40 18 18 2e ed |R4. g.....r@....| | 93 35 10 1f 87 25 30 9f df 4e 9d 8e 72 d5 0b bf |.5...%0..N..r...| | 52 34 bf 20 72 01 2d fe 9c f1 2b b9 36 46 d4 ea |R4. r.-...+.6F..| | 92 90 d8 38 3a 19 48 f0 0e 35 d8 dc 65 e4 c0 07 |...8:.H..5..e...| hash out[32]: | 99 f4 36 14 b1 15 c3 94 e6 eb 1d f4 4f 21 78 8a |..6.........O!x.| | 3e aa 20 99 ca 2b 4d bc bc e8 ca 51 12 4e 94 c8 |>. ..+M....Q.N..| PRF out[32]: | 99 f4 36 14 b1 15 c3 94 e6 eb 1d f4 4f 21 78 8a |..6.........O!x.| | 3e aa 20 99 ca 2b 4d bc bc e8 ca 51 12 4e 94 c8 |>. ..+M....Q.N..| Client MAC key[20]: | da bc 7a 95 4f fa e7 d6 24 12 d6 11 eb 59 74 4e |..z.O...$....YtN| | ce 25 7c b6 |.%|. | Server MAC key[20]: | fb 2f c2 20 9b 0b ed bd 10 38 6e eb 49 5b 72 32 |./. .....8n.I[r2| | ce 63 7c 2f |.c|/ | Client Write key[8]: | ef 0d 2b 13 ce 78 93 43 |..+..x.C | Server Write key[8]: | 99 f4 36 14 b1 15 c3 94 |..6..... | Client Write IV[8]: | 1a 56 15 98 62 8c 1a c5 |.V..b... | Server Write IV[8]: | f6 02 d4 da b4 c4 b5 bb |........ | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 8e 27 2f 89 e3 4d 48 21 c8 3a 6b 30 97 eb 80 00 |.'/..MH!.:k0....| | 4f 60 e2 ee fe b6 ea d0 38 e7 07 9d 35 a0 9f 92 |O`......8...5...| | e1 8b a9 91 31 87 14 7d 4b 72 62 9d de 00 d6 5f |....1..}Krb...._| dissect_ssl3_handshake session keys successfully generated record: offset = 75, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 81, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 9e 2f 76 d1 2f 2f b9 3b dd 2d bf c9 71 ea 86 29 |./v.//.;.-..q..)| | a4 2d 4c 2b 75 8c 0e 9e 10 49 1e bb 60 8c 2b 04 |.-L+u....I..`.+.| | 1c 71 b9 ff 1f fe 98 86 ea 50 7f 05 8a 01 33 fb |.q.......P....3.| Plaintext[48]: | 24 51 a1 43 c0 ec a3 1a 14 00 00 0c aa 2a 3d 27 |$Q.C.........*='| | 66 61 97 a7 58 37 13 b6 36 ab dc c7 72 bd a3 8a |fa..X7..6...r...| | cf fc 79 75 9d 69 52 63 ac 99 01 91 03 03 03 03 |..yu.iRc........| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 36 ab dc c7 72 bd a3 8a cf fc 79 75 9d 69 52 63 |6...r.....yu.iRc| | ac 99 01 91 |.... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #84 (first time) conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170 record: offset = 0, reported_length_remaining = 234 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 02 97 a5 f6 a9 60 b1 e6 25 f6 af 28 a0 00 5e 4e |.....`..%..(..^N| | d8 e1 3e 4b 6e bd 2b f4 88 6e 71 34 a9 38 16 b2 |..>Kn.+..nq4.8..| | 12 a4 a0 1e 74 46 5c 28 fc 04 9a 2f 88 82 ae 01 |....tF\(.../....| Plaintext[48]: | f2 99 b1 0e ac c0 45 f1 14 00 00 0c 03 4e 36 17 |......E......N6.| | 0b 12 6b f2 c1 ab 9c 9e 4f 12 5a a2 8c a1 e5 c5 |..k.....O.Z.....| | ed f5 77 d2 51 0d 10 e1 6f cc dd 29 03 03 03 03 |..w.Q...o..)....| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 4f 12 5a a2 8c a1 e5 c5 ed f5 77 d2 51 0d 10 e1 |O.Z.......w.Q...| | 6f cc dd 29 |o..) | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #85 (first time) conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170 record: offset = 0, reported_length_remaining = 109 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 104, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 104 Ciphertext[104]: | d5 df 46 7f 5e 0e ee 94 fe d8 89 05 b4 fd cd c3 |..F.^...........| | c6 b3 a6 60 51 ce c2 42 9f 26 23 d6 c9 6d 9e d2 |...`Q..B.&#..m..| | 96 c2 3a 5d f9 68 a4 64 1d 94 cc 0a 9f c7 43 f6 |..:].h.d......C.| | b8 e5 f1 cf 3d 14 22 b6 c9 5d 26 02 32 4a 6a 29 |....=."..]&.2Jj)| | f4 66 ca 68 35 19 7a 67 fb 94 70 d9 9b 58 67 6c |.f.h5.zg..p..Xgl| | 41 dd 04 e0 2d 7f 99 e9 29 37 6f 0d 38 3e b7 83 |A...-...)7o.8>..| | 54 eb e9 6e 3a ed 43 25 |T..n:.C% | Plaintext[104]: | a4 89 ea 43 1b eb ed 86 47 45 54 20 2f 20 48 54 |...C....GET / HT| | 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 78 |TP/1.1..Host: ex| | 70 2d 64 65 73 2d 63 62 63 2d 73 68 61 2e 6c 6f |p-des-cbc-sha.lo| | 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey| | 6e 2e 6e 6c 3a 34 34 33 39 0d 0a 0d 0a 93 00 b8 |n.nl:4439.......| | 41 d0 ae 0c 83 0a a8 b2 d8 14 3f ac b9 00 71 a9 |A.........?...q.| | 11 06 06 06 06 06 06 06 |........ | ssl_decrypt_record found padding 6 final len 97 checking mac (len 69, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 93 df f4 91 22 37 94 81 50 48 8a d4 88 08 65 e5 |...."7..PH....e.| | ef 4b 2a e1 |.K*. | ssl_decrypt_record: mac failed association_find: TCP port 52165 found (nil) association_find: TCP port 4439 found 0x342cfb0 dissect_ssl enter frame #86 (first time) conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | d0 c7 ac f3 05 4f c3 4e ac 40 c5 57 06 0b 60 bf |.....O.N.@.W..`.| | 4c c7 82 3e 85 78 50 02 81 e9 18 cb 92 dd 4e 46 |L..>.xP.......NF| | 51 5c a7 59 53 94 59 cd a9 d8 90 fe 3f 7f 0d 7a |Q\.YS.Y.....?..z| | ab bf ec a3 e3 20 f7 85 35 04 60 7f 52 42 0d 4a |..... ..5.`.RB.J| | 63 51 d2 8d 15 b2 88 8a 9b 7d d7 3d 6d 56 6c 9c |cQ.......}.=mVl.| | 75 6b 85 12 61 fc 39 a7 29 d8 fd 77 aa ee e3 4e |uk..a.9.)..w...N| | ee a2 1c 19 35 9f 80 c6 a6 fe 08 93 ed ff 89 71 |....5..........q| | 13 3c 70 84 5b 44 2c d0 64 a1 26 77 fa 97 0f 49 |..F....HTTP/1.1| | 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:| | 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da| | 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep | | 32 30 31 33 20 31 39 3a 35 35 3a 31 32 20 47 4d |2013 19:55:12 GM| | 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:| | 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont| | 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 38 0d |ent-Length: 148.| | 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo| | 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu| | 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00| | 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach| | 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca| | 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 30 38 |che....0x00,0x08| | 20 2d 20 45 58 50 2d 44 45 53 2d 43 42 43 2d 53 | - EXP-DES-CBC-S| | 48 41 20 20 20 20 20 20 20 20 20 53 53 4c 76 33 |HA SSLv3| | 20 4b 78 3d 52 53 41 28 35 31 32 29 20 41 75 3d | Kx=RSA(512) Au=| | 52 53 41 20 20 45 6e 63 3d 44 45 53 28 34 30 29 |RSA Enc=DES(40)| | 20 20 20 4d 61 63 3d 53 48 41 31 20 65 78 70 6f | Mac=SHA1 expo| | 72 74 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 |rt....i| | 26 10 0f 06 e2 8f e2 b9 d9 f0 34 de 06 15 c2 00 |&.........4.....| ssl_decrypt_record found padding 0 final len 383 checking mac (len 355, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | b3 bc 22 86 7e 5f f8 3a 84 6a 1b 8b b5 0d 62 c0 |..".~_.:.j....b.| | ca c1 7f 40 |...@ | ssl_decrypt_record: mac failed association_find: TCP port 4439 found 0x342cfb0 dissect_ssl enter frame #87 (first time) conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 21 25 a2 6d 98 e3 24 3b 53 62 1c 7a d0 f7 6d f0 |!%.m..$;Sb.z..m.| | 73 1c d5 8c 19 1d 00 1c ef 69 90 e0 6d 24 8f a3 |s........i..m$..| Plaintext[32]: | 03 a5 dd be a0 be ef 4a 01 00 2a cf 2c 48 90 13 |.......J..*.,H..| | 7c ea cd 01 d7 6c dd 23 a8 a3 bd 4d 60 9c 01 01 ||....l.#...M`...| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 2a cf 2c 48 90 13 7c ea cd 01 d7 6c dd 23 a8 a3 |*.,H..|....l.#..| | bd 4d 60 9c |.M`. | ssl_decrypt_record: mac ok dissect_ssl enter frame #89 (first time) conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 37 7e 17 a7 c4 96 ff d7 75 c2 29 a6 97 50 2e 9c |7~......u.)..P..| | d4 40 b7 6b f2 14 9c 56 51 6e 3e b9 b3 c5 6f 89 |.@.k...VQn>...o.| Plaintext[32]: | 57 93 1e c1 ad a6 90 6b 01 00 51 df 8b 46 02 5c |W......k..Q..F.\| | f3 bd cd 30 44 eb d7 cb c5 ee 66 bb 74 d8 01 01 |...0D.....f.t...| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 51 df 8b 46 02 5c f3 bd cd 30 44 eb d7 cb c5 ee |Q..F.\...0D.....| | 66 bb 74 d8 |f.t. | ssl_decrypt_record: mac ok dissect_ssl enter frame #94 (first time) ssl_session_init: initializing ptr 0x7facc381d630 size 688 conversation = 0x7facef997270, ssl_session = 0x7facc381d630 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 50147 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4440 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #96 (first time) conversation = 0x7facef997270, ssl_session = 0x7facc381d630 record: offset = 0, reported_length_remaining = 884 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0009 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 8e 27 2f 89 e3 4d 48 21 c8 3a 6b 30 97 eb 80 00 |.'/..MH!.:k0....| | 4f 60 e2 ee fe b6 ea d0 38 e7 07 9d 35 a0 9f 92 |O`......8...5...| | e1 8b a9 91 31 87 14 7d 4b 72 62 9d de 00 d6 5f |....1..}Krb...._| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 20 c7 90 41 a1 7d 14 3c d6 35 74 00 b5 b7 cc af | ..A.}.<.5t.....| | 18 81 1d c7 ca 58 7e 80 31 5d fc a6 8a 52 34 bf |.....X~.1]...R4.| | 20 2e 5d 51 50 4a c7 92 3f 3a 67 a5 40 ea 38 66 | .]QPJ..?:g.@.8f| | f2 86 3c bb 94 d4 6a df f2 8a 7f a5 b8 |..<...j...... | hash out[72]: | ed ee 6e f7 82 bd 80 29 0b 36 2e 22 4c 4f 65 fd |..n....).6."LOe.| | 5e 43 09 6f bf 8f 70 81 97 5f 7e 39 f0 8e 25 60 |^C.o..p.._~9..%`| | f2 32 56 fb 9f a4 9a 8b 9f 58 38 0d 59 c0 86 12 |.2V......X8.Y...| | 0c 82 76 fe ec 53 37 c9 c6 61 03 48 fd 2a ce 40 |..v..S7..a.H.*.@| | 8b a0 6d 38 34 8c 78 ce |..m84.x. | PRF out[72]: | ed ee 6e f7 82 bd 80 29 0b 36 2e 22 4c 4f 65 fd |..n....).6."LOe.| | 5e 43 09 6f bf 8f 70 81 97 5f 7e 39 f0 8e 25 60 |^C.o..p.._~9..%`| | f2 32 56 fb 9f a4 9a 8b 9f 58 38 0d 59 c0 86 12 |.2V......X8.Y...| | 0c 82 76 fe ec 53 37 c9 c6 61 03 48 fd 2a ce 40 |..v..S7..a.H.*.@| | 8b a0 6d 38 34 8c 78 ce |..m84.x. | key expansion[72]: | ed ee 6e f7 82 bd 80 29 0b 36 2e 22 4c 4f 65 fd |..n....).6."LOe.| | 5e 43 09 6f bf 8f 70 81 97 5f 7e 39 f0 8e 25 60 |^C.o..p.._~9..%`| | f2 32 56 fb 9f a4 9a 8b 9f 58 38 0d 59 c0 86 12 |.2V......X8.Y...| | 0c 82 76 fe ec 53 37 c9 c6 61 03 48 fd 2a ce 40 |..v..S7..a.H.*.@| | 8b a0 6d 38 34 8c 78 ce |..m84.x. | Client MAC key[20]: | ed ee 6e f7 82 bd 80 29 0b 36 2e 22 4c 4f 65 fd |..n....).6."LOe.| | 5e 43 09 6f |^C.o | Server MAC key[20]: | bf 8f 70 81 97 5f 7e 39 f0 8e 25 60 f2 32 56 fb |..p.._~9..%`.2V.| | 9f a4 9a 8b |.... | Client Write key[8]: | 9f 58 38 0d 59 c0 86 12 |.X8.Y... | Server Write key[8]: | 0c 82 76 fe ec 53 37 c9 |..v..S7. | Client Write IV[8]: | c6 61 03 48 fd 2a ce 40 |.a.H.*.@ | Server Write IV[8]: | 8b a0 6d 38 34 8c 78 ce |..m84.x. | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 821 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884 dissect_ssl enter frame #98 (first time) conversation = 0x7facef997270, ssl_session = 0x7facc381d630 record: offset = 0, reported_length_remaining = 326 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 262, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94... looking for RSA pre-master113e309073f08d54ca50f560cbcc67a69298e5c229d6ee4c... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 6c 1f da 51 57 81 df 01 9e 94 ea f5 8e 72 48 dc |l..QW........rH.| | c2 2c 12 dc 04 5c 57 5a 37 ef 3a 71 39 2d 95 99 |.,...\WZ7.:q9-..| | a6 f6 17 bc c1 54 e7 3d 17 f1 f6 91 c3 ef 3d a7 |.....T.=......=.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 20 c7 90 41 a1 7d 14 3c d6 35 74 00 b5 b7 cc af | ..A.}.<.5t.....| | 18 81 1d c7 ca 58 7e 80 31 5d fc a6 8a 52 34 bf |.....X~.1]...R4.| | 20 2e 5d 51 50 4a c7 92 3f 3a 67 a5 40 ea 38 66 | .]QPJ..?:g.@.8f| | f2 86 3c bb 94 d4 6a df f2 8a 7f a5 b8 |..<...j...... | hash out[72]: | 50 5b 0c 9e af ad 01 9f 05 64 eb e3 75 62 63 98 |P[.......d..ubc.| | 9b 59 e5 f4 85 db 6e 68 d4 3d 7e c4 17 2c 8b f8 |.Y....nh.=~..,..| | 3d 0d 36 ac fe 16 83 d5 82 74 79 3f ec b5 47 7d |=.6......ty?..G}| | 67 8a 93 62 1b ca fd 45 8c 8a af b4 c2 61 12 81 |g..b...E.....a..| | 0d 7f 38 ec b0 f5 3e 6b |..8...>k | PRF out[72]: | 50 5b 0c 9e af ad 01 9f 05 64 eb e3 75 62 63 98 |P[.......d..ubc.| | 9b 59 e5 f4 85 db 6e 68 d4 3d 7e c4 17 2c 8b f8 |.Y....nh.=~..,..| | 3d 0d 36 ac fe 16 83 d5 82 74 79 3f ec b5 47 7d |=.6......ty?..G}| | 67 8a 93 62 1b ca fd 45 8c 8a af b4 c2 61 12 81 |g..b...E.....a..| | 0d 7f 38 ec b0 f5 3e 6b |..8...>k | key expansion[72]: | 50 5b 0c 9e af ad 01 9f 05 64 eb e3 75 62 63 98 |P[.......d..ubc.| | 9b 59 e5 f4 85 db 6e 68 d4 3d 7e c4 17 2c 8b f8 |.Y....nh.=~..,..| | 3d 0d 36 ac fe 16 83 d5 82 74 79 3f ec b5 47 7d |=.6......ty?..G}| | 67 8a 93 62 1b ca fd 45 8c 8a af b4 c2 61 12 81 |g..b...E.....a..| | 0d 7f 38 ec b0 f5 3e 6b |..8...>k | Client MAC key[20]: | 50 5b 0c 9e af ad 01 9f 05 64 eb e3 75 62 63 98 |P[.......d..ubc.| | 9b 59 e5 f4 |.Y.. | Server MAC key[20]: | 85 db 6e 68 d4 3d 7e c4 17 2c 8b f8 3d 0d 36 ac |..nh.=~..,..=.6.| | fe 16 83 d5 |.... | Client Write key[8]: | 82 74 79 3f ec b5 47 7d |.ty?..G} | Server Write key[8]: | 67 8a 93 62 1b ca fd 45 |g..b...E | Client Write IV[8]: | 8c 8a af b4 c2 61 12 81 |.....a.. | Server Write IV[8]: | 0d 7f 38 ec b0 f5 3e 6b |..8...>k | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 6c 1f da 51 57 81 df 01 9e 94 ea f5 8e 72 48 dc |l..QW........rH.| | c2 2c 12 dc 04 5c 57 5a 37 ef 3a 71 39 2d 95 99 |.,...\WZ7.:q9-..| | a6 f6 17 bc c1 54 e7 3d 17 f1 f6 91 c3 ef 3d a7 |.....T.=......=.| dissect_ssl3_handshake session keys successfully generated record: offset = 267, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 273, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 4d 49 26 30 9f 76 b9 65 f2 de d9 fe b2 a4 a1 ec |MI&0.v.e........| | d4 ca 74 ce db 15 60 77 e5 c5 f8 2f 93 57 ae d4 |..t...`w.../.W..| | 12 d6 53 d0 40 e5 8f 5f 3b b0 2e 0c 57 b1 ef 17 |..S.@.._;...W...| Plaintext[48]: | b2 2d be 6a 6c 68 e3 67 14 00 00 0c 32 36 10 27 |.-.jlh.g....26.'| | 45 c2 35 2e e7 fd 99 ef e6 41 49 34 3a c8 68 cc |E.5......AI4:.h.| | 39 b6 bc be 20 25 c7 89 e5 7e 74 0a 03 03 03 03 |9... %...~t.....| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | e6 41 49 34 3a c8 68 cc 39 b6 bc be 20 25 c7 89 |.AI4:.h.9... %..| | e5 7e 74 0a |.~t. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #99 (first time) conversation = 0x7facef997270, ssl_session = 0x7facc381d630 record: offset = 0, reported_length_remaining = 234 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | c3 ea fd 82 d3 d6 6c e2 00 bb c3 84 1d 48 24 0a |......l......H$.| | 6f 2d 02 f4 77 5b 43 ac ab 04 7c 54 bd 2b 81 de |o-..w[C...|T.+..| | 76 7c c9 56 a0 35 d1 f6 ff ec ca 85 8c ea 1e e5 |v|.V.5..........| Plaintext[48]: | dd 05 d3 72 a2 14 09 14 14 00 00 0c ed 76 03 3a |...r.........v.:| | a3 69 18 52 fb dc 1b ef 0d 9c 8c bd 6b 84 4f 23 |.i.R........k.O#| | 8a c5 cd a6 59 9b 86 57 28 90 0b 02 03 03 03 03 |....Y..W(.......| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 0d 9c 8c bd 6b 84 4f 23 8a c5 cd a6 59 9b 86 57 |....k.O#....Y..W| | 28 90 0b 02 |(... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #100 (first time) conversation = 0x7facef997270, ssl_session = 0x7facc381d630 record: offset = 0, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 96, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 96 Ciphertext[96]: | 11 db b3 52 2e ad 38 13 bc 11 5d f4 29 5a 5c 06 |...R..8...].)Z\.| | a0 a9 08 da 2c 4f d2 19 77 1d 33 f4 75 2d 11 78 |....,O..w.3.u-.x| | e1 4f 11 0c a2 fc 38 1d 23 e1 9e af 16 21 37 58 |.O....8.#....!7X| | d5 90 60 4b 63 b0 1f 98 07 99 9f 00 29 5e 99 9e |..`Kc.......)^..| | b2 e0 1e 6c b5 e1 75 6d c1 0a ed 54 28 a4 c2 ef |...l..um...T(...| | 44 ea 12 60 ee 77 fc f8 11 81 07 33 68 6c bf 3b |D..`.w.....3hl.;| Plaintext[96]: | c5 34 71 10 4f 4f 9c 44 47 45 54 20 2f 20 48 54 |.4q.OO.DGET / HT| | 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 64 65 |TP/1.1..Host: de| | 73 2d 63 62 63 2d 73 68 61 2e 6c 6f 63 61 6c 2e |s-cbc-sha.local.| | 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c |al.lekensteyn.nl| | 3a 34 34 34 30 0d 0a 0d 0a 6e 7d 5e 16 f6 79 c0 |:4440....n}^..y.| | ff 31 f9 b3 27 95 a0 f5 10 be bc fe 4b 02 02 02 |.1..'.......K...| ssl_decrypt_record found padding 2 final len 93 checking mac (len 65, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 7e 6f 9d 97 cf 0d 1d 4a d2 5e f0 23 ec 73 04 f5 |~o.....J.^.#.s..| | b8 a0 aa 89 |.... | ssl_decrypt_record: mac failed association_find: TCP port 50147 found (nil) association_find: TCP port 4440 found 0x342d040 dissect_ssl enter frame #101 (first time) conversation = 0x7facef997270, ssl_session = 0x7facc381d630 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | 20 7a e5 fb 30 5d bf 30 4b 54 b2 d8 7d db db 30 | z..0].0KT..}..0| | 49 22 22 28 c7 f5 8e a4 ad 6c b4 5d 0b 69 9f 7c |I""(.....l.].i.|| | 5a 6a 56 1e 7e 3b 60 20 1c dd 27 e0 14 59 0c 5e |ZjV.~;` ..'..Y.^| | e5 c0 07 79 a6 4e a0 35 c1 a9 d5 d3 0c c8 f3 c1 |...y.N.5........| | ef 1c 07 f0 36 79 f3 0b 79 ff 7e d3 29 96 85 ac |....6y..y.~.)...| | a9 90 50 95 d4 9d 52 ab dc 9a bd c3 4b 7c 6b 55 |..P...R.....K|kU| | b2 44 00 91 0a d1 6c 69 d8 c8 1f 49 78 5a f8 b3 |.D....li...IxZ..| | 9e 9e 61 e4 86 b5 92 33 7f 14 83 95 41 93 d2 05 |..a....3....A...| | 4b a1 0a 05 35 38 5a 37 5d f4 c0 0e b0 1c d0 32 |K...58Z7]......2| | e2 9d 10 6d ff c3 8b af c5 18 3f d4 45 6a a8 84 |...m......?.Ej..| | 1e a9 ed c8 d1 1f 2b 56 a8 77 e7 75 62 9d 7f ee |......+V.w.ub...| | e7 cd 70 2e 92 15 f1 e2 87 b4 bc 13 df 81 fd 30 |..p............0| | 4c 02 41 6c 67 e8 be 2f 68 11 de e9 f1 3c 5e fb |L.Alg../h....<^.| | 3f ab 3a d0 87 1e b3 39 cb af 07 49 8a 9a 21 04 |?.:....9...I..!.| | 6c 23 45 94 a4 b9 ef 31 7b 4c c9 16 0c 6b 4d ad |l#E....1{L...kM.| | 3e 9a 08 cc 69 3f aa 05 35 d5 d0 d7 f7 6e 4a 60 |>...i?..5....nJ`| | f3 27 67 3d 96 3c 40 42 d1 94 38 00 09 75 47 73 |.'g=.<@B..8..uGs| | 14 74 3f 0f bb 60 3f e5 54 69 e9 2c 0d 27 12 fc |.t?..`?.Ti.,.'..| | 84 73 65 67 b9 c0 f3 72 d3 c8 70 db 14 8c 77 14 |.seg...r..p...w.| | b9 a4 62 9d 9a fb 3f 56 0e 96 6f ff 61 be ff 80 |..b...?V..o.a...| | 95 47 c5 a3 9c 5a 73 3c 27 c6 6f f7 15 bd 2f 12 |.G...Zs<'.o.../.| | 3d 26 23 42 b5 35 e5 1a 7e 85 21 ea b3 45 2f a6 |=&#B.5..~.!..E/.| | 73 06 d6 0d 28 33 82 13 de 53 f8 61 13 09 9f e0 |s...(3...S.a....| | 85 8f b7 73 56 e2 ba f4 97 31 45 d9 a2 b8 a6 0f |...sV....1E.....| Plaintext[384]: | 21 d5 ef cf b8 85 d2 01 48 54 54 50 2f 31 2e 31 |!.......HTTP/1.1| | 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:| | 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da| | 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep | | 32 30 31 33 20 31 39 3a 35 35 3a 31 32 20 47 4d |2013 19:55:12 GM| | 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:| | 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont| | 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.| | 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo| | 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu| | 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00| | 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach| | 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca| | 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 30 39 |che....0x00,0x09| | 20 2d 20 44 45 53 2d 43 42 43 2d 53 48 41 20 20 | - DES-CBC-SHA | | 20 20 20 20 20 20 20 20 20 20 20 53 53 4c 76 33 | SSLv3| | 20 4b 78 3d 52 53 41 20 20 20 20 20 20 41 75 3d | Kx=RSA Au=| | 52 53 41 20 20 45 6e 63 3d 44 45 53 28 35 36 29 |RSA Enc=DES(56)| | 20 20 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 | Mac=SHA1document.doma| | 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek| | 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'g.&.Sh.M..a.| | 08 13 d8 79 3a 36 a2 0a 07 07 07 07 07 07 07 07 |...y:6..........| ssl_decrypt_record found padding 7 final len 376 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | a3 fa 92 45 d4 13 d8 bb 5e 86 a6 3e 2b ab 10 05 |...E....^..>+...| | 66 af 62 d4 |f.b. | ssl_decrypt_record: mac failed association_find: TCP port 4440 found 0x342d040 dissect_ssl enter frame #102 (first time) conversation = 0x7facef997270, ssl_session = 0x7facc381d630 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | ca cd 98 23 77 ce f4 50 c2 57 19 9c 6a 94 96 83 |...#w..P.W..j...| | da e8 13 d1 6c be f0 4d e4 7e d9 86 d3 d0 00 5b |....l..M.~.....[| Plaintext[32]: | 6e ab 83 3a 0c 6a 54 72 01 00 7b 75 cf dc 51 f7 |n..:.jTr..{u..Q.| | 5f 4a de 1b 15 82 02 fd ce 0e e2 86 e7 eb 01 01 |_J..............| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 7b 75 cf dc 51 f7 5f 4a de 1b 15 82 02 fd ce 0e |{u..Q._J........| | e2 86 e7 eb |.... | ssl_decrypt_record: mac ok dissect_ssl enter frame #104 (first time) conversation = 0x7facef997270, ssl_session = 0x7facc381d630 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | d4 57 0a 93 7f ed 1e ca 54 06 8d 5c de 13 74 43 |.W......T..\..tC| | 6f 98 56 8f 55 8e 7c cb a0 80 21 38 ce ce f8 b9 |o.V.U.|...!8....| Plaintext[32]: | f2 89 20 50 3a 5d a2 8a 01 00 6c 47 5d 5a 84 c2 |.. P:]....lG]Z..| | 11 a8 4e 93 b7 2f 0e 46 2c 9d 58 91 e2 db 01 01 |..N../.F,.X.....| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 6c 47 5d 5a 84 c2 11 a8 4e 93 b7 2f 0e 46 2c 9d |lG]Z....N../.F,.| | 58 91 e2 db |X... | ssl_decrypt_record: mac ok dissect_ssl enter frame #109 (first time) ssl_session_init: initializing ptr 0x7facc381fbf0 size 688 conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 55756 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4441 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #111 (first time) conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0 record: offset = 0, reported_length_remaining = 884 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x000A -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 6c 1f da 51 57 81 df 01 9e 94 ea f5 8e 72 48 dc |l..QW........rH.| | c2 2c 12 dc 04 5c 57 5a 37 ef 3a 71 39 2d 95 99 |.,...\WZ7.:q9-..| | a6 f6 17 bc c1 54 e7 3d 17 f1 f6 91 c3 ef 3d a7 |.....T.=......=.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 20 ec ae 5e 1e 08 83 3f 0f 67 6e cb 98 3f fc c8 | ..^...?.gn..?..| | c2 ed 34 c1 36 35 1a 6e 16 14 f3 bf 0c 52 34 bf |..4.65.n.....R4.| | 20 55 1b 2b 34 3b 58 88 41 66 88 fc 84 d8 de 28 | U.+4;X.Af.....(| | 44 e7 ce 19 ec c6 46 ca b8 31 dd f9 4b |D.....F..1..K | hash out[104]: | 0a de 8b dd 14 fe 08 16 79 a4 a0 a8 2f ae 21 a2 |........y.../.!.| | fa b9 33 be f5 77 31 d2 e3 59 16 50 ad 49 44 c2 |..3..w1..Y.P.ID.| | d7 ff bf 83 23 11 02 07 56 80 49 52 75 8a b0 66 |....#...V.IRu..f| | 66 5b d7 9e 3a 1a 20 6d 71 5b 66 e7 ed 85 85 05 |f[..:. mq[f.....| | 87 4a cf c1 f0 b4 99 3c f5 d0 b4 5c d4 65 57 ef |.J.....<...\.eW.| | 71 d1 72 d9 4e 7f 17 33 8d 60 74 7d c3 94 cd 02 |q.r.N..3.`t}....| | be ee 5c 28 3a a0 89 f8 |..\(:... | PRF out[104]: | 0a de 8b dd 14 fe 08 16 79 a4 a0 a8 2f ae 21 a2 |........y.../.!.| | fa b9 33 be f5 77 31 d2 e3 59 16 50 ad 49 44 c2 |..3..w1..Y.P.ID.| | d7 ff bf 83 23 11 02 07 56 80 49 52 75 8a b0 66 |....#...V.IRu..f| | 66 5b d7 9e 3a 1a 20 6d 71 5b 66 e7 ed 85 85 05 |f[..:. mq[f.....| | 87 4a cf c1 f0 b4 99 3c f5 d0 b4 5c d4 65 57 ef |.J.....<...\.eW.| | 71 d1 72 d9 4e 7f 17 33 8d 60 74 7d c3 94 cd 02 |q.r.N..3.`t}....| | be ee 5c 28 3a a0 89 f8 |..\(:... | key expansion[104]: | 0a de 8b dd 14 fe 08 16 79 a4 a0 a8 2f ae 21 a2 |........y.../.!.| | fa b9 33 be f5 77 31 d2 e3 59 16 50 ad 49 44 c2 |..3..w1..Y.P.ID.| | d7 ff bf 83 23 11 02 07 56 80 49 52 75 8a b0 66 |....#...V.IRu..f| | 66 5b d7 9e 3a 1a 20 6d 71 5b 66 e7 ed 85 85 05 |f[..:. mq[f.....| | 87 4a cf c1 f0 b4 99 3c f5 d0 b4 5c d4 65 57 ef |.J.....<...\.eW.| | 71 d1 72 d9 4e 7f 17 33 8d 60 74 7d c3 94 cd 02 |q.r.N..3.`t}....| | be ee 5c 28 3a a0 89 f8 |..\(:... | Client MAC key[20]: | 0a de 8b dd 14 fe 08 16 79 a4 a0 a8 2f ae 21 a2 |........y.../.!.| | fa b9 33 be |..3. | Server MAC key[20]: | f5 77 31 d2 e3 59 16 50 ad 49 44 c2 d7 ff bf 83 |.w1..Y.P.ID.....| | 23 11 02 07 |#... | Client Write key[24]: | 56 80 49 52 75 8a b0 66 66 5b d7 9e 3a 1a 20 6d |V.IRu..ff[..:. m| | 71 5b 66 e7 ed 85 85 05 |q[f..... | Server Write key[24]: | 87 4a cf c1 f0 b4 99 3c f5 d0 b4 5c d4 65 57 ef |.J.....<...\.eW.| | 71 d1 72 d9 4e 7f 17 33 |q.r.N..3 | Client Write IV[8]: | 8d 60 74 7d c3 94 cd 02 |.`t}.... | Server Write IV[8]: | be ee 5c 28 3a a0 89 f8 |..\(:... | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 821 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884 dissect_ssl enter frame #113 (first time) conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0 record: offset = 0, reported_length_remaining = 326 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 262, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ec... looking for RSA pre-master002f09b09d0de0dba351fcefb17adf42995c476d0a2bd37f... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | d0 17 98 30 78 3d 4c df f6 19 67 c0 a2 58 33 2d |...0x=L...g..X3-| | b6 8e 2f bd c1 2f ef c3 09 3b 0e a2 3d d3 98 47 |../../...;..=..G| | a9 40 b4 58 43 b7 e5 08 93 e6 e7 89 2a 2a c6 b7 |.@.XC.......**..| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 20 ec ae 5e 1e 08 83 3f 0f 67 6e cb 98 3f fc c8 | ..^...?.gn..?..| | c2 ed 34 c1 36 35 1a 6e 16 14 f3 bf 0c 52 34 bf |..4.65.n.....R4.| | 20 55 1b 2b 34 3b 58 88 41 66 88 fc 84 d8 de 28 | U.+4;X.Af.....(| | 44 e7 ce 19 ec c6 46 ca b8 31 dd f9 4b |D.....F..1..K | hash out[104]: | b3 c2 f0 17 24 e9 9f 3e 4a 35 ca da 43 03 f0 45 |....$..>J5..C..E| | bb c3 cf 9a 7f 21 90 ac e3 02 ff cc 96 a7 2c 86 |.....!........,.| | 98 44 b6 06 b2 54 66 cb 5f 49 2c 8d 04 b9 bf c1 |.D...Tf._I,.....| | 43 98 17 73 f1 65 a7 86 dc 5c ad 8d 68 6c a4 de |C..s.e...\..hl..| | 8a 73 e9 6a 67 c1 71 af 73 e7 fb ff 67 e6 93 a8 |.s.jg.q.s...g...| | 06 2a ad a5 bd 2b a6 20 1b d1 5a 49 1c 45 59 6b |.*...+. ..ZI.EYk| | 85 05 60 cf 69 91 56 a7 |..`.i.V. | PRF out[104]: | b3 c2 f0 17 24 e9 9f 3e 4a 35 ca da 43 03 f0 45 |....$..>J5..C..E| | bb c3 cf 9a 7f 21 90 ac e3 02 ff cc 96 a7 2c 86 |.....!........,.| | 98 44 b6 06 b2 54 66 cb 5f 49 2c 8d 04 b9 bf c1 |.D...Tf._I,.....| | 43 98 17 73 f1 65 a7 86 dc 5c ad 8d 68 6c a4 de |C..s.e...\..hl..| | 8a 73 e9 6a 67 c1 71 af 73 e7 fb ff 67 e6 93 a8 |.s.jg.q.s...g...| | 06 2a ad a5 bd 2b a6 20 1b d1 5a 49 1c 45 59 6b |.*...+. ..ZI.EYk| | 85 05 60 cf 69 91 56 a7 |..`.i.V. | key expansion[104]: | b3 c2 f0 17 24 e9 9f 3e 4a 35 ca da 43 03 f0 45 |....$..>J5..C..E| | bb c3 cf 9a 7f 21 90 ac e3 02 ff cc 96 a7 2c 86 |.....!........,.| | 98 44 b6 06 b2 54 66 cb 5f 49 2c 8d 04 b9 bf c1 |.D...Tf._I,.....| | 43 98 17 73 f1 65 a7 86 dc 5c ad 8d 68 6c a4 de |C..s.e...\..hl..| | 8a 73 e9 6a 67 c1 71 af 73 e7 fb ff 67 e6 93 a8 |.s.jg.q.s...g...| | 06 2a ad a5 bd 2b a6 20 1b d1 5a 49 1c 45 59 6b |.*...+. ..ZI.EYk| | 85 05 60 cf 69 91 56 a7 |..`.i.V. | Client MAC key[20]: | b3 c2 f0 17 24 e9 9f 3e 4a 35 ca da 43 03 f0 45 |....$..>J5..C..E| | bb c3 cf 9a |.... | Server MAC key[20]: | 7f 21 90 ac e3 02 ff cc 96 a7 2c 86 98 44 b6 06 |.!........,..D..| | b2 54 66 cb |.Tf. | Client Write key[24]: | 5f 49 2c 8d 04 b9 bf c1 43 98 17 73 f1 65 a7 86 |_I,.....C..s.e..| | dc 5c ad 8d 68 6c a4 de |.\..hl.. | Server Write key[24]: | 8a 73 e9 6a 67 c1 71 af 73 e7 fb ff 67 e6 93 a8 |.s.jg.q.s...g...| | 06 2a ad a5 bd 2b a6 20 |.*...+. | Client Write IV[8]: | 1b d1 5a 49 1c 45 59 6b |..ZI.EYk | Server Write IV[8]: | 85 05 60 cf 69 91 56 a7 |..`.i.V. | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | d0 17 98 30 78 3d 4c df f6 19 67 c0 a2 58 33 2d |...0x=L...g..X3-| | b6 8e 2f bd c1 2f ef c3 09 3b 0e a2 3d d3 98 47 |../../...;..=..G| | a9 40 b4 58 43 b7 e5 08 93 e6 e7 89 2a 2a c6 b7 |.@.XC.......**..| dissect_ssl3_handshake session keys successfully generated record: offset = 267, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 273, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 64 d7 01 47 6d 68 ac be 80 ef 6a f6 0b 3e 38 2c |d..Gmh....j..>8,| | 2d 5c d7 1d f4 4d cc e3 09 c3 4c f6 5b fe d0 fd |-\...M....L.[...| | 9d e9 49 c3 a0 80 56 6c c4 b4 b8 a0 25 e3 00 e0 |..I...Vl....%...| Plaintext[48]: | 53 a9 17 8a a6 e5 f7 a2 14 00 00 0c 0b 5c 4f c2 |S............\O.| | 41 06 37 83 4a 3b 8e af cd 23 af 7a 24 a1 0e 71 |A.7.J;...#.z$..q| | 9b d0 6a 0f 9a 5e a3 5c 8c 27 ff 35 03 03 03 03 |..j..^.\.'.5....| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | cd 23 af 7a 24 a1 0e 71 9b d0 6a 0f 9a 5e a3 5c |.#.z$..q..j..^.\| | 8c 27 ff 35 |.'.5 | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #114 (first time) conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0 record: offset = 0, reported_length_remaining = 234 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 47 5b eb de 90 8a 3d 10 98 da 79 32 f8 f7 fd 75 |G[....=...y2...u| | e9 03 0a 06 8d f6 f9 84 c8 ad b5 25 42 4f 10 42 |...........%BO.B| | 30 56 21 8e a6 18 bb c9 ef 7d 32 87 c6 e9 c4 b5 |0V!......}2.....| Plaintext[48]: | c0 f9 b0 90 c3 2d ad 4a 14 00 00 0c 97 aa 11 89 |.....-.J........| | 33 79 e3 13 5d 72 87 f0 76 41 81 af 18 ed 8d cd |3y..]r..vA......| | 09 9d ac dc 72 fa fc bb 47 13 bf 45 03 03 03 03 |....r...G..E....| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 76 41 81 af 18 ed 8d cd 09 9d ac dc 72 fa fc bb |vA..........r...| | 47 13 bf 45 |G..E | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #115 (first time) conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0 record: offset = 0, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 96, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 96 Ciphertext[96]: | 73 db bd d6 64 e3 d7 0a 0c 4a fb b6 24 c2 2a d4 |s...d....J..$.*.| | ca 9a ec 15 0b b0 47 20 2d 76 60 b1 dd 66 45 5c |......G -v`..fE\| | 58 f0 07 b7 47 3a 6f a2 45 90 4d fd 30 99 3f 32 |X...G:o.E.M.0.?2| | 43 84 88 47 59 57 2e af 6b c4 0f d9 52 18 5e e7 |C..GYW..k...R.^.| | ed 4b 97 52 f9 b4 51 4f 8f 3d 5a 68 9d 76 b1 76 |.K.R..QO.=Zh.v.v| | 66 16 b4 1e d1 a3 a9 c7 9f 14 33 4e 38 cd c8 6d |f.........3N8..m| Plaintext[96]: | fd 0c 83 39 38 9b 82 b9 47 45 54 20 2f 20 48 54 |...98...GET / HT| | 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 64 65 |TP/1.1..Host: de| | 73 2d 63 62 63 33 2d 73 68 61 2e 6c 6f 63 61 6c |s-cbc3-sha.local| | 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n| | 6c 3a 34 34 34 31 0d 0a 0d 0a 7d 31 90 11 1e d5 |l:4441....}1....| | a6 6e 98 a1 8d 51 2c 1f 9f 47 cd a1 6d d5 01 01 |.n...Q,..G..m...| ssl_decrypt_record found padding 1 final len 94 checking mac (len 66, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | af 05 67 d6 7c 43 c7 1b 65 34 9d 67 d4 5e 20 eb |..g.|C..e4.g.^ .| | e7 e6 ac 49 |...I | ssl_decrypt_record: mac failed association_find: TCP port 55756 found (nil) association_find: TCP port 4441 found 0x342d0d0 dissect_ssl enter frame #116 (first time) conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | 81 25 d4 59 0f 03 bc 3c ad 17 b0 01 a8 10 56 03 |.%.Y...<......V.| | 1e 2c 32 67 45 34 8b f8 66 8c 52 52 51 ed 13 b0 |.,2gE4..f.RRQ...| | 23 bc 36 78 3e e4 2d 0d a1 23 be 97 6b 19 6b 14 |#.6x>.-..#..k.k.| | 58 da d3 0f 12 17 aa 56 50 c8 aa 5b 7c 6f 2c 7f |X......VP..[|o,.| | cd 77 2a d5 a6 93 9e 1e 8f 1a cb 07 67 0d 8b 52 |.w*.........g..R| | 90 2a 52 c6 c2 d1 67 80 6a 1d 21 89 ec f1 3e ad |.*R...g.j.!...>.| | d8 33 fa 93 a2 b0 de b2 7d af 36 19 a3 6a 3b e5 |.3......}.6..j;.| | 51 d9 df 6c 7d 08 eb 92 a5 a9 ca ac 59 aa e4 59 |Q..l}.......Y..Y| | 15 63 e7 7f f4 79 b8 59 a5 e8 f6 3c cd c8 1c 60 |.c...y.Y...<...`| | 7d 0e ce b0 75 6b 5c cb d3 36 20 ea 0b 6c 6f 1c |}...uk\..6 ..lo.| | 63 21 7b 1c 2c 3c 21 c4 da 10 5b c5 eb 83 5f ae |c!{.,9.........I.| | 28 08 1f 96 61 38 05 e9 a1 06 9c 46 61 6b 08 00 |(...a8.....Fak..| | f1 e1 4d 50 e9 7f 9e 27 c4 46 06 3e 0c 7e ff 07 |..MP...'.F.>.~..| | 1f f7 c4 4c 24 5f 5f 94 0c 97 de 1a 66 f4 09 9f |...L$__.....f...| | 75 14 17 cb a4 3e 61 35 ec e7 8b 63 61 4e bc 96 |u....>a5...caN..| | 8e d3 d1 8f 8d 19 f8 f4 cf 7b ec 7a d6 f7 02 45 |.........{.z...E| | 1a bc 66 28 6e 45 5c 07 fe dd ee 3a d8 06 8a 0b |..f(nE\....:....| Plaintext[384]: | d7 87 da 2c b6 ac a8 e6 48 54 54 50 2f 31 2e 31 |...,....HTTP/1.1| | 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:| | 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da| | 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep | | 32 30 31 33 20 31 39 3a 35 35 3a 31 32 20 47 4d |2013 19:55:12 GM| | 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:| | 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont| | 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.| | 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo| | 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu| | 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00| | 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach| | 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca| | 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 30 41 |che....0x00,0x0A| | 20 2d 20 44 45 53 2d 43 42 43 33 2d 53 48 41 20 | - DES-CBC3-SHA | | 20 20 20 20 20 20 20 20 20 20 20 53 53 4c 76 33 | SSLv3| | 20 4b 78 3d 52 53 41 20 20 20 20 20 20 41 75 3d | Kx=RSA Au=| | 52 53 41 20 20 45 6e 63 3d 33 44 45 53 28 31 36 |RSA Enc=3DES(16| | 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 |8) Mac=SHA1document.doma| | 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek| | 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'...O..&...L.| | 9b c9 15 8e 1a 02 2b 6d 07 07 07 07 07 07 07 07 |......+m........| ssl_decrypt_record found padding 7 final len 376 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | a3 5d 7a ca 0d 41 2c 16 d2 05 1c 14 d2 fe b5 ff |.]z..A,.........| | c9 df da 04 |.... | ssl_decrypt_record: mac failed association_find: TCP port 4441 found 0x342d0d0 dissect_ssl enter frame #117 (first time) conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 2b 1b f6 bf 99 db 13 91 ea a9 e6 70 92 3e 80 d2 |+..........p.>..| | 29 be 4e 47 2f 5c bd 57 73 50 c5 af 0c 6d 97 0e |).NG/\.WsP...m..| Plaintext[32]: | 0e a7 12 62 90 a2 6a c8 01 00 ee 80 00 9b 9c 51 |...b..j........Q| | ed a5 c3 5b 34 71 45 b2 b1 9e a2 cf d8 91 01 01 |...[4qE.........| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | ee 80 00 9b 9c 51 ed a5 c3 5b 34 71 45 b2 b1 9e |.....Q...[4qE...| | a2 cf d8 91 |.... | ssl_decrypt_record: mac ok dissect_ssl enter frame #119 (first time) conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 58 4f 72 ed 2c 1f 62 60 69 57 1c ad b9 72 0b 3c |XOr.,.b`iW...r.<| | 6e 15 79 a3 b9 85 e2 0e 0d 6c 8a a3 aa e7 07 3c |n.y......l.....<| Plaintext[32]: | e1 ef 85 ff bb 67 17 3e 01 00 74 b7 63 97 30 e2 |.....g.>..t.c.0.| | 31 6a e0 09 a2 b4 95 b8 d0 e5 aa 60 ef 72 01 01 |1j.........`.r..| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 74 b7 63 97 30 e2 31 6a e0 09 a2 b4 95 b8 d0 e5 |t.c.0.1j........| | aa 60 ef 72 |.`.r | ssl_decrypt_record: mac ok dissect_ssl enter frame #124 (first time) ssl_session_init: initializing ptr 0x7facc3822170 size 688 conversation = 0x7facef9977c0, ssl_session = 0x7facc3822170 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 47475 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4443 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #126 (first time) conversation = 0x7facef9977c0, ssl_session = 0x7facc3822170 record: offset = 0, reported_length_remaining = 1134 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0012 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | d0 17 98 30 78 3d 4c df f6 19 67 c0 a2 58 33 2d |...0x=L...g..X3-| | b6 8e 2f bd c1 2f ef c3 09 3b 0e a2 3d d3 98 47 |../../...;..=..G| | a9 40 b4 58 43 b7 e5 08 93 e6 e7 89 2a 2a c6 b7 |.@.XC.......**..| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 21 e2 e9 62 ea 05 3b 39 5a 34 50 b6 73 74 c6 8b |!..b..;9Z4P.st..| | 10 d9 74 c3 ea f2 38 d4 75 26 d3 a1 22 52 34 bf |..t...8.u&.."R4.| | 21 f0 ba 1b d8 02 1a 6d a9 e7 c7 57 7f a3 00 a2 |!......m...W....| | 41 ae a0 40 96 0f fe 8a da 41 d1 19 24 |A..@.....A..$ | hash out[72]: | 39 3b d5 67 7b 2a 68 fa 95 6c ee 99 17 62 56 38 |9;.g{*h..l...bV8| | 2f ca 44 6d 3a 09 14 d8 cc 41 5b 87 84 18 51 0d |/.Dm:....A[...Q.| | fa 6b 1a c1 d2 dd ee 99 ae 7e 55 f1 46 cc 7f 2f |.k.......~U.F../| | a6 48 c3 fe e6 7c 70 ed 2e 80 8f 37 fc 81 8c 65 |.H...|p....7...e| | aa 79 50 4b fd 88 01 28 |.yPK...( | PRF out[72]: | 39 3b d5 67 7b 2a 68 fa 95 6c ee 99 17 62 56 38 |9;.g{*h..l...bV8| | 2f ca 44 6d 3a 09 14 d8 cc 41 5b 87 84 18 51 0d |/.Dm:....A[...Q.| | fa 6b 1a c1 d2 dd ee 99 ae 7e 55 f1 46 cc 7f 2f |.k.......~U.F../| | a6 48 c3 fe e6 7c 70 ed 2e 80 8f 37 fc 81 8c 65 |.H...|p....7...e| | aa 79 50 4b fd 88 01 28 |.yPK...( | key expansion[72]: | 39 3b d5 67 7b 2a 68 fa 95 6c ee 99 17 62 56 38 |9;.g{*h..l...bV8| | 2f ca 44 6d 3a 09 14 d8 cc 41 5b 87 84 18 51 0d |/.Dm:....A[...Q.| | fa 6b 1a c1 d2 dd ee 99 ae 7e 55 f1 46 cc 7f 2f |.k.......~U.F../| | a6 48 c3 fe e6 7c 70 ed 2e 80 8f 37 fc 81 8c 65 |.H...|p....7...e| | aa 79 50 4b fd 88 01 28 |.yPK...( | Client MAC key[20]: | 39 3b d5 67 7b 2a 68 fa 95 6c ee 99 17 62 56 38 |9;.g{*h..l...bV8| | 2f ca 44 6d |/.Dm | Server MAC key[20]: | 3a 09 14 d8 cc 41 5b 87 84 18 51 0d fa 6b 1a c1 |:....A[...Q..k..| | d2 dd ee 99 |.... | Client Write key[8]: | ae 7e 55 f1 46 cc 7f 2f |.~U.F../ | Server Write key[8]: | a6 48 c3 fe e6 7c 70 ed |.H...|p. | Client Write IV[8]: | 2e 80 8f 37 fc 81 8c 65 |...7...e | Server Write IV[8]: | aa 79 50 4b fd 88 01 28 |.yPK...( | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 1071 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 735, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803 record: offset = 803, reported_length_remaining = 331 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 808 length 313 bytes, remaining 1125 record: offset = 1125, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1130 length 0 bytes, remaining 1134 dissect_ssl enter frame #128 (first time) conversation = 0x7facef9977c0, ssl_session = 0x7facc3822170 record: offset = 0, reported_length_remaining = 198 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea04096... looking for RSA pre-master0080b8603544edfde42c437eb40569d8924b670069534998... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 9e 19 2b 69 f9 61 2e 65 7b d0 c5 4b 0a ba 9c d8 |..+i.a.e{..K....| | df dc f7 84 88 1c 06 b5 16 44 0c 12 c6 bd 4b 45 |.........D....KE| | 18 b6 eb a8 da 1d 61 1b a5 bd 1a c4 81 c7 e2 39 |......a........9| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 21 e2 e9 62 ea 05 3b 39 5a 34 50 b6 73 74 c6 8b |!..b..;9Z4P.st..| | 10 d9 74 c3 ea f2 38 d4 75 26 d3 a1 22 52 34 bf |..t...8.u&.."R4.| | 21 f0 ba 1b d8 02 1a 6d a9 e7 c7 57 7f a3 00 a2 |!......m...W....| | 41 ae a0 40 96 0f fe 8a da 41 d1 19 24 |A..@.....A..$ | hash out[72]: | b7 d8 7c b4 88 f8 58 ac 73 d4 d0 25 99 03 69 55 |..|...X.s..%..iU| | 44 8a 03 a7 a9 07 e8 e8 db d7 87 10 a5 c3 72 08 |D.............r.| | 28 4d b0 4c 65 40 0d a2 c0 9e 03 fc 60 02 8f 26 |(M.Le@......`..&| | 3c 51 cd a9 2f 0d 6f 76 1d bb e0 92 17 48 aa 0e |]..&.....P.| | 83 f2 ba 23 37 68 7d 72 7f 7e d0 48 a8 3f 6b 0e |...#7h}r.~.H.?k.| | 12 f9 57 e4 ad 57 0f 59 02 a9 d5 a2 99 f5 c8 1c |..W..W.Y........| | 90 84 2c ff 97 be 29 57 1d 16 ee 21 e2 f3 1f ae |..,...)W...!....| | f5 25 0f 1a df 9b 85 ca |.%...... | Plaintext[104]: | 0f b6 f3 e9 59 cb de b5 47 45 54 20 2f 20 48 54 |....Y...GET / HT| | 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 64 |TP/1.1..Host: ed| | 68 2d 64 73 73 2d 64 65 73 2d 63 62 63 2d 73 68 |h-dss-des-cbc-sh| | 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |a.local.al.leken| | 73 74 65 79 6e 2e 6e 6c 3a 34 34 34 33 0d 0a 0d |steyn.nl:4443...| | 0a 30 b3 29 3d e2 4e 08 46 ce e8 51 6a 61 77 c2 |.0.)=.N.F..Qjaw.| | bc 6a b4 9b 16 02 02 02 |.j...... | ssl_decrypt_record found padding 2 final len 101 checking mac (len 73, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 38 8e cb 90 10 df af 98 1b 8d 0c 1c 56 f1 5a f0 |8...........V.Z.| | 04 a4 50 46 |..PF | ssl_decrypt_record: mac failed association_find: TCP port 47475 found (nil) association_find: TCP port 4443 found 0x342da70 dissect_ssl enter frame #131 (first time) conversation = 0x7facef9977c0, ssl_session = 0x7facc3822170 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | 33 5f 3a 79 09 d7 bd 7b 84 37 ea 25 af ee e3 ad |3_:y...{.7.%....| | ad bf 90 af 9c 41 19 76 ba 56 71 12 3d 40 01 8f |.....A.v.Vq.=@..| | 79 b0 66 a4 21 6e 40 d1 d9 22 12 61 72 43 66 f2 |y.f.!n@..".arCf.| | c1 d2 40 ba 47 ce bb 41 bc cb 61 d5 fc ed a9 81 |..@.G..A..a.....| | 8c 02 fb e2 1a 21 8a 04 25 31 d4 d8 b4 38 8c ae |.....!..%1...8..| | 28 47 dd 21 9b a6 02 ed 43 9a 3e 47 a4 31 34 2d |(G.!....C.>G.14-| | be 83 2b 8e f5 86 f8 fb d6 30 0e 17 31 c2 83 a4 |..+......0..1...| | 44 92 8b 7b d6 0a bf 07 bc 64 70 1b 51 0b 7f fa |D..{.....dp.Q...| | 5d 9a da 3a 90 54 87 e8 d2 7d 4f 03 5b 1b d3 01 |]..:.T...}O.[...| | fe e9 ea 78 37 39 c0 3a 97 a8 c3 78 75 46 66 a1 |...x79.:...xuFf.| | eb b9 b7 52 9d 51 b3 b0 5d 1c 9b 10 45 41 c3 33 |...R.Q..]...EA.3| | 64 2e 0b 3a 80 f1 ca db be eb 96 e2 b7 d2 d2 52 |d..:...........R| | 52 ba bb df 71 54 b7 22 af ba 05 6f b5 76 5d dc |R...qT."...o.v].| | c5 f6 73 fc ea cf 02 c6 7a 7d c1 4e 3f 50 72 83 |..s.....z}.N?Pr.| | c4 ca 31 87 50 ae d7 ac c5 9f 28 9a 5d f8 76 a4 |..1.P.....(.].v.| | c6 b2 f4 75 a2 a9 d1 f0 7f 6c fe 88 90 0a 90 61 |...u.....l.....a| | 7e 44 96 df bd de 2d 12 cd 35 b1 90 b6 20 c3 69 |~D....-..5... .i| | f8 81 19 80 7b 95 4b f7 a0 a1 f6 bd 45 23 ef 34 |....{.K.....E#.4| | d8 ed 6f 7e 1c 3d b4 22 98 37 d1 0a 53 e2 e5 22 |..o~.=.".7..S.."| | 9e 15 02 ad a0 80 dd 75 6a aa 0a ff 45 fd f0 e4 |.......uj...E...| | 43 7c b8 21 5f a1 90 25 d3 d5 9e 94 07 e4 fe 59 |C|.!_..%.......Y| | fd 2d b7 48 42 8e 69 cb 94 f7 28 fc 19 51 ff 68 |.-.HB.i...(..Q.h| | b8 8d 3f ab b7 1f 8c 56 d5 ee ed 51 e6 9c 88 b9 |..?....V...Q....| | 85 62 9f 03 f5 7c 4b 96 97 33 03 e6 16 3c e7 1e |.b...|K..3...<..| Plaintext[384]: | b8 c5 19 0e 41 d7 91 e7 48 54 54 50 2f 31 2e 31 |....A...HTTP/1.1| | 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:| | 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da| | 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep | | 32 30 31 33 20 31 39 3a 35 35 3a 31 33 20 47 4d |2013 19:55:13 GM| | 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:| | 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont| | 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.| | 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo| | 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu| | 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00| | 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach| | 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca| | 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 31 32 |che....0x00,0x12| | 20 2d 20 45 44 48 2d 44 53 53 2d 44 45 53 2d 43 | - EDH-DSS-DES-C| | 42 43 2d 53 48 41 20 20 20 20 20 53 53 4c 76 33 |BC-SHA SSLv3| | 20 4b 78 3d 44 48 20 20 20 20 20 20 20 41 75 3d | Kx=DH Au=| | 44 53 53 20 20 45 6e 63 3d 44 45 53 28 35 36 29 |DSS Enc=DES(56)| | 20 20 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 | Mac=SHA1document.doma| | 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek| | 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl' .83...B...o| | cb ac 11 16 62 65 d9 77 07 07 07 07 07 07 07 07 |....be.w........| ssl_decrypt_record found padding 7 final len 376 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 58 1b 47 bf a2 88 97 eb 49 d3 35 9c fc a1 4d 5c |X.G.....I.5...M\| | 87 07 38 48 |..8H | ssl_decrypt_record: mac failed association_find: TCP port 4443 found 0x342da70 dissect_ssl enter frame #132 (first time) conversation = 0x7facef9977c0, ssl_session = 0x7facc3822170 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 6c 54 ca a5 84 57 b5 d7 ea 2e 7a 6e 19 22 f0 6a |lT...W....zn.".j| | 3c 55 3f 0a 23 81 3b 04 3e ef cc b8 8f 3f b9 71 |....?.q| Plaintext[32]: | 7c cf ac eb eb 9f a8 1c 01 00 a8 98 04 64 39 d7 ||............d9.| | 7a e9 a5 36 a7 56 6a 02 01 53 eb 29 76 e9 01 01 |z..6.Vj..S.)v...| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | a8 98 04 64 39 d7 7a e9 a5 36 a7 56 6a 02 01 53 |...d9.z..6.Vj..S| | eb 29 76 e9 |.)v. | ssl_decrypt_record: mac ok dissect_ssl enter frame #134 (first time) conversation = 0x7facef9977c0, ssl_session = 0x7facc3822170 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 61 19 65 f7 6a d4 16 67 e4 22 76 29 6d 87 2b 0a |a.e.j..g."v)m.+.| | d3 55 54 ad c6 3f 72 9d 94 79 af 92 66 42 d5 75 |.UT..?r..y..fB.u| Plaintext[32]: | d8 42 0a 0d 6e b2 ea ce 01 00 e1 70 ad 00 81 93 |.B..n......p....| | 0c ce bb b9 3e ad 2c f7 25 4f 35 d4 84 a4 01 01 |....>.,.%O5.....| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | e1 70 ad 00 81 93 0c ce bb b9 3e ad 2c f7 25 4f |.p........>.,.%O| | 35 d4 84 a4 |5... | ssl_decrypt_record: mac ok dissect_ssl enter frame #139 (first time) ssl_session_init: initializing ptr 0x7facc3824670 size 688 conversation = 0x7facef997a68, ssl_session = 0x7facc3824670 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 60402 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4444 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #141 (first time) conversation = 0x7facef997a68, ssl_session = 0x7facc3824670 record: offset = 0, reported_length_remaining = 1134 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0013 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 9e 19 2b 69 f9 61 2e 65 7b d0 c5 4b 0a ba 9c d8 |..+i.a.e{..K....| | df dc f7 84 88 1c 06 b5 16 44 0c 12 c6 bd 4b 45 |.........D....KE| | 18 b6 eb a8 da 1d 61 1b a5 bd 1a c4 81 c7 e2 39 |......a........9| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 21 79 0b db 99 cb b2 ff d1 81 3c d5 b4 93 e9 a6 |!y........<.....| | 51 1d 52 d0 0d 8e 33 cc ca 5b 24 56 e8 52 34 bf |Q.R...3..[$V.R4.| | 21 bd e0 54 e6 9e ac 46 0e fe 55 77 10 0d f8 21 |!..T...F..Uw...!| | f5 6e 28 c7 63 f1 8a 08 1d 0a 83 52 8f |.n(.c......R. | hash out[104]: | b3 27 43 3d ac a3 8c 5f f6 a7 8c 6a 59 78 4c d1 |.'C=..._...jYxL.| | e9 5c de 6c 37 db 48 db cb d1 5f 66 89 d3 97 bc |.\.l7.H..._f....| | 23 14 07 f3 3f 2a 98 f3 6e fa e9 c3 88 b2 28 69 |#...?*..n.....(i| | d0 1f 35 35 20 24 f3 c5 7f 7e a4 55 ef ec 5c c2 |..55 $...~.U..\.| | 0f 5b b3 f6 41 4b 63 1e e3 c6 bb ce d8 d3 7e b7 |.[..AKc.......~.| | 41 ad e2 ae b9 c7 c1 f7 fd 5a 18 31 d7 61 26 d4 |A........Z.1.a&.| | 7b fe d8 95 c1 e3 ee 61 |{......a | PRF out[104]: | b3 27 43 3d ac a3 8c 5f f6 a7 8c 6a 59 78 4c d1 |.'C=..._...jYxL.| | e9 5c de 6c 37 db 48 db cb d1 5f 66 89 d3 97 bc |.\.l7.H..._f....| | 23 14 07 f3 3f 2a 98 f3 6e fa e9 c3 88 b2 28 69 |#...?*..n.....(i| | d0 1f 35 35 20 24 f3 c5 7f 7e a4 55 ef ec 5c c2 |..55 $...~.U..\.| | 0f 5b b3 f6 41 4b 63 1e e3 c6 bb ce d8 d3 7e b7 |.[..AKc.......~.| | 41 ad e2 ae b9 c7 c1 f7 fd 5a 18 31 d7 61 26 d4 |A........Z.1.a&.| | 7b fe d8 95 c1 e3 ee 61 |{......a | key expansion[104]: | b3 27 43 3d ac a3 8c 5f f6 a7 8c 6a 59 78 4c d1 |.'C=..._...jYxL.| | e9 5c de 6c 37 db 48 db cb d1 5f 66 89 d3 97 bc |.\.l7.H..._f....| | 23 14 07 f3 3f 2a 98 f3 6e fa e9 c3 88 b2 28 69 |#...?*..n.....(i| | d0 1f 35 35 20 24 f3 c5 7f 7e a4 55 ef ec 5c c2 |..55 $...~.U..\.| | 0f 5b b3 f6 41 4b 63 1e e3 c6 bb ce d8 d3 7e b7 |.[..AKc.......~.| | 41 ad e2 ae b9 c7 c1 f7 fd 5a 18 31 d7 61 26 d4 |A........Z.1.a&.| | 7b fe d8 95 c1 e3 ee 61 |{......a | Client MAC key[20]: | b3 27 43 3d ac a3 8c 5f f6 a7 8c 6a 59 78 4c d1 |.'C=..._...jYxL.| | e9 5c de 6c |.\.l | Server MAC key[20]: | 37 db 48 db cb d1 5f 66 89 d3 97 bc 23 14 07 f3 |7.H..._f....#...| | 3f 2a 98 f3 |?*.. | Client Write key[24]: | 6e fa e9 c3 88 b2 28 69 d0 1f 35 35 20 24 f3 c5 |n.....(i..55 $..| | 7f 7e a4 55 ef ec 5c c2 |.~.U..\. | Server Write key[24]: | 0f 5b b3 f6 41 4b 63 1e e3 c6 bb ce d8 d3 7e b7 |.[..AKc.......~.| | 41 ad e2 ae b9 c7 c1 f7 |A....... | Client Write IV[8]: | fd 5a 18 31 d7 61 26 d4 |.Z.1.a&. | Server Write IV[8]: | 7b fe d8 95 c1 e3 ee 61 |{......a | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 1071 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 735, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803 record: offset = 803, reported_length_remaining = 331 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 808 length 313 bytes, remaining 1125 record: offset = 1125, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1130 length 0 bytes, remaining 1134 dissect_ssl enter frame #143 (first time) conversation = 0x7facef997a68, ssl_session = 0x7facc3824670 record: offset = 0, reported_length_remaining = 198 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763... looking for RSA pre-master00806e8987be63f656f700ba3e954714c9a88a06f035968f... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 46 9a e5 b1 4d 01 d5 cb 62 ed f7 2e d7 98 f4 1c |F...M...b.......| | 9e 6d d9 5d 66 99 b7 8b 47 a7 ce a4 7d 54 37 07 |.m.]f...G...}T7.| | 71 b3 a0 a1 74 66 8b e4 f3 e2 8f c9 2c 5d 54 d9 |q...tf......,]T.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 21 79 0b db 99 cb b2 ff d1 81 3c d5 b4 93 e9 a6 |!y........<.....| | 51 1d 52 d0 0d 8e 33 cc ca 5b 24 56 e8 52 34 bf |Q.R...3..[$V.R4.| | 21 bd e0 54 e6 9e ac 46 0e fe 55 77 10 0d f8 21 |!..T...F..Uw...!| | f5 6e 28 c7 63 f1 8a 08 1d 0a 83 52 8f |.n(.c......R. | hash out[104]: | 3d 66 f3 de 08 89 3d e0 dc cd 0e 39 68 79 2b ec |=f....=....9hy+.| | e5 0e 88 85 ae 02 2a 8b 57 bb 77 cb 20 36 42 86 |......*.W.w. 6B.| | bc ec cc f7 05 70 51 21 4d 74 91 6b 6c 13 a3 36 |.....pQ!Mt.kl..6| | bc c2 a1 42 0e 76 c1 62 95 0e b9 f3 36 f2 52 26 |...B.v.b....6.R&| | 1d 79 6d 59 93 73 af 8f 8e 8d 29 50 3c 81 74 d9 |.ymY.s....)P<.t.| | 06 72 1b 0e 85 8d bf 1b 62 d5 87 44 e9 69 99 06 |.r......b..D.i..| | 8b 78 61 c4 92 94 1a 1c |.xa..... | PRF out[104]: | 3d 66 f3 de 08 89 3d e0 dc cd 0e 39 68 79 2b ec |=f....=....9hy+.| | e5 0e 88 85 ae 02 2a 8b 57 bb 77 cb 20 36 42 86 |......*.W.w. 6B.| | bc ec cc f7 05 70 51 21 4d 74 91 6b 6c 13 a3 36 |.....pQ!Mt.kl..6| | bc c2 a1 42 0e 76 c1 62 95 0e b9 f3 36 f2 52 26 |...B.v.b....6.R&| | 1d 79 6d 59 93 73 af 8f 8e 8d 29 50 3c 81 74 d9 |.ymY.s....)P<.t.| | 06 72 1b 0e 85 8d bf 1b 62 d5 87 44 e9 69 99 06 |.r......b..D.i..| | 8b 78 61 c4 92 94 1a 1c |.xa..... | key expansion[104]: | 3d 66 f3 de 08 89 3d e0 dc cd 0e 39 68 79 2b ec |=f....=....9hy+.| | e5 0e 88 85 ae 02 2a 8b 57 bb 77 cb 20 36 42 86 |......*.W.w. 6B.| | bc ec cc f7 05 70 51 21 4d 74 91 6b 6c 13 a3 36 |.....pQ!Mt.kl..6| | bc c2 a1 42 0e 76 c1 62 95 0e b9 f3 36 f2 52 26 |...B.v.b....6.R&| | 1d 79 6d 59 93 73 af 8f 8e 8d 29 50 3c 81 74 d9 |.ymY.s....)P<.t.| | 06 72 1b 0e 85 8d bf 1b 62 d5 87 44 e9 69 99 06 |.r......b..D.i..| | 8b 78 61 c4 92 94 1a 1c |.xa..... | Client MAC key[20]: | 3d 66 f3 de 08 89 3d e0 dc cd 0e 39 68 79 2b ec |=f....=....9hy+.| | e5 0e 88 85 |.... | Server MAC key[20]: | ae 02 2a 8b 57 bb 77 cb 20 36 42 86 bc ec cc f7 |..*.W.w. 6B.....| | 05 70 51 21 |.pQ! | Client Write key[24]: | 4d 74 91 6b 6c 13 a3 36 bc c2 a1 42 0e 76 c1 62 |Mt.kl..6...B.v.b| | 95 0e b9 f3 36 f2 52 26 |....6.R& | Server Write key[24]: | 1d 79 6d 59 93 73 af 8f 8e 8d 29 50 3c 81 74 d9 |.ymY.s....)P<.t.| | 06 72 1b 0e 85 8d bf 1b |.r...... | Client Write IV[8]: | 62 d5 87 44 e9 69 99 06 |b..D.i.. | Server Write IV[8]: | 8b 78 61 c4 92 94 1a 1c |.xa..... | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 46 9a e5 b1 4d 01 d5 cb 62 ed f7 2e d7 98 f4 1c |F...M...b.......| | 9e 6d d9 5d 66 99 b7 8b 47 a7 ce a4 7d 54 37 07 |.m.]f...G...}T7.| | 71 b3 a0 a1 74 66 8b e4 f3 e2 8f c9 2c 5d 54 d9 |q...tf......,]T.| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 3d b4 f8 fb 08 61 48 c4 35 e1 28 af e7 ea 2a a9 |=....aH.5.(...*.| | 4e 3a e1 25 ff 7b 89 56 76 de b6 5b f1 e5 1c 7f |N:.%.{.Vv..[....| | 37 eb 87 25 4b d8 3c 74 5f 61 5d 07 03 e2 12 88 |7..%K.document.doma| | 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek| | 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'U|=.[1...h..| | 9e 1e 3e 8d c8 49 d9 fb 07 07 07 07 07 07 07 07 |..>..I..........| ssl_decrypt_record found padding 7 final len 376 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | e3 e5 78 6d b1 ab a3 e1 9c 04 a9 ed c1 18 47 75 |..xm..........Gu| | 57 48 1a d0 |WH.. | ssl_decrypt_record: mac failed association_find: TCP port 4444 found 0x342db00 dissect_ssl enter frame #147 (first time) conversation = 0x7facef997a68, ssl_session = 0x7facc3824670 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 46 e5 ca 45 bf 17 ae 99 1d 63 48 ac 68 a7 8f c0 |F..E.....cH.h...| | 04 85 49 77 c6 f0 2f 07 6b 2b 96 29 da fa 7f 1c |..Iw../.k+.)....| Plaintext[32]: | 2b db 5a 85 9f 08 7d 2a 01 00 3f 62 e6 81 09 83 |+.Z...}*..?b....| | a1 cb 1c a7 6d c6 77 b2 12 61 c7 b2 b0 a1 01 01 |....m.w..a......| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 3f 62 e6 81 09 83 a1 cb 1c a7 6d c6 77 b2 12 61 |?b........m.w..a| | c7 b2 b0 a1 |.... | ssl_decrypt_record: mac ok dissect_ssl enter frame #149 (first time) conversation = 0x7facef997a68, ssl_session = 0x7facc3824670 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 23 b5 78 ef 9c fd 59 77 25 f4 d1 11 9b 8a a6 4c |#.x...Yw%......L| | 3e de 4d 7c 56 4a e7 8d a1 ae 60 10 39 2d 24 3d |>.M|VJ....`.9-$=| Plaintext[32]: | d9 af 1f 9a d2 49 80 20 01 00 bf d8 8b 27 b3 fe |.....I. .....'..| | 69 fe e2 33 df ca 62 67 18 14 0d b9 2f fa 01 01 |i..3..bg..../...| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | bf d8 8b 27 b3 fe 69 fe e2 33 df ca 62 67 18 14 |...'..i..3..bg..| | 0d b9 2f fa |../. | ssl_decrypt_record: mac ok dissect_ssl enter frame #154 (first time) ssl_session_init: initializing ptr 0x7facc3826bb0 size 688 conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 34412 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4446 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #156 (first time) conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0 record: offset = 0, reported_length_remaining = 1416 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0015 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 46 9a e5 b1 4d 01 d5 cb 62 ed f7 2e d7 98 f4 1c |F...M...b.......| | 9e 6d d9 5d 66 99 b7 8b 47 a7 ce a4 7d 54 37 07 |.m.]f...G...}T7.| | 71 b3 a0 a1 74 66 8b e4 f3 e2 8f c9 2c 5d 54 d9 |q...tf......,]T.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 21 b0 8d c0 81 33 2f d1 95 4f 87 08 d9 7d 75 26 |!....3/..O...}u&| | 45 57 2e d3 b0 05 fc 6e ca fb 7d 3b 84 52 34 bf |EW.....n..};.R4.| | 21 d7 fa 17 07 4e 94 fb 73 98 4c 4a c9 10 6b e5 |!....N..s.LJ..k.| | 53 a9 68 e7 ca ac f4 95 fc 4c dc 7a ef |S.h......L.z. | hash out[72]: | e1 a2 22 1a 07 d2 8b 66 7c 4f 68 0c 25 b0 73 26 |.."....f|Oh.%.s&| | 93 de f0 19 81 3c 17 4b ea 5b 38 48 44 0b 95 49 |.....<.K.[8HD..I| | 33 e8 ed ec 28 b9 92 2c 5e be 00 1b 1d 30 f4 f0 |3...(..,^....0..| | 18 7b 14 b0 b8 28 b0 27 4a 42 80 b6 5c 6d 9a 3a |.{...(.'JB..\m.:| | 41 99 c7 67 51 18 08 6b |A..gQ..k | PRF out[72]: | e1 a2 22 1a 07 d2 8b 66 7c 4f 68 0c 25 b0 73 26 |.."....f|Oh.%.s&| | 93 de f0 19 81 3c 17 4b ea 5b 38 48 44 0b 95 49 |.....<.K.[8HD..I| | 33 e8 ed ec 28 b9 92 2c 5e be 00 1b 1d 30 f4 f0 |3...(..,^....0..| | 18 7b 14 b0 b8 28 b0 27 4a 42 80 b6 5c 6d 9a 3a |.{...(.'JB..\m.:| | 41 99 c7 67 51 18 08 6b |A..gQ..k | key expansion[72]: | e1 a2 22 1a 07 d2 8b 66 7c 4f 68 0c 25 b0 73 26 |.."....f|Oh.%.s&| | 93 de f0 19 81 3c 17 4b ea 5b 38 48 44 0b 95 49 |.....<.K.[8HD..I| | 33 e8 ed ec 28 b9 92 2c 5e be 00 1b 1d 30 f4 f0 |3...(..,^....0..| | 18 7b 14 b0 b8 28 b0 27 4a 42 80 b6 5c 6d 9a 3a |.{...(.'JB..\m.:| | 41 99 c7 67 51 18 08 6b |A..gQ..k | Client MAC key[20]: | e1 a2 22 1a 07 d2 8b 66 7c 4f 68 0c 25 b0 73 26 |.."....f|Oh.%.s&| | 93 de f0 19 |.... | Server MAC key[20]: | 81 3c 17 4b ea 5b 38 48 44 0b 95 49 33 e8 ed ec |.<.K.[8HD..I3...| | 28 b9 92 2c |(.., | Client Write key[8]: | 5e be 00 1b 1d 30 f4 f0 |^....0.. | Server Write key[8]: | 18 7b 14 b0 b8 28 b0 27 |.{...(.' | Client Write IV[8]: | 4a 42 80 b6 5c 6d 9a 3a |JB..\m.: | Server Write IV[8]: | 41 99 c7 67 51 18 08 6b |A..gQ..k | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 1353 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 541 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 527, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407 record: offset = 1407, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416 dissect_ssl enter frame #158 (first time) conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0 record: offset = 0, reported_length_remaining = 198 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7ca... looking for RSA pre-master00802a0d0f85b40a6903ecad2f96c85838fd915f30332c23... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 93 57 83 6f 16 f7 a5 bf 81 77 73 ad 7a b1 b1 12 |.W.o.....ws.z...| | 81 76 e6 9a ee b2 90 1a 5a e4 e8 d2 9d c1 76 cb |.v......Z.....v.| | e6 a2 ec 75 23 b3 7a 3d da 7a 69 4a 52 34 3a 66 |...u#.z=.ziJR4:f| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 21 b0 8d c0 81 33 2f d1 95 4f 87 08 d9 7d 75 26 |!....3/..O...}u&| | 45 57 2e d3 b0 05 fc 6e ca fb 7d 3b 84 52 34 bf |EW.....n..};.R4.| | 21 d7 fa 17 07 4e 94 fb 73 98 4c 4a c9 10 6b e5 |!....N..s.LJ..k.| | 53 a9 68 e7 ca ac f4 95 fc 4c dc 7a ef |S.h......L.z. | hash out[72]: | c9 a1 98 83 27 96 86 50 c8 37 5c ee 46 a6 34 e9 |....'..P.7\.F.4.| | ab 5c aa 99 66 4d c1 30 25 31 1f db f1 10 d5 01 |.\..fM.0%1......| | 8a c7 be e9 ed 6d bb 1d 19 6e cb 8b c1 4b be 46 |.....m...n...K.F| | 0e f1 af d3 a8 40 ab b9 5b ee 4b 96 c2 f2 fc e7 |.....@..[.K.....| | c7 34 25 2e b3 54 ed 16 |.4%..T.. | PRF out[72]: | c9 a1 98 83 27 96 86 50 c8 37 5c ee 46 a6 34 e9 |....'..P.7\.F.4.| | ab 5c aa 99 66 4d c1 30 25 31 1f db f1 10 d5 01 |.\..fM.0%1......| | 8a c7 be e9 ed 6d bb 1d 19 6e cb 8b c1 4b be 46 |.....m...n...K.F| | 0e f1 af d3 a8 40 ab b9 5b ee 4b 96 c2 f2 fc e7 |.....@..[.K.....| | c7 34 25 2e b3 54 ed 16 |.4%..T.. | key expansion[72]: | c9 a1 98 83 27 96 86 50 c8 37 5c ee 46 a6 34 e9 |....'..P.7\.F.4.| | ab 5c aa 99 66 4d c1 30 25 31 1f db f1 10 d5 01 |.\..fM.0%1......| | 8a c7 be e9 ed 6d bb 1d 19 6e cb 8b c1 4b be 46 |.....m...n...K.F| | 0e f1 af d3 a8 40 ab b9 5b ee 4b 96 c2 f2 fc e7 |.....@..[.K.....| | c7 34 25 2e b3 54 ed 16 |.4%..T.. | Client MAC key[20]: | c9 a1 98 83 27 96 86 50 c8 37 5c ee 46 a6 34 e9 |....'..P.7\.F.4.| | ab 5c aa 99 |.\.. | Server MAC key[20]: | 66 4d c1 30 25 31 1f db f1 10 d5 01 8a c7 be e9 |fM.0%1..........| | ed 6d bb 1d |.m.. | Client Write key[8]: | 19 6e cb 8b c1 4b be 46 |.n...K.F | Server Write key[8]: | 0e f1 af d3 a8 40 ab b9 |.....@.. | Client Write IV[8]: | 5b ee 4b 96 c2 f2 fc e7 |[.K..... | Server Write IV[8]: | c7 34 25 2e b3 54 ed 16 |.4%..T.. | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 93 57 83 6f 16 f7 a5 bf 81 77 73 ad 7a b1 b1 12 |.W.o.....ws.z...| | 81 76 e6 9a ee b2 90 1a 5a e4 e8 d2 9d c1 76 cb |.v......Z.....v.| | e6 a2 ec 75 23 b3 7a 3d da 7a 69 4a 52 34 3a 66 |...u#.z=.ziJR4:f| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | b3 b6 3f 49 fc 09 ff a9 48 23 89 ce eb 96 cb 40 |..?I....H#.....@| | f4 01 16 65 eb a2 9c 3b 07 06 b2 ce 19 74 84 f3 |...e...;.....t..| | fa 1d 36 49 64 a8 d9 07 9b f7 9c ee a2 6a 62 f7 |..6Id........jb.| Plaintext[48]: | 0d 58 46 d4 81 13 c3 af 14 00 00 0c a6 c3 1a 90 |.XF.............| | 66 71 e6 58 35 bf 82 67 4b 33 ee 3b 64 a4 1c 28 |fq.X5..gK3.;d..(| | 63 d1 e4 03 68 9f 8b d5 f6 a9 99 4d 03 03 03 03 |c...h......M....| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 4b 33 ee 3b 64 a4 1c 28 63 d1 e4 03 68 9f 8b d5 |K3.;d..(c...h...| | f6 a9 99 4d |...M | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #159 (first time) conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0 record: offset = 0, reported_length_remaining = 234 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | e3 a5 44 22 cf 49 d2 2c 86 74 db ca e4 89 2f eb |..D".I.,.t..../.| | 02 4d 14 46 12 6b f4 8d cd e8 e1 56 de 2c e9 b4 |.M.F.k.....V.,..| | 73 5b 3d ef 93 11 2f 22 e4 35 36 81 58 13 37 c0 |s[=.../".56.X.7.| Plaintext[48]: | 5a 53 b7 d8 09 0e 69 39 14 00 00 0c 89 dc 88 bc |ZS....i9........| | da 02 87 a9 e3 73 18 6d 8c 14 3d 07 e0 a6 ab 15 |.....s.m..=.....| | 47 60 d6 7f 57 f4 0e 6c 98 9c 03 79 03 03 03 03 |G`..W..l...y....| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 8c 14 3d 07 e0 a6 ab 15 47 60 d6 7f 57 f4 0e 6c |..=.....G`..W..l| | 98 9c 03 79 |...y | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #160 (first time) conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0 record: offset = 0, reported_length_remaining = 109 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 104, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 104 Ciphertext[104]: | 69 f8 b1 df d5 c9 14 65 da 4d dc cc cb 60 f6 70 |i......e.M...`.p| | 17 ce 72 33 63 28 75 31 47 d9 60 e7 86 1e 24 43 |..r3c(u1G.`...$C| | 1e 2f 8a 28 1c d1 af d7 62 7e 48 f7 4a 97 37 2d |./.(....b~H.J.7-| | 2c d6 31 92 cd e1 e6 aa 04 ea 83 49 6f 7e 86 e2 |,.1........Io~..| | e0 6a 91 b3 23 96 cf 14 ec 3d 74 41 ac 9b 87 ed |.j..#....=tA....| | 20 30 2b e6 4c 29 42 19 05 f9 7b 79 68 6e 6d 7a | 0+.L)B...{yhnmz| | a1 45 ab 4f 5b e0 12 5e |.E.O[..^ | Plaintext[104]: | e4 17 15 58 70 29 4b ad 47 45 54 20 2f 20 48 54 |...Xp)K.GET / HT| | 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 64 |TP/1.1..Host: ed| | 68 2d 72 73 61 2d 64 65 73 2d 63 62 63 2d 73 68 |h-rsa-des-cbc-sh| | 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |a.local.al.leken| | 73 74 65 79 6e 2e 6e 6c 3a 34 34 34 36 0d 0a 0d |steyn.nl:4446...| | 0a b7 db 5d 0e f4 87 18 bc e9 71 24 4f 65 b0 34 |...]......q$Oe.4| | 88 b9 9b f3 f4 02 02 02 |........ | ssl_decrypt_record found padding 2 final len 101 checking mac (len 73, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 4c f5 c4 9e d5 1d 75 68 cc fb 2a dd e2 ef c0 81 |L.....uh..*.....| | 11 ca 8b e4 |.... | ssl_decrypt_record: mac failed association_find: TCP port 34412 found (nil) association_find: TCP port 4446 found 0x342dc20 dissect_ssl enter frame #161 (first time) conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | 96 f2 81 e6 42 8c 20 31 a7 de b2 81 4a 35 4d 95 |....B. 1....J5M.| | 68 85 5d 50 c9 22 9c e8 0d 87 8f 3f ec 03 58 3d |h.]P.".....?..X=| | 39 b0 25 3b 99 d6 7f 3a ca 77 29 72 89 5c 3b 46 |9.%;...:.w)r.\;F| | 22 d9 13 ca 53 aa 28 bc 13 07 9a 36 db 38 3b ca |"...S.(....6.8;.| | 8a 48 a0 12 1b 90 80 38 7f 14 d8 a6 be fb 63 15 |.H.....8......c.| | 12 56 44 dd 21 5a 6e 36 1a fb 12 b0 ae 9c 4b a3 |.VD.!Zn6......K.| | b3 2f e9 42 d1 e9 48 45 ec 26 91 52 01 dc fa a6 |./.B..HE.&.R....| | 58 1e 0f 49 b0 cd 7d d0 99 f0 e1 86 43 c6 f8 84 |X..I..}.....C...| | f2 7a f9 31 c5 cb d6 3d 55 f9 81 e2 cf 33 3f 66 |.z.1...=U....3?f| | 23 af 96 71 ab 28 9d c9 42 99 7a 33 f9 d0 38 07 |#..q.(..B.z3..8.| | 8e d5 35 e8 68 a5 0f 53 21 08 ef 18 08 46 de 67 |..5.h..S!....F.g| | 1d 30 d6 9c 33 fa 98 91 55 fc 53 fc 44 9e a6 79 |.0..3...U.S.D..y| | 4d 90 53 aa b5 3e 0a d1 04 5e 4d 7e 27 d4 1b 87 |M.S..>...^M~'...| | 27 e0 18 1b e3 40 e1 a4 1c fb e7 5e 97 91 ba 15 |'....@.....^....| | 3e 76 f5 57 66 4b 15 ee 79 43 60 60 18 05 8e 52 |>v.WfK..yC``...R| | 11 2f ae 8c 06 44 a5 e5 ac 51 12 b2 7a b1 d4 10 |./...D...Q..z...| | 1d 3b f3 55 c4 ce de d0 71 a5 6a 4e eb 44 23 d6 |.;.U....q.jN.D#.| | 4e 75 49 46 7f c9 86 70 b1 64 5f 8e b5 5e 2b 1c |NuIF...p.d_..^+.| | 63 bb 83 00 f7 8e 88 b7 10 1e 50 6e f5 06 0a d4 |c.........Pn....| | 1a 27 a2 c8 c6 61 b9 39 a8 ee 82 1d 6f 18 b1 6d |.'...a.9....o..m| | 69 cd a5 0e 0e c3 ba 50 c0 de 12 d0 d5 51 70 57 |i......P.....QpW| | 09 02 d0 f2 71 aa 21 fc 39 de 0b 60 bf da fd 4f |....q.!.9..`...O| | f7 00 7e 32 03 d6 13 22 f2 07 a9 a6 23 e6 d2 13 |..~2..."....#...| | 45 cb 55 41 f6 5b 44 df a0 f6 64 4c 9c 2b 79 e7 |E.UA.[D...dL.+y.| Plaintext[384]: | 76 ac 3b fa b1 54 fa 6a 48 54 54 50 2f 31 2e 31 |v.;..T.jHTTP/1.1| | 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:| | 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da| | 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep | | 32 30 31 33 20 31 39 3a 35 35 3a 31 33 20 47 4d |2013 19:55:13 GM| | 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:| | 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont| | 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.| | 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo| | 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu| | 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00| | 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach| | 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca| | 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 31 35 |che....0x00,0x15| | 20 2d 20 45 44 48 2d 52 53 41 2d 44 45 53 2d 43 | - EDH-RSA-DES-C| | 42 43 2d 53 48 41 20 20 20 20 20 53 53 4c 76 33 |BC-SHA SSLv3| | 20 4b 78 3d 44 48 20 20 20 20 20 20 20 41 75 3d | Kx=DH Au=| | 52 53 41 20 20 45 6e 63 3d 44 45 53 28 35 36 29 |RSA Enc=DES(56)| | 20 20 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 | Mac=SHA1document.doma| | 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek| | 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'..........1.| | 60 89 37 f1 94 ad fd a2 07 07 07 07 07 07 07 07 |`.7.............| ssl_decrypt_record found padding 7 final len 376 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | c6 8e 88 6c 4a 0d 2f 24 5a e6 9d 8b ed 1c 68 0f |...lJ./$Z.....h.| | 59 41 2e 7d |YA.} | ssl_decrypt_record: mac failed association_find: TCP port 4446 found 0x342dc20 dissect_ssl enter frame #162 (first time) conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 90 f6 07 04 e0 4a 07 59 f3 0d 7c 9d c1 fc d7 8a |.....J.Y..|.....| | fb d1 9d 5f 88 e9 38 90 30 0f 6f e4 69 5d 4a 1a |..._..8.0.o.i]J.| Plaintext[32]: | 0c 1a e1 d4 78 6a da 00 01 00 9c 5a 40 9d db f4 |....xj.....Z@...| | 05 13 fa 7e 0e cd 31 cd 8d d0 df 9c 0a da 01 01 |...~..1.........| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 9c 5a 40 9d db f4 05 13 fa 7e 0e cd 31 cd 8d d0 |.Z@......~..1...| | df 9c 0a da |.... | ssl_decrypt_record: mac ok dissect_ssl enter frame #164 (first time) conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 7d d7 c0 e6 96 9e 50 c3 7f d0 b5 0d cc dd 53 da |}.....P.......S.| | 00 42 4e 39 07 ec 5e 40 5f 00 f0 c5 3b 4c 04 78 |.BN9..^@_...;L.x| Plaintext[32]: | e2 0d bf b8 8a be e4 0b 01 00 de 63 97 d3 6f d6 |...........c..o.| | ad f1 c0 fc 08 53 a9 a7 e9 d6 c5 46 d0 da 01 01 |.....S.....F....| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | de 63 97 d3 6f d6 ad f1 c0 fc 08 53 a9 a7 e9 d6 |.c..o......S....| | c5 46 d0 da |.F.. | ssl_decrypt_record: mac ok dissect_ssl enter frame #169 (first time) ssl_session_init: initializing ptr 0x7facc38290b0 size 688 conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 34630 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4447 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #171 (first time) conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0 record: offset = 0, reported_length_remaining = 1416 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0016 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 93 57 83 6f 16 f7 a5 bf 81 77 73 ad 7a b1 b1 12 |.W.o.....ws.z...| | 81 76 e6 9a ee b2 90 1a 5a e4 e8 d2 9d c1 76 cb |.v......Z.....v.| | e6 a2 ec 75 23 b3 7a 3d da 7a 69 4a 52 34 3a 66 |...u#.z=.ziJR4:f| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 21 03 e0 5e 34 06 5a 8f 2a 18 34 6f 0b ba aa 8f |!..^4.Z.*.4o....| | 16 f9 df b8 62 39 f7 4f 32 ee 15 c2 25 52 34 bf |....b9.O2...%R4.| | 21 62 eb cc a4 df 9d d8 a8 5b ef 60 a5 f3 2a d9 |!b.......[.`..*.| | 47 50 d7 93 12 a7 9e 81 d0 e2 83 1c 5b |GP..........[ | hash out[104]: | 18 d3 be 2d a9 e6 77 5d a9 5d f5 47 1e b4 bd 4e |...-..w].].G...N| | 26 42 00 bb 04 ad ef 41 e2 6a ce 7e 1d 23 43 52 |&B.....A.j.~.#CR| | fe 14 37 f3 bd 43 0e af e9 bf 44 8f 11 9c 68 9a |..7..C....D...h.| | d3 37 a3 40 39 62 09 8b b8 79 3b 5e d1 73 93 10 |.7.@9b...y;^.s..| | 45 e1 04 d8 96 76 ba 0f 1e e5 85 48 8e e0 6b 84 |E....v.....H..k.| | 96 d0 cf 7e 68 0f de 59 cc bd 9c 99 62 ff 6c e8 |...~h..Y....b.l.| | a9 0f 68 6e f7 bc a7 ea |..hn.... | PRF out[104]: | 18 d3 be 2d a9 e6 77 5d a9 5d f5 47 1e b4 bd 4e |...-..w].].G...N| | 26 42 00 bb 04 ad ef 41 e2 6a ce 7e 1d 23 43 52 |&B.....A.j.~.#CR| | fe 14 37 f3 bd 43 0e af e9 bf 44 8f 11 9c 68 9a |..7..C....D...h.| | d3 37 a3 40 39 62 09 8b b8 79 3b 5e d1 73 93 10 |.7.@9b...y;^.s..| | 45 e1 04 d8 96 76 ba 0f 1e e5 85 48 8e e0 6b 84 |E....v.....H..k.| | 96 d0 cf 7e 68 0f de 59 cc bd 9c 99 62 ff 6c e8 |...~h..Y....b.l.| | a9 0f 68 6e f7 bc a7 ea |..hn.... | key expansion[104]: | 18 d3 be 2d a9 e6 77 5d a9 5d f5 47 1e b4 bd 4e |...-..w].].G...N| | 26 42 00 bb 04 ad ef 41 e2 6a ce 7e 1d 23 43 52 |&B.....A.j.~.#CR| | fe 14 37 f3 bd 43 0e af e9 bf 44 8f 11 9c 68 9a |..7..C....D...h.| | d3 37 a3 40 39 62 09 8b b8 79 3b 5e d1 73 93 10 |.7.@9b...y;^.s..| | 45 e1 04 d8 96 76 ba 0f 1e e5 85 48 8e e0 6b 84 |E....v.....H..k.| | 96 d0 cf 7e 68 0f de 59 cc bd 9c 99 62 ff 6c e8 |...~h..Y....b.l.| | a9 0f 68 6e f7 bc a7 ea |..hn.... | Client MAC key[20]: | 18 d3 be 2d a9 e6 77 5d a9 5d f5 47 1e b4 bd 4e |...-..w].].G...N| | 26 42 00 bb |&B.. | Server MAC key[20]: | 04 ad ef 41 e2 6a ce 7e 1d 23 43 52 fe 14 37 f3 |...A.j.~.#CR..7.| | bd 43 0e af |.C.. | Client Write key[24]: | e9 bf 44 8f 11 9c 68 9a d3 37 a3 40 39 62 09 8b |..D...h..7.@9b..| | b8 79 3b 5e d1 73 93 10 |.y;^.s.. | Server Write key[24]: | 45 e1 04 d8 96 76 ba 0f 1e e5 85 48 8e e0 6b 84 |E....v.....H..k.| | 96 d0 cf 7e 68 0f de 59 |...~h..Y | Client Write IV[8]: | cc bd 9c 99 62 ff 6c e8 |....b.l. | Server Write IV[8]: | a9 0f 68 6e f7 bc a7 ea |..hn.... | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 1353 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 541 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 527, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407 record: offset = 1407, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416 dissect_ssl enter frame #173 (first time) conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0 record: offset = 0, reported_length_remaining = 198 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312... looking for RSA pre-master008027b568fcd473db04087fdc9b05310f3c92161bfb26f1... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 25 73 16 cf 74 a7 82 52 52 74 72 8f f1 d5 d1 a9 |%s..t..RRtr.....| | 02 5a d8 f4 d7 ec f5 43 2d 23 3d 87 4c df 0d 4d |.Z.....C-#=.L..M| | 0c 5b ad 7f 65 f8 e9 49 3f a8 10 76 c0 03 39 02 |.[..e..I?..v..9.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 21 03 e0 5e 34 06 5a 8f 2a 18 34 6f 0b ba aa 8f |!..^4.Z.*.4o....| | 16 f9 df b8 62 39 f7 4f 32 ee 15 c2 25 52 34 bf |....b9.O2...%R4.| | 21 62 eb cc a4 df 9d d8 a8 5b ef 60 a5 f3 2a d9 |!b.......[.`..*.| | 47 50 d7 93 12 a7 9e 81 d0 e2 83 1c 5b |GP..........[ | hash out[104]: | 36 d1 03 18 89 dc fb c9 6e 87 79 3d d6 fe ae 08 |6.......n.y=....| | 56 4f 14 f0 7e fb 12 39 31 6f ee 5b 60 90 90 b6 |VO..~..91o.[`...| | 77 e0 70 41 92 17 12 71 5e ed bf 9a a0 fe 96 7f |w.pA...q^.......| | d5 7b 92 8d 8c b3 5e 40 78 f7 06 49 d9 c2 4f 90 |.{....^@x..I..O.| | 59 38 d8 45 60 b7 fe d5 7c d6 12 f7 a9 37 75 a0 |Y8.E`...|....7u.| | 7a d3 7c 8c a7 2a bc 21 7f 2b 21 ed eb 3c b3 bb |z.|..*.!.+!..<..| | d8 3b 55 b8 c3 02 7a ca |.;U...z. | PRF out[104]: | 36 d1 03 18 89 dc fb c9 6e 87 79 3d d6 fe ae 08 |6.......n.y=....| | 56 4f 14 f0 7e fb 12 39 31 6f ee 5b 60 90 90 b6 |VO..~..91o.[`...| | 77 e0 70 41 92 17 12 71 5e ed bf 9a a0 fe 96 7f |w.pA...q^.......| | d5 7b 92 8d 8c b3 5e 40 78 f7 06 49 d9 c2 4f 90 |.{....^@x..I..O.| | 59 38 d8 45 60 b7 fe d5 7c d6 12 f7 a9 37 75 a0 |Y8.E`...|....7u.| | 7a d3 7c 8c a7 2a bc 21 7f 2b 21 ed eb 3c b3 bb |z.|..*.!.+!..<..| | d8 3b 55 b8 c3 02 7a ca |.;U...z. | key expansion[104]: | 36 d1 03 18 89 dc fb c9 6e 87 79 3d d6 fe ae 08 |6.......n.y=....| | 56 4f 14 f0 7e fb 12 39 31 6f ee 5b 60 90 90 b6 |VO..~..91o.[`...| | 77 e0 70 41 92 17 12 71 5e ed bf 9a a0 fe 96 7f |w.pA...q^.......| | d5 7b 92 8d 8c b3 5e 40 78 f7 06 49 d9 c2 4f 90 |.{....^@x..I..O.| | 59 38 d8 45 60 b7 fe d5 7c d6 12 f7 a9 37 75 a0 |Y8.E`...|....7u.| | 7a d3 7c 8c a7 2a bc 21 7f 2b 21 ed eb 3c b3 bb |z.|..*.!.+!..<..| | d8 3b 55 b8 c3 02 7a ca |.;U...z. | Client MAC key[20]: | 36 d1 03 18 89 dc fb c9 6e 87 79 3d d6 fe ae 08 |6.......n.y=....| | 56 4f 14 f0 |VO.. | Server MAC key[20]: | 7e fb 12 39 31 6f ee 5b 60 90 90 b6 77 e0 70 41 |~..91o.[`...w.pA| | 92 17 12 71 |...q | Client Write key[24]: | 5e ed bf 9a a0 fe 96 7f d5 7b 92 8d 8c b3 5e 40 |^........{....^@| | 78 f7 06 49 d9 c2 4f 90 |x..I..O. | Server Write key[24]: | 59 38 d8 45 60 b7 fe d5 7c d6 12 f7 a9 37 75 a0 |Y8.E`...|....7u.| | 7a d3 7c 8c a7 2a bc 21 |z.|..*.! | Client Write IV[8]: | 7f 2b 21 ed eb 3c b3 bb |.+!..<.. | Server Write IV[8]: | d8 3b 55 b8 c3 02 7a ca |.;U...z. | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 25 73 16 cf 74 a7 82 52 52 74 72 8f f1 d5 d1 a9 |%s..t..RRtr.....| | 02 5a d8 f4 d7 ec f5 43 2d 23 3d 87 4c df 0d 4d |.Z.....C-#=.L..M| | 0c 5b ad 7f 65 f8 e9 49 3f a8 10 76 c0 03 39 02 |.[..e..I?..v..9.| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 30 b9 99 b5 98 3a 51 ba 34 9f 5f c3 fa 03 14 a5 |0....:Q.4._.....| | ff 2b 4c e7 1d 75 8e 9b 9f 7e 1a f7 9c 04 c5 7b |.+L..u...~.....{| | ef 9d e7 8d d3 52 a8 f2 60 1e 56 3e 94 1c 79 75 |.....R..`.V>..yu| Plaintext[48]: | 11 54 ba b8 2b 47 c3 13 14 00 00 0c d4 0c 3a 75 |.T..+G........:u| | 2f ae 37 1c 80 8e f4 b6 bf eb f9 f3 74 05 e3 b2 |/.7.........t...| | 8a 91 5f 39 26 39 24 10 89 96 19 d6 03 03 03 03 |.._9&9$.........| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | bf eb f9 f3 74 05 e3 b2 8a 91 5f 39 26 39 24 10 |....t....._9&9$.| | 89 96 19 d6 |.... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #174 (first time) conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0 record: offset = 0, reported_length_remaining = 234 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 43 b9 41 64 c5 c1 70 d9 95 40 43 89 6d 6a 0f 7e |C.Ad..p..@C.mj.~| | 1f b0 d1 8b 8e cc 05 85 5e 1d 64 05 7f c3 18 6c |........^.d....l| | 1b 6f fb 98 8c 36 f4 92 5f 58 6d 29 af b8 1b b3 |.o...6.._Xm)....| Plaintext[48]: | 3e 8c 1e 41 11 1c 02 94 14 00 00 0c b1 af 5a f7 |>..A..........Z.| | 46 79 f1 9d 13 16 f8 d6 77 48 26 28 97 92 87 35 |Fy......wH&(...5| | 2e 9a 77 58 79 64 5d 3f 37 26 30 58 03 03 03 03 |..wXyd]?7&0X....| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 77 48 26 28 97 92 87 35 2e 9a 77 58 79 64 5d 3f |wH&(...5..wXyd]?| | 37 26 30 58 |7&0X | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #175 (first time) conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0 record: offset = 0, reported_length_remaining = 109 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 104, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 104 Ciphertext[104]: | 52 25 de 8e dc 51 1e 44 7a 04 36 3a fe f7 5a 2a |R%...Q.Dz.6:..Z*| | f8 c6 0a 28 6a be ce 44 47 9c 36 9c d8 16 86 a8 |...(j..DG.6.....| | b5 23 27 08 96 eb 4c dc 09 0d 57 27 71 3f 75 cb |.#'...L...W'q?u.| | 04 3f 78 fa a6 3c 32 bc ec 2a 1e 66 71 b3 22 bd |.?x..<2..*.fq.".| | b7 0a bd 82 68 aa 70 a1 cd 99 a9 70 c8 cd 74 a5 |....h.p....p..t.| | ad 7f 52 6f d0 71 4e 94 d3 09 dc 9f 01 d5 d2 4e |..Ro.qN........N| | f9 48 cc ac 0a 66 40 37 |.H...f@7 | Plaintext[104]: | c8 61 50 07 a9 8d 67 44 47 45 54 20 2f 20 48 54 |.aP...gDGET / HT| | 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 64 |TP/1.1..Host: ed| | 68 2d 72 73 61 2d 64 65 73 2d 63 62 63 33 2d 73 |h-rsa-des-cbc3-s| | 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |ha.local.al.leke| | 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 34 37 0d 0a |nsteyn.nl:4447..| | 0d 0a 4d a5 7b 38 2e 13 89 3f e6 db 22 e5 fa 38 |..M.{8...?.."..8| | f2 c8 c6 33 1e c6 01 01 |...3.... | ssl_decrypt_record found padding 1 final len 102 checking mac (len 74, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 5d 2f 5b bd d8 8f 3f f3 2f 99 b0 8a ef fc 8b df |]/[...?./.......| | a4 d6 01 22 |..." | ssl_decrypt_record: mac failed association_find: TCP port 34630 found (nil) association_find: TCP port 4447 found 0x342dcb0 dissect_ssl enter frame #176 (first time) conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | c6 a7 90 28 b2 f1 b7 15 43 62 7a 8e 57 14 47 11 |...(....Cbz.W.G.| | 8b 43 bb 7f c5 53 21 ef 53 53 a5 a0 11 37 66 6f |.C...S!.SS...7fo| | 1a db 78 e4 e2 3c 2e 19 51 bb ec 08 06 33 6e ac |..x..<..Q....3n.| | c8 96 d3 5d 06 de 57 71 89 ad 14 97 38 9f f2 f2 |...]..Wq....8...| | 05 06 8c 49 c0 00 0f 08 de 60 e2 2c ed 57 bd 7a |...I.....`.,.W.z| | b0 75 2e 8f 92 28 5e 0a 49 ef 83 86 4f 05 eb f9 |.u...(^.I...O...| | f5 4a 7a 69 e2 bc d5 be 68 c7 52 b9 3c 98 b3 50 |.Jzi....h.R.<..P| | ae b3 de 52 cc a7 61 fd bf af a9 f0 e3 cc d6 54 |...R..a........T| | 9b 45 a5 94 26 58 87 cf 51 63 aa 82 56 9b 3e b1 |.E..&X..Qc..V.>.| | fe 6f 12 74 f2 1c ae 8b 7c 7b bd a4 c0 d0 6f 17 |.o.t....|{....o.| | b9 50 61 6e 51 02 32 19 54 1a 57 a2 d5 9e a5 0a |.PanQ.2.T.W.....| | 14 3c e9 f7 11 84 7d ad e8 d7 7d 0c 07 4c 3f 57 |.<....}...}..L?W| | ac 44 b8 a9 f0 c7 2e db 53 12 81 99 4a 0e 6a e4 |.D......S...J.j.| | c6 fb 54 9b bf 9a c3 e2 a9 f0 68 34 c3 95 74 34 |..T.......h4..t4| | 6c f2 8c 77 3d 57 b7 a0 c3 f8 cd 04 5b 15 5e 41 |l..w=W......[.^A| | 53 13 85 50 fc 72 27 a2 7b 84 0b b1 66 9b a5 eb |S..P.r'.{...f...| | 35 ad e4 cf fa 58 29 07 78 79 f5 14 c0 34 2d b2 |5....X).xy...4-.| | a2 b9 25 1c 87 83 63 13 c3 60 87 b7 c9 94 5f 10 |..%...c..`...._.| | 4e 5a 94 63 18 2f 23 39 1b 0e f3 d5 13 27 a8 a5 |NZ.c./#9.....'..| | 51 9f 1c e3 c1 6e 24 b7 c6 ec 19 a2 8b a0 37 8e |Q....n$.......7.| | 3e 5e da aa 5e 37 9f 36 c6 d3 33 15 96 a2 7b 62 |>^..^7.6..3...{b| | 63 1b 6a af 83 e8 48 71 77 92 13 49 5f 09 53 5a |c.j...Hqw..I_.SZ| | 81 b0 a7 be 34 02 fe dd 05 41 32 91 41 df 80 9a |....4....A2.A...| | 4e 78 88 1c a7 90 dd 6a 98 9b ec a0 73 0c 1a 1a |Nx.....j....s...| Plaintext[384]: | 15 08 3a 52 13 84 ff 32 48 54 54 50 2f 31 2e 31 |..:R...2HTTP/1.1| | 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:| | 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da| | 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep | | 32 30 31 33 20 31 39 3a 35 35 3a 31 33 20 47 4d |2013 19:55:13 GM| | 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:| | 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont| | 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.| | 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo| | 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu| | 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00| | 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach| | 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca| | 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 31 36 |che....0x00,0x16| | 20 2d 20 45 44 48 2d 52 53 41 2d 44 45 53 2d 43 | - EDH-RSA-DES-C| | 42 43 33 2d 53 48 41 20 20 20 20 53 53 4c 76 33 |BC3-SHA SSLv3| | 20 4b 78 3d 44 48 20 20 20 20 20 20 20 41 75 3d | Kx=DH Au=| | 52 53 41 20 20 45 6e 63 3d 33 44 45 53 28 31 36 |RSA Enc=3DES(16| | 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 |8) Mac=SHA1document.doma| | 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek| | 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'..Ee...;"Ce.| | bb 26 09 2a 69 d1 2c 94 07 07 07 07 07 07 07 07 |.&.*i.,.........| ssl_decrypt_record found padding 7 final len 376 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 6e 38 8e 36 a4 fc f7 22 c3 52 d5 c3 70 e0 30 e9 |n8.6...".R..p.0.| | fc bb 46 de |..F. | ssl_decrypt_record: mac failed association_find: TCP port 4447 found 0x342dcb0 dissect_ssl enter frame #177 (first time) conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 55 ee a8 58 43 84 d9 46 e9 af a2 07 a7 c0 5a e5 |U..XC..F......Z.| | 9b f6 7e d0 b3 3d 25 37 88 45 a1 00 c8 e7 dc be |..~..=%7.E......| Plaintext[32]: | 28 c5 00 a5 16 dd 5e e0 01 00 d3 7a ba cf ea 38 |(.....^....z...8| | ec 1b 2d ef 78 0d 34 2f 3c 11 c4 bf 08 70 01 01 |..-.x.4/<....p..| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | d3 7a ba cf ea 38 ec 1b 2d ef 78 0d 34 2f 3c 11 |.z...8..-.x.4/<.| | c4 bf 08 70 |...p | ssl_decrypt_record: mac ok dissect_ssl enter frame #179 (first time) conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 76 68 33 16 36 aa 6b 09 b6 a9 34 b1 61 c6 fb e3 |vh3.6.k...4.a...| | b3 8d dd 81 3c e8 4e 02 9b 85 fe 37 c5 24 96 97 |....<.N....7.$..| Plaintext[32]: | f2 a4 38 4d 1e 1c 93 cd 01 00 a9 6f f3 6d 2b ba |..8M.......o.m+.| | a6 3d 8a 8c 6b 65 e4 84 4c 61 1e 50 86 a7 01 01 |.=..ke..La.P....| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | a9 6f f3 6d 2b ba a6 3d 8a 8c 6b 65 e4 84 4c 61 |.o.m+..=..ke..La| | 1e 50 86 a7 |.P.. | ssl_decrypt_record: mac ok dissect_ssl enter frame #184 (first time) ssl_session_init: initializing ptr 0x7facc382b5b0 size 688 conversation = 0x7facef998260, ssl_session = 0x7facc382b5b0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 56585 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4448 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #186 (first time) conversation = 0x7facef998260, ssl_session = 0x7facc382b5b0 record: offset = 0, reported_length_remaining = 884 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x002F -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 25 73 16 cf 74 a7 82 52 52 74 72 8f f1 d5 d1 a9 |%s..t..RRtr.....| | 02 5a d8 f4 d7 ec f5 43 2d 23 3d 87 4c df 0d 4d |.Z.....C-#=.L..M| | 0c 5b ad 7f 65 f8 e9 49 3f a8 10 76 c0 03 39 02 |.[..e..I?..v..9.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 22 1d 0b 60 48 82 dd df 5c da e5 be 82 fd 4a 9c |"..`H...\.....J.| | 6e f5 3f 8d 63 98 82 36 66 8a 36 49 62 52 34 bf |n.?.c..6f.6IbR4.| | 22 b7 64 92 8c ba fa b0 8f f1 01 c0 11 e0 e2 3e |".d............>| | a0 d3 b4 56 32 5d f1 d9 ad 5b e3 5b 36 |...V2]...[.[6 | hash out[104]: | b8 c8 ef 24 ff 89 0d db a5 13 0e f9 41 d3 5e 67 |...$........A.^g| | 93 87 13 02 07 f9 81 ce c2 22 76 b6 9b 18 c9 aa |........."v.....| | ad d1 8c e4 18 60 e9 b7 17 32 20 aa 71 e4 51 58 |.....`...2 .q.QX| | de 29 07 4f ff 5f 42 28 d3 6a 06 82 7d 52 e0 44 |.).O._B(.j..}R.D| | ee 97 db df 7c c4 f5 41 20 8e 7e 43 da 31 84 17 |....|..A .~C.1..| | ac 47 27 8a 28 19 f1 07 22 b5 68 ef 27 e0 f2 e4 |.G'.(...".h.'...| | ed cc 53 e8 a9 38 28 61 |..S..8(a | PRF out[104]: | b8 c8 ef 24 ff 89 0d db a5 13 0e f9 41 d3 5e 67 |...$........A.^g| | 93 87 13 02 07 f9 81 ce c2 22 76 b6 9b 18 c9 aa |........."v.....| | ad d1 8c e4 18 60 e9 b7 17 32 20 aa 71 e4 51 58 |.....`...2 .q.QX| | de 29 07 4f ff 5f 42 28 d3 6a 06 82 7d 52 e0 44 |.).O._B(.j..}R.D| | ee 97 db df 7c c4 f5 41 20 8e 7e 43 da 31 84 17 |....|..A .~C.1..| | ac 47 27 8a 28 19 f1 07 22 b5 68 ef 27 e0 f2 e4 |.G'.(...".h.'...| | ed cc 53 e8 a9 38 28 61 |..S..8(a | key expansion[104]: | b8 c8 ef 24 ff 89 0d db a5 13 0e f9 41 d3 5e 67 |...$........A.^g| | 93 87 13 02 07 f9 81 ce c2 22 76 b6 9b 18 c9 aa |........."v.....| | ad d1 8c e4 18 60 e9 b7 17 32 20 aa 71 e4 51 58 |.....`...2 .q.QX| | de 29 07 4f ff 5f 42 28 d3 6a 06 82 7d 52 e0 44 |.).O._B(.j..}R.D| | ee 97 db df 7c c4 f5 41 20 8e 7e 43 da 31 84 17 |....|..A .~C.1..| | ac 47 27 8a 28 19 f1 07 22 b5 68 ef 27 e0 f2 e4 |.G'.(...".h.'...| | ed cc 53 e8 a9 38 28 61 |..S..8(a | Client MAC key[20]: | b8 c8 ef 24 ff 89 0d db a5 13 0e f9 41 d3 5e 67 |...$........A.^g| | 93 87 13 02 |.... | Server MAC key[20]: | 07 f9 81 ce c2 22 76 b6 9b 18 c9 aa ad d1 8c e4 |....."v.........| | 18 60 e9 b7 |.`.. | Client Write key[16]: | 17 32 20 aa 71 e4 51 58 de 29 07 4f ff 5f 42 28 |.2 .q.QX.).O._B(| Server Write key[16]: | d3 6a 06 82 7d 52 e0 44 ee 97 db df 7c c4 f5 41 |.j..}R.D....|..A| Client Write IV[16]: | 20 8e 7e 43 da 31 84 17 ac 47 27 8a 28 19 f1 07 | .~C.1...G'.(...| Server Write IV[16]: | 22 b5 68 ef 27 e0 f2 e4 ed cc 53 e8 a9 38 28 61 |".h.'.....S..8(a| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 821 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884 dissect_ssl enter frame #188 (first time) conversation = 0x7facef998260, ssl_session = 0x7facc382b5b0 record: offset = 0, reported_length_remaining = 342 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 262, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b45632... looking for RSA pre-master9c6ff5543ffe32d8ea3a28bd01a06a2390bf507ff9296aa5... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 61 3c 50 08 4a d0 92 9a 68 1f df 81 6c f1 06 c2 |a| | a0 d3 b4 56 32 5d f1 d9 ad 5b e3 5b 36 |...V2]...[.[6 | hash out[104]: | ab 24 9e 1c 8b e4 d0 cb 6f 12 9e a3 77 70 ba 5d |.$......o...wp.]| | 9c f8 f6 51 b5 3e 6d 5f d4 55 5f c1 91 dd a9 08 |...Q.>m_.U_.....| | 52 0a 0e 02 08 16 57 da ab 14 c4 af 42 91 20 e7 |R.....W.....B. .| | 7b ab 41 ae 53 6e cd f4 0c bc fb 0d 51 58 b0 25 |{.A.Sn......QX.%| | f8 2f ad 6d 7f 2a 02 13 88 73 65 2e c7 b4 3d 1c |./.m.*...se...=.| | 94 d0 61 28 cb 66 35 71 8d 3c 54 51 6b a4 ad 6e |..a(.f5q.m_.U_.....| | 52 0a 0e 02 08 16 57 da ab 14 c4 af 42 91 20 e7 |R.....W.....B. .| | 7b ab 41 ae 53 6e cd f4 0c bc fb 0d 51 58 b0 25 |{.A.Sn......QX.%| | f8 2f ad 6d 7f 2a 02 13 88 73 65 2e c7 b4 3d 1c |./.m.*...se...=.| | 94 d0 61 28 cb 66 35 71 8d 3c 54 51 6b a4 ad 6e |..a(.f5q.m_.U_.....| | 52 0a 0e 02 08 16 57 da ab 14 c4 af 42 91 20 e7 |R.....W.....B. .| | 7b ab 41 ae 53 6e cd f4 0c bc fb 0d 51 58 b0 25 |{.A.Sn......QX.%| | f8 2f ad 6d 7f 2a 02 13 88 73 65 2e c7 b4 3d 1c |./.m.*...se...=.| | 94 d0 61 28 cb 66 35 71 8d 3c 54 51 6b a4 ad 6e |..a(.f5q.m_.U_.....R...| | 08 16 57 da |..W. | Client Write key[16]: | ab 14 c4 af 42 91 20 e7 7b ab 41 ae 53 6e cd f4 |....B. .{.A.Sn..| Server Write key[16]: | 0c bc fb 0d 51 58 b0 25 f8 2f ad 6d 7f 2a 02 13 |....QX.%./.m.*..| Client Write IV[16]: | 88 73 65 2e c7 b4 3d 1c 94 d0 61 28 cb 66 35 71 |.se...=...a(.f5q| Server Write IV[16]: | 8d 3c 54 51 6b a4 ad 6e b9 f8 29 05 96 08 f3 3a |.x| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 61 65 73 31 32 38 2d 73 68 61 |Host: aes128-sha| | 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 |.local.al.lekens| | 74 65 79 6e 2e 6e 6c 3a 34 34 34 38 0d 0a 0d 0a |teyn.nl:4448....| | 90 ab af 77 9f 92 99 2f 13 ca b2 56 b2 0a 6c 6a |...w.../...V..lj| | af 9c 0b fc 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................| ssl_decrypt_record found padding 11 final len 100 checking mac (len 64, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | cc ad 88 d7 c0 ce ec 90 81 5c f5 2b dd 8b 99 6e |.........\.+...n| | 3b be 1b 69 |;..i | ssl_decrypt_record: mac failed association_find: TCP port 56585 found (nil) association_find: TCP port 4448 found 0x342dd40 dissect_ssl enter frame #191 (first time) conversation = 0x7facef998260, ssl_session = 0x7facc382b5b0 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | 18 93 55 f3 49 26 2e 7f e3 2e 94 24 ca 57 3a 5b |..U.I&.....$.W:[| | 21 e3 43 4d bf 63 46 ee e3 6a e9 07 96 68 30 57 |!.CM.cF..j...h0W| | 94 15 f0 2c 57 37 23 39 2f f7 bc cd fb 4d 15 8f |...,W7#9/....M..| | f6 88 0d 09 fa 08 ab 34 fd b9 59 1b 4b 4a ee 81 |.......4..Y.KJ..| | 1d e9 14 80 1a 89 68 bf e0 2e 69 53 b9 17 00 96 |......h...iS....| | a1 69 1d 6e 69 0e 2a 0f 1e 82 d1 56 2d 05 64 31 |.i.ni.*....V-.d1| | e4 44 a4 4f fa 23 a6 fc 68 32 be 15 f6 b9 ac 6f |.D.O.#..h2.....o| | 19 30 ea 4d a1 08 04 65 03 17 91 88 b6 0e be 78 |.0.M...e.......x| | ec 3e 35 d7 89 dd d1 5b 16 b9 ac 75 2c 7e e7 ab |.>5....[...u,~..| | 50 4f b7 73 ca 30 fd f6 a1 4c c9 ab 85 08 5e 09 |PO.s.0...L....^.| | 71 b5 bf ee 5e b0 92 06 0a 43 5b c7 16 f3 71 ab |q...^....C[...q.| | ed ae 5f e2 2d 8e d1 2d 45 ba 20 aa 4f ce ad 60 |.._.-..-E. .O..`| | 33 9d b0 7f dd 4e 60 c0 18 52 92 1b 72 98 d6 79 |3....N`..R..r..y| | 9a a5 18 fc 48 73 77 42 10 dc 13 20 55 16 cb ec |....HswB... U...| | 61 c5 71 86 fa 22 9b f2 a5 f0 ed 54 cb 96 a1 4d |a.q..".....T...M| | e3 af 35 c0 98 48 86 2a 7c 20 60 61 f2 82 6b 06 |..5..H.*| `a..k.| | 9b e1 9b 28 8a 99 8b c8 be 95 6b f6 76 c5 89 fb |...(......k.v...| | 3c 60 01 ed 6b 44 df 94 dd f8 9e cc a2 01 30 02 |<`..kD........0.| | 9f 71 30 82 33 21 89 92 02 d1 e5 bf f6 8a 94 f8 |.q0.3!..........| | bc 21 09 a0 c1 9f aa 0a 6d 82 43 0a e4 a0 a5 59 |.!......m.C....Y| | b4 e0 38 26 6e 13 03 61 d1 2e bc ab 61 94 c2 0d |..8&n..a....a...| | 60 b8 d4 92 73 3a bf f8 90 ee f9 92 f5 3d 10 57 |`...s:.......=.W| | 68 a8 65 11 94 be b2 4c 7a d7 72 a7 56 b0 15 71 |h.e....Lz.r.V..q| | 3f cd 2f 1a c4 c9 3f 27 d0 bc 0f aa fa b2 14 81 |?./...?'........| | f2 e2 ac 23 1d 5d 6e 09 34 b8 b9 ee 35 29 93 e0 |...#.]n.4...5)..| Plaintext[400]: | 1b bd f3 c6 cc 1c 1c f8 eb af 5e 18 ba bd c3 40 |..........^....@| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:| | 35 35 3a 31 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:14 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 32 46 20 2d 20 41 45 53 31 32 |x00,0x2F - AES12| | 38 2d 53 48 41 20 20 20 20 20 20 20 20 20 20 20 |8-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1.F.e| | 92 cf d8 33 79 d6 e7 4c 0e 7a 91 81 cc 1b 00 43 |...3y..L.z.....C| | 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................| ssl_decrypt_record found padding 15 final len 384 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 55 4f b0 3a ac 07 a7 cb 7e f5 2b a5 9d 48 19 71 |UO.:....~.+..H.q| | 56 15 b9 89 |V... | ssl_decrypt_record: mac failed association_find: TCP port 4448 found 0x342dd40 dissect_ssl enter frame #192 (first time) conversation = 0x7facef998260, ssl_session = 0x7facc382b5b0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 2d 7e 64 d1 d4 bb b7 06 06 ab 93 21 37 b1 58 fd |-~d........!7.X.| | 98 fe 27 e2 6a 7c b3 6a d7 be be 21 6e 6a 8b 98 |..'.j|.j...!nj..| | 91 c8 8d 1c 36 d5 84 4f b8 23 02 24 d8 cf 62 ad |....6..O.#.$..b.| Plaintext[48]: | c1 5d 52 33 77 47 a6 d0 8b 1c eb 6b 9f 6d 9f e6 |.]R3wG.....k.m..| | 01 00 61 38 ad f5 8a d6 69 da df 95 24 ff c7 27 |..a8....i...$..'| | 21 a9 28 c0 97 19 09 09 09 09 09 09 09 09 09 09 |!.(.............| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 61 38 ad f5 8a d6 69 da df 95 24 ff c7 27 21 a9 |a8....i...$..'!.| | 28 c0 97 19 |(... | ssl_decrypt_record: mac ok dissect_ssl enter frame #194 (first time) conversation = 0x7facef998260, ssl_session = 0x7facc382b5b0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 9c e0 8b 42 4a b9 05 46 ad ff 69 7f 0b c3 4c bf |...BJ..F..i...L.| | af be 30 e2 fc 0b 9e 2c 6c d0 9d 07 ea f4 fc 48 |..0....,l......H| | 9e e4 f8 34 c8 a8 bd bb fb c2 90 33 f2 78 83 78 |...4.......3.x.x| Plaintext[48]: | 0a 8b 34 b0 63 e9 d4 58 35 28 31 6b a8 69 1d 4c |..4.c..X5(1k.i.L| | 01 00 59 a7 38 a2 64 06 f2 97 ee 05 eb 91 bf 8a |..Y.8.d.........| | 59 35 7c 63 c2 dc 09 09 09 09 09 09 09 09 09 09 |Y5|c............| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 59 a7 38 a2 64 06 f2 97 ee 05 eb 91 bf 8a 59 35 |Y.8.d.........Y5| | 7c 63 c2 dc ||c.. | ssl_decrypt_record: mac ok dissect_ssl enter frame #199 (first time) ssl_session_init: initializing ptr 0x7facc382db70 size 688 conversation = 0x7facef998508, ssl_session = 0x7facc382db70 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 35174 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4449 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #201 (first time) conversation = 0x7facef998508, ssl_session = 0x7facc382db70 record: offset = 0, reported_length_remaining = 1135 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0032 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 61 3c 50 08 4a d0 92 9a 68 1f df 81 6c f1 06 c2 |aV............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | cd 6c 8a 83 cf ce 8e d4 e0 d4 bd 34 a0 20 f1 15 |.l.........4. ..| | fc 51 3e 56 |.Q>V | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #204 (first time) conversation = 0x7facef998508, ssl_session = 0x7facc382db70 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 8c cb 3d c7 4b 41 55 a1 6c 88 db a7 f2 7b 12 d6 |..=.KAU.l....{..| | f0 76 38 7d ff 01 bd f8 30 b8 1b ba bb ea 91 b6 |.v8}....0.......| | 2b 5d c9 7e 3b a7 a4 06 fc f0 6b d9 d1 81 55 56 |+].~;.....k...UV| | fe 9a 56 f3 3f dc 01 61 1c 7f 69 a7 6f 9f ce 1a |..V.?..a..i.o...| Plaintext[64]: | d0 72 3d d9 78 4a 2e 8b 82 8e 64 2c 0a 71 8b 5c |.r=.xJ....d,.q.\| | 14 00 00 0c 7b f3 4d d3 23 a2 c1 bc 5f d5 4c 84 |....{.M.#..._.L.| | 31 f4 af 88 4c 19 05 af d8 48 14 16 8f d5 2c 40 |1...L....H....,@| | c5 60 09 e3 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.`..............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 31 f4 af 88 4c 19 05 af d8 48 14 16 8f d5 2c 40 |1...L....H....,@| | c5 60 09 e3 |.`.. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #205 (first time) conversation = 0x7facef998508, ssl_session = 0x7facc382db70 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | 95 c2 42 13 da cc 84 b5 31 bb cc 7a 2d 8c 3a c5 |..B.....1..z-.:.| | 76 da 0f 00 83 0b db 4e 1a 04 b1 27 fc 8c a1 f7 |v......N...'....| | 0a be 0e 78 40 18 8a bd 20 cb fe f6 ff d3 9b c2 |...x@... .......| | fc 91 7a d5 b3 35 51 02 b9 1a 82 32 80 91 2c d2 |..z..5Q....2..,.| | fb f7 a1 e9 32 d2 37 32 73 76 16 29 68 52 7c a9 |....2.72sv.)hR|.| | 7a 69 6f eb 7c fc 50 83 5b 5f b5 72 4b b5 69 29 |zio.|.P.[_.rK.i)| | f1 25 40 c2 ba b0 41 ef 53 de 28 83 d0 fa 6b f8 |.%@...A.S.(...k.| Plaintext[112]: | ce 37 c8 32 fa f8 2f 01 1c a4 d7 d2 53 c2 74 73 |.7.2../.....S.ts| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 61 65 |Host: dhe-dss-ae| | 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s128-sha.local.a| | 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:| | 34 34 34 39 0d 0a 0d 0a 72 a0 8f 78 7e a3 57 49 |4449....r..x~.WI| | 6b ca 69 7b 19 37 aa d9 ef 6c 18 40 03 03 03 03 |k.i{.7...l.@....| ssl_decrypt_record found padding 3 final len 108 checking mac (len 72, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 42 10 d3 40 4f e3 b3 15 17 78 c0 5d 6c 43 17 20 |B..@O....x.]lC. | | 5f 43 42 1b |_CB. | ssl_decrypt_record: mac failed association_find: TCP port 35174 found (nil) association_find: TCP port 4449 found 0x342ddd0 dissect_ssl enter frame #206 (first time) conversation = 0x7facef998508, ssl_session = 0x7facc382db70 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | f9 c6 ca af d9 57 23 46 a9 cb e8 f7 3d 3b 8f 42 |.....W#F....=;.B| | fd 80 9a f0 70 a7 d9 84 9b 04 f5 e3 01 58 d7 88 |....p........X..| | 96 50 80 23 a7 7d 9c 7d 14 c9 19 e5 86 be ad b8 |.P.#.}.}........| | 86 65 11 e5 79 e2 f4 60 1f b7 fa bd 8f 4e 72 46 |.e..y..`.....NrF| | e8 b7 66 e5 09 54 fa 10 ae 96 61 4b 5c b4 3c e3 |..f..T....aK\.<.| | b9 35 a4 ef a6 ef c5 0c 81 ad 4b 5b bb 96 6c 0d |.5........K[..l.| | 2a 95 67 3c 7b 31 b8 81 e7 06 fc aa 7c 3d 6c 75 |*.g<{1......|=lu| | 3c 06 fb ec d6 57 5c 4d 55 14 8e 7e ab db de 54 |<....W\MU..~...T| | 7a 5b 60 cd dd b7 35 94 77 b4 ad 99 8b cd 34 97 |z[`...5.w.....4.| | c0 bb a9 7a 0d 6f 53 ce 76 8f e8 51 8a 8c dc f8 |...z.oS.v..Q....| | 5a b4 86 58 63 0f 91 5e c5 b3 d0 09 6a ca 6a f2 |Z..Xc..^....j.j.| | c9 b5 20 83 90 17 d2 7e 88 47 ba 95 89 ec dd 4a |.. ....~.G.....J| | d1 c4 cd 4f 22 40 cb 9d 6e 22 59 c6 66 dd 3f 48 |...O"@..n"Y.f.?H| | fa cd 37 c9 0a bd 29 8f 9a 70 b2 2a 2a 5d 36 24 |..7...)..p.**]6$| | 53 da db 7c 51 1c 93 67 cf a4 b2 db 3e 94 bc f5 |S..|Q..g....>...| | 88 be 16 d1 09 da ed 29 a6 ac 5b e5 b8 08 24 32 |.......)..[...$2| | 85 58 ae 47 c6 8c 77 e6 28 3a f2 49 00 d1 26 1e |.X.G..w.(:.I..&.| | 3e 1d fb 01 d1 cf ac 95 97 04 59 10 91 fb 47 1a |>.........Y...G.| | 91 11 fd 85 8d 79 14 56 35 16 66 ad 91 50 c8 3a |.....y.V5.f..P.:| | 5e 6c f4 f2 02 6c de a2 d6 cf 48 b3 c3 8f 1b c8 |^l...l....H.....| | 49 21 4c 5d 6c 49 49 43 29 88 0c ef 94 a8 d7 60 |I!L]lIIC)......`| | cf 72 be 34 54 cb b6 9e f2 c3 e6 d3 56 fc ab 4a |.r.4T.......V..J| | 5a f3 46 1d c4 98 ad 96 e4 bf 74 33 6b 74 a5 2e |Z.F.......t3kt..| | 28 d9 6e 6e b1 c1 7f e3 a1 d7 24 9c 0c 75 a7 fc |(.nn......$..u..| | 9c 74 64 3d fc 29 55 85 1b 6d fc ce df f3 98 44 |.td=.)U..m.....D| Plaintext[400]: | 8c 98 a2 4f 4b 5e c6 7b da 49 3c ff 53 de d6 70 |...OK^.{.I<.S..p| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:| | 35 35 3a 31 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:14 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 33 32 20 2d 20 44 48 45 2d 44 |x00,0x32 - DHE-D| | 53 53 2d 41 45 53 31 32 38 2d 53 48 41 20 20 20 |SS-AES128-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc| | 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1....| | d4 2c d0 de 99 91 8d 2d a9 fe df a6 6b 27 96 3e |.,.....-....k'.>| | 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................| ssl_decrypt_record found padding 15 final len 384 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 79 57 0f 53 9a 8b 11 3b 7d fe 4c 8a 99 10 4f e4 |yW.S...;}.L...O.| | f8 1c 52 00 |..R. | ssl_decrypt_record: mac failed association_find: TCP port 4449 found 0x342ddd0 dissect_ssl enter frame #207 (first time) conversation = 0x7facef998508, ssl_session = 0x7facc382db70 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | cc 91 6e 69 2b ad f6 5d 0f 4c 48 28 a3 cb 08 c4 |..ni+..].LH(....| | 96 35 79 19 88 e9 4a f8 85 ef f6 73 b9 ff b7 41 |.5y...J....s...A| | 1c 8f 19 66 77 97 2b 8f 51 44 1b de ce ee 0c e3 |...fw.+.QD......| Plaintext[48]: | 72 0d d0 89 07 ec 22 1c c3 7a f4 20 15 8c 15 20 |r....."..z. ... | | 01 00 d8 e9 d6 ac 6c e3 3c 87 ad 71 f2 04 55 73 |......l.<..q..Us| | 2a 4c 83 f1 9f 36 09 09 09 09 09 09 09 09 09 09 |*L...6..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | d8 e9 d6 ac 6c e3 3c 87 ad 71 f2 04 55 73 2a 4c |....l.<..q..Us*L| | 83 f1 9f 36 |...6 | ssl_decrypt_record: mac ok dissect_ssl enter frame #209 (first time) conversation = 0x7facef998508, ssl_session = 0x7facc382db70 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 90 aa ba 12 d1 e9 9a 9d aa 5a cd 26 66 dc ac 01 |.........Z.&f...| | 39 9f a1 98 a5 ec 81 97 7d 87 5a 9e 8e 58 c1 4d |9.......}.Z..X.M| | 21 80 07 64 7d 28 ac d2 f5 c9 51 98 2b b3 36 fb |!..d}(....Q.+.6.| Plaintext[48]: | 4a 36 7b 03 9d a9 ed 83 0e 67 07 9f e4 8b 7c ae |J6{......g....|.| | 01 00 53 0b 67 f4 d8 ad f9 9b c9 90 36 45 a2 8d |..S.g.......6E..| | 59 f6 a7 97 a5 d5 09 09 09 09 09 09 09 09 09 09 |Y...............| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 53 0b 67 f4 d8 ad f9 9b c9 90 36 45 a2 8d 59 f6 |S.g.......6E..Y.| | a7 97 a5 d5 |.... | ssl_decrypt_record: mac ok dissect_ssl enter frame #214 (first time) ssl_session_init: initializing ptr 0x7facc3830070 size 688 conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 53394 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4450 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #216 (first time) conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070 record: offset = 0, reported_length_remaining = 1416 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0033 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 5e 31 7b 8e 79 15 59 4b b1 fb e9 cb 20 92 4b 99 |^1{.y.YK.... .K.| | aa 7e ac c6 c6 43 15 2f da 4c 82 5c 0b 1e ad f3 |.~...C./.L.\....| | 9f e4 a2 83 c1 9c d9 f1 c7 c8 2e 6e c1 11 6f 1f |...........n..o.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 22 1d 36 cb 96 d5 6b 2b 19 e2 9b 73 23 2d bd ea |".6...k+...s#-..| | 5d b3 3f 1c d2 b6 36 f6 df 51 2b 46 cd 52 34 bf |].?...6..Q+F.R4.| | 22 7d 0c fc d5 2d e6 89 a6 94 a4 69 22 8b 09 06 |"}...-.....i"...| | 68 e9 4f 91 ae ab 3a db 64 a0 d9 c6 92 |h.O...:.d.... | hash out[104]: | 20 b9 33 62 84 c4 81 bc cb fe d3 64 6b 4a 32 55 | .3b.......dkJ2U| | 12 8d 5e cd 95 7c f3 a1 7a aa e2 18 7c 14 5d eb |..^..|..z...|.].| | 44 de 1a 0e 8a 57 0f 31 11 18 c5 bf 7e 5f bb 80 |D....W.1....~_..| | 77 75 fd 33 6b 6e 72 b1 07 70 86 4b b1 1b 9b ae |wu.3knr..p.K....| | 7b da 46 f1 ee c2 e8 8f 40 64 89 a4 db 02 a5 98 |{.F.....@d......| | ec 83 72 a5 bb 31 a1 f2 93 d5 7f 76 99 ec f0 49 |..r..1.....v...I| | 4f 34 55 ac 31 de 9b 4e |O4U.1..N | PRF out[104]: | 20 b9 33 62 84 c4 81 bc cb fe d3 64 6b 4a 32 55 | .3b.......dkJ2U| | 12 8d 5e cd 95 7c f3 a1 7a aa e2 18 7c 14 5d eb |..^..|..z...|.].| | 44 de 1a 0e 8a 57 0f 31 11 18 c5 bf 7e 5f bb 80 |D....W.1....~_..| | 77 75 fd 33 6b 6e 72 b1 07 70 86 4b b1 1b 9b ae |wu.3knr..p.K....| | 7b da 46 f1 ee c2 e8 8f 40 64 89 a4 db 02 a5 98 |{.F.....@d......| | ec 83 72 a5 bb 31 a1 f2 93 d5 7f 76 99 ec f0 49 |..r..1.....v...I| | 4f 34 55 ac 31 de 9b 4e |O4U.1..N | key expansion[104]: | 20 b9 33 62 84 c4 81 bc cb fe d3 64 6b 4a 32 55 | .3b.......dkJ2U| | 12 8d 5e cd 95 7c f3 a1 7a aa e2 18 7c 14 5d eb |..^..|..z...|.].| | 44 de 1a 0e 8a 57 0f 31 11 18 c5 bf 7e 5f bb 80 |D....W.1....~_..| | 77 75 fd 33 6b 6e 72 b1 07 70 86 4b b1 1b 9b ae |wu.3knr..p.K....| | 7b da 46 f1 ee c2 e8 8f 40 64 89 a4 db 02 a5 98 |{.F.....@d......| | ec 83 72 a5 bb 31 a1 f2 93 d5 7f 76 99 ec f0 49 |..r..1.....v...I| | 4f 34 55 ac 31 de 9b 4e |O4U.1..N | Client MAC key[20]: | 20 b9 33 62 84 c4 81 bc cb fe d3 64 6b 4a 32 55 | .3b.......dkJ2U| | 12 8d 5e cd |..^. | Server MAC key[20]: | 95 7c f3 a1 7a aa e2 18 7c 14 5d eb 44 de 1a 0e |.|..z...|.].D...| | 8a 57 0f 31 |.W.1 | Client Write key[16]: | 11 18 c5 bf 7e 5f bb 80 77 75 fd 33 6b 6e 72 b1 |....~_..wu.3knr.| Server Write key[16]: | 07 70 86 4b b1 1b 9b ae 7b da 46 f1 ee c2 e8 8f |.p.K....{.F.....| Client Write IV[16]: | 40 64 89 a4 db 02 a5 98 ec 83 72 a5 bb 31 a1 f2 |@d........r..1..| Server Write IV[16]: | 93 d5 7f 76 99 ec f0 49 4f 34 55 ac 31 de 9b 4e |...v...IO4U.1..N| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 1353 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 541 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 527, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407 record: offset = 1407, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416 dissect_ssl enter frame #218 (first time) conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91ae... looking for RSA pre-master008098036d78af04b0df0adf81fd3d92912cfb41a1fd72f7... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 63 f4 d7 a0 ff 85 99 42 04 ea ca 66 0b 37 80 c6 |c......B...f.7..| | db 35 98 04 22 13 99 7c c2 a8 8a d9 17 83 19 46 |.5.."..|.......F| | 47 6c 12 01 69 e7 d8 16 7f e8 32 b6 e0 96 79 03 |Gl..i.....2...y.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 22 1d 36 cb 96 d5 6b 2b 19 e2 9b 73 23 2d bd ea |".6...k+...s#-..| | 5d b3 3f 1c d2 b6 36 f6 df 51 2b 46 cd 52 34 bf |].?...6..Q+F.R4.| | 22 7d 0c fc d5 2d e6 89 a6 94 a4 69 22 8b 09 06 |"}...-.....i"...| | 68 e9 4f 91 ae ab 3a db 64 a0 d9 c6 92 |h.O...:.d.... | hash out[104]: | 73 ec 98 7c 79 9d a6 23 e6 42 10 be cb 1f b3 82 |s..|y..#.B......| | 8e 88 30 09 ae e3 75 36 0e 9b a6 f8 73 b0 e5 8a |..0...u6....s...| | 28 58 15 6a c9 8d a4 90 b2 d6 70 be b2 30 1a c6 |(X.j......p..0..| | 4e d8 15 e0 d6 67 b7 8c 4d 85 e0 53 35 84 95 4e |N....g..M..S5..N| | 73 10 4d 3f 4a fc 2e ae c5 ae 50 0f f8 b1 f9 10 |s.M?J.....P.....| | cc cd 68 1a 7f e7 09 5a e0 00 51 bf 15 2b 12 bf |..h....Z..Q..+..| | f4 d3 a8 8e ab 53 46 db |.....SF. | PRF out[104]: | 73 ec 98 7c 79 9d a6 23 e6 42 10 be cb 1f b3 82 |s..|y..#.B......| | 8e 88 30 09 ae e3 75 36 0e 9b a6 f8 73 b0 e5 8a |..0...u6....s...| | 28 58 15 6a c9 8d a4 90 b2 d6 70 be b2 30 1a c6 |(X.j......p..0..| | 4e d8 15 e0 d6 67 b7 8c 4d 85 e0 53 35 84 95 4e |N....g..M..S5..N| | 73 10 4d 3f 4a fc 2e ae c5 ae 50 0f f8 b1 f9 10 |s.M?J.....P.....| | cc cd 68 1a 7f e7 09 5a e0 00 51 bf 15 2b 12 bf |..h....Z..Q..+..| | f4 d3 a8 8e ab 53 46 db |.....SF. | key expansion[104]: | 73 ec 98 7c 79 9d a6 23 e6 42 10 be cb 1f b3 82 |s..|y..#.B......| | 8e 88 30 09 ae e3 75 36 0e 9b a6 f8 73 b0 e5 8a |..0...u6....s...| | 28 58 15 6a c9 8d a4 90 b2 d6 70 be b2 30 1a c6 |(X.j......p..0..| | 4e d8 15 e0 d6 67 b7 8c 4d 85 e0 53 35 84 95 4e |N....g..M..S5..N| | 73 10 4d 3f 4a fc 2e ae c5 ae 50 0f f8 b1 f9 10 |s.M?J.....P.....| | cc cd 68 1a 7f e7 09 5a e0 00 51 bf 15 2b 12 bf |..h....Z..Q..+..| | f4 d3 a8 8e ab 53 46 db |.....SF. | Client MAC key[20]: | 73 ec 98 7c 79 9d a6 23 e6 42 10 be cb 1f b3 82 |s..|y..#.B......| | 8e 88 30 09 |..0. | Server MAC key[20]: | ae e3 75 36 0e 9b a6 f8 73 b0 e5 8a 28 58 15 6a |..u6....s...(X.j| | c9 8d a4 90 |.... | Client Write key[16]: | b2 d6 70 be b2 30 1a c6 4e d8 15 e0 d6 67 b7 8c |..p..0..N....g..| Server Write key[16]: | 4d 85 e0 53 35 84 95 4e 73 10 4d 3f 4a fc 2e ae |M..S5..Ns.M?J...| Client Write IV[16]: | c5 ae 50 0f f8 b1 f9 10 cc cd 68 1a 7f e7 09 5a |..P.......h....Z| Server Write IV[16]: | e0 00 51 bf 15 2b 12 bf f4 d3 a8 8e ab 53 46 db |..Q..+.......SF.| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 63 f4 d7 a0 ff 85 99 42 04 ea ca 66 0b 37 80 c6 |c......B...f.7..| | db 35 98 04 22 13 99 7c c2 a8 8a d9 17 83 19 46 |.5.."..|.......F| | 47 6c 12 01 69 e7 d8 16 7f e8 32 b6 e0 96 79 03 |Gl..i.....2...y.| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | da 1e 53 71 13 06 e0 4d 50 f4 f5 1e 8f 8b 4f 61 |..Sq...MP.....Oa| | a3 c6 75 18 d0 87 99 db 1a 5f 08 a9 b6 e9 f6 43 |..u......_.....C| | d9 d4 ef f2 73 f9 06 10 90 2c 8a a1 fe b9 48 b1 |....s....,....H.| | 36 48 2d 85 db b2 03 6a 22 30 bd d6 56 24 ea f5 |6H-....j"0..V$..| Plaintext[64]: | 34 6c 1c 72 2e c6 f9 f4 7b d1 c7 4c ce ac 42 0d |4l.r....{..L..B.| | 14 00 00 0c 62 68 8e 07 e3 e9 87 c4 64 4c ae 96 |....bh......dL..| | 4e 1c e2 21 5f fc c0 f8 b9 e8 7b 8e 10 9b cc ee |N..!_.....{.....| | 01 e1 50 3f 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..P?............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 4e 1c e2 21 5f fc c0 f8 b9 e8 7b 8e 10 9b cc ee |N..!_.....{.....| | 01 e1 50 3f |..P? | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #219 (first time) conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | de 04 09 48 bb 04 88 66 86 4f 28 a4 c4 98 58 02 |...H...f.O(...X.| | 3d 86 95 4a 9c a3 45 1e eb c4 27 9d 85 9a d6 b0 |=..J..E...'.....| | 4e cf c3 04 7d c0 1d 1a a1 0d e2 9f 72 a6 fa bb |N...}.......r...| | fe 60 f0 63 53 11 d6 bb a7 5d b4 be d7 dd ae 10 |.`.cS....]......| Plaintext[64]: | 60 fc 5d e4 11 09 ef 6f 85 b6 6e cd 0c a9 70 db |`.]....o..n...p.| | 14 00 00 0c a3 db ba fd 9c b7 bc e4 1d c6 6b ac |..............k.| | 63 80 67 ce 10 1f dd 03 64 3d 43 a4 92 06 31 9c |c.g.....d=C...1.| | c6 6d 9d 76 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.m.v............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 63 80 67 ce 10 1f dd 03 64 3d 43 a4 92 06 31 9c |c.g.....d=C...1.| | c6 6d 9d 76 |.m.v | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #220 (first time) conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | f6 fe b7 9f c5 71 d6 09 31 21 97 31 71 2c ea 1e |.....q..1!.1q,..| | 46 d6 3b 94 19 f7 62 c3 5d 89 ee 1e aa e5 c8 03 |F.;...b.].......| | 3d 14 f5 36 4b 67 ef 79 fc 5b b5 e1 c2 0d eb bf |=..6Kg.y.[......| | 81 b3 9c 38 bb 8f af 7c 1c a2 06 de 1e 33 47 9a |...8...|.....3G.| | 3d ce d8 f7 ea f1 ff dc 88 76 b0 90 0c 46 8d bc |=........v...F..| | 7e c3 a1 5f 7c 0a 39 1d b2 07 ec 63 aa 66 d8 59 |~.._|.9....c.f.Y| | bf fb 7f 05 77 51 19 59 2d 4b aa 53 93 dd f6 73 |....wQ.Y-K.S...s| Plaintext[112]: | da bc 75 e8 e2 36 3a 4a 75 2d 01 cf ba 6a 95 58 |..u..6:Ju-...j.X| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 61 65 |Host: dhe-rsa-ae| | 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s128-sha.local.a| | 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:| | 34 34 35 30 0d 0a 0d 0a 77 96 c7 8d e2 d2 15 e5 |4450....w.......| | 2d 77 c1 73 5e b2 37 5c d6 98 c4 28 03 03 03 03 |-w.s^.7\...(....| ssl_decrypt_record found padding 3 final len 108 checking mac (len 72, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 8b 17 28 9f f4 2e cf 5e f1 f4 29 db e2 ea b8 33 |..(....^..)....3| | fa d1 e7 58 |...X | ssl_decrypt_record: mac failed association_find: TCP port 53394 found (nil) association_find: TCP port 4450 found 0x342de60 dissect_ssl enter frame #221 (first time) conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | 85 90 11 f6 15 d2 7c 8b 27 50 90 40 d2 e9 4b 86 |......|.'P.@..K.| | f8 40 92 7b e3 cc fb b5 e6 75 61 61 fb a4 1f a0 |.@.{.....uaa....| | 44 8a be c2 f5 10 41 8b 53 81 8c 69 01 13 14 b5 |D.....A.S..i....| | d8 eb 77 35 e1 5c 9f 07 11 af 60 6e b3 55 55 e6 |..w5.\....`n.UU.| | 4d e4 6e ba 2c a9 ee 82 29 11 7c 94 94 e6 00 da |M.n.,...).|.....| | 4d 31 7e f8 1e 75 78 8d c4 dd 2b 39 eb 87 0b 6a |M1~..ux...+9...j| | 76 a1 5d aa 5f 30 b9 ef a7 61 95 74 f9 2c a0 0f |v.]._0...a.t.,..| | f3 ca b7 b1 55 6b d5 7d 4b 9d 15 48 c7 03 92 c8 |....Uk.}K..H....| | 2a 47 a4 fa c5 90 2a 19 df d4 e8 1b 21 6f 4f f5 |*G....*.....!oO.| | fc 75 01 57 94 d6 24 ae ba d2 56 99 16 ef f2 43 |.u.W..$...V....C| | ad c6 c2 fe ad 7b cf b2 30 1d ab 4c 1e 7b 01 d0 |.....{..0..L.{..| | f7 d7 d4 dd 0d 9d 3b a5 77 43 b3 f2 92 41 0f bc |......;.wC...A..| | 5c be c8 55 ee 53 2a cb 79 12 de b2 8b 95 9e f3 |\..U.S*.y.......| | cd c0 f4 1a a4 ad be 94 30 00 c0 fd 0f 34 c5 a8 |........0....4..| | 36 ea b8 f2 33 af 2e 5e 1e c4 45 30 59 22 db a3 |6...3..^..E0Y"..| | 75 da 27 c9 c1 6e 99 73 83 db 49 00 44 9e 81 7a |u.'..n.s..I.D..z| | b2 b4 55 6d 4d ba d6 08 c2 61 41 f4 76 ab c2 dd |..UmM....aA.v...| | 2a 32 a4 49 82 12 f3 43 eb 94 22 56 2a 12 78 a1 |*2.I...C.."V*.x.| | 38 ab fb c8 fb 7c 9d f6 15 62 e2 98 d8 e9 14 0d |8....|...b......| | ab 0a d6 dd db 7f cc 92 81 ab fb 36 3d 32 64 a5 |...........6=2d.| | a0 d4 99 4f c2 d9 5e 2a 69 80 ab 9f 3b 2c 69 2f |...O..^*i...;,i/| | eb 9b fc dd a4 b1 51 eb f8 cd fd 82 2d 12 cf 3f |......Q.....-..?| | db c5 ec af 29 2f 89 6e 84 1b f3 81 7e b5 42 0c |....)/.n....~.B.| | 28 d4 48 8a 56 ad 0a cb 53 1c 11 f7 dd 17 f5 33 |(.H.V...S......3| | ca 61 bb 25 e1 17 d4 54 be 6a 35 9d 06 61 3e c1 |.a.%...T.j5..a>.| Plaintext[400]: | 0d cd 43 22 4e ee 0e 02 2d 1a 62 80 89 7a 97 9b |..C"N...-.b..z..| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:| | 35 35 3a 31 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:14 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 33 33 20 2d 20 44 48 45 2d 52 |x00,0x33 - DHE-R| | 53 41 2d 41 45 53 31 32 38 2d 53 48 41 20 20 20 |SA-AES128-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1.x].| | f5 ae 76 de ee 26 9b b1 fb df b3 42 94 8f 67 67 |..v..&.....B..gg| | 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................| ssl_decrypt_record found padding 15 final len 384 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | bc 41 56 7d 9e 88 34 95 b0 3d 51 2b ad 81 89 3b |.AV}..4..=Q+...;| | 6f 02 89 b2 |o... | ssl_decrypt_record: mac failed association_find: TCP port 4450 found 0x342de60 dissect_ssl enter frame #222 (first time) conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 56 07 e5 3d a8 e5 e2 b7 82 32 98 51 b0 cd db 92 |V..=.....2.Q....| | 2e 71 94 4f 2c 50 48 f5 7c 00 e3 d6 53 ac ce 61 |.q.O,PH.|...S..a| | 32 c9 92 6a 9f 88 8e 81 0a fe 83 86 70 9b 87 4f |2..j........p..O| Plaintext[48]: | 6d fa 5a c7 06 29 98 f9 67 3a 23 41 64 47 1a b1 |m.Z..)..g:#AdG..| | 01 00 e1 1d 91 04 8d c6 33 e0 b0 24 5b 34 39 3a |........3..$[49:| | 9e de e2 14 20 24 09 09 09 09 09 09 09 09 09 09 |.... $..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | e1 1d 91 04 8d c6 33 e0 b0 24 5b 34 39 3a 9e de |......3..$[49:..| | e2 14 20 24 |.. $ | ssl_decrypt_record: mac ok dissect_ssl enter frame #224 (first time) conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 67 87 bf 08 17 6d a5 3e 16 71 61 9c ca bb 8c 3e |g....m.>.qa....>| | e7 99 6f c3 8d 4b 94 e7 db 4d e8 d0 17 c8 ce fe |..o..K...M......| | 00 aa ed e8 69 4a 6c ff a6 1e 58 e6 86 04 27 33 |....iJl...X...'3| Plaintext[48]: | c6 1e 1e 46 38 d7 d1 db 27 a5 9b bf 8d a9 61 08 |...F8...'.....a.| | 01 00 33 cc ca a3 56 5c 16 c8 a5 bc ed 01 71 03 |..3...V\......q.| | 18 63 43 5f 7c 01 09 09 09 09 09 09 09 09 09 09 |.cC_|...........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 33 cc ca a3 56 5c 16 c8 a5 bc ed 01 71 03 18 63 |3...V\......q..c| | 43 5f 7c 01 |C_|. | ssl_decrypt_record: mac ok dissect_ssl enter frame #229 (first time) ssl_session_init: initializing ptr 0x7facc3832570 size 688 conversation = 0x7facef998a58, ssl_session = 0x7facc3832570 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 45991 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4451 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #231 (first time) conversation = 0x7facef998a58, ssl_session = 0x7facc3832570 record: offset = 0, reported_length_remaining = 884 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0035 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 63 f4 d7 a0 ff 85 99 42 04 ea ca 66 0b 37 80 c6 |c......B...f.7..| | db 35 98 04 22 13 99 7c c2 a8 8a d9 17 83 19 46 |.5.."..|.......F| | 47 6c 12 01 69 e7 d8 16 7f e8 32 b6 e0 96 79 03 |Gl..i.....2...y.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 22 a1 3b b3 4c e2 97 d8 58 b8 13 bf b7 04 0c 2b |".;.L...X......+| | 8f cc 7b 08 f4 4e 83 58 2b 01 61 ee 5b 52 34 bf |..{..N.X+.a.[R4.| | 22 d6 d5 c5 a6 3c 2c de 9b 46 13 3f bd 92 25 2a |"....<,..F.?..%*| | 89 89 8b 8a 09 7a bd 69 bd 4b 0d 52 c3 |.....z.i.K.R. | hash out[136]: | 80 6f 5f 48 fb 67 16 f3 c9 12 64 ee 65 7e 77 84 |.o_H.g....d.e~w.| | 04 1a 3c ec 2b 78 c7 ec ee ea 76 f8 65 8e 0f fd |..<.+x....v.e...| | fe 19 46 0c ef 8b e8 ad 7c 4f 97 74 31 57 f5 57 |..F.....|O.t1W.W| | 56 47 bc ef 4c c7 33 8e 92 f0 b6 6a 3b c7 ea 55 |VG..L.3....j;..U| | a8 aa 22 d0 26 cf 0c 08 01 13 48 92 c8 21 0a eb |..".&.....H..!..| | f9 8e 71 e5 1e 7d 6f 45 07 69 f9 2e 7e 6e 07 a4 |..q..}oE.i..~n..| | f7 64 2e 37 7c 5f b3 c8 ff 79 6e c4 8c 8b 77 88 |.d.7|_...yn...w.| | af 92 1c 13 83 9c 43 75 3a ca a7 e2 49 a7 0b bb |......Cu:...I...| | 52 f0 f8 09 aa 19 a5 43 |R......C | PRF out[136]: | 80 6f 5f 48 fb 67 16 f3 c9 12 64 ee 65 7e 77 84 |.o_H.g....d.e~w.| | 04 1a 3c ec 2b 78 c7 ec ee ea 76 f8 65 8e 0f fd |..<.+x....v.e...| | fe 19 46 0c ef 8b e8 ad 7c 4f 97 74 31 57 f5 57 |..F.....|O.t1W.W| | 56 47 bc ef 4c c7 33 8e 92 f0 b6 6a 3b c7 ea 55 |VG..L.3....j;..U| | a8 aa 22 d0 26 cf 0c 08 01 13 48 92 c8 21 0a eb |..".&.....H..!..| | f9 8e 71 e5 1e 7d 6f 45 07 69 f9 2e 7e 6e 07 a4 |..q..}oE.i..~n..| | f7 64 2e 37 7c 5f b3 c8 ff 79 6e c4 8c 8b 77 88 |.d.7|_...yn...w.| | af 92 1c 13 83 9c 43 75 3a ca a7 e2 49 a7 0b bb |......Cu:...I...| | 52 f0 f8 09 aa 19 a5 43 |R......C | key expansion[136]: | 80 6f 5f 48 fb 67 16 f3 c9 12 64 ee 65 7e 77 84 |.o_H.g....d.e~w.| | 04 1a 3c ec 2b 78 c7 ec ee ea 76 f8 65 8e 0f fd |..<.+x....v.e...| | fe 19 46 0c ef 8b e8 ad 7c 4f 97 74 31 57 f5 57 |..F.....|O.t1W.W| | 56 47 bc ef 4c c7 33 8e 92 f0 b6 6a 3b c7 ea 55 |VG..L.3....j;..U| | a8 aa 22 d0 26 cf 0c 08 01 13 48 92 c8 21 0a eb |..".&.....H..!..| | f9 8e 71 e5 1e 7d 6f 45 07 69 f9 2e 7e 6e 07 a4 |..q..}oE.i..~n..| | f7 64 2e 37 7c 5f b3 c8 ff 79 6e c4 8c 8b 77 88 |.d.7|_...yn...w.| | af 92 1c 13 83 9c 43 75 3a ca a7 e2 49 a7 0b bb |......Cu:...I...| | 52 f0 f8 09 aa 19 a5 43 |R......C | Client MAC key[20]: | 80 6f 5f 48 fb 67 16 f3 c9 12 64 ee 65 7e 77 84 |.o_H.g....d.e~w.| | 04 1a 3c ec |..<. | Server MAC key[20]: | 2b 78 c7 ec ee ea 76 f8 65 8e 0f fd fe 19 46 0c |+x....v.e.....F.| | ef 8b e8 ad |.... | Client Write key[32]: | 7c 4f 97 74 31 57 f5 57 56 47 bc ef 4c c7 33 8e ||O.t1W.WVG..L.3.| | 92 f0 b6 6a 3b c7 ea 55 a8 aa 22 d0 26 cf 0c 08 |...j;..U..".&...| Server Write key[32]: | 01 13 48 92 c8 21 0a eb f9 8e 71 e5 1e 7d 6f 45 |..H..!....q..}oE| | 07 69 f9 2e 7e 6e 07 a4 f7 64 2e 37 7c 5f b3 c8 |.i..~n...d.7|_..| Client Write IV[16]: | ff 79 6e c4 8c 8b 77 88 af 92 1c 13 83 9c 43 75 |.yn...w.......Cu| Server Write IV[16]: | 3a ca a7 e2 49 a7 0b bb 52 f0 f8 09 aa 19 a5 43 |:...I...R......C| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 821 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884 dissect_ssl enter frame #233 (first time) conversation = 0x7facef998a58, ssl_session = 0x7facc3832570 record: offset = 0, reported_length_remaining = 342 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 262, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a09... looking for RSA pre-master7c97fd12116f5cd9318ea3c2fd49a66dedcd1c3dd6580709... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 9f 19 d2 38 de 2c 1c fa 56 ca 36 20 11 21 6e 09 |...8.,..V.6 .!n.| | be 33 a4 f0 08 e7 e5 86 a2 bf 27 ad f7 82 80 eb |.3........'.....| | c0 78 d9 82 bc 20 48 64 9f de 6e a2 ce a0 ee c5 |.x... Hd..n.....| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 22 a1 3b b3 4c e2 97 d8 58 b8 13 bf b7 04 0c 2b |".;.L...X......+| | 8f cc 7b 08 f4 4e 83 58 2b 01 61 ee 5b 52 34 bf |..{..N.X+.a.[R4.| | 22 d6 d5 c5 a6 3c 2c de 9b 46 13 3f bd 92 25 2a |"....<,..F.?..%*| | 89 89 8b 8a 09 7a bd 69 bd 4b 0d 52 c3 |.....z.i.K.R. | hash out[136]: | 76 7c a1 87 18 28 64 7b 20 6e df ca 3b b2 5f 2b |v|...(d{ n..;._+| | 00 2d f7 36 39 a4 b4 23 28 89 0c 6b 7f 56 a1 5c |.-.69..#(..k.V.\| | 8f 11 5c bb 27 8a 75 ae e5 21 ca ce 1b 2f 90 38 |..\.'.u..!.../.8| | 07 16 01 63 3c 91 ab 4a c4 82 b4 46 82 8b cc e2 |...c<..J...F....| | 53 21 62 af d0 8f aa fe 36 ba 16 c9 7b e9 2a b7 |S!b.....6...{.*.| | b7 80 d1 e2 1d 93 5f 44 79 a9 9e 3e 68 5c 89 3e |......_Dy..>h\.>| | cc 50 32 89 15 d4 99 26 08 c5 c8 26 75 f7 2a ed |.P2....&...&u.*.| | 24 ba 5f 03 57 b4 69 ba 0f 9d 74 ea d4 46 bb 51 |$._.W.i...t..F.Q| | 6a b3 10 38 53 5b df 4d |j..8S[.M | PRF out[136]: | 76 7c a1 87 18 28 64 7b 20 6e df ca 3b b2 5f 2b |v|...(d{ n..;._+| | 00 2d f7 36 39 a4 b4 23 28 89 0c 6b 7f 56 a1 5c |.-.69..#(..k.V.\| | 8f 11 5c bb 27 8a 75 ae e5 21 ca ce 1b 2f 90 38 |..\.'.u..!.../.8| | 07 16 01 63 3c 91 ab 4a c4 82 b4 46 82 8b cc e2 |...c<..J...F....| | 53 21 62 af d0 8f aa fe 36 ba 16 c9 7b e9 2a b7 |S!b.....6...{.*.| | b7 80 d1 e2 1d 93 5f 44 79 a9 9e 3e 68 5c 89 3e |......_Dy..>h\.>| | cc 50 32 89 15 d4 99 26 08 c5 c8 26 75 f7 2a ed |.P2....&...&u.*.| | 24 ba 5f 03 57 b4 69 ba 0f 9d 74 ea d4 46 bb 51 |$._.W.i...t..F.Q| | 6a b3 10 38 53 5b df 4d |j..8S[.M | key expansion[136]: | 76 7c a1 87 18 28 64 7b 20 6e df ca 3b b2 5f 2b |v|...(d{ n..;._+| | 00 2d f7 36 39 a4 b4 23 28 89 0c 6b 7f 56 a1 5c |.-.69..#(..k.V.\| | 8f 11 5c bb 27 8a 75 ae e5 21 ca ce 1b 2f 90 38 |..\.'.u..!.../.8| | 07 16 01 63 3c 91 ab 4a c4 82 b4 46 82 8b cc e2 |...c<..J...F....| | 53 21 62 af d0 8f aa fe 36 ba 16 c9 7b e9 2a b7 |S!b.....6...{.*.| | b7 80 d1 e2 1d 93 5f 44 79 a9 9e 3e 68 5c 89 3e |......_Dy..>h\.>| | cc 50 32 89 15 d4 99 26 08 c5 c8 26 75 f7 2a ed |.P2....&...&u.*.| | 24 ba 5f 03 57 b4 69 ba 0f 9d 74 ea d4 46 bb 51 |$._.W.i...t..F.Q| | 6a b3 10 38 53 5b df 4d |j..8S[.M | Client MAC key[20]: | 76 7c a1 87 18 28 64 7b 20 6e df ca 3b b2 5f 2b |v|...(d{ n..;._+| | 00 2d f7 36 |.-.6 | Server MAC key[20]: | 39 a4 b4 23 28 89 0c 6b 7f 56 a1 5c 8f 11 5c bb |9..#(..k.V.\..\.| | 27 8a 75 ae |'.u. | Client Write key[32]: | e5 21 ca ce 1b 2f 90 38 07 16 01 63 3c 91 ab 4a |.!.../.8...c<..J| | c4 82 b4 46 82 8b cc e2 53 21 62 af d0 8f aa fe |...F....S!b.....| Server Write key[32]: | 36 ba 16 c9 7b e9 2a b7 b7 80 d1 e2 1d 93 5f 44 |6...{.*......._D| | 79 a9 9e 3e 68 5c 89 3e cc 50 32 89 15 d4 99 26 |y..>h\.>.P2....&| Client Write IV[16]: | 08 c5 c8 26 75 f7 2a ed 24 ba 5f 03 57 b4 69 ba |...&u.*.$._.W.i.| Server Write IV[16]: | 0f 9d 74 ea d4 46 bb 51 6a b3 10 38 53 5b df 4d |..t..F.Qj..8S[.M| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 9f 19 d2 38 de 2c 1c fa 56 ca 36 20 11 21 6e 09 |...8.,..V.6 .!n.| | be 33 a4 f0 08 e7 e5 86 a2 bf 27 ad f7 82 80 eb |.3........'.....| | c0 78 d9 82 bc 20 48 64 9f de 6e a2 ce a0 ee c5 |.x... Hd..n.....| dissect_ssl3_handshake session keys successfully generated record: offset = 267, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 273, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 8c 5f 0e c2 4f 0d dc 70 fa 81 64 3a 7f df 6f 8a |._..O..p..d:..o.| | 65 73 62 2a 29 20 d4 c0 f1 da c9 6f 5a 2a 28 4e |esb*) .....oZ*(N| | 73 01 d3 3c 23 a0 8d ce ac df 8a 15 6b 27 40 ff |s..<#.......k'@.| | fe 10 b0 d9 e2 d1 87 33 8c 11 84 4b 4b d2 5e a1 |.......3...KK.^.| Plaintext[64]: | a3 e6 4c 96 5b 0a db 17 31 13 95 cc f2 bc b5 d5 |..L.[...1.......| | 14 00 00 0c a8 bd 4b 1c 45 58 96 01 31 fc b9 72 |......K.EX..1..r| | 90 7a ef 96 de 27 47 60 0a 9d 7b e9 1f e6 e5 15 |.z...'G`..{.....| | a7 59 ff 35 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.Y.5............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 90 7a ef 96 de 27 47 60 0a 9d 7b e9 1f e6 e5 15 |.z...'G`..{.....| | a7 59 ff 35 |.Y.5 | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #234 (first time) conversation = 0x7facef998a58, ssl_session = 0x7facc3832570 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | dc 75 bf d7 50 2f 48 80 b7 82 c3 2c 9b 6f f2 e3 |.u..P/H....,.o..| | 24 9f d6 90 8c 41 02 9c 33 6f 04 3e 10 a2 f2 90 |$....A..3o.>....| | 2a 2b ed 75 f9 3e 2f 17 4f 4b 72 fc ee 11 ce cc |*+.u.>/.OKr.....| | 8c b0 3a 57 7e aa 79 2b 34 bc 75 2a ff 0c 3f 21 |..:W~.y+4.u*..?!| Plaintext[64]: | a9 ff 4a 61 99 33 93 3c ee 55 f2 51 a6 1e 53 9c |..Ja.3.<.U.Q..S.| | 14 00 00 0c ff 37 53 48 fe fb 5f ef 96 28 b4 62 |.....7SH.._..(.b| | 68 ae d5 35 86 24 f0 eb 3e 27 cd 41 78 dd a0 77 |h..5.$..>'.Ax..w| | 62 e4 e4 d8 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |b...............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 68 ae d5 35 86 24 f0 eb 3e 27 cd 41 78 dd a0 77 |h..5.$..>'.Ax..w| | 62 e4 e4 d8 |b... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #235 (first time) conversation = 0x7facef998a58, ssl_session = 0x7facc3832570 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | a9 ac 77 6a b9 49 cc 01 9e 99 52 80 0d c3 cd a9 |..wj.I....R.....| | d5 fe 73 b5 08 3b 39 9b 74 b2 db 0d 27 96 03 fa |..s..;9.t...'...| | e0 9e 07 37 fc 80 21 9b 6d bc d0 8a d2 8e d0 fb |...7..!.m.......| | c4 9a 33 3f be 1b 78 37 c9 fd cb 10 b7 85 26 12 |..3?..x7......&.| | 0a 72 19 84 27 7e fa 65 35 0c be 30 eb 96 eb c5 |.r..'~.e5..0....| | 8f 6e b2 72 84 89 d3 ef 1e 28 43 7d 7d f1 65 25 |.n.r.....(C}}.e%| | 44 fe 89 21 bb 84 11 ec 90 c8 43 d1 8b cf 49 3d |D..!......C...I=| Plaintext[112]: | 0d dc fe 87 9e 66 d3 86 a2 96 4e 92 2f e1 8f 4e |.....f....N./..N| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 61 65 73 32 35 36 2d 73 68 61 |Host: aes256-sha| | 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 |.local.al.lekens| | 74 65 79 6e 2e 6e 6c 3a 34 34 35 31 0d 0a 0d 0a |teyn.nl:4451....| | 55 00 17 d7 9e 89 64 21 f1 d5 16 e3 54 8a a1 72 |U.....d!....T..r| | 6d ea 4e 84 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |m.N.............| ssl_decrypt_record found padding 11 final len 100 checking mac (len 64, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 33 c7 49 3c 3f 3f 62 74 b0 97 4b 0c d1 15 9d 50 |3.I.4.| | a3 98 c3 d0 5d dc e6 5f 31 12 64 76 f8 66 1d da |....].._1.dv.f..| | d0 e5 61 fd ef fd b4 b2 0e ff 6f 19 12 ab 8c f5 |..a.......o.....| | ba 63 97 50 d7 f4 34 63 9b be aa 7e 18 9b 8b f7 |.c.P..4c...~....| | 49 5a 73 bf 30 e2 6f 78 fb c4 fb 32 60 dc 0a 48 |IZs.0.ox...2`..H| | bb a5 64 17 43 25 37 70 dc 95 21 64 6d f4 41 48 |..d.C%7p..!dm.AH| | 66 c7 0b 01 cd d6 8b 40 96 63 16 52 64 53 84 38 |f......@.c.RdS.8| | 94 15 bc 95 a9 c0 00 2f a3 22 89 bf d0 da 89 02 |......./."......| | 7d de a7 cc 6c 1e c9 e2 18 1e 9d 79 0b ce fe 8c |}...l......y....| | da c7 74 e9 8a 14 f4 3e 64 bf 70 e2 5b 53 d1 92 |..t....>d.p.[S..| | 4c e9 a0 2b a5 ce 4c a3 e7 72 be 63 08 6c 4f 58 |L..+..L..r.c.lOX| | 2e 94 3a 8a 7b 92 f7 46 aa 47 e4 28 16 12 27 68 |..:.{..F.G.(..'h| Plaintext[400]: | fe 07 3e 92 d3 80 72 af 82 76 8c 41 23 45 c9 c5 |..>...r..v.A#E..| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:| | 35 35 3a 31 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:14 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 33 35 20 2d 20 41 45 53 32 35 |x00,0x35 - AES25| | 36 2d 53 48 41 20 20 20 20 20 20 20 20 20 20 20 |6-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1...#| | a0 00 9c 53 8c 7e d3 dc 68 98 1b da 1b ec 58 43 |...S.~..h.....XC| | 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................| ssl_decrypt_record found padding 15 final len 384 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | f9 f1 83 ba 77 40 95 49 8e 20 1e 75 be 14 e2 8c |....w@.I. .u....| | 6c 49 99 07 |lI.. | ssl_decrypt_record: mac failed association_find: TCP port 4451 found 0x3424dc0 dissect_ssl enter frame #237 (first time) conversation = 0x7facef998a58, ssl_session = 0x7facc3832570 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 78 26 87 b1 f9 e8 f1 33 20 91 34 02 00 78 4e 4a |x&.....3 .4..xNJ| | 91 3b 8b 17 91 de b0 cc fa c2 8c f5 1d 82 d1 a8 |.;..............| | d0 af b1 ba 6d a1 73 0f 51 f1 50 57 1c 94 6c 10 |....m.s.Q.PW..l.| Plaintext[48]: | 12 ec 43 b7 63 d8 9e 38 e7 c1 31 50 b9 22 a8 d3 |..C.c..8..1P."..| | 01 00 65 14 fa 9f 64 56 39 40 f0 25 81 6b 24 2f |..e...dV9@.%.k$/| | 1f b8 98 da 0f 76 09 09 09 09 09 09 09 09 09 09 |.....v..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 65 14 fa 9f 64 56 39 40 f0 25 81 6b 24 2f 1f b8 |e...dV9@.%.k$/..| | 98 da 0f 76 |...v | ssl_decrypt_record: mac ok dissect_ssl enter frame #239 (first time) conversation = 0x7facef998a58, ssl_session = 0x7facc3832570 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 4b e0 4c ca 1b c6 2a 79 38 d1 eb a9 fb 86 98 7f |K.L...*y8.......| | e0 a4 2a 34 60 a5 ba 3f c6 89 b6 d7 bc 61 48 f5 |..*4`..?.....aH.| | 05 bb e3 ea 75 ed 5d c8 a4 a0 38 68 62 d4 54 97 |....u.]...8hb.T.| Plaintext[48]: | d4 72 5e 93 4c 53 89 73 09 a8 0b 04 14 8d 12 c6 |.r^.LS.s........| | 01 00 cb dd 76 c6 cb d3 f8 d2 eb a3 d5 a6 ed 04 |....v...........| | a5 bf 7f 45 a1 19 09 09 09 09 09 09 09 09 09 09 |...E............| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | cb dd 76 c6 cb d3 f8 d2 eb a3 d5 a6 ed 04 a5 bf |..v.............| | 7f 45 a1 19 |.E.. | ssl_decrypt_record: mac ok dissect_ssl enter frame #244 (first time) ssl_session_init: initializing ptr 0x7facc3834af0 size 688 conversation = 0x7facef998d00, ssl_session = 0x7facc3834af0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 44935 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4452 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #246 (first time) conversation = 0x7facef998d00, ssl_session = 0x7facc3834af0 record: offset = 0, reported_length_remaining = 1134 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0038 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 9f 19 d2 38 de 2c 1c fa 56 ca 36 20 11 21 6e 09 |...8.,..V.6 .!n.| | be 33 a4 f0 08 e7 e5 86 a2 bf 27 ad f7 82 80 eb |.3........'.....| | c0 78 d9 82 bc 20 48 64 9f de 6e a2 ce a0 ee c5 |.x... Hd..n.....| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 22 6f 00 14 e4 aa 33 40 44 06 00 79 49 27 36 75 |"o....3@D..yI'6u| | 2e 18 96 0f 52 12 f0 b1 01 c7 79 30 b8 52 34 bf |....R.....y0.R4.| | 22 c3 b0 44 e2 4b fc 9a b0 7c 23 9f fa c9 4a 6d |"..D.K...|#...Jm| | 10 7f 59 e3 2a 07 59 b6 8c 90 e0 f1 f0 |..Y.*.Y...... | hash out[136]: | 3c 7f 92 2f a1 f2 af 1e bc 3a 4d 91 ba f6 96 68 |<../.....:M....h| | 43 e3 db b2 4f 1c 9b af 3f f2 66 7a 74 a3 42 38 |C...O...?.fzt.B8| | 14 49 c8 c0 63 b9 78 f6 55 5b 32 fb 0f ef b9 7f |.I..c.x.U[2.....| | 7c bd 10 ac 89 e5 16 75 27 f9 e6 ad 8a f4 07 f7 ||......u'.......| | 6c 2b e5 05 03 31 97 b6 41 72 d3 2e 3c df 70 8d |l+...1..Ar..<.p.| | 57 a6 03 68 34 99 3e d8 d2 14 58 b2 0a 86 40 30 |W..h4.>...X...@0| | 0a 11 4f ad 47 1c 23 33 7e a1 39 52 d0 fc 07 16 |..O.G.#3~.9R....| | 32 8a 8e 80 81 aa 11 15 a0 89 d6 b5 2a 6c 8c 91 |2...........*l..| | 27 4b be af 69 fb 6e 33 |'K..i.n3 | PRF out[136]: | 3c 7f 92 2f a1 f2 af 1e bc 3a 4d 91 ba f6 96 68 |<../.....:M....h| | 43 e3 db b2 4f 1c 9b af 3f f2 66 7a 74 a3 42 38 |C...O...?.fzt.B8| | 14 49 c8 c0 63 b9 78 f6 55 5b 32 fb 0f ef b9 7f |.I..c.x.U[2.....| | 7c bd 10 ac 89 e5 16 75 27 f9 e6 ad 8a f4 07 f7 ||......u'.......| | 6c 2b e5 05 03 31 97 b6 41 72 d3 2e 3c df 70 8d |l+...1..Ar..<.p.| | 57 a6 03 68 34 99 3e d8 d2 14 58 b2 0a 86 40 30 |W..h4.>...X...@0| | 0a 11 4f ad 47 1c 23 33 7e a1 39 52 d0 fc 07 16 |..O.G.#3~.9R....| | 32 8a 8e 80 81 aa 11 15 a0 89 d6 b5 2a 6c 8c 91 |2...........*l..| | 27 4b be af 69 fb 6e 33 |'K..i.n3 | key expansion[136]: | 3c 7f 92 2f a1 f2 af 1e bc 3a 4d 91 ba f6 96 68 |<../.....:M....h| | 43 e3 db b2 4f 1c 9b af 3f f2 66 7a 74 a3 42 38 |C...O...?.fzt.B8| | 14 49 c8 c0 63 b9 78 f6 55 5b 32 fb 0f ef b9 7f |.I..c.x.U[2.....| | 7c bd 10 ac 89 e5 16 75 27 f9 e6 ad 8a f4 07 f7 ||......u'.......| | 6c 2b e5 05 03 31 97 b6 41 72 d3 2e 3c df 70 8d |l+...1..Ar..<.p.| | 57 a6 03 68 34 99 3e d8 d2 14 58 b2 0a 86 40 30 |W..h4.>...X...@0| | 0a 11 4f ad 47 1c 23 33 7e a1 39 52 d0 fc 07 16 |..O.G.#3~.9R....| | 32 8a 8e 80 81 aa 11 15 a0 89 d6 b5 2a 6c 8c 91 |2...........*l..| | 27 4b be af 69 fb 6e 33 |'K..i.n3 | Client MAC key[20]: | 3c 7f 92 2f a1 f2 af 1e bc 3a 4d 91 ba f6 96 68 |<../.....:M....h| | 43 e3 db b2 |C... | Server MAC key[20]: | 4f 1c 9b af 3f f2 66 7a 74 a3 42 38 14 49 c8 c0 |O...?.fzt.B8.I..| | 63 b9 78 f6 |c.x. | Client Write key[32]: | 55 5b 32 fb 0f ef b9 7f 7c bd 10 ac 89 e5 16 75 |U[2.....|......u| | 27 f9 e6 ad 8a f4 07 f7 6c 2b e5 05 03 31 97 b6 |'.......l+...1..| Server Write key[32]: | 41 72 d3 2e 3c df 70 8d 57 a6 03 68 34 99 3e d8 |Ar..<.p.W..h4.>.| | d2 14 58 b2 0a 86 40 30 0a 11 4f ad 47 1c 23 33 |..X...@0..O.G.#3| Client Write IV[16]: | 7e a1 39 52 d0 fc 07 16 32 8a 8e 80 81 aa 11 15 |~.9R....2.......| Server Write IV[16]: | a0 89 d6 b5 2a 6c 8c 91 27 4b be af 69 fb 6e 33 |....*l..'K..i.n3| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 1071 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 735, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803 record: offset = 803, reported_length_remaining = 331 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 808 length 313 bytes, remaining 1125 record: offset = 1125, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1130 length 0 bytes, remaining 1134 dissect_ssl enter frame #248 (first time) conversation = 0x7facef998d00, ssl_session = 0x7facc3834af0 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a... looking for RSA pre-master0080a7f168aa7ed7d19030f70c424cdc8441875d8e56e5f3... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | a7 59 28 89 bf cd 53 b6 49 5a 4f ed b0 4c a6 13 |.Y(...S.IZO..L..| | 97 f1 f8 e9 31 8b c0 e8 86 87 2b 5c c8 1e 1d e4 |....1.....+\....| | 85 42 cf fa a5 59 23 cb 6e 3a 5a 68 76 df 69 97 |.B...Y#.n:Zhv.i.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 22 6f 00 14 e4 aa 33 40 44 06 00 79 49 27 36 75 |"o....3@D..yI'6u| | 2e 18 96 0f 52 12 f0 b1 01 c7 79 30 b8 52 34 bf |....R.....y0.R4.| | 22 c3 b0 44 e2 4b fc 9a b0 7c 23 9f fa c9 4a 6d |"..D.K...|#...Jm| | 10 7f 59 e3 2a 07 59 b6 8c 90 e0 f1 f0 |..Y.*.Y...... | hash out[136]: | fa ca b8 cd 5c 79 51 2e 36 4d b5 a5 03 ee 3c 6a |....\yQ.6M.....\...&PEe..../.| | e3 76 ab 8f |.v.. | ssl_decrypt_record: mac failed association_find: TCP port 44935 found (nil) association_find: TCP port 4452 found 0x3425580 dissect_ssl enter frame #251 (first time) conversation = 0x7facef998d00, ssl_session = 0x7facc3834af0 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | 07 25 c2 b9 e3 c5 07 31 5d 7e 76 d2 35 df a7 27 |.%.....1]~v.5..'| | 79 f5 62 56 fa 8e 9b 7e 73 03 c1 b0 15 55 5e 39 |y.bV...~s....U^9| | 38 3b 16 78 a1 88 da fe 33 48 6e ac df 30 34 ce |8;.x....3Hn..04.| | 18 b2 c4 83 4a b0 e6 67 2e 20 2a d9 25 75 fb 17 |....J..g. *.%u..| | 85 ea 08 af 6f 3d ae cd e4 50 a2 e1 d5 0a 59 c3 |....o=...P....Y.| | c8 3d af e6 1d 70 eb 6f 41 ca 32 57 a6 53 f4 86 |.=...p.oA.2W.S..| | 4b 7f ae 77 55 cc 68 c2 cb 22 e0 4a 13 d8 e8 dc |K..wU.h..".J....| | d4 95 63 8c 69 19 91 94 48 da f7 65 3c ed b5 03 |..c.i...H..e<...| | 86 c6 fc e0 6c fb b0 70 85 9e e7 14 aa ed dc 49 |....l..p.......I| | 61 75 88 ff 72 a1 2c 6e 69 47 5d 92 2e 0a 9e 0a |au..r.,niG].....| | fb a1 da e5 d4 9c 36 a0 3b 8d 23 2c 12 68 a2 85 |......6.;.#,.h..| | 02 b5 99 26 9a 66 9b c0 01 1b 8b a6 e5 13 94 88 |...&.f..........| | 0a 75 fa 61 8d da e0 a9 41 47 a3 0e 2b 18 f2 2f |.u.a....AG..+../| | c8 93 2f 68 99 37 8d 72 bc 99 ab e9 df 80 55 ba |../h.7.r......U.| | 05 14 dd ba 41 b2 66 a5 8a 24 f5 99 2b f3 c9 8f |....A.f..$..+...| | 4b 45 d3 0c 55 2b 6e a3 93 7b 0a db 96 86 34 7f |KE..U+n..{....4.| | 37 bc 50 d8 15 34 47 61 9c 75 af a8 5b 5d ab 5b |7.P..4Ga.u..[].[| | 1e cb 9a 04 49 e6 3b 53 12 fa 21 25 7d b9 2f 68 |....I.;S..!%}./h| | da ae 3a e5 20 8b d6 49 47 ca c9 45 c4 3b 9f 9c |..:. ..IG..E.;..| | 43 c0 01 9f 8f 11 39 b1 5a 3c 89 2e de 09 4e 65 |C.....9.Z<....Ne| | ce aa d4 4b 4b 02 8a a5 3a 0d 68 20 8c 09 22 b6 |...KK...:.h ..".| | 92 67 d5 74 03 10 63 4d 15 6d a0 ed fa 5c 55 bc |.g.t..cM.m...\U.| | da ea 35 05 44 7e 28 36 1a 0c d7 8e 73 2c 25 de |..5.D~(6....s,%.| | ec 81 ff 06 5a 4a 82 de 08 5a 80 93 91 75 e0 fd |....ZJ...Z...u..| | c3 67 a5 ce 08 43 a4 db ce 1d 09 78 6f 87 a7 96 |.g...C.....xo...| Plaintext[400]: | 3e 38 79 cc e8 37 06 2d 17 6a 2d 3d b3 bf 24 46 |>8y..7.-.j-=..$F| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:| | 35 35 3a 31 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:14 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 33 38 20 2d 20 44 48 45 2d 44 |x00,0x38 - DHE-D| | 53 53 2d 41 45 53 32 35 36 2d 53 48 41 20 20 20 |SS-AES256-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc| | 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1.n..| | 14 ca ec 62 1a b2 1a a6 a0 62 21 bc 50 63 81 16 |...b.....b!.Pc..| | 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................| ssl_decrypt_record found padding 15 final len 384 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 14 66 d1 03 82 dd 26 c5 2f 30 f1 f2 86 8e e5 82 |.f....&./0......| | 30 1e 81 e9 |0... | ssl_decrypt_record: mac failed association_find: TCP port 4452 found 0x3425580 dissect_ssl enter frame #252 (first time) conversation = 0x7facef998d00, ssl_session = 0x7facc3834af0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | f6 4a 3f 4c 1d d6 d3 2c fe 8e 4f 8f 4c 31 52 5e |.J?L...,..O.L1R^| | 8a 53 bb 66 b4 2c 1b a2 f9 56 3c e5 68 8e 88 25 |.S.f.,...V<.h..%| | be 47 a4 bc f0 e4 99 61 67 03 50 f6 d5 8b 2c c1 |.G.....ag.P...,.| Plaintext[48]: | 08 4c cf cb 75 b3 56 cb 0f c5 f9 44 13 87 bd 8c |.L..u.V....D....| | 01 00 b9 08 e0 4d d2 d9 b2 6c cf 25 a5 eb ed 2e |.....M...l.%....| | 85 f6 67 9a 38 75 09 09 09 09 09 09 09 09 09 09 |..g.8u..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | b9 08 e0 4d d2 d9 b2 6c cf 25 a5 eb ed 2e 85 f6 |...M...l.%......| | 67 9a 38 75 |g.8u | ssl_decrypt_record: mac ok dissect_ssl enter frame #254 (first time) conversation = 0x7facef998d00, ssl_session = 0x7facc3834af0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 9a 35 0b d6 e7 5b 20 4c 59 dd 07 48 cb b1 49 6f |.5...[ LY..H..Io| | 54 bc fd 71 99 d8 f6 92 5b 7f 0f 1a b7 8d c3 4b |T..q....[......K| | bd d3 84 e0 95 dc 0d e2 3f 86 8d 69 f5 5a 82 59 |........?..i.Z.Y| Plaintext[48]: | 51 02 c2 5e ff 54 55 ff de 55 11 c8 1d 7c 9a 09 |Q..^.TU..U...|..| | 01 00 f1 fa b9 59 f5 be 75 38 13 7c 3c 18 4b 41 |.....Y..u8.|<.KA| | e9 91 92 e7 fa 51 09 09 09 09 09 09 09 09 09 09 |.....Q..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | f1 fa b9 59 f5 be 75 38 13 7c 3c 18 4b 41 e9 91 |...Y..u8.|<.KA..| | 92 e7 fa 51 |...Q | ssl_decrypt_record: mac ok dissect_ssl enter frame #259 (first time) ssl_session_init: initializing ptr 0x7facc3837030 size 688 conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 52817 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4453 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #261 (first time) conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030 record: offset = 0, reported_length_remaining = 1416 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0039 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | a7 59 28 89 bf cd 53 b6 49 5a 4f ed b0 4c a6 13 |.Y(...S.IZO..L..| | 97 f1 f8 e9 31 8b c0 e8 86 87 2b 5c c8 1e 1d e4 |....1.....+\....| | 85 42 cf fa a5 59 23 cb 6e 3a 5a 68 76 df 69 97 |.B...Y#.n:Zhv.i.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 23 17 69 75 07 cb bb 39 67 cb 4f 6c 4d 3f a8 99 |#.iu...9g.OlM?..| | 98 84 b6 53 ce 71 83 8b 04 22 ee 96 c0 52 34 bf |...S.q..."...R4.| | 23 c7 ee fe 88 63 f2 03 a7 30 98 37 ea cd bf 2a |#....c...0.7...*| | 9a d5 d6 bb 67 b9 01 ad 09 6a f5 f7 2e |....g....j... | hash out[136]: | f8 66 76 ec 4c 76 e5 82 2e 4e 5e 33 05 82 22 83 |.fv.Lv...N^3..".| | 02 59 c5 f6 8a 8a 97 a8 ba 57 92 f6 c5 75 cb 27 |.Y.......W...u.'| | 22 37 8a 74 37 cd 58 77 cd da 50 dd 9f c1 25 35 |"7.t7.Xw..P...%5| | ee c7 62 fd 60 b0 42 53 51 25 4d 1e f5 53 0b 9f |..b.`.BSQ%M..S..| | db f1 9c fd 5d 71 6d 82 22 8e 83 c8 70 0f 43 e9 |....]qm."...p.C.| | a2 85 08 25 82 52 93 72 07 6b 3c 79 1a 9e 77 79 |...%.R.r.k../.{RH.| | 9c cf a2 75 eb c3 48 fe df c2 e0 65 cc d5 1b 7d |...u..H....e...}| | 41 90 f2 cc 91 c3 a2 19 ef cb eb c3 66 14 5f 48 |A...........f._H| | 27 84 d2 b3 94 79 87 ce |'....y.. | PRF out[136]: | c4 b3 e3 66 c0 59 d7 08 1a 97 92 54 0c ef 30 bb |...f.Y.....T..0.| | a0 1c ff 21 97 6e 6d 02 ea c1 33 5b e9 ec 9a b5 |...!.nm...3[....| | 75 22 5a 3b 72 fc dd 11 d9 90 b0 18 52 4f 80 e0 |u"Z;r.......RO..| | f2 31 97 a7 cb ce 65 9f e5 32 7c 31 b4 a5 0f fb |.1....e..2|1....| | eb b1 3f 58 98 20 86 72 1f 9b ed ea 9e 28 4c 76 |..?X. .r.....(Lv| | 61 2c 96 75 57 c9 c8 3e 01 10 2f d9 7b 52 48 f2 |a,.uW..>../.{RH.| | 9c cf a2 75 eb c3 48 fe df c2 e0 65 cc d5 1b 7d |...u..H....e...}| | 41 90 f2 cc 91 c3 a2 19 ef cb eb c3 66 14 5f 48 |A...........f._H| | 27 84 d2 b3 94 79 87 ce |'....y.. | key expansion[136]: | c4 b3 e3 66 c0 59 d7 08 1a 97 92 54 0c ef 30 bb |...f.Y.....T..0.| | a0 1c ff 21 97 6e 6d 02 ea c1 33 5b e9 ec 9a b5 |...!.nm...3[....| | 75 22 5a 3b 72 fc dd 11 d9 90 b0 18 52 4f 80 e0 |u"Z;r.......RO..| | f2 31 97 a7 cb ce 65 9f e5 32 7c 31 b4 a5 0f fb |.1....e..2|1....| | eb b1 3f 58 98 20 86 72 1f 9b ed ea 9e 28 4c 76 |..?X. .r.....(Lv| | 61 2c 96 75 57 c9 c8 3e 01 10 2f d9 7b 52 48 f2 |a,.uW..>../.{RH.| | 9c cf a2 75 eb c3 48 fe df c2 e0 65 cc d5 1b 7d |...u..H....e...}| | 41 90 f2 cc 91 c3 a2 19 ef cb eb c3 66 14 5f 48 |A...........f._H| | 27 84 d2 b3 94 79 87 ce |'....y.. | Client MAC key[20]: | c4 b3 e3 66 c0 59 d7 08 1a 97 92 54 0c ef 30 bb |...f.Y.....T..0.| | a0 1c ff 21 |...! | Server MAC key[20]: | 97 6e 6d 02 ea c1 33 5b e9 ec 9a b5 75 22 5a 3b |.nm...3[....u"Z;| | 72 fc dd 11 |r... | Client Write key[32]: | d9 90 b0 18 52 4f 80 e0 f2 31 97 a7 cb ce 65 9f |....RO...1....e.| | e5 32 7c 31 b4 a5 0f fb eb b1 3f 58 98 20 86 72 |.2|1......?X. .r| Server Write key[32]: | 1f 9b ed ea 9e 28 4c 76 61 2c 96 75 57 c9 c8 3e |.....(Lva,.uW..>| | 01 10 2f d9 7b 52 48 f2 9c cf a2 75 eb c3 48 fe |../.{RH....u..H.| Client Write IV[16]: | df c2 e0 65 cc d5 1b 7d 41 90 f2 cc 91 c3 a2 19 |...e...}A.......| Server Write IV[16]: | ef cb eb c3 66 14 5f 48 27 84 d2 b3 94 79 87 ce |....f._H'....y..| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 20 b7 f1 51 ab 0a d5 94 9d 9b a4 38 49 52 ee 40 | ..Q.......8IR.@| | fd 5b 0f 36 23 71 b4 59 5e 13 d2 e2 d7 54 db c9 |.[.6#q.Y^....T..| | 45 c4 a9 de b3 ca 64 db 24 88 4c 9e 48 83 2b 9e |E.....d.$.L.H.+.| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | f9 cd f8 0e 2a 35 1c 38 46 b8 97 ee d0 2d ad 13 |....*5.8F....-..| | 64 bf 9d db bc 38 b3 28 89 4d 91 61 37 9c 4d f1 |d....8.(.M.a7.M.| | 60 97 d3 e8 30 61 8d 4f 41 6e 25 ed 6f 7e 06 10 |`...0a.OAn%.o~..| | 82 25 58 bd 33 a9 83 0f ce ac 88 f7 fb d2 19 72 |.%X.3..........r| Plaintext[64]: | d8 db 31 5a 45 68 02 52 59 02 8d 8c 6b b4 e0 f5 |..1ZEh.RY...k...| | 14 00 00 0c d8 a7 bc e3 c6 f1 50 8b 6f 2c 9e f6 |..........P.o,..| | 12 0b c4 0a b0 71 5e 2c e1 79 69 eb f8 24 38 08 |.....q^,.yi..$8.| | 75 e6 8c 93 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |u...............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 12 0b c4 0a b0 71 5e 2c e1 79 69 eb f8 24 38 08 |.....q^,.yi..$8.| | 75 e6 8c 93 |u... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #264 (first time) conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 1c e7 46 55 44 95 2c e0 54 e3 9a 5f 49 d7 29 28 |..FUD.,.T.._I.)(| | f4 a9 a5 cd ee a9 1d 6f 00 a3 9e c5 fa 99 8d 85 |.......o........| | 73 3b e9 84 48 a3 85 d7 d6 61 4c be fe 6f 6e 35 |s;..H....aL..on5| | 34 30 b3 c9 b2 0c 4e 96 ca 1d ad a3 dd a9 21 dd |40....N.......!.| Plaintext[64]: | c2 a4 95 cb 42 16 52 56 6b ab 48 02 63 36 6a d9 |....B.RVk.H.c6j.| | 14 00 00 0c 9b ca bc 2d 37 c6 5e f6 7a 33 71 e8 |.......-7.^.z3q.| | 00 89 44 f0 06 c4 b1 3e 6f f7 55 5f 26 2c 73 1e |..D....>o.U_&,s.| | af 01 59 3f 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..Y?............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 00 89 44 f0 06 c4 b1 3e 6f f7 55 5f 26 2c 73 1e |..D....>o.U_&,s.| | af 01 59 3f |..Y? | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #265 (first time) conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | 1e ab cc b1 b6 4c d0 fb f9 84 f6 6d 1e 43 80 d7 |.....L.....m.C..| | c7 06 39 3e 38 de c6 38 9e 31 69 b6 1d e9 4e 2e |..9>8..8.1i...N.| | c1 7a 67 e1 19 7b 3f d8 92 21 f7 3c 30 85 c4 ff |.zg..{?..!.<0...| | 85 08 1a 5e 3d bf 8e 49 e3 b6 1f 6d f9 50 fe 99 |...^=..I...m.P..| | 9c b6 d4 c7 b6 81 2b 92 0f aa f6 b8 09 a8 03 0e |......+.........| | 7b 1a 02 9d 04 08 c0 10 2c 2a 0c 05 12 be 1c bb |{.......,*......| | c8 6c 83 7c 4a c6 7b ca 14 ee 7d 86 fe ea c0 f8 |.l.|J.{...}.....| Plaintext[112]: | a6 54 42 d0 c7 bf 33 a3 9c 3e dc 31 3d 40 bf ad |.TB...3..>.1=@..| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 61 65 |Host: dhe-rsa-ae| | 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s256-sha.local.a| | 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:| | 34 34 35 33 0d 0a 0d 0a 94 27 43 3c 34 7e 07 8b |4453.....'C<4~..| | a5 94 3d 0b ba f1 82 54 d5 0d 3a 21 03 03 03 03 |..=....T..:!....| ssl_decrypt_record found padding 3 final len 108 checking mac (len 72, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 25 f9 9a f8 88 2f 31 15 24 07 80 a3 88 1b 23 b0 |%..../1.$.....#.| | 17 c4 76 f2 |..v. | ssl_decrypt_record: mac failed association_find: TCP port 52817 found (nil) association_find: TCP port 4453 found 0x3425530 dissect_ssl enter frame #266 (first time) conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | cb 1e 48 31 e7 63 1e 7f 99 78 23 80 2e 9a c3 3d |..H1.c...x#....=| | 9a 74 54 80 bc 1e 6d e5 8e ce 3a 2e 28 6b 3c 27 |.tT...m...:.(k<'| | 09 6c 99 07 c8 f9 63 84 53 b7 cb 7d 64 3f 04 dc |.l....c.S..}d?..| | ef 09 a3 9f 52 c8 dd a3 03 50 d9 d9 93 fa 19 0a |....R....P......| | a7 02 15 6c 44 43 62 c6 73 6b 5c 18 c0 3d 1c ce |...lDCb.sk\..=..| | db 41 fa 80 2f 78 f4 3f 16 74 e4 0f 05 12 4c d3 |.A../x.?.t....L.| | 4f 18 12 12 70 14 83 13 e2 4d 45 bd fe 7b 8b 03 |O...p....ME..{..| | 00 d6 8c 28 9a ec e8 9e 3f 76 0a df 98 0e 02 88 |...(....?v......| | fc 12 df 72 5f b3 85 5b 46 90 9d 84 72 58 cf 0e |...r_..[F...rX..| | 6f 25 ff 40 16 eb 8d 6b 44 e1 d3 0b 55 83 a5 0f |o%.@...kD...U...| | 14 d0 bd 0e b4 a2 45 a2 a9 31 58 05 76 c8 8e 47 |......E..1X.v..G| | 71 6c b0 e6 87 7f 11 77 c8 fd 19 f7 9a c1 ef b7 |ql.....w........| | 2c f1 05 83 f0 85 d0 a7 91 10 b5 1f 0c 54 4a 90 |,............TJ.| | 5c 6e bb c6 2e a7 d4 7a d6 a2 ce 23 5d 65 ab c5 |\n.....z...#]e..| | c2 fd 82 b0 2b de d6 86 22 c8 47 04 cf 23 8f e2 |....+...".G..#..| | de c2 5c 42 91 38 7b 4f 92 83 ef a6 b7 f7 62 22 |..\B.8{O......b"| | 6d 5a 0c bc 69 fa be 94 bf da 04 a8 7d e8 ea 37 |mZ..i.......}..7| | ef 91 d9 3f 50 e9 0c 15 d9 86 9b 1f ca 23 f1 5d |...?P........#.]| | e8 b2 31 64 11 00 db 65 7e 6b 03 6b 5d db 86 bc |..1d...e~k.k]...| | 43 62 cb af c2 7b e7 cb 09 1f 2e 76 e2 c3 7f 9a |Cb...{.....v....| | 0b 6a 81 99 83 c5 90 8d 8b 44 b7 87 4c 48 f5 ba |.j.......D..LH..| | 27 8d e1 ee 51 f8 28 50 36 05 02 99 26 cb 5a 26 |'...Q.(P6...&.Z&| | ac 21 a5 cb 75 11 d8 10 cf ee 12 31 b8 fe 1b 74 |.!..u......1...t| | 85 ae 19 32 9e 31 af a8 6f be 2d e9 6b 78 90 e5 |...2.1..o.-.kx..| | 51 b6 5b dd fa e8 7a dc 45 c8 29 75 f3 10 74 17 |Q.[...z.E.)u..t.| Plaintext[400]: | 78 b9 b9 b5 43 4a a2 10 2b 58 5d b4 0d 45 73 ab |x...CJ..+X]..Es.| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:| | 35 35 3a 31 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:15 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 33 39 20 2d 20 44 48 45 2d 52 |x00,0x39 - DHE-R| | 53 41 2d 41 45 53 32 35 36 2d 53 48 41 20 20 20 |SA-AES256-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1..:.| | 34 a6 10 78 7a ae 78 fb 12 7e c3 79 18 c9 78 71 |4..xz.x..~.y..xq| | 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................| ssl_decrypt_record found padding 15 final len 384 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | a1 61 90 93 11 23 77 13 ea a4 e9 b0 1f a3 bc 51 |.a...#w........Q| | 78 a2 17 80 |x... | ssl_decrypt_record: mac failed association_find: TCP port 4453 found 0x3425530 dissect_ssl enter frame #267 (first time) conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 4e 95 cc 52 06 b4 4c 17 89 3a 8c 81 42 34 23 52 |N..R..L..:..B4#R| | 22 67 92 51 c5 fc be 40 0f a1 22 b0 d5 59 d2 c7 |"g.Q...@.."..Y..| | 4b 2b 16 d4 59 0a 38 9c 51 b8 6d 86 af a6 b9 22 |K+..Y.8.Q.m...."| Plaintext[48]: | 9e c3 0d 82 a9 67 6b 4d a5 4e 0c f5 40 9a 8f 12 |.....gkM.N..@...| | 01 00 37 a4 fd 64 2e 98 56 63 a5 70 e0 d7 0a 49 |..7..d..Vc.p...I| | 99 87 66 a0 c6 d1 09 09 09 09 09 09 09 09 09 09 |..f.............| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 37 a4 fd 64 2e 98 56 63 a5 70 e0 d7 0a 49 99 87 |7..d..Vc.p...I..| | 66 a0 c6 d1 |f... | ssl_decrypt_record: mac ok dissect_ssl enter frame #269 (first time) conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 2c a4 58 8b 8b 93 11 d3 3d 11 6b 35 42 be d7 52 |,.X.....=.k5B..R| | 33 27 b3 a3 3e de 83 f0 a8 e1 53 dc 9b c0 d4 71 |3'..>.....S....q| | 53 72 b8 fb 87 5d d1 7e 61 01 b3 41 c0 5d 56 3f |Sr...].~a..A.]V?| Plaintext[48]: | ff 5e e5 02 7a c0 2e 50 99 54 67 49 c2 35 6d 14 |.^..z..P.TgI.5m.| | 01 00 4e 8f 01 51 2f 23 ad 52 ab 16 22 54 bd 2b |..N..Q/#.R.."T.+| | 5b 9f 0b ac 53 8b 09 09 09 09 09 09 09 09 09 09 |[...S...........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 4e 8f 01 51 2f 23 ad 52 ab 16 22 54 bd 2b 5b 9f |N..Q/#.R.."T.+[.| | 0b ac 53 8b |..S. | ssl_decrypt_record: mac ok dissect_ssl enter frame #274 (first time) ssl_session_init: initializing ptr 0x7facc3839530 size 688 conversation = 0x7facef999250, ssl_session = 0x7facc3839530 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 50333 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4457 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #276 (first time) conversation = 0x7facef999250, ssl_session = 0x7facc3839530 record: offset = 0, reported_length_remaining = 884 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0041 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 20 b7 f1 51 ab 0a d5 94 9d 9b a4 38 49 52 ee 40 | ..Q.......8IR.@| | fd 5b 0f 36 23 71 b4 59 5e 13 d2 e2 d7 54 db c9 |.[.6#q.Y^....T..| | 45 c4 a9 de b3 ca 64 db 24 88 4c 9e 48 83 2b 9e |E.....d.$.L.H.+.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 23 f9 36 0d be 36 69 c6 37 6a d8 79 cc f1 c8 26 |#.6..6i.7j.y...&| | a9 cb ee a4 e7 de 7b 36 19 a0 94 0b ef 52 34 bf |......{6.....R4.| | 23 c9 8a ee 73 6e 46 46 4b 7b 4f 69 76 63 d9 3b |#...snFFK{Oivc.;| | 19 4c fd 0f f6 ef 1f 56 43 e8 0e 54 c9 |.L.....VC..T. | hash out[104]: | 7e 59 53 fc 10 a2 11 e2 b6 77 49 93 e7 47 00 52 |~YS......wI..G.R| | a8 ae 4a 38 b5 95 4b 55 9f 58 b0 3a 55 2d bd 0f |..J8..KU.X.:U-..| | 89 44 4a 98 db ad 27 69 62 d8 46 48 48 fa c3 98 |.DJ...'ib.FHH...| | 43 81 83 58 fb df 64 e2 a2 26 cc 21 7e 20 1b 04 |C..X..d..&.!~ ..| | 81 ad 69 c5 bf 1b 86 c5 89 0b 05 b8 1b f3 f7 2f |..i............/| | fa c6 98 1e 9c 4d 4c 68 1c 61 a2 49 5a b2 90 2f |.....MLh.a.IZ../| | fd 63 2a d8 4d 83 95 58 |.c*.M..X | PRF out[104]: | 7e 59 53 fc 10 a2 11 e2 b6 77 49 93 e7 47 00 52 |~YS......wI..G.R| | a8 ae 4a 38 b5 95 4b 55 9f 58 b0 3a 55 2d bd 0f |..J8..KU.X.:U-..| | 89 44 4a 98 db ad 27 69 62 d8 46 48 48 fa c3 98 |.DJ...'ib.FHH...| | 43 81 83 58 fb df 64 e2 a2 26 cc 21 7e 20 1b 04 |C..X..d..&.!~ ..| | 81 ad 69 c5 bf 1b 86 c5 89 0b 05 b8 1b f3 f7 2f |..i............/| | fa c6 98 1e 9c 4d 4c 68 1c 61 a2 49 5a b2 90 2f |.....MLh.a.IZ../| | fd 63 2a d8 4d 83 95 58 |.c*.M..X | key expansion[104]: | 7e 59 53 fc 10 a2 11 e2 b6 77 49 93 e7 47 00 52 |~YS......wI..G.R| | a8 ae 4a 38 b5 95 4b 55 9f 58 b0 3a 55 2d bd 0f |..J8..KU.X.:U-..| | 89 44 4a 98 db ad 27 69 62 d8 46 48 48 fa c3 98 |.DJ...'ib.FHH...| | 43 81 83 58 fb df 64 e2 a2 26 cc 21 7e 20 1b 04 |C..X..d..&.!~ ..| | 81 ad 69 c5 bf 1b 86 c5 89 0b 05 b8 1b f3 f7 2f |..i............/| | fa c6 98 1e 9c 4d 4c 68 1c 61 a2 49 5a b2 90 2f |.....MLh.a.IZ../| | fd 63 2a d8 4d 83 95 58 |.c*.M..X | Client MAC key[20]: | 7e 59 53 fc 10 a2 11 e2 b6 77 49 93 e7 47 00 52 |~YS......wI..G.R| | a8 ae 4a 38 |..J8 | Server MAC key[20]: | b5 95 4b 55 9f 58 b0 3a 55 2d bd 0f 89 44 4a 98 |..KU.X.:U-...DJ.| | db ad 27 69 |..'i | Client Write key[16]: | 62 d8 46 48 48 fa c3 98 43 81 83 58 fb df 64 e2 |b.FHH...C..X..d.| Server Write key[16]: | a2 26 cc 21 7e 20 1b 04 81 ad 69 c5 bf 1b 86 c5 |.&.!~ ....i.....| Client Write IV[16]: | 89 0b 05 b8 1b f3 f7 2f fa c6 98 1e 9c 4d 4c 68 |......./.....MLh| Server Write IV[16]: | 1c 61 a2 49 5a b2 90 2f fd 63 2a d8 4d 83 95 58 |.a.IZ../.c*.M..X| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: CAMELLIA128 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: CAMELLIA128 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 821 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884 dissect_ssl enter frame #278 (first time) conversation = 0x7facef999250, ssl_session = 0x7facc3839530 record: offset = 0, reported_length_remaining = 342 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 262, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6... looking for RSA pre-master49b0d526ec1cca1e189791ee6237d54b6d7a53ba163b9e3c... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 9a 2c 35 22 34 27 d9 2a 88 d1 8f 6a bc 77 5a 32 |.,5"4'.*...j.wZ2| | 68 de 56 7e 9a ad f3 ec 4b ab d9 a9 25 61 00 9b |h.V~....K...%a..| | 0b 30 a1 d3 eb e3 c8 77 44 1f 98 8d fd 11 0d 43 |.0.....wD......C| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 23 f9 36 0d be 36 69 c6 37 6a d8 79 cc f1 c8 26 |#.6..6i.7j.y...&| | a9 cb ee a4 e7 de 7b 36 19 a0 94 0b ef 52 34 bf |......{6.....R4.| | 23 c9 8a ee 73 6e 46 46 4b 7b 4f 69 76 63 d9 3b |#...snFFK{Oivc.;| | 19 4c fd 0f f6 ef 1f 56 43 e8 0e 54 c9 |.L.....VC..T. | hash out[104]: | 3f 24 b6 52 fa db 57 42 5f 28 1a 2f 28 e1 78 f9 |?$.R..WB_(./(.x.| | 07 7c 8d 59 35 8b 2f 00 b0 c0 1b 41 ca aa 11 83 |.|.Y5./....A....| | ba 32 ac 6d 01 8a 04 61 4f 32 41 e7 55 47 90 32 |.2.m...aO2A.UG.2| | 66 e4 0b 57 ed d6 3d b0 e6 5e 04 6b c0 3f b5 c3 |f..W..=..^.k.?..| | 92 8e 62 c3 41 36 35 69 70 1b 35 77 16 97 09 d5 |..b.A65ip.5w....| | 9b bb 8f 8a 97 4d ec 20 4e 96 94 6c 84 a7 85 7a |.....M. N..l...z| | bb d4 14 ff 4f c3 ad f2 |....O... | PRF out[104]: | 3f 24 b6 52 fa db 57 42 5f 28 1a 2f 28 e1 78 f9 |?$.R..WB_(./(.x.| | 07 7c 8d 59 35 8b 2f 00 b0 c0 1b 41 ca aa 11 83 |.|.Y5./....A....| | ba 32 ac 6d 01 8a 04 61 4f 32 41 e7 55 47 90 32 |.2.m...aO2A.UG.2| | 66 e4 0b 57 ed d6 3d b0 e6 5e 04 6b c0 3f b5 c3 |f..W..=..^.k.?..| | 92 8e 62 c3 41 36 35 69 70 1b 35 77 16 97 09 d5 |..b.A65ip.5w....| | 9b bb 8f 8a 97 4d ec 20 4e 96 94 6c 84 a7 85 7a |.....M. N..l...z| | bb d4 14 ff 4f c3 ad f2 |....O... | key expansion[104]: | 3f 24 b6 52 fa db 57 42 5f 28 1a 2f 28 e1 78 f9 |?$.R..WB_(./(.x.| | 07 7c 8d 59 35 8b 2f 00 b0 c0 1b 41 ca aa 11 83 |.|.Y5./....A....| | ba 32 ac 6d 01 8a 04 61 4f 32 41 e7 55 47 90 32 |.2.m...aO2A.UG.2| | 66 e4 0b 57 ed d6 3d b0 e6 5e 04 6b c0 3f b5 c3 |f..W..=..^.k.?..| | 92 8e 62 c3 41 36 35 69 70 1b 35 77 16 97 09 d5 |..b.A65ip.5w....| | 9b bb 8f 8a 97 4d ec 20 4e 96 94 6c 84 a7 85 7a |.....M. N..l...z| | bb d4 14 ff 4f c3 ad f2 |....O... | Client MAC key[20]: | 3f 24 b6 52 fa db 57 42 5f 28 1a 2f 28 e1 78 f9 |?$.R..WB_(./(.x.| | 07 7c 8d 59 |.|.Y | Server MAC key[20]: | 35 8b 2f 00 b0 c0 1b 41 ca aa 11 83 ba 32 ac 6d |5./....A.....2.m| | 01 8a 04 61 |...a | Client Write key[16]: | 4f 32 41 e7 55 47 90 32 66 e4 0b 57 ed d6 3d b0 |O2A.UG.2f..W..=.| Server Write key[16]: | e6 5e 04 6b c0 3f b5 c3 92 8e 62 c3 41 36 35 69 |.^.k.?....b.A65i| Client Write IV[16]: | 70 1b 35 77 16 97 09 d5 9b bb 8f 8a 97 4d ec 20 |p.5w.........M. | Server Write IV[16]: | 4e 96 94 6c 84 a7 85 7a bb d4 14 ff 4f c3 ad f2 |N..l...z....O...| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: CAMELLIA128 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: CAMELLIA128 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 9a 2c 35 22 34 27 d9 2a 88 d1 8f 6a bc 77 5a 32 |.,5"4'.*...j.wZ2| | 68 de 56 7e 9a ad f3 ec 4b ab d9 a9 25 61 00 9b |h.V~....K...%a..| | 0b 30 a1 d3 eb e3 c8 77 44 1f 98 8d fd 11 0d 43 |.0.....wD......C| dissect_ssl3_handshake session keys successfully generated record: offset = 267, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 273, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | b1 dc 9b 8b 30 62 dc 3c 73 65 7d 43 aa aa ed 69 |....0b.| Plaintext[64]: | 4c ca d8 e5 92 a5 96 fb 1d 54 52 e6 fd c1 06 64 |L........TR....d| | 14 00 00 0c 61 42 f8 38 c7 91 5d 72 b6 74 92 dc |....aB.8..]r.t..| | 5f fd 49 40 0a 16 5d 9e 08 ed 28 8f 62 28 56 fe |_.I@..]...(.b(V.| | a1 15 70 9d 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..p.............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 5f fd 49 40 0a 16 5d 9e 08 ed 28 8f 62 28 56 fe |_.I@..]...(.b(V.| | a1 15 70 9d |..p. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #280 (first time) conversation = 0x7facef999250, ssl_session = 0x7facc3839530 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | 73 db 77 89 e3 a7 c9 fb 53 48 d3 2a 85 71 79 da |s.w.....SH.*.qy.| | f3 5b e0 ab d0 f7 a0 5d d2 43 06 6f 3c 01 9a c1 |.[.....].C.o<...| | 79 ba 05 f1 a0 67 3d 23 69 18 9c 2b 70 94 71 1c |y....g=#i..+p.q.| | 8d f4 25 e2 03 13 f4 91 e2 8c c1 46 43 1b ad a6 |..%........FC...| | 25 88 44 89 05 55 11 e8 be 9a b7 5b 72 48 2e a7 |%.D..U.....[rH..| | b9 a5 a6 6d dc 81 0f 09 45 ca 2c c2 c3 f0 b2 b8 |...m....E.,.....| | 87 8c 4c c6 a7 fe 6d 03 a0 fe 5e 6d 0b 80 08 14 |..L...m...^m....| Plaintext[112]: | 59 db 8a 5f e8 a2 a8 e7 ad 17 00 35 cd ef 3a 69 |Y.._.......5..:i| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 63 61 6d 65 6c 6c 69 61 31 32 |Host: camellia12| | 38 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c |8-sha.local.al.l| | 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 35 |ekensteyn.nl:445| | 37 0d 0a 0d 0a 22 2d a5 65 9f 4f 66 55 39 1a 50 |7...."-.e.OfU9.P| | e1 09 71 ac 14 55 3d 43 4b 06 06 06 06 06 06 06 |..q..U=CK.......| ssl_decrypt_record found padding 6 final len 105 checking mac (len 69, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 10 58 a5 55 ab da cd ab 83 64 d5 c0 12 d4 df 14 |.X.U.....d......| | 01 a0 fa 18 |.... | ssl_decrypt_record: mac failed association_find: TCP port 50333 found (nil) association_find: TCP port 4457 found 0x3425860 dissect_ssl enter frame #281 (first time) conversation = 0x7facef999250, ssl_session = 0x7facc3839530 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | 45 ec 2f af ab d8 64 59 62 19 e5 db 53 fd ab 59 |E./...dYb...S..Y| | c7 41 de 02 e9 9f 13 49 f3 7b 96 54 89 84 04 57 |.A.....I.{.T...W| | 0b b3 b4 99 7e 7e 8b 85 47 41 e7 0f 82 a9 d9 81 |....~~..GA......| | a1 10 f0 12 66 13 07 5f 17 64 12 80 b2 d1 aa 64 |....f.._.d.....d| | 87 9f 8c 63 f0 c3 d9 67 b0 e7 a2 3d 7d f7 86 4c |...c...g...=}..L| | a4 62 10 f4 46 67 53 19 14 ea 31 14 1a cd be a5 |.b..FgS...1.....| | fd 30 ec 60 31 4e 95 a6 1e 5c 4d c7 5a 5f 7c de |.0.`1N...\M.Z_|.| | 80 de b2 9a 93 c9 96 e8 76 95 1b 18 cb 95 e9 80 |........v.......| | 3b c7 78 11 14 45 90 42 42 44 19 bc 9f 5e 17 6b |;.x..E.BBD...^.k| | 56 06 de d4 52 c4 50 4e 2f 4b 8a 0e 24 b9 72 c0 |V...R.PN/K..$.r.| | 9b 03 d2 4f a8 3e 15 4c b4 58 8f 74 58 bb 2f 16 |...O.>.L.X.tX./.| | a0 6f 68 7d dd 15 89 37 9e 67 3a e0 84 a8 92 cd |.oh}...7.g:.....| | b8 1f 8c 7b d8 ec 8a ff 88 83 a6 bc 64 2a aa 08 |...{........d*..| | e5 54 1b 03 d9 2e 20 3e ca 17 03 51 0d ae 2e 7f |.T.... >...Q....| | d3 d1 df 7d 9e 98 1f 3d 14 51 ba c2 67 69 c6 8e |...}...=.Q..gi..| | 71 3e f6 01 06 4e 3a 16 47 27 f7 52 07 fb 01 ae |q>...N:.G'.R....| | eb 09 64 33 49 05 0e f3 33 1f 07 5b aa 2b 14 de |..d3I...3..[.+..| | f7 95 a2 c6 f1 8a a3 41 5e 25 3b be 59 b8 6d 4d |.......A^%;.Y.mM| | 88 91 77 e9 44 ab 6a 60 14 09 c9 0b 7f 60 9d 8c |..w.D.j`.....`..| | 1e c5 07 c6 9d 29 60 1f 6a 0a 93 dc 2e 14 f9 c3 |.....)`.j.......| | 5b 9f bf 36 59 44 25 09 e6 12 89 74 93 44 51 1a |[..6YD%....t.DQ.| | 00 34 af 2c 79 36 a5 08 6b 55 de 83 a0 ca cf 62 |.4.,y6..kU.....b| | f2 a2 9a 76 94 4b ed 96 34 5d 54 51 82 d9 9b 2b |...v.K..4]TQ...+| | 3a 1a 2e 2a 06 ec 48 50 ea 5f a4 2a 5f fd e1 f3 |:..*..HP._.*_...| | 1a ad f2 dc 1c ff 33 8c 68 f2 3d 95 ba e6 bc ac |......3.h.=.....| Plaintext[400]: | 9a c6 14 70 ac 6f a4 c0 1f c0 e8 49 a0 b9 99 b5 |...p.o.....I....| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:| | 35 35 3a 31 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:15 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 34 31 20 2d 20 43 41 4d 45 4c |x00,0x41 - CAMEL| | 4c 49 41 31 32 38 2d 53 48 41 20 20 20 20 20 20 |LIA128-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 43 61 6d 65 6c 6c 69 61 28 31 32 38 29 20 4d |=Camellia(128) M| | 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1| | 7f 41 57 03 d3 08 fd 78 86 2b aa 3a b5 57 5e 78 |.AW....x.+.:.W^x| | 7d 5a 42 00 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |}ZB.............| ssl_decrypt_record found padding 11 final len 388 checking mac (len 352, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 21 c6 d6 7a 18 f5 c7 4e cf 09 55 6b e0 e1 f1 a4 |!..z...N..Uk....| | 8b be e0 c5 |.... | ssl_decrypt_record: mac failed association_find: TCP port 4457 found 0x3425860 dissect_ssl enter frame #282 (first time) conversation = 0x7facef999250, ssl_session = 0x7facc3839530 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 96 2c ce 53 2f df 3a cf 80 7e f0 f3 0e c5 48 eb |.,.S/.:..~....H.| | 58 26 21 2e b2 a2 78 e8 9a d4 be da fe d5 e1 9b |X&!...x.........| | 1c cb 21 4d 24 8f fc b5 1d dd 8f 6a 54 ba cd 98 |..!M$......jT...| Plaintext[48]: | 7b 05 0a ea 9a e5 6e e4 4d 05 35 38 59 b9 57 b7 |{.....n.M.58Y.W.| | 01 00 8d ba d2 ab 65 15 b7 ee 16 71 71 10 30 9b |......e....qq.0.| | f8 d5 21 8a 4b 7b 09 09 09 09 09 09 09 09 09 09 |..!.K{..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 8d ba d2 ab 65 15 b7 ee 16 71 71 10 30 9b f8 d5 |....e....qq.0...| | 21 8a 4b 7b |!.K{ | ssl_decrypt_record: mac ok dissect_ssl enter frame #284 (first time) conversation = 0x7facef999250, ssl_session = 0x7facc3839530 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | c3 77 31 8c 96 9d 3b 7c bf d8 24 fb a1 70 d4 a5 |.w1...;|..$..p..| | a0 b9 a5 5f 1e f9 1c a6 14 f1 f0 6f 05 dc eb ff |..._.......o....| | aa f3 aa da 25 41 1c 89 7f 9c 91 f3 cd cd aa 55 |....%A.........U| Plaintext[48]: | 64 cc 71 81 da 80 c2 c1 4b 7c e6 d9 f9 26 09 3e |d.q.....K|...&.>| | 01 00 9e 70 6e 5f 54 46 a1 31 2f c5 0c bc f1 3f |...pn_TF.1/....?| | 7c 4a 10 ee 54 13 09 09 09 09 09 09 09 09 09 09 ||J..T...........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 9e 70 6e 5f 54 46 a1 31 2f c5 0c bc f1 3f 7c 4a |.pn_TF.1/....?|J| | 10 ee 54 13 |..T. | ssl_decrypt_record: mac ok dissect_ssl enter frame #289 (first time) ssl_session_init: initializing ptr 0x7facc383baf0 size 688 conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 44746 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4458 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #291 (first time) conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0 record: offset = 0, reported_length_remaining = 1135 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0044 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 9a 2c 35 22 34 27 d9 2a 88 d1 8f 6a bc 77 5a 32 |.,5"4'.*...j.wZ2| | 68 de 56 7e 9a ad f3 ec 4b ab d9 a9 25 61 00 9b |h.V~....K...%a..| | 0b 30 a1 d3 eb e3 c8 77 44 1f 98 8d fd 11 0d 43 |.0.....wD......C| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 23 0c 19 8a b6 1d 09 aa 16 a9 50 bc d6 2b b0 f1 |#.........P..+..| | 1e a8 83 58 08 36 04 0b be 22 b6 6c e7 52 34 bf |...X.6...".l.R4.| | 23 48 94 c7 dd 68 85 6e 2c 8b 74 c8 8d 5d 88 e3 |#H...h.n,.t..]..| | ae 0f de e3 6f 97 47 a3 23 9d 3c a1 0d |....o.G.#.<.. | hash out[104]: | 5d e8 c0 0e a7 80 ea d2 c9 68 c6 08 73 ed fc 96 |]........h..s...| | 0a a8 4d a2 ed 56 fd 29 b8 7a 8c 11 e4 35 f6 da |..M..V.).z...5..| | 5a eb 1b 81 e3 58 ec 44 29 3e 75 11 5e e1 37 30 |Z....X.D)>u.^.70| | 9b 49 ac ea 01 8f 95 b6 6a 87 90 52 1a c5 73 95 |.I......j..R..s.| | 2e 6d 7b e5 8b 02 ed 89 18 be a5 f3 a0 6c 5d cc |.m{..........l].| | ee 0b 94 bf ee d4 18 97 62 5b 3f ab 84 2d b7 3d |........b[?..-.=| | ea 1a ec 7e f5 de ea 12 |...~.... | PRF out[104]: | 5d e8 c0 0e a7 80 ea d2 c9 68 c6 08 73 ed fc 96 |]........h..s...| | 0a a8 4d a2 ed 56 fd 29 b8 7a 8c 11 e4 35 f6 da |..M..V.).z...5..| | 5a eb 1b 81 e3 58 ec 44 29 3e 75 11 5e e1 37 30 |Z....X.D)>u.^.70| | 9b 49 ac ea 01 8f 95 b6 6a 87 90 52 1a c5 73 95 |.I......j..R..s.| | 2e 6d 7b e5 8b 02 ed 89 18 be a5 f3 a0 6c 5d cc |.m{..........l].| | ee 0b 94 bf ee d4 18 97 62 5b 3f ab 84 2d b7 3d |........b[?..-.=| | ea 1a ec 7e f5 de ea 12 |...~.... | key expansion[104]: | 5d e8 c0 0e a7 80 ea d2 c9 68 c6 08 73 ed fc 96 |]........h..s...| | 0a a8 4d a2 ed 56 fd 29 b8 7a 8c 11 e4 35 f6 da |..M..V.).z...5..| | 5a eb 1b 81 e3 58 ec 44 29 3e 75 11 5e e1 37 30 |Z....X.D)>u.^.70| | 9b 49 ac ea 01 8f 95 b6 6a 87 90 52 1a c5 73 95 |.I......j..R..s.| | 2e 6d 7b e5 8b 02 ed 89 18 be a5 f3 a0 6c 5d cc |.m{..........l].| | ee 0b 94 bf ee d4 18 97 62 5b 3f ab 84 2d b7 3d |........b[?..-.=| | ea 1a ec 7e f5 de ea 12 |...~.... | Client MAC key[20]: | 5d e8 c0 0e a7 80 ea d2 c9 68 c6 08 73 ed fc 96 |]........h..s...| | 0a a8 4d a2 |..M. | Server MAC key[20]: | ed 56 fd 29 b8 7a 8c 11 e4 35 f6 da 5a eb 1b 81 |.V.).z...5..Z...| | e3 58 ec 44 |.X.D | Client Write key[16]: | 29 3e 75 11 5e e1 37 30 9b 49 ac ea 01 8f 95 b6 |)>u.^.70.I......| Server Write key[16]: | 6a 87 90 52 1a c5 73 95 2e 6d 7b e5 8b 02 ed 89 |j..R..s..m{.....| Client Write IV[16]: | 18 be a5 f3 a0 6c 5d cc ee 0b 94 bf ee d4 18 97 |.....l].........| Server Write IV[16]: | 62 5b 3f ab 84 2d b7 3d ea 1a ec 7e f5 de ea 12 |b[?..-.=...~....| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: CAMELLIA128 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: CAMELLIA128 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 1072 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 735, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803 record: offset = 803, reported_length_remaining = 332 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 318, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 808 length 314 bytes, remaining 1126 record: offset = 1126, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1131 length 0 bytes, remaining 1135 dissect_ssl enter frame #293 (first time) conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f... looking for RSA pre-master008032041c81e691596ba5ab0fbf45b29c5f64c0e2d8dcd8... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 59 77 8a 78 2c fe e9 99 fc 9e 66 cd 62 7c ee 93 |Yw.x,.....f.b|..| | e4 3d 2e c9 7d 28 55 81 68 e0 08 f0 76 9e 5d 36 |.=..}(U.h...v.]6| | 6d 3c da 09 b0 33 fa 5d db 7e f4 c7 ac a0 5d d1 |m<...3.].~....].| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 23 0c 19 8a b6 1d 09 aa 16 a9 50 bc d6 2b b0 f1 |#.........P..+..| | 1e a8 83 58 08 36 04 0b be 22 b6 6c e7 52 34 bf |...X.6...".l.R4.| | 23 48 94 c7 dd 68 85 6e 2c 8b 74 c8 8d 5d 88 e3 |#H...h.n,.t..]..| | ae 0f de e3 6f 97 47 a3 23 9d 3c a1 0d |....o.G.#.<.. | hash out[104]: | 81 17 09 f2 85 03 c6 e3 3c dc b1 ba 29 cd 46 8d |........<...).F.| | 66 6e 7f 20 8f c0 23 a7 84 dd 7e 3a 36 fd 18 24 |fn. ..#...~:6..$| | 52 93 70 4a 12 e4 9c 7f 08 1c d3 36 74 e5 12 9c |R.pJ.......6t...| | d8 83 fb c2 0d 56 25 d3 58 ac 0e e3 57 2d fa 10 |.....V%.X...W-..| | b7 fb 9b 3e 5d d1 c8 1d b3 67 57 e3 04 c7 25 ed |...>]....gW...%.| | 97 21 bd 41 7a 2e 87 6e 4b c9 01 2e 82 70 53 01 |.!.Az..nK....pS.| | 71 41 ef 52 83 75 18 62 |qA.R.u.b | PRF out[104]: | 81 17 09 f2 85 03 c6 e3 3c dc b1 ba 29 cd 46 8d |........<...).F.| | 66 6e 7f 20 8f c0 23 a7 84 dd 7e 3a 36 fd 18 24 |fn. ..#...~:6..$| | 52 93 70 4a 12 e4 9c 7f 08 1c d3 36 74 e5 12 9c |R.pJ.......6t...| | d8 83 fb c2 0d 56 25 d3 58 ac 0e e3 57 2d fa 10 |.....V%.X...W-..| | b7 fb 9b 3e 5d d1 c8 1d b3 67 57 e3 04 c7 25 ed |...>]....gW...%.| | 97 21 bd 41 7a 2e 87 6e 4b c9 01 2e 82 70 53 01 |.!.Az..nK....pS.| | 71 41 ef 52 83 75 18 62 |qA.R.u.b | key expansion[104]: | 81 17 09 f2 85 03 c6 e3 3c dc b1 ba 29 cd 46 8d |........<...).F.| | 66 6e 7f 20 8f c0 23 a7 84 dd 7e 3a 36 fd 18 24 |fn. ..#...~:6..$| | 52 93 70 4a 12 e4 9c 7f 08 1c d3 36 74 e5 12 9c |R.pJ.......6t...| | d8 83 fb c2 0d 56 25 d3 58 ac 0e e3 57 2d fa 10 |.....V%.X...W-..| | b7 fb 9b 3e 5d d1 c8 1d b3 67 57 e3 04 c7 25 ed |...>]....gW...%.| | 97 21 bd 41 7a 2e 87 6e 4b c9 01 2e 82 70 53 01 |.!.Az..nK....pS.| | 71 41 ef 52 83 75 18 62 |qA.R.u.b | Client MAC key[20]: | 81 17 09 f2 85 03 c6 e3 3c dc b1 ba 29 cd 46 8d |........<...).F.| | 66 6e 7f 20 |fn. | Server MAC key[20]: | 8f c0 23 a7 84 dd 7e 3a 36 fd 18 24 52 93 70 4a |..#...~:6..$R.pJ| | 12 e4 9c 7f |.... | Client Write key[16]: | 08 1c d3 36 74 e5 12 9c d8 83 fb c2 0d 56 25 d3 |...6t........V%.| Server Write key[16]: | 58 ac 0e e3 57 2d fa 10 b7 fb 9b 3e 5d d1 c8 1d |X...W-.....>]...| Client Write IV[16]: | b3 67 57 e3 04 c7 25 ed 97 21 bd 41 7a 2e 87 6e |.gW...%..!.Az..n| Server Write IV[16]: | 4b c9 01 2e 82 70 53 01 71 41 ef 52 83 75 18 62 |K....pS.qA.R.u.b| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: CAMELLIA128 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: CAMELLIA128 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 59 77 8a 78 2c fe e9 99 fc 9e 66 cd 62 7c ee 93 |Yw.x,.....f.b|..| | e4 3d 2e c9 7d 28 55 81 68 e0 08 f0 76 9e 5d 36 |.=..}(U.h...v.]6| | 6d 3c da 09 b0 33 fa 5d db 7e f4 c7 ac a0 5d d1 |m<...3.].~....].| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 76 ee 05 b3 ce 43 54 ae b7 42 80 62 99 39 5e 96 |v....CT..B.b.9^.| | fe d1 a1 fe 08 a5 93 da a2 46 2b 02 e6 7a f3 d0 |.........F+..z..| | 20 af 2c 26 3b 07 89 48 c0 6a 0e a2 16 ec b9 c6 | .,&;..H.j......| | 90 d0 c7 7a aa ca d2 f0 02 23 2d b9 e5 48 4f 0f |...z.....#-..HO.| Plaintext[64]: | d4 53 7a 8c d2 0b 73 47 f2 f9 27 88 99 10 ee 46 |.Sz...sG..'....F| | 14 00 00 0c b0 2d f1 76 d2 be 56 e4 9d e9 0a 53 |.....-.v..V....S| | b4 a5 0d 3b 37 4b 4d cf 88 39 76 37 96 a7 d0 ef |...;7KM..9v7....| | 60 79 d0 59 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |`y.Y............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | b4 a5 0d 3b 37 4b 4d cf 88 39 76 37 96 a7 d0 ef |...;7KM..9v7....| | 60 79 d0 59 |`y.Y | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #294 (first time) conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 28 a6 e6 11 e9 7a 6a 68 9c 1b 91 91 4b d9 f7 b4 |(....zjh....K...| | 74 cb a2 a1 67 0c 63 a5 ac 46 e4 db 84 fd 8e 66 |t...g.c..F.....f| | 27 15 b4 2f 3c 19 3e d0 1a 3d a7 47 6a 4c eb e0 |'../<.>..=.GjL..| | 67 77 56 3d df 69 e7 b4 c5 87 83 34 30 fc 91 38 |gwV=.i.....40..8| Plaintext[64]: | 52 04 27 46 3c 6c 26 04 af eb 2d 3f ff 19 31 c3 |R.'F.m...61| | b9 71 27 60 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.q'`............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | e0 a7 96 53 5d 08 11 43 3e c4 6d bb 16 a4 36 31 |...S]..C>.m...61| | b9 71 27 60 |.q'` | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #295 (first time) conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0 record: offset = 0, reported_length_remaining = 133 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 128, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 128 Ciphertext[128]: | 12 20 e2 74 2a 11 c4 10 ed a0 aa a7 23 ca 38 c3 |. .t*.......#.8.| | f4 3d 4b 06 32 ed ff 62 b8 42 e4 ed c8 86 39 74 |.=K.2..b.B....9t| | 3b 71 af c4 0e 97 b6 7c 2a ef ef 92 d0 01 fc bd |;q.....|*.......| | 78 65 81 6e e2 cb 1b 6d 28 a4 60 2a 75 ba 35 e6 |xe.n...m(.`*u.5.| | 97 f8 04 9c fa d3 3c 07 30 7e 27 66 4f 19 33 3b |......<.0~'fO.3;| | 7a c1 33 d7 ef 7a a5 59 53 15 05 7c bf dc d7 08 |z.3..z.YS..|....| | e4 17 a2 d5 08 2c 89 eb 40 8a 07 19 90 28 52 29 |.....,..@....(R)| | 69 af 4f 26 e7 99 f5 2f 54 59 ca 03 f6 a7 c1 a6 |i.O&.../TY......| Plaintext[128]: | a7 c0 77 b3 8c 76 cc 8c 41 50 49 ef 86 d3 0c 3f |..w..v..API....?| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 63 61 |Host: dhe-dss-ca| | 6d 65 6c 6c 69 61 31 32 38 2d 73 68 61 2e 6c 6f |mellia128-sha.lo| | 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey| | 6e 2e 6e 6c 3a 34 34 35 38 0d 0a 0d 0a c6 c4 f2 |n.nl:4458.......| | 60 32 67 48 e0 11 bc 98 89 66 b5 48 48 38 2d ae |`2gH.....f.HH8-.| | a8 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |................| ssl_decrypt_record found padding 14 final len 113 checking mac (len 77, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 15 32 91 17 d5 ed 1a c3 1c ab 40 d5 3e c9 2b 25 |.2........@.>.+%| | bb 4b 6f be |.Ko. | ssl_decrypt_record: mac failed association_find: TCP port 44746 found (nil) association_find: TCP port 4458 found 0x34258f0 dissect_ssl enter frame #296 (first time) conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | fd a4 cd 1c ed 1b 11 1a d1 45 ee 85 7a 0f 23 3b |.........E..z.#;| | 3e 3f 2a 0e 17 28 88 92 f2 19 9b f9 e8 f7 ff 34 |>?*..(.........4| | 8b 11 11 9f 63 f7 ff 22 5d a0 3f b1 9a 94 c0 d4 |....c.."].?.....| | 21 17 f6 ff d8 a0 1c cf 03 b0 27 35 51 34 25 0e |!.........'5Q4%.| | 6e cb fa 41 3e 34 c5 f4 27 b6 59 bc 5d ae 8e c1 |n..A>4..'.Y.]...| | 12 48 ef 40 91 5a f1 42 e3 02 6a 54 29 f9 05 19 |.H.@.Z.B..jT)...| | e0 21 01 17 69 a8 84 35 08 ea 09 e2 dd 1c 54 00 |.!..i..5......T.| | 3c 2d 7d 9a f0 10 4d c3 c6 cf 5e 09 ff d0 01 51 |<-}...M...^....Q| | 78 f0 63 42 9a 58 1d b4 30 4a 40 50 df 39 06 56 |x.cB.X..0J@P.9.V| | 3e b4 ec 9d 64 09 f0 8e d6 be 4f e3 48 33 68 b5 |>...d.....O.H3h.| | 94 d5 f6 db 96 e7 8e 18 2b fc 5d 5f c6 2e d7 2d |........+.]_...-| | 99 73 c3 f4 dd 37 54 b1 f2 5f d8 c9 de 5f bb 69 |.s...7T.._..._.i| | 39 68 34 8f 49 24 ca 77 e0 f0 13 20 eb c7 01 92 |9h4.I$.w... ....| | b6 b8 6f de 78 28 37 5a 09 69 41 2a db 3d 62 a4 |..o.x(7Z.iA*.=b.| | 23 1f af 54 b3 ce 6e 4e 71 35 d2 e0 db 1d 02 1f |#..T..nNq5......| | f8 33 d1 97 cb d7 a5 c6 f9 46 b6 98 ff 9b 26 15 |.3.......F....&.| | de 38 ea 5d c1 1c e2 8e 62 7d 16 c1 51 c9 ba 53 |.8.]....b}..Q..S| | fe 48 8e df b0 90 c5 f5 57 cd 82 31 60 3f d9 c8 |.H......W..1`?..| | 22 a7 34 fd 28 2c c6 59 81 df bd 53 a8 85 54 6c |".4.(,.Y...S..Tl| | 57 b4 6d ea d8 16 fa 9b 1b 6e 46 8d 66 6c c7 bd |W.m......nF.fl..| | 95 d7 0e 3c 44 84 d4 d9 cd f4 93 01 04 54 9a d8 |...d| | 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='| | 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst| | 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'| | 58 05 86 66 e9 10 03 7d 14 04 31 53 69 a1 b6 13 |X..f...}..1Si...| | 82 52 ac c3 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.R..............| ssl_decrypt_record found padding 11 final len 388 checking mac (len 352, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | b4 8e f2 0c 2c 53 73 b8 87 7c 12 33 34 a4 d9 fe |....,Ss..|.34...| | be 8b 6d f5 |..m. | ssl_decrypt_record: mac failed association_find: TCP port 4458 found 0x34258f0 dissect_ssl enter frame #297 (first time) conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 7d e0 a4 b5 95 8c d7 b4 f5 da c6 ce fa 28 84 19 |}............(..| | db 25 fa 66 97 d7 3e fa 01 9f 25 8c cd ac 46 d2 |.%.f..>...%...F.| | b4 8a 04 b8 4b 0a 1d 9c 47 56 42 1f 6e 4b 03 5a |....K...GVB.nK.Z| Plaintext[48]: | e2 80 85 77 af ee bc a5 4c 1a 9d 71 01 fe c3 58 |...w....L..q...X| | 01 00 8a 56 eb f7 cc ad 7f 84 58 33 29 e6 21 30 |...V......X3).!0| | 49 74 f0 be 0c ce 09 09 09 09 09 09 09 09 09 09 |It..............| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 8a 56 eb f7 cc ad 7f 84 58 33 29 e6 21 30 49 74 |.V......X3).!0It| | f0 be 0c ce |.... | ssl_decrypt_record: mac ok dissect_ssl enter frame #299 (first time) conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 9d 88 b2 b6 f1 fc 08 ad 12 97 a1 40 80 72 24 7a |...........@.r$z| | a4 a8 28 0f c5 e2 ea ae ba 03 5f 95 27 76 48 e1 |..(......._.'vH.| | ed 5d 38 23 df a1 83 bb da 3d 2a 07 21 0e 36 18 |.]8#.....=*.!.6.| Plaintext[48]: | 7a 2c 25 f8 59 43 18 2f ea e6 a5 68 1a 1d 12 cc |z,%.YC./...h....| | 01 00 ef 69 16 d4 c5 9a 2f 7d 24 f7 7d 0d 8c a6 |...i..../}$.}...| | a1 84 50 3f a2 ed 09 09 09 09 09 09 09 09 09 09 |..P?............| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | ef 69 16 d4 c5 9a 2f 7d 24 f7 7d 0d 8c a6 a1 84 |.i..../}$.}.....| | 50 3f a2 ed |P?.. | ssl_decrypt_record: mac ok dissect_ssl enter frame #304 (first time) ssl_session_init: initializing ptr 0x7facc383dff0 size 688 conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 45627 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4459 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #306 (first time) conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0 record: offset = 0, reported_length_remaining = 1416 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0045 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 59 77 8a 78 2c fe e9 99 fc 9e 66 cd 62 7c ee 93 |Yw.x,.....f.b|..| | e4 3d 2e c9 7d 28 55 81 68 e0 08 f0 76 9e 5d 36 |.=..}(U.h...v.]6| | 6d 3c da 09 b0 33 fa 5d db 7e f4 c7 ac a0 5d d1 |m<...3.].~....].| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 23 67 b0 df 0c 44 2d e4 e0 d5 67 b4 e9 64 20 58 |#g...D-...g..d X| | 56 a3 83 25 b3 ba 49 2f ee e4 b2 be ed 52 34 bf |V..%..I/.....R4.| | 23 7d d6 d1 44 fb ee a4 16 dc 5b 5a f1 72 80 ce |#}..D.....[Z.r..| | 44 f1 5f e2 cf f0 c8 45 ca db 21 46 a0 |D._....E..!F. | hash out[104]: | db fb b6 62 90 ab 89 a3 ff 46 77 c0 41 1e a3 16 |...b.....Fw.A...| | e3 4a 7c 1f 93 9b ba 45 ab 1e a7 34 64 aa 88 3e |.J|....E...4d..>| | 3b c5 33 e5 da 1e 6d da 58 a3 23 dc 5e ce be 49 |;.3...m.X.#.^..I| | 78 ff 86 f6 40 24 f8 6b 2b c9 6b a8 3f b3 63 ae |x...@$.k+.k.?.c.| | 7f a9 61 33 d5 2a 35 5a 59 eb 97 39 0a 95 4d 35 |..a3.*5ZY..9..M5| | 52 6a e2 b7 e4 43 11 97 b3 3f 16 f1 cf 48 de cb |Rj...C...?...H..| | 3d 96 4c 6b 90 e7 14 ed |=.Lk.... | PRF out[104]: | db fb b6 62 90 ab 89 a3 ff 46 77 c0 41 1e a3 16 |...b.....Fw.A...| | e3 4a 7c 1f 93 9b ba 45 ab 1e a7 34 64 aa 88 3e |.J|....E...4d..>| | 3b c5 33 e5 da 1e 6d da 58 a3 23 dc 5e ce be 49 |;.3...m.X.#.^..I| | 78 ff 86 f6 40 24 f8 6b 2b c9 6b a8 3f b3 63 ae |x...@$.k+.k.?.c.| | 7f a9 61 33 d5 2a 35 5a 59 eb 97 39 0a 95 4d 35 |..a3.*5ZY..9..M5| | 52 6a e2 b7 e4 43 11 97 b3 3f 16 f1 cf 48 de cb |Rj...C...?...H..| | 3d 96 4c 6b 90 e7 14 ed |=.Lk.... | key expansion[104]: | db fb b6 62 90 ab 89 a3 ff 46 77 c0 41 1e a3 16 |...b.....Fw.A...| | e3 4a 7c 1f 93 9b ba 45 ab 1e a7 34 64 aa 88 3e |.J|....E...4d..>| | 3b c5 33 e5 da 1e 6d da 58 a3 23 dc 5e ce be 49 |;.3...m.X.#.^..I| | 78 ff 86 f6 40 24 f8 6b 2b c9 6b a8 3f b3 63 ae |x...@$.k+.k.?.c.| | 7f a9 61 33 d5 2a 35 5a 59 eb 97 39 0a 95 4d 35 |..a3.*5ZY..9..M5| | 52 6a e2 b7 e4 43 11 97 b3 3f 16 f1 cf 48 de cb |Rj...C...?...H..| | 3d 96 4c 6b 90 e7 14 ed |=.Lk.... | Client MAC key[20]: | db fb b6 62 90 ab 89 a3 ff 46 77 c0 41 1e a3 16 |...b.....Fw.A...| | e3 4a 7c 1f |.J|. | Server MAC key[20]: | 93 9b ba 45 ab 1e a7 34 64 aa 88 3e 3b c5 33 e5 |...E...4d..>;.3.| | da 1e 6d da |..m. | Client Write key[16]: | 58 a3 23 dc 5e ce be 49 78 ff 86 f6 40 24 f8 6b |X.#.^..Ix...@$.k| Server Write key[16]: | 2b c9 6b a8 3f b3 63 ae 7f a9 61 33 d5 2a 35 5a |+.k.?.c...a3.*5Z| Client Write IV[16]: | 59 eb 97 39 0a 95 4d 35 52 6a e2 b7 e4 43 11 97 |Y..9..M5Rj...C..| Server Write IV[16]: | b3 3f 16 f1 cf 48 de cb 3d 96 4c 6b 90 e7 14 ed |.?...H..=.Lk....| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: CAMELLIA128 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: CAMELLIA128 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 1353 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 541 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 527, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407 record: offset = 1407, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416 dissect_ssl enter frame #308 (first time) conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cf... looking for RSA pre-master00804d7ad45959353a60dbb7bc3b8677ddfe7950df38c6cb... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 98 f4 4c 2f 4f da d3 39 63 dd d5 5c 49 fa a0 75 |..L/O..9c..\I..u| | d6 89 68 83 d7 7c 9d 95 2e 54 1b 96 d1 75 c5 09 |..h..|...T...u..| | 0a 3e e8 51 c3 d1 c2 fe b8 02 54 6b 68 9f 08 f2 |.>.Q......Tkh...| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 23 67 b0 df 0c 44 2d e4 e0 d5 67 b4 e9 64 20 58 |#g...D-...g..d X| | 56 a3 83 25 b3 ba 49 2f ee e4 b2 be ed 52 34 bf |V..%..I/.....R4.| | 23 7d d6 d1 44 fb ee a4 16 dc 5b 5a f1 72 80 ce |#}..D.....[Z.r..| | 44 f1 5f e2 cf f0 c8 45 ca db 21 46 a0 |D._....E..!F. | hash out[104]: | a0 8c 19 b4 58 17 91 26 71 db 06 ae 76 60 a7 97 |....X..&q...v`..| | dc ee 24 51 18 b2 c9 49 6c 18 16 cc 1e 25 6f 16 |..$Q...Il....%o.| | 54 df 97 7c 72 3c e3 dd 47 95 1d cb 70 fd a0 9d |T..|r<..G...p...| | 2f a5 29 f8 a9 cb 2f 13 35 4d 4c a5 32 67 92 76 |/.).../.5ML.2g.v| | 1b fc dd 73 b1 cc ad d6 ac b6 89 a7 36 1a 35 fb |...s........6.5.| | 76 13 5c 55 8e 01 a8 93 23 dd 9c 11 49 ad 1d 14 |v.\U....#...I...| | 19 7b 40 5a 67 ae 1d 43 |.{@Zg..C | PRF out[104]: | a0 8c 19 b4 58 17 91 26 71 db 06 ae 76 60 a7 97 |....X..&q...v`..| | dc ee 24 51 18 b2 c9 49 6c 18 16 cc 1e 25 6f 16 |..$Q...Il....%o.| | 54 df 97 7c 72 3c e3 dd 47 95 1d cb 70 fd a0 9d |T..|r<..G...p...| | 2f a5 29 f8 a9 cb 2f 13 35 4d 4c a5 32 67 92 76 |/.).../.5ML.2g.v| | 1b fc dd 73 b1 cc ad d6 ac b6 89 a7 36 1a 35 fb |...s........6.5.| | 76 13 5c 55 8e 01 a8 93 23 dd 9c 11 49 ad 1d 14 |v.\U....#...I...| | 19 7b 40 5a 67 ae 1d 43 |.{@Zg..C | key expansion[104]: | a0 8c 19 b4 58 17 91 26 71 db 06 ae 76 60 a7 97 |....X..&q...v`..| | dc ee 24 51 18 b2 c9 49 6c 18 16 cc 1e 25 6f 16 |..$Q...Il....%o.| | 54 df 97 7c 72 3c e3 dd 47 95 1d cb 70 fd a0 9d |T..|r<..G...p...| | 2f a5 29 f8 a9 cb 2f 13 35 4d 4c a5 32 67 92 76 |/.).../.5ML.2g.v| | 1b fc dd 73 b1 cc ad d6 ac b6 89 a7 36 1a 35 fb |...s........6.5.| | 76 13 5c 55 8e 01 a8 93 23 dd 9c 11 49 ad 1d 14 |v.\U....#...I...| | 19 7b 40 5a 67 ae 1d 43 |.{@Zg..C | Client MAC key[20]: | a0 8c 19 b4 58 17 91 26 71 db 06 ae 76 60 a7 97 |....X..&q...v`..| | dc ee 24 51 |..$Q | Server MAC key[20]: | 18 b2 c9 49 6c 18 16 cc 1e 25 6f 16 54 df 97 7c |...Il....%o.T..|| | 72 3c e3 dd |r<.. | Client Write key[16]: | 47 95 1d cb 70 fd a0 9d 2f a5 29 f8 a9 cb 2f 13 |G...p.../.).../.| Server Write key[16]: | 35 4d 4c a5 32 67 92 76 1b fc dd 73 b1 cc ad d6 |5ML.2g.v...s....| Client Write IV[16]: | ac b6 89 a7 36 1a 35 fb 76 13 5c 55 8e 01 a8 93 |....6.5.v.\U....| Server Write IV[16]: | 23 dd 9c 11 49 ad 1d 14 19 7b 40 5a 67 ae 1d 43 |#...I....{@Zg..C| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: CAMELLIA128 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: CAMELLIA128 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 98 f4 4c 2f 4f da d3 39 63 dd d5 5c 49 fa a0 75 |..L/O..9c..\I..u| | d6 89 68 83 d7 7c 9d 95 2e 54 1b 96 d1 75 c5 09 |..h..|...T...u..| | 0a 3e e8 51 c3 d1 c2 fe b8 02 54 6b 68 9f 08 f2 |.>.Q......Tkh...| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 89 31 47 3e d2 51 cd 32 0e c5 14 19 f7 3d 2d 99 |.1G>.Q.2.....=-.| | 8c 35 a5 3d df eb 96 83 17 2c d2 22 7a b0 ab 8d |.5.=.....,."z...| | dc 7c 40 af c7 93 e7 e8 32 94 8f 81 86 41 6a d4 |.|@.....2....Aj.| | 4e 77 72 44 28 3a d7 73 1c e3 2d 96 49 e4 4b 67 |NwrD(:.s..-.I.Kg| Plaintext[64]: | cc 32 e8 ed f2 bd aa a3 1c e7 4e 18 12 54 3b cb |.2........N..T;.| | 14 00 00 0c 56 fa fb b6 f1 01 61 53 6b e7 f2 16 |....V.....aSk...| | 31 5f 78 75 2a 86 17 2c bd 67 aa 9a 44 0f 39 0b |1_xu*..,.g..D.9.| | 61 21 f0 d5 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |a!..............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 31 5f 78 75 2a 86 17 2c bd 67 aa 9a 44 0f 39 0b |1_xu*..,.g..D.9.| | 61 21 f0 d5 |a!.. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #309 (first time) conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 6f 7d 75 d5 68 e8 50 bf 56 74 e2 31 32 50 be cd |o}u.h.P.Vt.12P..| | 7e 76 21 ef f4 4a f9 5e f1 4b 32 fe 4d 66 8b a7 |~v!..J.^.K2.Mf..| | 26 d4 1b 36 26 ab 52 90 0f d0 b3 62 1f e0 65 1b |&..6&.R....b..e.| | f8 4f 61 3b 8d 91 3f 2d 02 03 ba 60 a5 f4 8c ee |.Oa;..?-...`....| Plaintext[64]: | 31 53 dd d4 5b 02 e9 48 30 8d f1 3d 8b f1 04 25 |1S..[..H0..=...%| | 14 00 00 0c 7a 76 e1 e0 89 d8 c7 5b 54 3c c2 99 |....zv.....[T<..| | ff b6 ed cf 90 94 b2 a4 99 e2 13 de 8b 5d c5 28 |.............].(| | 27 9e 48 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |'.H.............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | ff b6 ed cf 90 94 b2 a4 99 e2 13 de 8b 5d c5 28 |.............].(| | 27 9e 48 0b |'.H. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #310 (first time) conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0 record: offset = 0, reported_length_remaining = 133 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 128, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 128 Ciphertext[128]: | d2 7a a9 6b d2 35 c6 d3 63 d3 68 6b 62 1c c1 96 |.z.k.5..c.hkb...| | bb 3d 71 8c dd 9f d6 05 e4 7d ad 8a 7d be de 5b |.=q......}..}..[| | 8f 8c 2f 09 a5 03 c1 01 9a d5 f1 41 93 71 1a 1c |../........A.q..| | 1d 67 7e c4 01 1b 6b 0d 77 d8 c3 66 85 b4 3c 42 |.g~...k.w..f...5&.{..0%.| | be 0f 33 92 01 16 47 88 af be 92 f4 ee 66 8c 37 |..3...G......f.7| | 1a a4 2e 6f 6d 01 a6 ad 7c 55 a7 d0 47 a8 fe f6 |...om...|U..G...| | 05 9e 7c ed a1 ea 1e a3 ee 6e 46 92 26 b0 02 8a |..|......nF.&...| Plaintext[128]: | a0 ef 57 7a 37 3a 92 ca 76 dd d5 36 59 33 69 6e |..Wz7:..v..6Y3in| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 63 61 |Host: dhe-rsa-ca| | 6d 65 6c 6c 69 61 31 32 38 2d 73 68 61 2e 6c 6f |mellia128-sha.lo| | 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey| | 6e 2e 6e 6c 3a 34 34 35 39 0d 0a 0d 0a 3d 98 be |n.nl:4459....=..| | ad c3 82 26 b5 c4 04 26 ab 26 e3 c4 0b 51 75 e6 |...&...&.&...Qu.| | 2d 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |-...............| ssl_decrypt_record found padding 14 final len 113 checking mac (len 77, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 03 48 86 ee fb d5 a2 b3 65 e6 04 af 0b 04 61 72 |.H......e.....ar| | b0 ed 40 70 |..@p | ssl_decrypt_record: mac failed association_find: TCP port 45627 found (nil) association_find: TCP port 4459 found 0x3328090 dissect_ssl enter frame #311 (first time) conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | d3 f6 28 f3 d3 92 1b 76 e1 8d 33 fa 6a f0 5f 26 |..(....v..3.j._&| | 15 48 68 96 f8 26 f3 50 ed 3a be 5d ee c4 72 d2 |.Hh..&.P.:.]..r.| | 22 46 c9 20 d4 ea 27 8e a2 be 42 98 92 a7 ab db |"F. ..'...B.....| | 25 cb 67 3c b9 5e 10 f5 1b 99 7b 2c 62 d1 ff d6 |%.g<.^....{,b...| | 15 d2 35 37 7f 6c 38 a9 15 a2 e8 9f 43 53 dd 85 |..57.l8.....CS..| | 1e a8 11 03 4a 4d da 0a cc 4c 39 f6 e2 dd b7 27 |....JM...L9....'| | 71 7d 52 18 d5 5e 11 c0 81 be 94 53 38 59 a4 12 |q}R..^.....S8Y..| | f2 0a f6 60 19 db 0c dd fa 81 ba f9 3f c0 53 ee |...`........?.S.| | 67 f3 04 88 04 47 6e 60 98 cb f2 85 a7 1e f4 ef |g....Gn`........| | a7 af bb a1 a6 6e 77 d9 ff e7 16 ce 12 99 77 eb |.....nw.......w.| | 3c ff 72 63 95 51 49 51 27 74 58 78 11 59 c8 8a |<.rc.QIQ'tXx.Y..| | cf f7 c9 dc 54 24 43 0e 67 a4 cd bf 04 65 f2 5a |....T$C.g....e.Z| | e0 58 29 27 c9 f2 51 51 b6 0e e7 b2 20 ad 31 f7 |.X)'..QQ.... .1.| | d6 7f 1d 01 02 f0 6c 28 e1 0a 4c 06 75 96 13 68 |......l(..L.u..h| | e2 36 33 79 8f c8 9b 9d 69 ba 41 a6 70 44 2c 1b |.63y....i.A.pD,.| | 90 e5 ea 22 ee 70 96 cf e2 50 b6 b1 f7 56 66 8b |...".p...P...Vf.| | 06 ba fc 8c e3 68 d0 29 6c 50 3c 74 da 97 26 f1 |.....h.)lPd| | 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='| | 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst| | 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'| | e7 07 5d 56 06 9f 5f 9e 62 c4 ac 44 5a 46 88 08 |..]V.._.b..DZF..| | c0 5d a9 25 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.].%............| ssl_decrypt_record found padding 11 final len 388 checking mac (len 352, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 9a 34 f7 7e ac a3 fa 2d d9 6e 32 9d d8 53 af f5 |.4.~...-.n2..S..| | 41 dc e8 24 |A..$ | ssl_decrypt_record: mac failed association_find: TCP port 4459 found 0x3328090 dissect_ssl enter frame #312 (first time) conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 3e 26 3f 1a 0f b8 ba 30 38 51 ba 0e 2b d6 7e f9 |>&?....08Q..+.~.| | 17 63 34 f2 5f 32 d7 d5 15 42 95 9a b6 2f 32 93 |.c4._2...B.../2.| | d3 b8 c2 8b ff fd 10 c6 81 d3 72 db d6 d6 ad 44 |..........r....D| Plaintext[48]: | 56 2c b3 ff 6c 96 0e c4 f5 ad a3 87 c5 99 04 71 |V,..l..........q| | 01 00 4a 3b 09 17 19 66 8f 3f 28 97 2c 1e 85 96 |..J;...f.?(.,...| | ca a8 13 ec 1f 4a 09 09 09 09 09 09 09 09 09 09 |.....J..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 4a 3b 09 17 19 66 8f 3f 28 97 2c 1e 85 96 ca a8 |J;...f.?(.,.....| | 13 ec 1f 4a |...J | ssl_decrypt_record: mac ok dissect_ssl enter frame #314 (first time) conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | fb 15 dc 4b ab c1 4d f4 ce 06 a6 27 76 3f 01 4a |...K..M....'v?.J| | 2e 5e 4e 52 c0 9e a8 56 e2 9c 03 e8 54 2c 65 34 |.^NR...V....T,e4| | 30 92 c7 5d 78 d8 50 ab ab 09 47 fa 22 51 55 b9 |0..]x.P...G."QU.| Plaintext[48]: | 7d 23 d5 16 80 35 92 c6 14 53 8c 1c bb c3 7a 2f |}#...5...S....z/| | 01 00 0a 3a e3 36 ee fc 46 4e a0 c9 2c ac ca e2 |...:.6..FN..,...| | 6d 6b 10 bb 5d 2a 09 09 09 09 09 09 09 09 09 09 |mk..]*..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 0a 3a e3 36 ee fc 46 4e a0 c9 2c ac ca e2 6d 6b |.:.6..FN..,...mk| | 10 bb 5d 2a |..]* | ssl_decrypt_record: mac ok dissect_ssl enter frame #319 (first time) ssl_session_init: initializing ptr 0x7facc3840530 size 688 conversation = 0x7facef999a48, ssl_session = 0x7facc3840530 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 45960 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4463 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #321 (first time) conversation = 0x7facef999a48, ssl_session = 0x7facc3840530 record: offset = 0, reported_length_remaining = 884 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0084 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 98 f4 4c 2f 4f da d3 39 63 dd d5 5c 49 fa a0 75 |..L/O..9c..\I..u| | d6 89 68 83 d7 7c 9d 95 2e 54 1b 96 d1 75 c5 09 |..h..|...T...u..| | 0a 3e e8 51 c3 d1 c2 fe b8 02 54 6b 68 9f 08 f2 |.>.Q......Tkh...| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 23 6a eb c0 e2 35 e7 d6 88 c3 0c 0a 78 1a a2 47 |#j...5......x..G| | 5a 4f 3a 0a 2b 1b 1f 3e 46 02 23 2d f4 52 34 bf |ZO:.+..>F.#-.R4.| | 23 8f 8b 52 e2 71 f6 a8 35 0d 2f 2a f8 85 d5 e6 |#..R.q..5./*....| | 89 0f 54 a3 c6 68 7b 98 72 20 c0 aa 3d |..T..h{.r ..= | hash out[136]: | 2a bf ab e9 44 c8 f2 3b 6c 69 29 fa 8c 82 10 81 |*...D..;li).....| | 90 98 ac f1 76 10 cc d5 50 2a 86 bd 16 07 49 53 |....v...P*....IS| | f7 d3 3e 3c 17 28 b4 b8 a2 ab 9c b8 88 7c b6 2e |..><.(.......|..| | 70 e2 d1 ca c8 11 9b e0 4a 52 46 48 3b e9 8d f6 |p.......JRFH;...| | 11 09 8d 54 62 29 25 48 bd 6c 26 ac 29 7e d2 e5 |...Tb)%H.l&.)~..| | 0a e0 d9 a1 75 fd cd 1a 6a f1 6d d3 f8 83 be 47 |....u...j.m....G| | d0 99 fe 8b 13 46 0a e6 b6 15 ee a8 55 22 16 51 |.....F......U".Q| | cb cc f2 cc 09 cf 21 3c c3 b5 2e 5b e3 bb a8 86 |......!<...[....| | 70 55 ea f6 83 1f f8 6f |pU.....o | PRF out[136]: | 2a bf ab e9 44 c8 f2 3b 6c 69 29 fa 8c 82 10 81 |*...D..;li).....| | 90 98 ac f1 76 10 cc d5 50 2a 86 bd 16 07 49 53 |....v...P*....IS| | f7 d3 3e 3c 17 28 b4 b8 a2 ab 9c b8 88 7c b6 2e |..><.(.......|..| | 70 e2 d1 ca c8 11 9b e0 4a 52 46 48 3b e9 8d f6 |p.......JRFH;...| | 11 09 8d 54 62 29 25 48 bd 6c 26 ac 29 7e d2 e5 |...Tb)%H.l&.)~..| | 0a e0 d9 a1 75 fd cd 1a 6a f1 6d d3 f8 83 be 47 |....u...j.m....G| | d0 99 fe 8b 13 46 0a e6 b6 15 ee a8 55 22 16 51 |.....F......U".Q| | cb cc f2 cc 09 cf 21 3c c3 b5 2e 5b e3 bb a8 86 |......!<...[....| | 70 55 ea f6 83 1f f8 6f |pU.....o | key expansion[136]: | 2a bf ab e9 44 c8 f2 3b 6c 69 29 fa 8c 82 10 81 |*...D..;li).....| | 90 98 ac f1 76 10 cc d5 50 2a 86 bd 16 07 49 53 |....v...P*....IS| | f7 d3 3e 3c 17 28 b4 b8 a2 ab 9c b8 88 7c b6 2e |..><.(.......|..| | 70 e2 d1 ca c8 11 9b e0 4a 52 46 48 3b e9 8d f6 |p.......JRFH;...| | 11 09 8d 54 62 29 25 48 bd 6c 26 ac 29 7e d2 e5 |...Tb)%H.l&.)~..| | 0a e0 d9 a1 75 fd cd 1a 6a f1 6d d3 f8 83 be 47 |....u...j.m....G| | d0 99 fe 8b 13 46 0a e6 b6 15 ee a8 55 22 16 51 |.....F......U".Q| | cb cc f2 cc 09 cf 21 3c c3 b5 2e 5b e3 bb a8 86 |......!<...[....| | 70 55 ea f6 83 1f f8 6f |pU.....o | Client MAC key[20]: | 2a bf ab e9 44 c8 f2 3b 6c 69 29 fa 8c 82 10 81 |*...D..;li).....| | 90 98 ac f1 |.... | Server MAC key[20]: | 76 10 cc d5 50 2a 86 bd 16 07 49 53 f7 d3 3e 3c |v...P*....IS..><| | 17 28 b4 b8 |.(.. | Client Write key[32]: | a2 ab 9c b8 88 7c b6 2e 70 e2 d1 ca c8 11 9b e0 |.....|..p.......| | 4a 52 46 48 3b e9 8d f6 11 09 8d 54 62 29 25 48 |JRFH;......Tb)%H| Server Write key[32]: | bd 6c 26 ac 29 7e d2 e5 0a e0 d9 a1 75 fd cd 1a |.l&.)~......u...| | 6a f1 6d d3 f8 83 be 47 d0 99 fe 8b 13 46 0a e6 |j.m....G.....F..| Client Write IV[16]: | b6 15 ee a8 55 22 16 51 cb cc f2 cc 09 cf 21 3c |....U".Q......!<| Server Write IV[16]: | c3 b5 2e 5b e3 bb a8 86 70 55 ea f6 83 1f f8 6f |...[....pU.....o| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: CAMELLIA256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: CAMELLIA256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 821 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884 dissect_ssl enter frame #323 (first time) conversation = 0x7facef999a48, ssl_session = 0x7facc3840530 record: offset = 0, reported_length_remaining = 342 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 262, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6... looking for RSA pre-master28a5e5ae37eb7d5c1b3740154edc21c244ade2aa80b2c5a9... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 13 19 85 5e 4c 8c d2 67 a7 29 81 ec 40 c2 6f ee |...^L..g.)..@.o.| | b3 69 64 f2 3e b1 c0 bb 7d c3 7f a7 d3 72 1b 14 |.id.>...}....r..| | 43 de 90 61 3d 9f e3 23 16 69 0c 36 02 82 3b 5f |C..a=..#.i.6..;_| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 23 6a eb c0 e2 35 e7 d6 88 c3 0c 0a 78 1a a2 47 |#j...5......x..G| | 5a 4f 3a 0a 2b 1b 1f 3e 46 02 23 2d f4 52 34 bf |ZO:.+..>F.#-.R4.| | 23 8f 8b 52 e2 71 f6 a8 35 0d 2f 2a f8 85 d5 e6 |#..R.q..5./*....| | 89 0f 54 a3 c6 68 7b 98 72 20 c0 aa 3d |..T..h{.r ..= | hash out[136]: | 1e e9 75 7a 04 27 a2 72 7a 40 2b 52 8c 41 ea cc |..uz.'.rz@+R.A..| | c9 aa 7c 14 9e 2c 69 95 ff 18 8f 18 c2 dc 11 94 |..|..,i.........| | 9d a1 9f 69 e6 49 d6 dd ef fc d6 9e 44 fc 5f 81 |...i.I......D._.| | 35 02 8b 36 64 82 23 43 30 74 6a cd 9f ea 1e 8a |5..6d.#C0tj.....| | 49 74 50 3d 3b 5c f2 4b 73 02 65 23 da 1f 5a d8 |ItP=;\.Ks.e#..Z.| | ed 23 88 ca f4 e1 83 d7 e4 07 4c ba cf 48 9b ef |.#........L..H..| | cd b1 86 a0 57 8a 98 41 9f ed 72 49 5d 55 79 e5 |....W..A..rI]Uy.| | 50 72 78 77 39 7c be cf 01 f6 41 cf 24 03 3d 64 |Prxw9|....A.$.=d| | be 57 98 9c ce ad e6 5a |.W.....Z | PRF out[136]: | 1e e9 75 7a 04 27 a2 72 7a 40 2b 52 8c 41 ea cc |..uz.'.rz@+R.A..| | c9 aa 7c 14 9e 2c 69 95 ff 18 8f 18 c2 dc 11 94 |..|..,i.........| | 9d a1 9f 69 e6 49 d6 dd ef fc d6 9e 44 fc 5f 81 |...i.I......D._.| | 35 02 8b 36 64 82 23 43 30 74 6a cd 9f ea 1e 8a |5..6d.#C0tj.....| | 49 74 50 3d 3b 5c f2 4b 73 02 65 23 da 1f 5a d8 |ItP=;\.Ks.e#..Z.| | ed 23 88 ca f4 e1 83 d7 e4 07 4c ba cf 48 9b ef |.#........L..H..| | cd b1 86 a0 57 8a 98 41 9f ed 72 49 5d 55 79 e5 |....W..A..rI]Uy.| | 50 72 78 77 39 7c be cf 01 f6 41 cf 24 03 3d 64 |Prxw9|....A.$.=d| | be 57 98 9c ce ad e6 5a |.W.....Z | key expansion[136]: | 1e e9 75 7a 04 27 a2 72 7a 40 2b 52 8c 41 ea cc |..uz.'.rz@+R.A..| | c9 aa 7c 14 9e 2c 69 95 ff 18 8f 18 c2 dc 11 94 |..|..,i.........| | 9d a1 9f 69 e6 49 d6 dd ef fc d6 9e 44 fc 5f 81 |...i.I......D._.| | 35 02 8b 36 64 82 23 43 30 74 6a cd 9f ea 1e 8a |5..6d.#C0tj.....| | 49 74 50 3d 3b 5c f2 4b 73 02 65 23 da 1f 5a d8 |ItP=;\.Ks.e#..Z.| | ed 23 88 ca f4 e1 83 d7 e4 07 4c ba cf 48 9b ef |.#........L..H..| | cd b1 86 a0 57 8a 98 41 9f ed 72 49 5d 55 79 e5 |....W..A..rI]Uy.| | 50 72 78 77 39 7c be cf 01 f6 41 cf 24 03 3d 64 |Prxw9|....A.$.=d| | be 57 98 9c ce ad e6 5a |.W.....Z | Client MAC key[20]: | 1e e9 75 7a 04 27 a2 72 7a 40 2b 52 8c 41 ea cc |..uz.'.rz@+R.A..| | c9 aa 7c 14 |..|. | Server MAC key[20]: | 9e 2c 69 95 ff 18 8f 18 c2 dc 11 94 9d a1 9f 69 |.,i............i| | e6 49 d6 dd |.I.. | Client Write key[32]: | ef fc d6 9e 44 fc 5f 81 35 02 8b 36 64 82 23 43 |....D._.5..6d.#C| | 30 74 6a cd 9f ea 1e 8a 49 74 50 3d 3b 5c f2 4b |0tj.....ItP=;\.K| Server Write key[32]: | 73 02 65 23 da 1f 5a d8 ed 23 88 ca f4 e1 83 d7 |s.e#..Z..#......| | e4 07 4c ba cf 48 9b ef cd b1 86 a0 57 8a 98 41 |..L..H......W..A| Client Write IV[16]: | 9f ed 72 49 5d 55 79 e5 50 72 78 77 39 7c be cf |..rI]Uy.Prxw9|..| Server Write IV[16]: | 01 f6 41 cf 24 03 3d 64 be 57 98 9c ce ad e6 5a |..A.$.=d.W.....Z| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: CAMELLIA256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: CAMELLIA256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 13 19 85 5e 4c 8c d2 67 a7 29 81 ec 40 c2 6f ee |...^L..g.)..@.o.| | b3 69 64 f2 3e b1 c0 bb 7d c3 7f a7 d3 72 1b 14 |.id.>...}....r..| | 43 de 90 61 3d 9f e3 23 16 69 0c 36 02 82 3b 5f |C..a=..#.i.6..;_| dissect_ssl3_handshake session keys successfully generated record: offset = 267, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 273, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 47 fb 9b b3 2e b2 65 44 ee 57 a7 f1 85 8e 12 a1 |G.....eD.W......| | 43 56 d0 2e c9 23 46 5d a9 c9 7f 35 75 35 a4 fa |CV...#F]...5u5..| | 1d 43 9f b0 05 db f4 90 e4 df 2f 14 44 90 35 18 |.C......../.D.5.| | 4d 12 bb 03 57 22 96 b0 08 46 02 de df 62 98 d7 |M...W"...F...b..| Plaintext[64]: | 24 b4 d0 d7 36 77 13 dc 8e d1 bc 52 c6 d7 7f f8 |$...6w.....R....| | 14 00 00 0c a4 a1 8e 8a a4 ee 69 b8 73 ed e5 91 |..........i.s...| | fc 11 11 1d 58 95 59 25 31 52 da eb df 06 8e 99 |....X.Y%1R......| | 88 11 12 6c 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |...l............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | fc 11 11 1d 58 95 59 25 31 52 da eb df 06 8e 99 |....X.Y%1R......| | 88 11 12 6c |...l | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #324 (first time) conversation = 0x7facef999a48, ssl_session = 0x7facc3840530 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 02 72 8d d9 a7 0e 3f 32 a1 e9 0b 9f 93 f6 7e 34 |.r....?2......~4| | 39 23 ae 0d eb d7 b8 44 bb 2f 93 f1 83 35 24 22 |9#.....D./...5$"| | 78 28 7f 03 8a 3c 74 83 27 0d b0 fb 46 56 6d 91 |x(...w.| | a5 91 88 b0 1e 61 8e 98 3f 31 23 63 47 91 59 31 |.....a..?1#cG.Y1| | d1 d1 bb ab f8 d5 d5 a2 5f 1c 96 79 20 6c e3 65 |........_..y l.e| | db 3d 7f b2 be d9 e5 31 86 23 02 f6 01 a8 c6 92 |.=.....1.#......| | 20 5a 32 85 59 28 18 ea f7 d6 aa 87 1b c8 1c 5a | Z2.Y(.........Z| Plaintext[112]: | 85 d9 c4 10 d3 53 d3 34 da 45 35 ae 4d 4a 96 13 |.....S.4.E5.MJ..| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 63 61 6d 65 6c 6c 69 61 32 35 |Host: camellia25| | 36 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c |6-sha.local.al.l| | 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 36 |ekensteyn.nl:446| | 33 0d 0a 0d 0a 9b ae 04 4b b5 f7 b2 5c 7b 34 a9 |3.......K...\{4.| | cc 22 b4 7d b9 ed 9b 6c 13 06 06 06 06 06 06 06 |.".}...l........| ssl_decrypt_record found padding 6 final len 105 checking mac (len 69, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 37 5d 52 b5 a7 ae 5e 90 41 3b ba 07 6b ac 99 c3 |7]R...^.A;..k...| | df 2c f1 b2 |.,.. | ssl_decrypt_record: mac failed association_find: TCP port 45960 found (nil) association_find: TCP port 4463 found 0x33292f0 dissect_ssl enter frame #326 (first time) conversation = 0x7facef999a48, ssl_session = 0x7facc3840530 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | 80 3f 74 e5 3b a0 39 64 10 ea 3c 88 07 0c 79 d5 |.?t.;.9d..<...y.| | f1 00 2e 2a 5b 6e 6d 18 d4 b5 e9 85 5c 95 b9 3d |...*[nm.....\..=| | 26 23 ec f0 0b 4b 40 ce 5a 31 a9 7c d9 a7 11 6d |&#...K@.Z1.|...m| | 14 f7 bd 3a ec ac e7 cd c4 fb 3b 9d 14 2e c4 98 |...:......;.....| | 70 4f 4f 87 f4 57 59 79 ec 33 b4 22 6b 36 cf 24 |pOO..WYy.3."k6.$| | ad 1e 13 bf 52 38 c3 55 9e ed 34 43 04 c3 d3 4e |....R8.U..4C...N| | c1 c9 72 a7 8d 90 31 f2 e1 23 dd 09 16 63 50 b5 |..r...1..#...cP.| | fe 73 d3 a8 aa 45 70 7c 1a 5c 09 2d a4 57 47 88 |.s...Ep|.\.-.WG.| | a2 97 08 cc 44 5e 7f 8c 41 cb ef 02 33 83 c5 f0 |....D^..A...3...| | 10 d3 fb 21 ae 09 15 b7 e4 04 44 b9 40 69 4b 97 |...!......D.@iK.| | 34 56 38 5a 9d 9a 0e 0d 72 59 82 21 54 4a 5b 00 |4V8Z....rY.!TJ[.| | e9 23 1c 44 c5 8b ed 7b ca 43 af b0 3d 0a 4a 76 |.#.D...{.C..=.Jv| | 5c 75 cd 04 c9 8a cc 16 08 da c7 20 44 9b 36 3b |\u......... D.6;| | 86 d4 2c 45 07 97 82 b5 f2 bd 8d ec 60 20 5c 88 |..,E........` \.| | 79 e7 b5 b0 90 6c fd 6d 59 12 18 ec 06 fa 9e b8 |y....l.mY.......| | ac fe 3e 07 45 42 bc f0 71 d8 c7 04 bc 7f 11 fc |..>.EB..q.......| | c1 d6 6b fa 1b 80 18 32 87 e4 9a 24 5f 1d 5f 51 |..k....2...$_._Q| | 42 8d f7 44 9e 06 1e 2d 3e 64 a4 be 17 05 38 7a |B..D...->d....8z| | 35 6c f2 3e 6a a6 82 f8 68 66 e9 95 8d 7d e7 09 |5l.>j...hf...}..| | a3 2a 33 3a 57 fa 42 ed b9 c0 f3 d9 c4 26 9d a0 |.*3:W.B......&..| | 13 1f de 4e 46 01 f5 f1 7c ac 1f 02 2f 2f d8 4f |...NF...|...//.O| | 17 95 56 75 d1 95 0a 01 c3 48 05 2e 3d 11 54 f5 |..Vu.....H..=.T.| | 25 58 7b e1 d8 35 a9 93 98 5c 91 a6 da 58 f2 91 |%X{..5...\...X..| | 9e f1 d0 e0 bd 76 06 ea e4 e7 66 ab 01 99 af fd |.....v....f.....| | ce f5 95 4e ef 40 7a f4 4c bd 39 59 29 a1 1d 7e |...N.@z.L.9Y)..~| Plaintext[400]: | 39 da 10 18 16 5d da d5 1a 93 51 26 b7 10 25 fa |9....]....Q&..%.| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:| | 35 35 3a 31 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:15 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 38 34 20 2d 20 43 41 4d 45 4c |x00,0x84 - CAMEL| | 4c 49 41 32 35 36 2d 53 48 41 20 20 20 20 20 20 |LIA256-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 43 61 6d 65 6c 6c 69 61 28 32 35 36 29 20 4d |=Camellia(256) M| | 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1| | 4d 20 9d 67 77 69 ef d0 35 d1 eb 1d a1 23 d3 44 |M .gwi..5....#.D| | e4 79 3b 4d 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.y;M............| ssl_decrypt_record found padding 11 final len 388 checking mac (len 352, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 6a 8e e9 2a e9 ce 28 ac 0b d3 c7 6a 1d fd ed 93 |j..*..(....j....| | b0 10 65 0f |..e. | ssl_decrypt_record: mac failed association_find: TCP port 4463 found 0x33292f0 dissect_ssl enter frame #327 (first time) conversation = 0x7facef999a48, ssl_session = 0x7facc3840530 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 2f fa 91 20 7b ba 19 80 01 32 8c 17 e0 75 25 41 |/.. {....2...u%A| | 41 0c f5 3c 46 bd c2 f3 56 19 92 48 92 f5 57 66 |A.. state 0x01 dissect_ssl enter frame #336 (first time) conversation = 0x7facef999cf0, ssl_session = 0x7facc3842ab0 record: offset = 0, reported_length_remaining = 1135 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0087 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 13 19 85 5e 4c 8c d2 67 a7 29 81 ec 40 c2 6f ee |...^L..g.)..@.o.| | b3 69 64 f2 3e b1 c0 bb 7d c3 7f a7 d3 72 1b 14 |.id.>...}....r..| | 43 de 90 61 3d 9f e3 23 16 69 0c 36 02 82 3b 5f |C..a=..#.i.6..;_| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 24 d6 e1 06 75 14 7a 53 48 96 db 8c cb ee 52 e8 |$...u.zSH.....R.| | ad dd 55 a0 a3 99 3c 62 13 93 66 26 b7 52 34 bf |..U.......| Plaintext[64]: | 26 fc 91 f6 e2 86 7d 37 70 47 3b 54 2b 52 3e c7 |&.....}7pG;T+R>.| | 14 00 00 0c fa db c0 11 3f c8 41 79 2c 6e 9b 0c |........?.Ay,n..| | 12 5c 56 01 93 8c b6 f4 a5 38 cf 2c 92 c0 df 73 |.\V......8.,...s| | 56 1f 24 47 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |V.$G............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 12 5c 56 01 93 8c b6 f4 a5 38 cf 2c 92 c0 df 73 |.\V......8.,...s| | 56 1f 24 47 |V.$G | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #339 (first time) conversation = 0x7facef999cf0, ssl_session = 0x7facc3842ab0 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | f5 02 c7 af 76 da 1d 26 df d0 99 08 80 87 c1 c0 |....v..&........| | 06 9f aa ea 77 b7 36 6e c8 4c 24 18 f3 32 26 cf |....w.6n.L$..2&.| | b1 7e 07 64 ac 97 32 34 48 84 58 77 5e ce bc 44 |.~.d..24H.Xw^..D| | a2 5f 0f c5 c4 a2 cd a9 1d a2 f4 f4 70 47 25 0b |._..........pG%.| Plaintext[64]: | 77 a0 f2 7d 13 86 ff ad 89 da 5e f6 2e e2 21 89 |w..}......^...!.| | 14 00 00 0c e4 6f f6 f8 4f f8 97 6f 90 e1 ae d7 |.....o..O..o....| | 3d 1d 09 bf 7a ae e8 96 39 97 87 3c 82 aa 4c 09 |=...z...9..<..L.| | 6d ce 01 fc 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |m...............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 3d 1d 09 bf 7a ae e8 96 39 97 87 3c 82 aa 4c 09 |=...z...9..<..L.| | 6d ce 01 fc |m... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #340 (first time) conversation = 0x7facef999cf0, ssl_session = 0x7facc3842ab0 record: offset = 0, reported_length_remaining = 133 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 128, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 128 Ciphertext[128]: | 94 69 cf 52 91 aa 64 9a b7 b4 aa a3 73 88 43 d5 |.i.R..d.....s.C.| | a1 e0 de 8a 57 e6 fa 44 f0 84 4d c7 0b 5f 77 b7 |....W..D..M.._w.| | cd ab d3 12 f4 5f 83 cd dd 07 4a 19 a2 13 0f 5a |....._....J....Z| | 8b 89 b9 ed e4 22 5f 15 82 fb 7f 93 26 a1 cf d6 |....."_.....&...| | d6 0e 7d dc f9 cc 52 0f d6 bf 75 ad da 43 62 64 |..}...R...u..Cbd| | 35 ab 4b 92 23 9b 39 9b bd 85 67 2a 4c c3 c7 5e |5.K.#.9...g*L..^| | c1 12 a3 cd 28 42 a1 5a fd f4 ec 4c 65 c1 1b 6b |....(B.Z...Le..k| | 6d 3f cf 83 c2 59 b0 91 b2 86 42 83 3e 14 4e 1e |m?...Y....B.>.N.| Plaintext[128]: | a2 de e4 4e ac eb 71 32 47 25 4c 54 27 c0 03 c3 |...N..q2G%LT'...| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 63 61 |Host: dhe-dss-ca| | 6d 65 6c 6c 69 61 32 35 36 2d 73 68 61 2e 6c 6f |mellia256-sha.lo| | 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey| | 6e 2e 6e 6c 3a 34 34 36 34 0d 0a 0d 0a 08 02 fe |n.nl:4464.......| | fb 08 70 fa 53 4b fb 93 27 16 f1 77 e1 fd 0a 58 |..p.SK..'..w...X| | 32 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |2...............| ssl_decrypt_record found padding 14 final len 113 checking mac (len 77, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 9c 2c b5 a9 5c 80 e8 38 4f a1 5a 1a cb 97 6e 3e |.,..\..8O.Z...n>| | f5 8e 67 dd |..g. | ssl_decrypt_record: mac failed association_find: TCP port 46494 found (nil) association_find: TCP port 4464 found 0x3329380 dissect_ssl enter frame #341 (first time) conversation = 0x7facef999cf0, ssl_session = 0x7facc3842ab0 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | d1 55 16 ed 01 dc a3 cc db f7 c0 01 9b 99 7b df |.U............{.| | 0b d8 37 20 65 cd c4 32 92 44 2b 35 56 fb fe f8 |..7 e..2.D+5V...| | 65 c4 b0 d6 af f9 a8 7f a4 cf 85 4b c3 52 7b cc |e..........K.R{.| | e1 7d 9c 34 42 77 bd b4 d6 1f 93 8e a5 0f 44 f5 |.}.4Bw........D.| | cf 12 e8 d6 ca 71 0a 33 6b 6f c2 17 e7 d0 4b a0 |.....q.3ko....K.| | da 67 86 c0 e0 e5 1e d3 4b ef ce 1a c5 a3 8d 49 |.g......K......I| | dc 23 48 f9 a6 71 52 9c 90 39 d4 1a 4c c2 ec 85 |.#H..qR..9..L...| | 3d 70 25 36 3a ad 94 b4 8b 49 71 54 15 e1 8b 35 |=p%6:....IqT...5| | 30 29 a3 d3 38 45 0f 26 94 f2 44 4f 4e 3c b4 97 |0)..8E.&..DON<..| | 11 fc c0 96 6d 1e c1 43 87 27 7d 12 72 83 82 99 |....m..C.'}.r...| | cd 1e a8 98 fe dd dc 8d 88 31 13 ba 03 d4 fb 34 |.........1.....4| | 89 a3 bb ae b9 50 88 83 33 97 60 f6 be b6 09 6c |.....P..3.`....l| | 1a cd 72 8c 16 13 b6 3b 25 76 f6 e6 a0 b0 a2 01 |..r....;%v......| | 13 02 e9 52 16 55 fd cd a6 7d a1 3b da 07 3d b4 |...R.U...}.;..=.| | 80 4a f1 7f f1 6c 87 01 16 2a 13 d6 17 b5 4e fd |.J...l...*....N.| | 0c 8d 1c 48 d0 a5 dd ca 88 4e 0b 71 a9 64 fa b2 |...H.....N.q.d..| | 72 c6 04 e6 a6 45 21 5f f0 e9 b3 b2 8e 2a 97 01 |r....E!_.....*..| | 26 d7 db d0 cb 5e e8 ad 10 67 bc ab 34 aa 22 d1 |&....^...g..4.".| | fc 15 a4 69 aa e5 16 60 66 64 b7 2a ba ed 22 32 |...i...`fd.*.."2| | ee ce 25 67 59 51 01 ca c0 fe 83 45 e0 13 30 d1 |..%gYQ.....E..0.| | 03 2c 70 83 6c 78 dc 05 3f 9a 24 db fa 5a 79 93 |.,p.lx..?.$..Zy.| | ad 24 37 79 03 b5 0a 7c 9d 70 0e 27 4f c6 df 49 |.$7y...|.p.'O..I| | 75 48 17 1b d4 f9 c4 ee f6 0e 25 5b 3c 3c ee 24 |uH........%[<<.$| | e0 db 23 6b d1 6f f3 70 fa b9 e4 6a bb b5 19 be |..#k.o.p...j....| | 82 2a b9 1c 42 59 6d b3 34 0f b1 3e ce fa f3 3c |.*..BYm.4..>...<| Plaintext[400]: | 56 d8 90 48 74 3a cb a2 26 96 76 52 d3 2a d7 62 |V..Ht:..&.vR.*.b| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:| | 35 35 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:16 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 38 37 20 2d 20 44 48 45 2d 44 |x00,0x87 - DHE-D| | 53 53 2d 43 41 4d 45 4c 4c 49 41 32 35 36 2d 53 |SS-CAMELLIA256-S| | 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc| | 3d 43 61 6d 65 6c 6c 69 61 28 32 35 36 29 20 4d |=Camellia(256) M| | 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1| | 9d 2f 0f ef c7 0f ce 43 a6 ee 38 8b 89 9c c5 fc |./.....C..8.....| | e0 9c e3 d2 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................| ssl_decrypt_record found padding 11 final len 388 checking mac (len 352, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 8c ef 7b 0c b7 61 63 78 62 4a 31 d9 d5 9c f5 fe |..{..acxbJ1.....| | 8c 51 93 86 |.Q.. | ssl_decrypt_record: mac failed association_find: TCP port 4464 found 0x3329380 dissect_ssl enter frame #342 (first time) conversation = 0x7facef999cf0, ssl_session = 0x7facc3842ab0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 73 c0 6a d0 83 12 3f 6c 73 dd 27 97 76 e3 58 11 |s.j...?ls.'.v.X.| | f5 5d 87 8d 64 29 4d c5 83 93 55 43 2c 8b 72 fa |.]..d)M...UC,.r.| | c4 da 78 2c 9b a1 ee d5 8d 38 da d6 27 ce ee 88 |..x,.....8..'...| Plaintext[48]: | 39 d2 ca 89 a0 d7 8f db 1c ab 32 e6 34 ad 7f 5d |9.........2.4..]| | 01 00 bf bc c2 c8 3e 11 58 ad ac 5e e4 f9 1b f9 |......>.X..^....| | f4 fe aa 02 19 7f 09 09 09 09 09 09 09 09 09 09 |................| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | bf bc c2 c8 3e 11 58 ad ac 5e e4 f9 1b f9 f4 fe |....>.X..^......| | aa 02 19 7f |.... | ssl_decrypt_record: mac ok dissect_ssl enter frame #344 (first time) conversation = 0x7facef999cf0, ssl_session = 0x7facc3842ab0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | c2 9c 16 b7 51 d3 f3 82 ab 81 37 5d 14 01 60 7a |....Q.....7]..`z| | d6 c0 f6 e8 3c 17 5d 4a 61 ab 32 2e 11 19 49 00 |....<.]Ja.2...I.| | dd 61 dc 76 38 55 06 ae 41 9e de f4 74 70 f3 4e |.a.v8U..A...tp.N| Plaintext[48]: | 4b b8 f2 c8 d7 66 d7 59 07 9f 04 af 0d 1f 56 16 |K....f.Y......V.| | 01 00 f9 1e 49 76 21 97 f4 ed 7b 46 a2 d6 8a be |....Iv!...{F....| | db be 97 91 fc 8d 09 09 09 09 09 09 09 09 09 09 |................| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | f9 1e 49 76 21 97 f4 ed 7b 46 a2 d6 8a be db be |..Iv!...{F......| | 97 91 fc 8d |.... | ssl_decrypt_record: mac ok dissect_ssl enter frame #349 (first time) ssl_session_init: initializing ptr 0x7facc3844ff0 size 688 conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 56836 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4465 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #351 (first time) conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0 record: offset = 0, reported_length_remaining = 1416 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0088 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 83 01 a8 73 6c 89 9c 81 75 4b 4d ea a7 a0 82 16 |...sl...uKM.....| | d3 ff 0b 5a d2 b9 9e 89 bc 36 9d 5d d1 f5 2c 1f |...Z.....6.]..,.| | 81 d9 b8 c7 d2 fe ee eb 0f c8 3a 28 2b 8d 4e cd |..........:(+.N.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 24 9c 46 3d 31 a5 4b 42 7e 81 1b 6c 74 b9 c8 25 |$.F=1.KB~..lt..%| | b7 dd e5 6a 5f a7 e4 fc 59 19 b0 ab 79 52 34 bf |...j_...Y...yR4.| | 24 49 f7 4f 35 22 63 ff 70 ed e3 65 09 26 f9 da |$I.O5"c.p..e.&..| | 77 96 a9 f1 f9 cc 97 c3 be 6a 1f fd fe |w........j... | hash out[136]: | 68 74 bb f4 d5 e9 18 3e 78 d7 eb 4f c3 05 9a e9 |ht.....>x..O....| | 9b 8f 2f 3b f1 10 84 e3 4b 5b 18 1a c2 93 19 dd |../;....K[......| | 25 ae e3 68 bf 0f e0 03 c5 69 45 6d da 9d 43 ef |%..h.....iEm..C.| | 3d e5 25 ac 87 ec 10 ca d6 58 dd 57 6a 3e 8b 0c |=.%......X.Wj>..| | 1e 44 44 27 68 0e 21 e1 2a 47 27 f8 df 6b 86 b7 |.DD'h.!.*G'..k..| | 80 cd 51 e2 cb 52 2f 43 86 61 e4 42 d7 72 2b 05 |..Q..R/C.a.B.r+.| | 55 89 70 37 79 dc d0 8b 88 d8 45 5a 2c d1 f4 d2 |U.p7y.....EZ,...| | db 96 a2 be af d9 c4 1c 35 9c 36 26 b3 31 72 fb |........5.6&.1r.| | 4c 16 bc 06 78 d2 25 bc |L...x.%. | PRF out[136]: | 68 74 bb f4 d5 e9 18 3e 78 d7 eb 4f c3 05 9a e9 |ht.....>x..O....| | 9b 8f 2f 3b f1 10 84 e3 4b 5b 18 1a c2 93 19 dd |../;....K[......| | 25 ae e3 68 bf 0f e0 03 c5 69 45 6d da 9d 43 ef |%..h.....iEm..C.| | 3d e5 25 ac 87 ec 10 ca d6 58 dd 57 6a 3e 8b 0c |=.%......X.Wj>..| | 1e 44 44 27 68 0e 21 e1 2a 47 27 f8 df 6b 86 b7 |.DD'h.!.*G'..k..| | 80 cd 51 e2 cb 52 2f 43 86 61 e4 42 d7 72 2b 05 |..Q..R/C.a.B.r+.| | 55 89 70 37 79 dc d0 8b 88 d8 45 5a 2c d1 f4 d2 |U.p7y.....EZ,...| | db 96 a2 be af d9 c4 1c 35 9c 36 26 b3 31 72 fb |........5.6&.1r.| | 4c 16 bc 06 78 d2 25 bc |L...x.%. | key expansion[136]: | 68 74 bb f4 d5 e9 18 3e 78 d7 eb 4f c3 05 9a e9 |ht.....>x..O....| | 9b 8f 2f 3b f1 10 84 e3 4b 5b 18 1a c2 93 19 dd |../;....K[......| | 25 ae e3 68 bf 0f e0 03 c5 69 45 6d da 9d 43 ef |%..h.....iEm..C.| | 3d e5 25 ac 87 ec 10 ca d6 58 dd 57 6a 3e 8b 0c |=.%......X.Wj>..| | 1e 44 44 27 68 0e 21 e1 2a 47 27 f8 df 6b 86 b7 |.DD'h.!.*G'..k..| | 80 cd 51 e2 cb 52 2f 43 86 61 e4 42 d7 72 2b 05 |..Q..R/C.a.B.r+.| | 55 89 70 37 79 dc d0 8b 88 d8 45 5a 2c d1 f4 d2 |U.p7y.....EZ,...| | db 96 a2 be af d9 c4 1c 35 9c 36 26 b3 31 72 fb |........5.6&.1r.| | 4c 16 bc 06 78 d2 25 bc |L...x.%. | Client MAC key[20]: | 68 74 bb f4 d5 e9 18 3e 78 d7 eb 4f c3 05 9a e9 |ht.....>x..O....| | 9b 8f 2f 3b |../; | Server MAC key[20]: | f1 10 84 e3 4b 5b 18 1a c2 93 19 dd 25 ae e3 68 |....K[......%..h| | bf 0f e0 03 |.... | Client Write key[32]: | c5 69 45 6d da 9d 43 ef 3d e5 25 ac 87 ec 10 ca |.iEm..C.=.%.....| | d6 58 dd 57 6a 3e 8b 0c 1e 44 44 27 68 0e 21 e1 |.X.Wj>...DD'h.!.| Server Write key[32]: | 2a 47 27 f8 df 6b 86 b7 80 cd 51 e2 cb 52 2f 43 |*G'..k....Q..R/C| | 86 61 e4 42 d7 72 2b 05 55 89 70 37 79 dc d0 8b |.a.B.r+.U.p7y...| Client Write IV[16]: | 88 d8 45 5a 2c d1 f4 d2 db 96 a2 be af d9 c4 1c |..EZ,...........| Server Write IV[16]: | 35 9c 36 26 b3 31 72 fb 4c 16 bc 06 78 d2 25 bc |5.6&.1r.L...x.%.| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: CAMELLIA256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: CAMELLIA256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 1353 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 541 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 527, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407 record: offset = 1407, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416 dissect_ssl enter frame #353 (first time) conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9... looking for RSA pre-master008078d26263650f6ddf092133c693e2b2727a3db5f9f9d5... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 40 a4 74 5a 04 0a 8f 9b bf 71 9c 43 6a 5f 51 66 |@.tZ.....q.Cj_Qf| | 83 6e ef 17 d8 37 f1 93 65 33 43 ff 87 52 b8 eb |.n...7..e3C..R..| | f2 b7 97 df 1b 7b da 2b c9 b5 99 02 51 ea 99 37 |.....{.+....Q..7| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 24 9c 46 3d 31 a5 4b 42 7e 81 1b 6c 74 b9 c8 25 |$.F=1.KB~..lt..%| | b7 dd e5 6a 5f a7 e4 fc 59 19 b0 ab 79 52 34 bf |...j_...Y...yR4.| | 24 49 f7 4f 35 22 63 ff 70 ed e3 65 09 26 f9 da |$I.O5"c.p..e.&..| | 77 96 a9 f1 f9 cc 97 c3 be 6a 1f fd fe |w........j... | hash out[136]: | 96 99 e5 44 a6 39 6a 9e 50 4f 9e 44 65 98 29 1a |...D.9j.PO.De.).| | 37 ce 62 45 c9 5e e8 a0 94 db c0 ff 86 7d 1c 58 |7.bE.^.......}.X| | 1c 90 8c 96 aa d3 e4 c1 c4 83 81 78 13 b0 fe db |...........x....| | 15 f3 3b dc a7 da 98 12 2f 97 75 23 1c 00 f4 28 |..;...../.u#...(| | 5e c2 2e 5c 1b c4 c7 60 e1 9b b8 54 4b 25 6f 06 |^..\...`...TK%o.| | 3c 22 f3 3b c3 fc 2d a1 88 13 85 f6 39 53 5c c1 |<".;..-.....9S\.| | 15 b8 90 a4 7a 16 4c 18 94 f4 1b 79 a4 09 5a 61 |....z.L....y..Za| | 01 11 50 8c ca 6d df a4 4a 3c 2a 9a 34 cb 52 07 |..P..m..J<*.4.R.| | 6b ad bc c7 6e 26 de 14 |k...n&.. | PRF out[136]: | 96 99 e5 44 a6 39 6a 9e 50 4f 9e 44 65 98 29 1a |...D.9j.PO.De.).| | 37 ce 62 45 c9 5e e8 a0 94 db c0 ff 86 7d 1c 58 |7.bE.^.......}.X| | 1c 90 8c 96 aa d3 e4 c1 c4 83 81 78 13 b0 fe db |...........x....| | 15 f3 3b dc a7 da 98 12 2f 97 75 23 1c 00 f4 28 |..;...../.u#...(| | 5e c2 2e 5c 1b c4 c7 60 e1 9b b8 54 4b 25 6f 06 |^..\...`...TK%o.| | 3c 22 f3 3b c3 fc 2d a1 88 13 85 f6 39 53 5c c1 |<".;..-.....9S\.| | 15 b8 90 a4 7a 16 4c 18 94 f4 1b 79 a4 09 5a 61 |....z.L....y..Za| | 01 11 50 8c ca 6d df a4 4a 3c 2a 9a 34 cb 52 07 |..P..m..J<*.4.R.| | 6b ad bc c7 6e 26 de 14 |k...n&.. | key expansion[136]: | 96 99 e5 44 a6 39 6a 9e 50 4f 9e 44 65 98 29 1a |...D.9j.PO.De.).| | 37 ce 62 45 c9 5e e8 a0 94 db c0 ff 86 7d 1c 58 |7.bE.^.......}.X| | 1c 90 8c 96 aa d3 e4 c1 c4 83 81 78 13 b0 fe db |...........x....| | 15 f3 3b dc a7 da 98 12 2f 97 75 23 1c 00 f4 28 |..;...../.u#...(| | 5e c2 2e 5c 1b c4 c7 60 e1 9b b8 54 4b 25 6f 06 |^..\...`...TK%o.| | 3c 22 f3 3b c3 fc 2d a1 88 13 85 f6 39 53 5c c1 |<".;..-.....9S\.| | 15 b8 90 a4 7a 16 4c 18 94 f4 1b 79 a4 09 5a 61 |....z.L....y..Za| | 01 11 50 8c ca 6d df a4 4a 3c 2a 9a 34 cb 52 07 |..P..m..J<*.4.R.| | 6b ad bc c7 6e 26 de 14 |k...n&.. | Client MAC key[20]: | 96 99 e5 44 a6 39 6a 9e 50 4f 9e 44 65 98 29 1a |...D.9j.PO.De.).| | 37 ce 62 45 |7.bE | Server MAC key[20]: | c9 5e e8 a0 94 db c0 ff 86 7d 1c 58 1c 90 8c 96 |.^.......}.X....| | aa d3 e4 c1 |.... | Client Write key[32]: | c4 83 81 78 13 b0 fe db 15 f3 3b dc a7 da 98 12 |...x......;.....| | 2f 97 75 23 1c 00 f4 28 5e c2 2e 5c 1b c4 c7 60 |/.u#...(^..\...`| Server Write key[32]: | e1 9b b8 54 4b 25 6f 06 3c 22 f3 3b c3 fc 2d a1 |...TK%o.<".;..-.| | 88 13 85 f6 39 53 5c c1 15 b8 90 a4 7a 16 4c 18 |....9S\.....z.L.| Client Write IV[16]: | 94 f4 1b 79 a4 09 5a 61 01 11 50 8c ca 6d df a4 |...y..Za..P..m..| Server Write IV[16]: | 4a 3c 2a 9a 34 cb 52 07 6b ad bc c7 6e 26 de 14 |J<*.4.R.k...n&..| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: CAMELLIA256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: CAMELLIA256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 40 a4 74 5a 04 0a 8f 9b bf 71 9c 43 6a 5f 51 66 |@.tZ.....q.Cj_Qf| | 83 6e ef 17 d8 37 f1 93 65 33 43 ff 87 52 b8 eb |.n...7..e3C..R..| | f2 b7 97 df 1b 7b da 2b c9 b5 99 02 51 ea 99 37 |.....{.+....Q..7| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | fa 68 d8 87 92 30 22 84 16 34 84 dd 38 e6 1d 34 |.h...0"..4..8..4| | 14 ab 5e 86 34 b8 f3 df 6c 43 05 bb 31 1c 09 a8 |..^.4...lC..1...| | 56 8a 1a 21 88 32 ef 18 e1 b7 53 c4 31 95 69 ea |V..!.2....S.1.i.| | da b8 42 cc d6 1b ec 7a eb 86 c5 3a 0f 2b 58 69 |..B....z...:.+Xi| Plaintext[64]: | 4b b8 fa 75 08 4a 3f a9 c8 db 63 5d 13 5a 69 5d |K..u.J?...c].Zi]| | 14 00 00 0c ae e2 6a 45 89 9e 66 35 23 cf 96 21 |......jE..f5#..!| | bc 6b 69 50 7e 25 31 e2 11 b5 10 3b c4 4b 2b 90 |.kiP~%1....;.K+.| | 1e 26 31 4a 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.&1J............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | bc 6b 69 50 7e 25 31 e2 11 b5 10 3b c4 4b 2b 90 |.kiP~%1....;.K+.| | 1e 26 31 4a |.&1J | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #354 (first time) conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 40 79 2f 88 65 aa f4 a1 4f dd 22 db f8 2b 5d f0 |@y/.e...O."..+].| | 9c 00 d4 0c e8 14 b1 79 9f a7 35 64 96 a0 a6 74 |.......y..5d...t| | 14 3d f5 b1 2d 07 79 9e bd ac b1 c4 fc 31 ce b9 |.=..-.y......1..| | 57 91 ad 39 f0 8e c6 82 25 39 1e d4 3c 28 11 4c |W..9....%9..<(.L| Plaintext[64]: | f9 8c 08 20 64 18 84 fb cf b0 01 9f 18 29 aa 5c |... d........).\| | 14 00 00 0c e0 07 f0 70 10 cf 3e af 77 24 da 12 |.......p..>.w$..| | 2b 66 b3 99 42 62 ec 86 a9 57 76 86 10 33 c0 c9 |+f..Bb...Wv..3..| | bd 87 0e 8d 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 2b 66 b3 99 42 62 ec 86 a9 57 76 86 10 33 c0 c9 |+f..Bb...Wv..3..| | bd 87 0e 8d |.... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #355 (first time) conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0 record: offset = 0, reported_length_remaining = 133 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 128, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 128 Ciphertext[128]: | 55 f0 1a 31 5e cb a0 5b 0f 9f e1 bd 94 ce 47 5d |U..1^..[......G]| | d9 d2 82 de 4a 62 4c 6b 65 dd 66 cb 40 d5 f7 38 |....JbLke.f.@..8| | 2f 6f 54 fa a8 c7 b6 c8 1d 0c 0f 9d 60 67 a6 53 |/oT.........`g.S| | c5 f3 f2 de e7 11 04 6f 18 28 b7 b5 da a9 04 e2 |.......o.(......| | 16 04 0a 90 7c 37 1e e7 d3 be f6 53 ad 43 c0 53 |....|7.....S.C.S| | 1c 1d 73 2d f6 39 6d b5 00 bc 9d 92 0b d7 7b 57 |..s-.9m.......{W| | ee 50 fd bc 91 c3 07 56 99 2b 2d 39 74 21 ff 16 |.P.....V.+-9t!..| | 4f 74 6b 4b e6 ce 12 ad 23 cf b7 22 22 3e a9 53 |OtkK....#.."">.S| Plaintext[128]: | 80 b2 67 f2 b3 04 ab 90 ba d6 20 26 56 47 bd ed |..g....... &VG..| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 63 61 |Host: dhe-rsa-ca| | 6d 65 6c 6c 69 61 32 35 36 2d 73 68 61 2e 6c 6f |mellia256-sha.lo| | 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey| | 6e 2e 6e 6c 3a 34 34 36 35 0d 0a 0d 0a c5 76 a8 |n.nl:4465.....v.| | fc 7c d4 c7 4d 40 29 77 4d d9 68 ab 41 94 9f 1e |.|..M@)wM.h.A...| | b8 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |................| ssl_decrypt_record found padding 14 final len 113 checking mac (len 77, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 07 5a 3d 9b 9c ce c4 b8 21 60 01 ac 95 56 e4 54 |.Z=.....!`...V.T| | ea cd 30 7c |..0| | ssl_decrypt_record: mac failed association_find: TCP port 56836 found (nil) association_find: TCP port 4465 found 0x3329410 dissect_ssl enter frame #356 (first time) conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | dd 3e f4 66 f9 61 9d 1d 08 21 c1 62 e5 32 b5 30 |.>.f.a...!.b.2.0| | bd 82 65 ba 66 86 cf 43 09 33 8d 02 0c 31 31 d4 |..e.f..C.3...11.| | 6e fa c6 2a b8 88 1f ce 0b 74 5c f8 fd 4e 89 22 |n..*.....t\..N."| | eb ab f1 3a eb e4 9b 2b 6f 78 c9 99 1c 92 5c 20 |...:...+ox....\ | | bb 71 f1 85 11 af df e0 71 a7 9a bd 4f 51 14 74 |.q......q...OQ.t| | d8 6e 9c 02 4e e6 ae 77 29 cf c7 08 59 15 2b 76 |.n..N..w)...Y.+v| | 2c 62 6c 43 1c 8e e4 c9 17 c0 53 6e 2f 20 d8 a1 |,blC......Sn/ ..| | 12 c0 5b 72 40 9d 7b 9e 2f ac 4f 79 2e 2e dd 45 |..[r@.{./.Oy...E| | 84 2d 26 b0 c4 3a 4e ca 97 ef 69 bf d8 97 7b ce |.-&..:N...i...{.| | e5 a0 25 24 43 7c 2f 47 a0 17 5b 78 8e ca 01 8c |..%$C|/G..[x....| | a2 9c fa fa 08 94 33 96 da 3d b9 ae 49 01 6d 30 |......3..=..I.m0| | ea 40 1e 4a 9b 89 d5 df a9 0c bd 16 c9 ac ed a5 |.@.J............| | ce e8 7f cd 99 21 cf 62 bc e1 c3 23 a8 07 89 b6 |.....!.b...#....| | 9d 7e ca c3 ee 0b ef bf 43 2f 7b e1 16 9b aa 77 |.~......C/{....w| | ee 30 f3 21 be 4c ca c7 8a 5c 2d c9 80 bd 16 9f |.0.!.L...\-.....| | b6 04 60 5f 39 a3 01 76 f6 c1 15 ce 2f 82 a7 15 |..`_9..v..../...| | 5e 5b 58 a8 c2 32 a9 33 3d 4a e2 fd 24 ea d2 18 |^[X..2.3=J..$...| | de eb 2d 4f a1 90 53 ac 49 86 bd c1 62 01 40 10 |..-O..S.I...b.@.| | 12 59 11 18 a5 ba 33 4b cd c2 1b d4 82 8c 06 cf |.Y....3K........| | 60 3d c1 5b 11 3a 02 7d f6 94 42 a5 48 c5 d1 97 |`=.[.:.}..B.H...| | b8 db 48 8f 3e 98 f2 98 fd 3a 6b e7 dc 8d ac ce |..H.>....:k.....| | f2 db b9 ac 88 59 ca be b4 34 37 69 9b 5b 89 08 |.....Y...47i.[..| | bb 3c 4b 27 ec 63 80 57 a2 2f 83 e1 9c 39 03 e8 |.d| | 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='| | 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst| | 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'| | df dd 36 53 be 4b 2a cf 0a 54 8d 28 4d d0 04 b9 |..6S.K*..T.(M...| | 08 a2 a5 5a 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |...Z............| ssl_decrypt_record found padding 11 final len 388 checking mac (len 352, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | f0 53 9d 53 d1 18 af 29 fc eb 69 68 7f 79 c0 f6 |.S.S...)..ih.y..| | e8 33 66 a2 |.3f. | ssl_decrypt_record: mac failed association_find: TCP port 4465 found 0x3329410 dissect_ssl enter frame #357 (first time) conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | c8 8e 52 02 bd ce d2 61 53 4d 77 13 e2 40 96 43 |..R....aSMw..@.C| | 8f c1 c7 ff 36 8c 11 d7 e4 5a 15 4c e3 5c 55 f1 |....6....Z.L.\U.| | e7 f1 01 6a c5 99 be e3 b9 aa 46 83 00 6b 4e f6 |...j......F..kN.| Plaintext[48]: | 04 e1 12 3e a1 e8 f2 c9 6d 92 92 9a 0b 52 3f f3 |...>....m....R?.| | 01 00 41 65 c8 9c 56 fd 66 ea 90 83 2c a2 7d bb |..Ae..V.f...,.}.| | 17 8e 07 36 0a b1 09 09 09 09 09 09 09 09 09 09 |...6............| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 41 65 c8 9c 56 fd 66 ea 90 83 2c a2 7d bb 17 8e |Ae..V.f...,.}...| | 07 36 0a b1 |.6.. | ssl_decrypt_record: mac ok dissect_ssl enter frame #359 (first time) conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 51 75 5c 7b 36 f1 13 5d 48 b0 c7 5b 00 41 13 19 |Qu\{6..]H..[.A..| | 76 23 60 e7 84 47 b8 75 02 e6 b6 79 8b fd a0 83 |v#`..G.u...y....| | e6 b6 b0 79 22 78 99 6a 4a 84 96 dd 39 12 81 93 |...y"x.jJ...9...| Plaintext[48]: | d3 8f a5 ef 2f 32 a0 8d b2 9a a1 50 91 a7 6f 52 |..../2.....P..oR| | 01 00 ee 92 da dd 32 b9 7e ae 23 2d 7c e7 49 31 |......2.~.#-|.I1| | 08 18 ea 38 7c 53 09 09 09 09 09 09 09 09 09 09 |...8|S..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | ee 92 da dd 32 b9 7e ae 23 2d 7c e7 49 31 08 18 |....2.~.#-|.I1..| | ea 38 7c 53 |.8|S | ssl_decrypt_record: mac ok dissect_ssl enter frame #364 (first time) ssl_session_init: initializing ptr 0x7facc38474f0 size 688 conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 47180 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4470 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #366 (first time) conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0 record: offset = 0, reported_length_remaining = 884 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0096 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 40 a4 74 5a 04 0a 8f 9b bf 71 9c 43 6a 5f 51 66 |@.tZ.....q.Cj_Qf| | 83 6e ef 17 d8 37 f1 93 65 33 43 ff 87 52 b8 eb |.n...7..e3C..R..| | f2 b7 97 df 1b 7b da 2b c9 b5 99 02 51 ea 99 37 |.....{.+....Q..7| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 24 56 9e 18 76 22 de ae 8f 15 c0 e2 55 6f 05 75 |$V..v"......Uo.u| | cf b7 7d 5a ad 40 1f f9 ab 2a 95 c1 74 52 34 bf |..}Z.@...*..tR4.| | 24 3e 01 c2 f6 75 c7 b3 61 12 79 e5 6c 12 83 3d |$>...u..a.y.l..=| | 90 35 10 41 54 1b b4 b4 56 db 47 29 36 |.5.AT...V.G)6 | hash out[104]: | a4 34 1e 3c 9c b0 93 c6 b2 35 ce 14 fe 1b d7 ab |.4.<.....5......| | 72 9f d8 25 7b 84 54 e3 5d 44 34 c1 d7 54 84 a4 |r..%{.T.]D4..T..| | a7 8f 41 03 e9 93 27 bc 9d 6b 12 30 1c 83 09 e4 |..A...'..k.0....| | a3 43 66 3e a5 fd 38 bf 93 58 00 eb 36 6c 2c b3 |.Cf>..8..X..6l,.| | 9a 74 e3 7f bc b3 0c 1a 6a 2b 62 83 c0 5a 36 de |.t......j+b..Z6.| | 50 3b 19 5f 65 0c 6c fa b1 15 af 88 ba 6a d2 66 |P;._e.l......j.f| | db 34 79 4e b3 9c 6f d9 |.4yN..o. | PRF out[104]: | a4 34 1e 3c 9c b0 93 c6 b2 35 ce 14 fe 1b d7 ab |.4.<.....5......| | 72 9f d8 25 7b 84 54 e3 5d 44 34 c1 d7 54 84 a4 |r..%{.T.]D4..T..| | a7 8f 41 03 e9 93 27 bc 9d 6b 12 30 1c 83 09 e4 |..A...'..k.0....| | a3 43 66 3e a5 fd 38 bf 93 58 00 eb 36 6c 2c b3 |.Cf>..8..X..6l,.| | 9a 74 e3 7f bc b3 0c 1a 6a 2b 62 83 c0 5a 36 de |.t......j+b..Z6.| | 50 3b 19 5f 65 0c 6c fa b1 15 af 88 ba 6a d2 66 |P;._e.l......j.f| | db 34 79 4e b3 9c 6f d9 |.4yN..o. | key expansion[104]: | a4 34 1e 3c 9c b0 93 c6 b2 35 ce 14 fe 1b d7 ab |.4.<.....5......| | 72 9f d8 25 7b 84 54 e3 5d 44 34 c1 d7 54 84 a4 |r..%{.T.]D4..T..| | a7 8f 41 03 e9 93 27 bc 9d 6b 12 30 1c 83 09 e4 |..A...'..k.0....| | a3 43 66 3e a5 fd 38 bf 93 58 00 eb 36 6c 2c b3 |.Cf>..8..X..6l,.| | 9a 74 e3 7f bc b3 0c 1a 6a 2b 62 83 c0 5a 36 de |.t......j+b..Z6.| | 50 3b 19 5f 65 0c 6c fa b1 15 af 88 ba 6a d2 66 |P;._e.l......j.f| | db 34 79 4e b3 9c 6f d9 |.4yN..o. | Client MAC key[20]: | a4 34 1e 3c 9c b0 93 c6 b2 35 ce 14 fe 1b d7 ab |.4.<.....5......| | 72 9f d8 25 |r..% | Server MAC key[20]: | 7b 84 54 e3 5d 44 34 c1 d7 54 84 a4 a7 8f 41 03 |{.T.]D4..T....A.| | e9 93 27 bc |..'. | Client Write key[16]: | 9d 6b 12 30 1c 83 09 e4 a3 43 66 3e a5 fd 38 bf |.k.0.....Cf>..8.| Server Write key[16]: | 93 58 00 eb 36 6c 2c b3 9a 74 e3 7f bc b3 0c 1a |.X..6l,..t......| Client Write IV[16]: | 6a 2b 62 83 c0 5a 36 de 50 3b 19 5f 65 0c 6c fa |j+b..Z6.P;._e.l.| Server Write IV[16]: | b1 15 af 88 ba 6a d2 66 db 34 79 4e b3 9c 6f d9 |.....j.f.4yN..o.| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: SEED decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: SEED decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 821 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884 dissect_ssl enter frame #368 (first time) conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0 record: offset = 0, reported_length_remaining = 342 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 262, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d9035104154... looking for RSA pre-mastera08f474c2a890fc66f808400c49cc26c2804ab7db0a99844... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 81 d9 fb 64 10 67 d7 05 13 b4 15 8f 9a e0 50 12 |...d.g........P.| | e7 d1 e4 78 7f 6a 21 26 62 fd 92 66 b3 cb 5f 96 |...x.j!&b..f.._.| | ba 68 df e0 c3 21 d8 1c 8f 9a 32 92 52 41 39 fa |.h...!....2.RA9.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 24 56 9e 18 76 22 de ae 8f 15 c0 e2 55 6f 05 75 |$V..v"......Uo.u| | cf b7 7d 5a ad 40 1f f9 ab 2a 95 c1 74 52 34 bf |..}Z.@...*..tR4.| | 24 3e 01 c2 f6 75 c7 b3 61 12 79 e5 6c 12 83 3d |$>...u..a.y.l..=| | 90 35 10 41 54 1b b4 b4 56 db 47 29 36 |.5.AT...V.G)6 | hash out[104]: | b0 94 d8 af ea ff 9a 2d b4 ce 30 e0 e6 b5 c3 57 |.......-..0....W| | 72 6f 78 ef c6 72 1e 7f 86 aa 21 84 23 2c 08 f5 |rox..r....!.#,..| | fc 56 c8 01 ac 8d d6 c1 bf 4e 2c c4 72 43 70 ea |.V.......N,.rCp.| | d0 b9 89 95 51 41 a8 27 68 1b 3b d2 8c 6b 70 73 |....QA.'h.;..kps| | e4 01 07 8e 68 8a 9f 09 ea 32 9d fb 23 54 37 bb |....h....2..#T7.| | d3 c8 ee db 13 f2 47 b7 3d 5d 77 94 97 f9 15 81 |......G.=]w.....| | 05 99 dd 6a 67 6a 9f 05 |...jgj.. | PRF out[104]: | b0 94 d8 af ea ff 9a 2d b4 ce 30 e0 e6 b5 c3 57 |.......-..0....W| | 72 6f 78 ef c6 72 1e 7f 86 aa 21 84 23 2c 08 f5 |rox..r....!.#,..| | fc 56 c8 01 ac 8d d6 c1 bf 4e 2c c4 72 43 70 ea |.V.......N,.rCp.| | d0 b9 89 95 51 41 a8 27 68 1b 3b d2 8c 6b 70 73 |....QA.'h.;..kps| | e4 01 07 8e 68 8a 9f 09 ea 32 9d fb 23 54 37 bb |....h....2..#T7.| | d3 c8 ee db 13 f2 47 b7 3d 5d 77 94 97 f9 15 81 |......G.=]w.....| | 05 99 dd 6a 67 6a 9f 05 |...jgj.. | key expansion[104]: | b0 94 d8 af ea ff 9a 2d b4 ce 30 e0 e6 b5 c3 57 |.......-..0....W| | 72 6f 78 ef c6 72 1e 7f 86 aa 21 84 23 2c 08 f5 |rox..r....!.#,..| | fc 56 c8 01 ac 8d d6 c1 bf 4e 2c c4 72 43 70 ea |.V.......N,.rCp.| | d0 b9 89 95 51 41 a8 27 68 1b 3b d2 8c 6b 70 73 |....QA.'h.;..kps| | e4 01 07 8e 68 8a 9f 09 ea 32 9d fb 23 54 37 bb |....h....2..#T7.| | d3 c8 ee db 13 f2 47 b7 3d 5d 77 94 97 f9 15 81 |......G.=]w.....| | 05 99 dd 6a 67 6a 9f 05 |...jgj.. | Client MAC key[20]: | b0 94 d8 af ea ff 9a 2d b4 ce 30 e0 e6 b5 c3 57 |.......-..0....W| | 72 6f 78 ef |rox. | Server MAC key[20]: | c6 72 1e 7f 86 aa 21 84 23 2c 08 f5 fc 56 c8 01 |.r....!.#,...V..| | ac 8d d6 c1 |.... | Client Write key[16]: | bf 4e 2c c4 72 43 70 ea d0 b9 89 95 51 41 a8 27 |.N,.rCp.....QA.'| Server Write key[16]: | 68 1b 3b d2 8c 6b 70 73 e4 01 07 8e 68 8a 9f 09 |h.;..kps....h...| Client Write IV[16]: | ea 32 9d fb 23 54 37 bb d3 c8 ee db 13 f2 47 b7 |.2..#T7.......G.| Server Write IV[16]: | 3d 5d 77 94 97 f9 15 81 05 99 dd 6a 67 6a 9f 05 |=]w........jgj..| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: SEED decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: SEED decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 81 d9 fb 64 10 67 d7 05 13 b4 15 8f 9a e0 50 12 |...d.g........P.| | e7 d1 e4 78 7f 6a 21 26 62 fd 92 66 b3 cb 5f 96 |...x.j!&b..f.._.| | ba 68 df e0 c3 21 d8 1c 8f 9a 32 92 52 41 39 fa |.h...!....2.RA9.| dissect_ssl3_handshake session keys successfully generated record: offset = 267, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 273, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | cd 79 dc 6f 62 fe 21 70 42 98 f6 48 e3 dd 80 71 |.y.ob.!pB..H...q| | f6 3f f8 59 ae 63 9d f0 69 7b 35 0d 8d d0 f0 28 |.?.Y.c..i{5....(| | df 91 4b 54 d7 76 fb d8 e7 5c 84 b0 a8 0f 6f af |..KT.v...\....o.| | 32 0d 65 32 a3 dd df 69 7d d3 79 c2 9c 2f 42 a5 |2.e2...i}.y../B.| Plaintext[64]: | 75 c8 e5 2e 3b 86 34 97 78 25 d2 5e 11 76 82 d4 |u...;.4.x%.^.v..| | 14 00 00 0c 88 2d 25 c6 b2 df f9 6e 7b a6 86 5d |.....-%....n{..]| | e9 2f 86 89 ec 27 c0 b7 e5 32 8c e0 65 48 f7 49 |./...'...2..eH.I| | 7e ca fe 05 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |~...............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | e9 2f 86 89 ec 27 c0 b7 e5 32 8c e0 65 48 f7 49 |./...'...2..eH.I| | 7e ca fe 05 |~... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #369 (first time) conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | f1 0a f2 a7 2e cc 2e 26 d7 f4 5c eb fd bc d6 ee |.......&..\.....| | b6 5a 36 1f 57 05 a1 72 a3 50 cc 99 df 24 2a 1b |.Z6.W..r.P...$*.| | e6 95 35 30 b1 5a 6a f1 84 2d e0 89 e8 95 0a c7 |..50.Zj..-......| | 47 08 e8 27 ab 7b 3d 3e a9 80 f9 0a 7d 1c 27 56 |G..'.{=>....}.'V| Plaintext[64]: | 9d e9 d9 96 dd a2 da 36 b5 13 46 ca 82 cd c3 21 |.......6..F....!| | 14 00 00 0c 86 b5 73 c1 67 fb a0 66 d0 7f b5 c5 |......s.g..f....| | 7a 4a 70 c1 f1 10 be 68 84 5b 77 d3 53 93 9a b7 |zJp....h.[w.S...| | 8d fd a0 4e 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |...N............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 7a 4a 70 c1 f1 10 be 68 84 5b 77 d3 53 93 9a b7 |zJp....h.[w.S...| | 8d fd a0 4e |...N | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #370 (first time) conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | 68 4a b6 73 42 99 a4 45 24 9b eb 56 6e 8d d8 a0 |hJ.sB..E$..Vn...| | 27 bc f4 56 84 c5 bc b3 df 25 60 80 3f fb be d4 |'..V.....%`.?...| | b7 f4 33 ed 5d 4b e1 06 cb b7 9b cd d8 04 d2 79 |..3.]K.........y| | d4 3e 1b c9 cf db 06 96 56 64 aa 35 0e 2a 33 1c |.>......Vd.5.*3.| | 81 bb 4a 37 60 b7 47 7f dc 45 c8 ba 7a 59 6e fb |..J7`.G..E..zYn.| | e1 1c e0 c3 f9 f0 5d d0 9d f0 a3 17 cb de 05 94 |......].........| | 82 94 03 81 26 51 0e 5e 8e 2f 41 00 fd 90 58 88 |....&Q.^./A...X.| Plaintext[112]: | d6 f4 8d 74 4f a9 b4 d7 46 26 79 2b a1 bb f5 d7 |...tO...F&y+....| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 73 65 65 64 2d 73 68 61 2e 6c |Host: seed-sha.l| | 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 |ocal.al.lekenste| | 79 6e 2e 6e 6c 3a 34 34 37 30 0d 0a 0d 0a 03 a3 |yn.nl:4470......| | 54 92 72 54 37 8d ad 36 33 26 d3 0e 22 e3 ce c5 |T.rT7..63&.."...| | 34 d4 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d |4...............| ssl_decrypt_record found padding 13 final len 98 checking mac (len 62, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 3c 35 f7 17 1d ca 6f e5 3b b6 d6 90 9e cb af f4 |<5....o.;.......| | 49 f6 4b 4c |I.KL | ssl_decrypt_record: mac failed association_find: TCP port 47180 found (nil) association_find: TCP port 4470 found 0x33cdf40 dissect_ssl enter frame #371 (first time) conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | fa d6 df 69 e5 8b 28 37 ec b4 85 9c 85 99 03 cd |...i..(7........| | e1 06 72 7e fe 3b 55 39 53 a5 c3 12 53 b7 50 43 |..r~.;U9S...S.PC| | 22 39 a5 c5 d9 f5 e4 10 ca 36 e3 23 e9 f0 52 c0 |"9.......6.#..R.| | c9 d7 4e 62 a7 41 49 46 a0 87 3f 93 bc 2e d1 6a |..Nb.AIF..?....j| | 15 f7 1f 76 54 41 74 89 28 b9 9d f9 7e 50 91 a7 |...vTAt.(...~P..| | 65 cc a2 b5 7e d1 0e 2c 54 bf 4b f6 06 bb 78 d7 |e...~..,T.K...x.| | d5 4d 82 21 f9 41 3a 6c fa c4 20 4b 55 b1 a5 c5 |.M.!.A:l.. KU...| | e0 50 92 f3 e2 03 e4 2b 90 8c 50 f7 b5 ef 1a 16 |.P.....+..P.....| | ea c2 7f 2b a2 a0 d8 ae bc 0b 8f 39 c9 9b ad 93 |...+.......9....| | 8d ca cf 99 e7 58 a7 98 1c fd a8 e4 ac d1 c0 ac |.....X..........| | c8 b4 a6 ea 4d 12 34 9b 1e 73 ed 25 62 df 91 47 |....M.4..s.%b..G| | da 5a 4d be 04 b3 d0 e9 d6 8f 2e bf 91 01 59 68 |.ZM...........Yh| | e6 9d 96 74 64 a3 84 dd 9d 1b 1d 8e 37 ef b4 8f |...td.......7...| | 8d 74 65 45 74 35 6e a0 00 b0 fe d4 48 38 3f 95 |.teEt5n.....H8?.| | 2f ad 20 d8 2e 30 79 2f 0f 26 8d 11 a6 35 bf 30 |/. ..0y/.&...5.0| | 8b 6a f3 17 bf 50 c6 53 74 44 5e d5 55 4f 64 46 |.j...P.StD^.UOdF| | 17 57 ca 1e 2a ad 5f 07 a4 df 91 3d af 66 54 69 |.W..*._....=.fTi| | ec e8 a2 e4 1a f1 3a 93 9c 23 3d 07 8b 51 f8 72 |......:..#=..Q.r| | 61 56 16 a9 79 87 09 f6 d7 16 a6 bb f3 9d fd e9 |aV..y...........| | e1 ad 5c 5f da fb fb 28 b9 da ec b9 cb 94 71 86 |..\_...(......q.| | 4f 5f bd d6 6d cd 83 44 55 4e 6f b0 fd eb 57 ed |O_..m..DUNo...W.| | df bc 1b fb c2 53 d0 20 0e 2c fc e8 16 e1 e7 c4 |.....S. .,......| | ba f0 51 3b 25 94 13 61 b0 de 39 14 ca a9 a4 f3 |..Q;%..a..9.....| | 93 44 1f 92 45 56 01 cf 55 c1 0f 94 7e e3 90 aa |.D..EV..U...~...| | 8a 1a de 0f 84 ad 4c 6a 50 8c 04 f3 7c ea ec 55 |......LjP...|..U| Plaintext[400]: | 3c d3 5c f5 f3 f1 a3 70 18 cf 03 31 81 3f 6b 8d |<.\....p...1.?k.| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:| | 35 35 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:16 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 39 36 20 2d 20 53 45 45 44 2d |x00,0x96 - SEED-| | 53 48 41 20 20 20 20 20 20 20 20 20 20 20 20 20 |SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 53 45 45 44 28 31 32 38 29 20 4d 61 63 3d 53 |=SEED(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1..].| | 6b 40 e2 98 6c b4 36 d8 4e f5 dc 4b b6 1c dc c6 |k@..l.6.N..K....| | 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................| ssl_decrypt_record found padding 15 final len 384 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 17 da a6 c8 e4 c3 71 ee 5d 95 dc 2f 2e 61 92 85 |......q.]../.a..| | 88 69 73 be |.is. | ssl_decrypt_record: mac failed association_find: TCP port 4470 found 0x33cdf40 dissect_ssl enter frame #372 (first time) conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 29 d1 08 9f 3d 50 58 b8 93 19 50 63 17 f3 74 aa |)...=PX...Pc..t.| | 66 d0 fb b3 3e b5 82 e6 ab 09 c7 87 60 41 55 d3 |f...>.......`AU.| | 65 fc d7 d8 ec ac 55 22 f7 62 85 de 5e f0 41 cf |e.....U".b..^.A.| Plaintext[48]: | df 60 4b 7a 98 c5 58 04 db a4 d9 da a8 99 7e 22 |.`Kz..X.......~"| | 01 00 de e6 45 8c 54 fd 21 99 c9 76 6a ed 91 0c |....E.T.!..vj...| | 6c 8a 69 44 59 48 09 09 09 09 09 09 09 09 09 09 |l.iDYH..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | de e6 45 8c 54 fd 21 99 c9 76 6a ed 91 0c 6c 8a |..E.T.!..vj...l.| | 69 44 59 48 |iDYH | ssl_decrypt_record: mac ok dissect_ssl enter frame #374 (first time) conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 78 f0 bb 1a 01 43 9e d6 0b 7c 86 c9 8e 7f ab 74 |x....C...|.....t| | c2 2e ad 47 19 29 7d e1 65 28 c7 88 4a 79 a5 80 |...G.)}.e(..Jy..| | f0 01 ea c4 e7 e5 5e 37 e7 3e 38 06 89 e2 59 56 |......^7.>8...YV| Plaintext[48]: | 14 9f f6 9d 8b 3b a1 96 25 5e c2 de 2d 63 cd d2 |.....;..%^..-c..| | 01 00 53 dc 96 4b 20 96 b5 c6 00 9b e2 3e dd 2b |..S..K ......>.+| | c5 f9 5a f4 da 38 09 09 09 09 09 09 09 09 09 09 |..Z..8..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 53 dc 96 4b 20 96 b5 c6 00 9b e2 3e dd 2b c5 f9 |S..K ......>.+..| | 5a f4 da 38 |Z..8 | ssl_decrypt_record: mac ok dissect_ssl enter frame #379 (first time) ssl_session_init: initializing ptr 0x7facc3849ab0 size 688 conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 60473 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4471 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #381 (first time) conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0 record: offset = 0, reported_length_remaining = 1134 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0099 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 81 d9 fb 64 10 67 d7 05 13 b4 15 8f 9a e0 50 12 |...d.g........P.| | e7 d1 e4 78 7f 6a 21 26 62 fd 92 66 b3 cb 5f 96 |...x.j!&b..f.._.| | ba 68 df e0 c3 21 d8 1c 8f 9a 32 92 52 41 39 fa |.h...!....2.RA9.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 24 73 e6 eb c0 a0 07 3f 11 e5 c1 d4 06 a7 0e be |$s.....?........| | c7 a3 f3 f8 61 da b0 03 b2 a2 b4 86 72 52 34 bf |....a.......rR4.| | 24 41 17 0b 66 21 87 d8 58 37 5c a1 cb fa ac 13 |$A..f!..X7\.....| | a7 e5 10 f2 27 1d a5 88 60 37 b1 6c 16 |....'...`7.l. | hash out[104]: | cc 5b c2 a5 d4 69 ff 07 7f 74 3c 2d 61 89 38 ac |.[...i...t<-a.8.| | be f3 be 2d 97 48 1d 4b c6 09 35 b6 ea d7 0c 78 |...-.H.K..5....x| | ad 35 e1 1c db 56 e9 82 70 1c 36 6f 88 ae 80 0d |.5...V..p.6o....| | c7 1b a9 4b 1c ae 21 8c 46 ca 70 dd d9 22 f3 1d |...K..!.F.p.."..| | 97 bc 64 b2 6a af 24 bb 32 8c b6 9a be 40 fb fd |..d.j.$.2....@..| | 89 a4 e7 88 11 eb f4 03 bf b2 c3 a2 08 5b 76 6e |.............[vn| | a1 1a 51 b7 c4 e7 21 9e |..Q...!. | PRF out[104]: | cc 5b c2 a5 d4 69 ff 07 7f 74 3c 2d 61 89 38 ac |.[...i...t<-a.8.| | be f3 be 2d 97 48 1d 4b c6 09 35 b6 ea d7 0c 78 |...-.H.K..5....x| | ad 35 e1 1c db 56 e9 82 70 1c 36 6f 88 ae 80 0d |.5...V..p.6o....| | c7 1b a9 4b 1c ae 21 8c 46 ca 70 dd d9 22 f3 1d |...K..!.F.p.."..| | 97 bc 64 b2 6a af 24 bb 32 8c b6 9a be 40 fb fd |..d.j.$.2....@..| | 89 a4 e7 88 11 eb f4 03 bf b2 c3 a2 08 5b 76 6e |.............[vn| | a1 1a 51 b7 c4 e7 21 9e |..Q...!. | key expansion[104]: | cc 5b c2 a5 d4 69 ff 07 7f 74 3c 2d 61 89 38 ac |.[...i...t<-a.8.| | be f3 be 2d 97 48 1d 4b c6 09 35 b6 ea d7 0c 78 |...-.H.K..5....x| | ad 35 e1 1c db 56 e9 82 70 1c 36 6f 88 ae 80 0d |.5...V..p.6o....| | c7 1b a9 4b 1c ae 21 8c 46 ca 70 dd d9 22 f3 1d |...K..!.F.p.."..| | 97 bc 64 b2 6a af 24 bb 32 8c b6 9a be 40 fb fd |..d.j.$.2....@..| | 89 a4 e7 88 11 eb f4 03 bf b2 c3 a2 08 5b 76 6e |.............[vn| | a1 1a 51 b7 c4 e7 21 9e |..Q...!. | Client MAC key[20]: | cc 5b c2 a5 d4 69 ff 07 7f 74 3c 2d 61 89 38 ac |.[...i...t<-a.8.| | be f3 be 2d |...- | Server MAC key[20]: | 97 48 1d 4b c6 09 35 b6 ea d7 0c 78 ad 35 e1 1c |.H.K..5....x.5..| | db 56 e9 82 |.V.. | Client Write key[16]: | 70 1c 36 6f 88 ae 80 0d c7 1b a9 4b 1c ae 21 8c |p.6o.......K..!.| Server Write key[16]: | 46 ca 70 dd d9 22 f3 1d 97 bc 64 b2 6a af 24 bb |F.p.."....d.j.$.| Client Write IV[16]: | 32 8c b6 9a be 40 fb fd 89 a4 e7 88 11 eb f4 03 |2....@..........| Server Write IV[16]: | bf b2 c3 a2 08 5b 76 6e a1 1a 51 b7 c4 e7 21 9e |.....[vn..Q...!.| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: SEED decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: SEED decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 1071 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 735, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803 record: offset = 803, reported_length_remaining = 331 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 808 length 313 bytes, remaining 1125 record: offset = 1125, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1130 length 0 bytes, remaining 1134 dissect_ssl enter frame #383 (first time) conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f227... looking for RSA pre-master0080925605454b9461199474e97c5f8964d84e2a5400fc5d... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 3e 13 91 7f ee c4 1a b7 37 ac a1 0f 14 86 ec d4 |>.......7.......| | aa 3b 6f 7a 91 bc 40 f7 f7 0e e7 f5 7d c3 cd d5 |.;oz..@.....}...| | 1c 0d b7 0b 66 f8 01 57 b6 f0 5c e3 03 0d ae cb |....f..W..\.....| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 24 73 e6 eb c0 a0 07 3f 11 e5 c1 d4 06 a7 0e be |$s.....?........| | c7 a3 f3 f8 61 da b0 03 b2 a2 b4 86 72 52 34 bf |....a.......rR4.| | 24 41 17 0b 66 21 87 d8 58 37 5c a1 cb fa ac 13 |$A..f!..X7\.....| | a7 e5 10 f2 27 1d a5 88 60 37 b1 6c 16 |....'...`7.l. | hash out[104]: | e4 fa 2a 45 db 5e e6 c9 7d 6c 6d c7 7a a5 31 c3 |..*E.^..}lm.z.1.| | b2 e1 26 b3 c7 ad 07 f2 69 cc 0e b0 cc 69 09 28 |..&.....i....i.(| | 44 e4 7c 70 3a 85 4f 59 04 15 14 3e 42 6b fd a4 |D.|p:.OY...>Bk..| | b4 e9 d4 6e d7 19 06 1f a3 fe 96 1d 1d 6d 8a fa |...n.........m..| | 0e d2 6a da 98 44 0e b0 cb 8c a8 48 21 79 92 d1 |..j..D.....H!y..| | a7 8b 66 50 43 1c 12 3c 3c 6c b8 08 b4 e7 5c 8a |..fPC..<Bk..| | b4 e9 d4 6e d7 19 06 1f a3 fe 96 1d 1d 6d 8a fa |...n.........m..| | 0e d2 6a da 98 44 0e b0 cb 8c a8 48 21 79 92 d1 |..j..D.....H!y..| | a7 8b 66 50 43 1c 12 3c 3c 6c b8 08 b4 e7 5c 8a |..fPC..<Bk..| | b4 e9 d4 6e d7 19 06 1f a3 fe 96 1d 1d 6d 8a fa |...n.........m..| | 0e d2 6a da 98 44 0e b0 cb 8c a8 48 21 79 92 d1 |..j..D.....H!y..| | a7 8b 66 50 43 1c 12 3c 3c 6c b8 08 b4 e7 5c 8a |..fPC..<Bk.....n....| Server Write key[16]: | a3 fe 96 1d 1d 6d 8a fa 0e d2 6a da 98 44 0e b0 |.....m....j..D..| Client Write IV[16]: | cb 8c a8 48 21 79 92 d1 a7 8b 66 50 43 1c 12 3c |...H!y....fPC..<| Server Write IV[16]: | 3c 6c b8 08 b4 e7 5c 8a 52 0e ad 3d 4d c2 44 6a |.......7.......| | aa 3b 6f 7a 91 bc 40 f7 f7 0e e7 f5 7d c3 cd d5 |.;oz..@.....}...| | 1c 0d b7 0b 66 f8 01 57 b6 f0 5c e3 03 0d ae cb |....f..W..\.....| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | ff fa 82 b0 4d 30 fe 55 33 2f 68 3c a2 4f 8b 45 |....M0.U3/h<.O.E| | 0c a0 90 8c 9a 8a 1e b7 76 cd 38 c0 a8 e9 a3 0b |........v.8.....| | 6d ac 88 95 50 c1 c5 9c c3 69 ef d9 7c bd d3 8e |m...P....i..|...| | 91 a3 60 5d 8e fc b6 b6 93 7c db 9a 59 ba f4 06 |..`].....|..Y...| Plaintext[64]: | fc f0 34 98 a0 90 d3 43 7b 98 e4 5f c5 9f 40 ce |..4....C{.._..@.| | 14 00 00 0c 25 8d d0 f4 43 f4 19 c7 70 b6 b4 72 |....%...C...p..r| | d1 b9 74 62 19 ae 91 a2 57 dc 42 d0 6e be 44 56 |..tb....W.B.n.DV| | 0d 3c f3 1d 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.<..............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | d1 b9 74 62 19 ae 91 a2 57 dc 42 d0 6e be 44 56 |..tb....W.B.n.DV| | 0d 3c f3 1d |.<.. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #384 (first time) conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | cc 70 11 57 0b f2 6c b9 05 43 60 3d 36 a3 fc e6 |.p.W..l..C`=6...| | a2 1d 20 67 b7 3b fc 53 dc 60 45 82 38 cc 1b 21 |.. g.;.S.`E.8..!| | 8d d1 32 83 c8 2a 8b 18 39 1e 04 80 74 81 53 44 |..2..*..9...t.SD| | 85 36 24 9f 5f 69 67 77 f5 b1 7c 18 06 c8 fe f8 |.6$._igw..|.....| Plaintext[64]: | c8 6b 4d 2b 1b 1c 96 d4 fb 98 5a b0 ff 7e 3f 79 |.kM+......Z..~?y| | 14 00 00 0c cc 5e 9b 8a 33 ee 1a 9f a2 82 d0 e8 |.....^..3.......| | c5 f2 8d 8e 39 6a e6 8b 37 c8 73 87 27 b1 85 8b |....9j..7.s.'...| | 53 f0 48 5d 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |S.H]............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | c5 f2 8d 8e 39 6a e6 8b 37 c8 73 87 27 b1 85 8b |....9j..7.s.'...| | 53 f0 48 5d |S.H] | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #385 (first time) conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | c1 81 85 64 bb 14 3a 97 60 53 86 5e c8 9a 0c 0a |...d..:.`S.^....| | 68 87 74 3d 5f 3d 0e 66 ea bc c6 00 15 7a 7a c5 |h.t=_=.f.....zz.| | ca ae 14 01 92 a3 7e ee 19 a4 b3 55 02 eb 82 23 |......~....U...#| | 76 bb 48 c9 02 f0 20 48 72 ba f7 0f af ea d7 a2 |v.H... Hr.......| | 7f 3d b3 34 8f be 50 2c 98 15 18 ec 5d ab 65 66 |.=.4..P,....].ef| | a3 e7 f2 27 3a 79 6a 32 be 9c cc 64 ea 9d 4f 50 |...':yj2...d..OP| | 87 b2 94 80 1f 05 f5 4d 40 33 ac e4 58 34 5b ca |.......M@3..X4[.| Plaintext[112]: | f4 97 05 81 29 29 0f cc f5 ab 32 b4 73 2d b1 5a |....))....2.s-.Z| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 73 65 |Host: dhe-dss-se| | 65 64 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e |ed-sha.local.al.| | 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 |lekensteyn.nl:44| | 37 31 0d 0a 0d 0a 0e 3a 04 3b 3b f8 a8 df d4 b4 |71.....:.;;.....| | 88 aa d0 77 2a dc ac 4b ac 12 05 05 05 05 05 05 |...w*..K........| ssl_decrypt_record found padding 5 final len 106 checking mac (len 70, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 8d b4 26 3e bf 0e 09 4c 6d a5 46 ed 83 88 23 bd |..&>...Lm.F...#.| | 05 43 5f 20 |.C_ | ssl_decrypt_record: mac failed association_find: TCP port 60473 found (nil) association_find: TCP port 4471 found 0x33cdfd0 dissect_ssl enter frame #386 (first time) conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | 75 c6 d3 7c b8 4d 66 cc fd 0e ed 2f 37 3f 64 04 |u..|.Mf..../7?d.| | 6f 75 bf 54 5d a0 eb 02 7f 23 75 4f 2c 1c 26 d3 |ou.T]....#uO,.&.| | 3c db e8 c2 69 b2 d6 de 21 20 22 6e e2 7e e4 fc |<...i...! "n.~..| | f3 1d 5a 8a 59 12 96 42 1d ad e0 87 b8 0e fb 86 |..Z.Y..B........| | 3f ff dd b3 98 42 c3 98 27 df 79 b9 d9 bb b5 bb |?....B..'.y.....| | 3b d6 cd 23 fc a7 67 a8 cb 76 c0 30 ce bc 3a 8b |;..#..g..v.0..:.| | 62 82 0d 72 ef 85 e8 81 9e 30 6d 89 4f c0 b2 d1 |b..r.....0m.O...| | 2d ac f2 40 1c 94 87 1d 7b aa 28 d2 f9 dc f2 41 |-..@....{.(....A| | 82 7f be b6 84 c3 30 e6 9f 6d 3a c0 bd 7f 72 44 |......0..m:...rD| | 31 ef 41 8f 99 9f a0 1e 63 01 d6 55 12 f6 d7 a4 |1.A.....c..U....| | aa 25 6d d4 31 fc 23 f8 55 20 6e 8d 0d 16 53 de |.%m.1.#.U n...S.| | 96 cb 5d 8b 9f 6e 96 cf ff f1 ad 24 ac f4 06 49 |..]..n.....$...I| | b2 c6 86 a0 d6 50 7e e1 3c fb fb ca bc 05 c9 7b |.....P~.<......{| | 03 11 de a3 14 ff 96 9d 67 6c 2e 2a 36 95 c3 4c |........gl.*6..L| | c2 d7 3b b0 cd 62 b5 6b 3c 51 07 c4 61 ab 75 45 |..;..b.k.......E.I,.| Plaintext[400]: | 7c 8f 27 4e 03 ee 85 93 f7 84 8c 63 b1 ce 76 b9 ||.'N.......c..v.| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:| | 35 35 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:16 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 39 39 20 2d 20 44 48 45 2d 44 |x00,0x99 - DHE-D| | 53 53 2d 53 45 45 44 2d 53 48 41 20 20 20 20 20 |SS-SEED-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc| | 3d 53 45 45 44 28 31 32 38 29 20 4d 61 63 3d 53 |=SEED(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1.KQ.| | c3 46 f0 aa dd 25 f0 d7 8e 38 f6 d5 1c aa 18 fc |.F...%...8......| | 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................| ssl_decrypt_record found padding 15 final len 384 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 94 66 a7 19 1d 91 b9 b4 22 ed ff 59 95 af c0 15 |.f......"..Y....| | 86 55 bf a3 |.U.. | ssl_decrypt_record: mac failed association_find: TCP port 4471 found 0x33cdfd0 dissect_ssl enter frame #387 (first time) conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | d8 68 1f b9 e4 9b 0e 10 d9 e3 a4 30 b4 95 28 96 |.h.........0..(.| | 1d 06 0e 7c 68 38 00 b8 8f 16 94 92 3e f8 63 0e |...|h8......>.c.| | 2d 27 a7 ff 18 36 bf c4 d6 6b 97 3e 7e 30 89 ab |-'...6...k.>~0..| Plaintext[48]: | 60 d1 c3 db e5 ef d9 6b 2d 2b 9e e4 93 15 09 66 |`......k-+.....f| | 01 00 cf 0c 1d 50 e4 ee be 6e 9d 45 f9 29 a5 4f |.....P...n.E.).O| | 65 10 31 4f 32 2d 09 09 09 09 09 09 09 09 09 09 |e.1O2-..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | cf 0c 1d 50 e4 ee be 6e 9d 45 f9 29 a5 4f 65 10 |...P...n.E.).Oe.| | 31 4f 32 2d |1O2- | ssl_decrypt_record: mac ok dissect_ssl enter frame #389 (first time) conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | d6 cc 07 ba ea 03 7d 68 7c f0 7b ce 4a b4 ed 5b |......}h|.{.J..[| | bd e7 c5 32 ff 88 d6 b4 6e af ad 92 9d fe ec 41 |...2....n......A| | d2 8f 4c de 30 90 7b 28 7a 1b 1d 96 c7 42 e4 c5 |..L.0.{(z....B..| Plaintext[48]: | 02 bc 99 84 e6 6f 25 d5 5a 8a bb d5 6c 5e f2 d7 |.....o%.Z...l^..| | 01 00 6c 33 3a 6a 3e d6 b6 2c 6f e7 fe 71 0a 45 |..l3:j>..,o..q.E| | a2 fd 84 e0 39 58 09 09 09 09 09 09 09 09 09 09 |....9X..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 6c 33 3a 6a 3e d6 b6 2c 6f e7 fe 71 0a 45 a2 fd |l3:j>..,o..q.E..| | 84 e0 39 58 |..9X | ssl_decrypt_record: mac ok dissect_ssl enter frame #394 (first time) ssl_session_init: initializing ptr 0x7facc384bfb0 size 688 conversation = 0x7facef99a790, ssl_session = 0x7facc384bfb0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 34652 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4472 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #396 (first time) conversation = 0x7facef99a790, ssl_session = 0x7facc384bfb0 record: offset = 0, reported_length_remaining = 1416 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x009A -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 3e 13 91 7f ee c4 1a b7 37 ac a1 0f 14 86 ec d4 |>.......7.......| | aa 3b 6f 7a 91 bc 40 f7 f7 0e e7 f5 7d c3 cd d5 |.;oz..@.....}...| | 1c 0d b7 0b 66 f8 01 57 b6 f0 5c e3 03 0d ae cb |....f..W..\.....| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 24 2e 0c dc 75 92 75 a7 f8 85 a9 7a 0b 0f 2e 3b |$...u.u....z...;| | e0 7d 9a 46 a0 49 b3 16 c0 a0 97 15 17 52 34 bf |.}.F.I.......R4.| | 24 d3 13 75 9a 63 89 f1 fd d3 f7 7e 99 8a 4b ea |$..u.c.....~..K.| | 35 c7 70 d5 67 3b 32 9f 06 d2 91 3a e5 |5.p.g;2....:. | hash out[104]: | 2b 1c b2 41 fc 3a 96 02 d5 0a d2 0a 84 32 26 ef |+..A.:.......2&.| | 91 9c 58 52 6c 77 bc 52 de 9f 7d 8d 26 19 3e 09 |..XRlw.R..}.&.>.| | c3 0e b3 70 e5 46 9c ad 76 59 4a db 1b 2b e4 45 |...p.F..vYJ..+.E| | d0 86 fd 28 55 ad d2 ef 8a d6 e1 30 cf 8c 7d 18 |...(U......0..}.| | 8e e5 18 af 12 f3 28 0c f1 72 ce a8 76 d8 69 98 |......(..r..v.i.| | a8 8e 90 31 a0 66 f8 20 65 f9 fd 52 17 25 05 79 |...1.f. e..R.%.y| | b3 d3 55 21 7f f3 55 37 |..U!..U7 | PRF out[104]: | 2b 1c b2 41 fc 3a 96 02 d5 0a d2 0a 84 32 26 ef |+..A.:.......2&.| | 91 9c 58 52 6c 77 bc 52 de 9f 7d 8d 26 19 3e 09 |..XRlw.R..}.&.>.| | c3 0e b3 70 e5 46 9c ad 76 59 4a db 1b 2b e4 45 |...p.F..vYJ..+.E| | d0 86 fd 28 55 ad d2 ef 8a d6 e1 30 cf 8c 7d 18 |...(U......0..}.| | 8e e5 18 af 12 f3 28 0c f1 72 ce a8 76 d8 69 98 |......(..r..v.i.| | a8 8e 90 31 a0 66 f8 20 65 f9 fd 52 17 25 05 79 |...1.f. e..R.%.y| | b3 d3 55 21 7f f3 55 37 |..U!..U7 | key expansion[104]: | 2b 1c b2 41 fc 3a 96 02 d5 0a d2 0a 84 32 26 ef |+..A.:.......2&.| | 91 9c 58 52 6c 77 bc 52 de 9f 7d 8d 26 19 3e 09 |..XRlw.R..}.&.>.| | c3 0e b3 70 e5 46 9c ad 76 59 4a db 1b 2b e4 45 |...p.F..vYJ..+.E| | d0 86 fd 28 55 ad d2 ef 8a d6 e1 30 cf 8c 7d 18 |...(U......0..}.| | 8e e5 18 af 12 f3 28 0c f1 72 ce a8 76 d8 69 98 |......(..r..v.i.| | a8 8e 90 31 a0 66 f8 20 65 f9 fd 52 17 25 05 79 |...1.f. e..R.%.y| | b3 d3 55 21 7f f3 55 37 |..U!..U7 | Client MAC key[20]: | 2b 1c b2 41 fc 3a 96 02 d5 0a d2 0a 84 32 26 ef |+..A.:.......2&.| | 91 9c 58 52 |..XR | Server MAC key[20]: | 6c 77 bc 52 de 9f 7d 8d 26 19 3e 09 c3 0e b3 70 |lw.R..}.&.>....p| | e5 46 9c ad |.F.. | Client Write key[16]: | 76 59 4a db 1b 2b e4 45 d0 86 fd 28 55 ad d2 ef |vYJ..+.E...(U...| Server Write key[16]: | 8a d6 e1 30 cf 8c 7d 18 8e e5 18 af 12 f3 28 0c |...0..}.......(.| Client Write IV[16]: | f1 72 ce a8 76 d8 69 98 a8 8e 90 31 a0 66 f8 20 |.r..v.i....1.f. | Server Write IV[16]: | 65 f9 fd 52 17 25 05 79 b3 d3 55 21 7f f3 55 37 |e..R.%.y..U!..U7| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: SEED decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: SEED decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 1353 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 541 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 527, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407 record: offset = 1407, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416 dissect_ssl enter frame #398 (first time) conversation = 0x7facef99a790, ssl_session = 0x7facc384bfb0 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d567... looking for RSA pre-master0080aeb905c19d1a09d1a50bad095bdafcc02622d8b1e32e... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 6e 0f 50 3c ce 1f 28 d6 49 81 06 31 e4 1d 67 db |n.P<..(.I..1..g.| | d6 72 6b f5 10 b3 bf 22 0d 58 d6 4b fe b7 69 36 |.rk....".X.K..i6| | ef c1 50 7d c7 21 0c 3d ef 8b 84 65 ea a9 13 84 |..P}.!.=...e....| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 24 2e 0c dc 75 92 75 a7 f8 85 a9 7a 0b 0f 2e 3b |$...u.u....z...;| | e0 7d 9a 46 a0 49 b3 16 c0 a0 97 15 17 52 34 bf |.}.F.I.......R4.| | 24 d3 13 75 9a 63 89 f1 fd d3 f7 7e 99 8a 4b ea |$..u.c.....~..K.| | 35 c7 70 d5 67 3b 32 9f 06 d2 91 3a e5 |5.p.g;2....:. | hash out[104]: | 14 f2 31 c7 0f e2 40 a0 d0 43 46 a0 7e a1 a8 10 |..1...@..CF.~...| | aa 7a 1a ea dc 0b f6 11 1b 86 86 08 43 61 e6 db |.z..........Ca..| | 6c a1 17 65 11 6e bb c7 60 4d 62 2a c8 27 4b 6a |l..e.n..`Mb*.'Kj| | 2f 48 26 e4 82 97 6a d2 77 42 b2 35 d9 31 c5 f5 |/H&...j.wB.5.1..| | 51 48 9c 96 59 75 76 c1 c9 bf c0 9c dd 7d 00 4f |QH..Yuv......}.O| | da 16 d1 c1 48 ae 2a af 05 f7 aa 04 32 39 1e 1d |....H.*.....29..| | df 08 69 d9 fd 21 06 71 |..i..!.q | PRF out[104]: | 14 f2 31 c7 0f e2 40 a0 d0 43 46 a0 7e a1 a8 10 |..1...@..CF.~...| | aa 7a 1a ea dc 0b f6 11 1b 86 86 08 43 61 e6 db |.z..........Ca..| | 6c a1 17 65 11 6e bb c7 60 4d 62 2a c8 27 4b 6a |l..e.n..`Mb*.'Kj| | 2f 48 26 e4 82 97 6a d2 77 42 b2 35 d9 31 c5 f5 |/H&...j.wB.5.1..| | 51 48 9c 96 59 75 76 c1 c9 bf c0 9c dd 7d 00 4f |QH..Yuv......}.O| | da 16 d1 c1 48 ae 2a af 05 f7 aa 04 32 39 1e 1d |....H.*.....29..| | df 08 69 d9 fd 21 06 71 |..i..!.q | key expansion[104]: | 14 f2 31 c7 0f e2 40 a0 d0 43 46 a0 7e a1 a8 10 |..1...@..CF.~...| | aa 7a 1a ea dc 0b f6 11 1b 86 86 08 43 61 e6 db |.z..........Ca..| | 6c a1 17 65 11 6e bb c7 60 4d 62 2a c8 27 4b 6a |l..e.n..`Mb*.'Kj| | 2f 48 26 e4 82 97 6a d2 77 42 b2 35 d9 31 c5 f5 |/H&...j.wB.5.1..| | 51 48 9c 96 59 75 76 c1 c9 bf c0 9c dd 7d 00 4f |QH..Yuv......}.O| | da 16 d1 c1 48 ae 2a af 05 f7 aa 04 32 39 1e 1d |....H.*.....29..| | df 08 69 d9 fd 21 06 71 |..i..!.q | Client MAC key[20]: | 14 f2 31 c7 0f e2 40 a0 d0 43 46 a0 7e a1 a8 10 |..1...@..CF.~...| | aa 7a 1a ea |.z.. | Server MAC key[20]: | dc 0b f6 11 1b 86 86 08 43 61 e6 db 6c a1 17 65 |........Ca..l..e| | 11 6e bb c7 |.n.. | Client Write key[16]: | 60 4d 62 2a c8 27 4b 6a 2f 48 26 e4 82 97 6a d2 |`Mb*.'Kj/H&...j.| Server Write key[16]: | 77 42 b2 35 d9 31 c5 f5 51 48 9c 96 59 75 76 c1 |wB.5.1..QH..Yuv.| Client Write IV[16]: | c9 bf c0 9c dd 7d 00 4f da 16 d1 c1 48 ae 2a af |.....}.O....H.*.| Server Write IV[16]: | 05 f7 aa 04 32 39 1e 1d df 08 69 d9 fd 21 06 71 |....29....i..!.q| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: SEED decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: SEED decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 6e 0f 50 3c ce 1f 28 d6 49 81 06 31 e4 1d 67 db |n.P<..(.I..1..g.| | d6 72 6b f5 10 b3 bf 22 0d 58 d6 4b fe b7 69 36 |.rk....".X.K..i6| | ef c1 50 7d c7 21 0c 3d ef 8b 84 65 ea a9 13 84 |..P}.!.=...e....| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | c6 1e 9c 56 50 69 56 72 5e 3b 82 31 0d 3b 39 f1 |...VPiVr^;.1.;9.| | ca d5 67 f2 fb 5f d4 cb 76 ea d7 6a c9 0a 26 19 |..g.._..v..j..&.| | a9 a7 55 54 41 0a a2 75 34 23 13 54 d1 f6 fd 34 |..UTA..u4#.T...4| | 17 9a f9 1f 18 3c 79 42 d0 dc a5 c6 07 b8 1c f6 |.....vO.| | 14 00 00 0c 6a 08 e7 c2 d8 18 bf b1 2f 46 54 91 |....j......./FT.| | e6 00 f8 1c 63 3b 15 ce 94 4d 7d db e5 84 fc 94 |....c;...M}.....| | 2e 19 b6 35 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |...5............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | e6 00 f8 1c 63 3b 15 ce 94 4d 7d db e5 84 fc 94 |....c;...M}.....| | 2e 19 b6 35 |...5 | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #399 (first time) conversation = 0x7facef99a790, ssl_session = 0x7facc384bfb0 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | db 8f 6b 7a 27 d9 c3 8e 82 97 d7 1c a0 53 c4 93 |..kz'........S..| | ab 65 d1 0a d4 b0 18 ec b3 a8 29 73 95 8e a4 27 |.e........)s...'| | e2 ca c1 cc 11 ce 21 3e 09 0b da 12 ee ab 52 de |......!>......R.| | c0 66 a6 ba bd fa c4 7d ab e5 a3 01 1e 89 a8 32 |.f.....}.......2| Plaintext[64]: | a4 7b 6a aa 61 e2 de 95 a4 8f 57 ee 74 36 51 15 |.{j.a.....W.t6Q.| | 14 00 00 0c 51 f8 fb d8 09 36 0a ff 22 d1 66 cc |....Q....6..".f.| | a8 27 e2 7d 44 1a f7 7d 76 d8 f2 56 b9 4d 76 ed |.'.}D..}v..V.Mv.| | 6c 47 8c fc 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |lG..............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | a8 27 e2 7d 44 1a f7 7d 76 d8 f2 56 b9 4d 76 ed |.'.}D..}v..V.Mv.| | 6c 47 8c fc |lG.. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #400 (first time) conversation = 0x7facef99a790, ssl_session = 0x7facc384bfb0 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | ac 3d 05 be 3e 73 a8 b2 60 8e 5e 6c bd 6e 54 23 |.=..>s..`.^l.nT#| | c1 99 78 88 ba 42 16 ef 19 42 5b 67 12 bc 39 58 |..x..B...B[g..9X| | 00 c9 6c 50 91 1a fc c7 7f 89 4d 05 89 fd 75 e4 |..lP......M...u.| | 1e 58 e2 d3 59 4b 94 9c 26 31 8c 84 d3 79 00 f3 |.X..YK..&1...y..| | c3 6a af ae 5f cf 60 9a ae ef cb 7f ed 0c 36 8c |.j.._.`.......6.| | f0 c6 30 0f e0 ea 66 4a da 06 6c d9 cf f1 8f 5c |..0...fJ..l....\| | 55 d7 4f 56 c0 79 ab 14 60 74 ba 7f 8d 33 7e 3b |U.OV.y..`t...3~;| Plaintext[112]: | 2b c4 90 ec 35 7a 40 8c 4f cd 7b 99 6a b4 b7 46 |+...5z@.O.{.j..F| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 73 65 |Host: dhe-rsa-se| | 65 64 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e |ed-sha.local.al.| | 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 |lekensteyn.nl:44| | 37 32 0d 0a 0d 0a 31 aa d4 9e ff 86 aa cb a2 02 |72....1.........| | 1f 3c 06 b0 26 6f 7d e6 a9 95 05 05 05 05 05 05 |.<..&o}.........| ssl_decrypt_record found padding 5 final len 106 checking mac (len 70, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | b1 97 61 f8 c9 3a ea f4 b2 66 f3 ca 33 dc 29 44 |..a..:...f..3.)D| | 87 53 fd d9 |.S.. | ssl_decrypt_record: mac failed association_find: TCP port 34652 found (nil) association_find: TCP port 4472 found 0x33ce060 dissect_ssl enter frame #401 (first time) conversation = 0x7facef99a790, ssl_session = 0x7facc384bfb0 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | d6 5e 96 de 32 3d 96 55 34 7e bc 61 09 c3 41 7d |.^..2=.U4~.a..A}| | 52 55 1b e0 3e 29 f2 26 f3 d8 99 e2 92 83 c1 7b |RU..>).&.......{| | 7b 66 a4 f9 d2 1b 05 69 da 79 fc ac 89 ae 75 e3 |{f.....i.y....u.| | f1 a0 e8 8c 8c e9 a7 2f dd ed 8e 32 22 0b df ea |......./...2"...| | d9 30 aa 2a 18 a7 20 7a c1 0c 6a 9c 2e 1d 45 01 |.0.*.. z..j...E.| | 59 38 94 d2 84 29 31 8e 9a b3 2d 00 83 cd f6 39 |Y8...)1...-....9| | fb 08 26 87 ab 35 c7 1d 1a df 9e bc 1f 5b dd 41 |..&..5.......[.A| | 21 62 e8 94 d3 10 99 78 e7 2a c8 d0 1c 00 a2 1d |!b.....x.*......| | c4 d1 5f a8 3e af 98 fc 82 a2 62 8b 00 56 97 65 |.._.>.....b..V.e| | ed 38 2e 9f 33 cf 2a 19 40 94 1e 28 5b e2 66 d9 |.8..3.*.@..([.f.| | 15 c9 f1 65 78 27 ba f3 68 44 8e af da f3 b1 66 |...ex'..hD.....f| | f0 34 be 14 f2 df 86 bd a2 58 3d f7 9a 95 48 62 |.4.......X=...Hb| | 24 8e 16 4d ca 4d 98 db d9 92 61 a5 a3 35 bf 2c |$..M.M....a..5.,| | af 9a 36 1c fd da 7a 30 49 09 7a f1 e2 c8 fd 43 |..6...z0I.z....C| | d5 1d 01 98 ee c6 8e 2d bd 9c 15 27 11 a6 e4 4f |.......-...'...O| | 6f 3e a3 63 83 46 2b d2 f0 23 21 fb 05 71 a5 8f |o>.c.F+..#!..q..| | 54 ef 26 19 49 a9 4b 46 88 12 27 91 41 0b e1 f5 |T.&.I.KF..'.A...| | 48 43 f2 8b d4 dd 39 08 bf 68 3d 3f 90 1c 4c aa |HC....9..h=?..L.| | 0e e4 bb 6a 74 02 e0 22 2c 99 25 5f be a1 a6 1e |...jt..",.%_....| | de ab 66 b3 32 63 7f 6f bb 3b bf db c8 71 74 e3 |..f.2c.o.;...qt.| | 70 30 d6 17 d5 1e ab bf 6b ea 85 be 3d a3 1e 1b |p0......k...=...| | df fa e3 d9 16 0d dc 7e 9f 90 19 b0 da c3 33 1c |.......~......3.| | be c4 63 29 f2 8e f9 ab 32 b7 72 78 ae 1d aa 00 |..c)....2.rx....| | e9 f6 c4 b8 ed 5b 0f 9f fe 57 81 33 2e 6b 78 39 |.....[...W.3.kx9| | 99 46 97 1c 6d 9d c4 0b b6 2d 02 ac db 5a 51 8a |.F..m....-...ZQ.| Plaintext[400]: | 4f a3 84 9e 81 10 fb 5e 35 86 8b 98 1d e8 5c 2e |O......^5.....\.| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:| | 35 35 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:16 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 39 41 20 2d 20 44 48 45 2d 52 |x00,0x9A - DHE-R| | 53 41 2d 53 45 45 44 2d 53 48 41 20 20 20 20 20 |SA-SEED-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 53 45 45 44 28 31 32 38 29 20 4d 61 63 3d 53 |=SEED(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1u.4x| | c5 1f bb 12 9e af 9b cb 49 d3 43 c6 de 3a 02 8b |........I.C..:..| | 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................| ssl_decrypt_record found padding 15 final len 384 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 97 45 05 4e 98 d6 1f 6b 78 d4 4a ad 94 e3 f8 c4 |.E.N...kx.J.....| | d4 f8 08 1d |.... | ssl_decrypt_record: mac failed association_find: TCP port 4472 found 0x33ce060 dissect_ssl enter frame #402 (first time) conversation = 0x7facef99a790, ssl_session = 0x7facc384bfb0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 92 19 19 b5 dc ab 59 18 e4 dc 2f c3 3f 66 76 bb |......Y.../.?fv.| | 4d 6d ab 0e 31 0b 1e e7 69 9e 73 e5 0e 95 93 79 |Mm..1...i.s....y| | a2 b2 57 d8 93 b0 28 0b 42 f0 31 05 29 4c 48 79 |..W...(.B.1.)LHy| Plaintext[48]: | 20 9f b0 76 a7 0d 9e a7 ad be c3 35 f7 21 08 9f | ..v.......5.!..| | 01 00 e3 d2 19 73 66 1a 3f 1e ca d7 7d 2a 51 c7 |.....sf.?...}*Q.| | 2f 28 c8 0f 53 ba 09 09 09 09 09 09 09 09 09 09 |/(..S...........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | e3 d2 19 73 66 1a 3f 1e ca d7 7d 2a 51 c7 2f 28 |...sf.?...}*Q./(| | c8 0f 53 ba |..S. | ssl_decrypt_record: mac ok dissect_ssl enter frame #404 (first time) conversation = 0x7facef99a790, ssl_session = 0x7facc384bfb0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 2f 4c 6a a7 3c d8 02 04 18 81 7c 7c f5 e1 c8 59 |/Lj.<.....||...Y| | ed 7c c9 ab d2 82 29 9a f9 e5 bb 3a d7 d0 00 68 |.|....)....:...h| | d4 02 d5 f9 05 b6 d7 ee 56 c5 03 0d 09 47 a8 40 |........V....G.@| Plaintext[48]: | a0 ad a1 9a 91 87 b3 e1 af b7 56 0d 19 b6 d9 31 |..........V....1| | 01 00 09 27 fb e5 72 af e4 bf c1 bc ff 11 80 cb |...'..r.........| | 28 64 72 8a 63 9a 09 09 09 09 09 09 09 09 09 09 |(dr.c...........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 09 27 fb e5 72 af e4 bf c1 bc ff 11 80 cb 28 64 |.'..r.........(d| | 72 8a 63 9a |r.c. | ssl_decrypt_record: mac ok dissect_ssl enter frame #409 (first time) ssl_session_init: initializing ptr 0x7facc384e4b0 size 688 conversation = 0x7facef99aa38, ssl_session = 0x7facc384e4b0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 34183 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4479 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #411 (first time) conversation = 0x7facef99aa38, ssl_session = 0x7facc384e4b0 record: offset = 0, reported_length_remaining = 565 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 66, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0xC002 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 6e 0f 50 3c ce 1f 28 d6 49 81 06 31 e4 1d 67 db |n.P<..(.I..1..g.| | d6 72 6b f5 10 b3 bf 22 0d 58 d6 4b fe b7 69 36 |.rk....".X.K..i6| | ef c1 50 7d c7 21 0c 3d ef 8b 84 65 ea a9 13 84 |..P}.!.=...e....| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 25 28 0c 4e 7b 0e 4e 70 ca 6f 36 b8 b1 fe c0 6d |%(.N{.Np.o6....m| | ac 16 f7 77 60 aa 7c 9e 8a 15 ab e5 f5 52 34 bf |...w`.|......R4.| | 25 06 e0 8e a2 a0 d6 d2 58 17 2d ce 2e 54 0d a6 |%.......X.-..T..| | c3 c6 40 1c af f3 d7 c4 6d 2b f4 26 51 |..@.....m+.&Q | hash out[72]: | 72 43 6d 4a e2 a6 ec 66 fd de db a5 7b 4f 2b ea |rCmJ...f....{O+.| | bf 38 b1 21 2a ff cd 91 f1 98 14 b3 b8 a0 7d d2 |.8.!*.........}.| | e5 e6 cb cc 9f 18 43 92 cd a0 f6 6a b0 af 87 79 |......C....j...y| | 2a a3 ef 6f f4 3c 5d 65 3f c3 eb 52 d6 c2 4d 1a |*..o.<]e?..R..M.| | 95 40 f7 29 f8 38 e2 21 |.@.).8.! | PRF out[72]: | 72 43 6d 4a e2 a6 ec 66 fd de db a5 7b 4f 2b ea |rCmJ...f....{O+.| | bf 38 b1 21 2a ff cd 91 f1 98 14 b3 b8 a0 7d d2 |.8.!*.........}.| | e5 e6 cb cc 9f 18 43 92 cd a0 f6 6a b0 af 87 79 |......C....j...y| | 2a a3 ef 6f f4 3c 5d 65 3f c3 eb 52 d6 c2 4d 1a |*..o.<]e?..R..M.| | 95 40 f7 29 f8 38 e2 21 |.@.).8.! | key expansion[72]: | 72 43 6d 4a e2 a6 ec 66 fd de db a5 7b 4f 2b ea |rCmJ...f....{O+.| | bf 38 b1 21 2a ff cd 91 f1 98 14 b3 b8 a0 7d d2 |.8.!*.........}.| | e5 e6 cb cc 9f 18 43 92 cd a0 f6 6a b0 af 87 79 |......C....j...y| | 2a a3 ef 6f f4 3c 5d 65 3f c3 eb 52 d6 c2 4d 1a |*..o.<]e?..R..M.| | 95 40 f7 29 f8 38 e2 21 |.@.).8.! | Client MAC key[20]: | 72 43 6d 4a e2 a6 ec 66 fd de db a5 7b 4f 2b ea |rCmJ...f....{O+.| | bf 38 b1 21 |.8.! | Server MAC key[20]: | 2a ff cd 91 f1 98 14 b3 b8 a0 7d d2 e5 e6 cb cc |*.........}.....| | 9f 18 43 92 |..C. | Client Write key[16]: | cd a0 f6 6a b0 af 87 79 2a a3 ef 6f f4 3c 5d 65 |...j...y*..o.<]e| Server Write key[16]: | 3f c3 eb 52 d6 c2 4d 1a 95 40 f7 29 f8 38 e2 21 |?..R..M..@.).8.!| Client Write IV[8]: | 01 00 00 00 00 00 00 00 |........ | Server Write IV[8]: | 14 00 00 00 00 00 00 00 |........ | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: ARCFOUR decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: ARCFOUR decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 71, reported_length_remaining = 494 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 480, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556 record: offset = 556, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 561 length 0 bytes, remaining 565 dissect_ssl enter frame #413 (first time) conversation = 0x7facef99aa38, ssl_session = 0x7facc384e4b0 record: offset = 0, reported_length_remaining = 154 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 102, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 98 bytes, remaining 107 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caf... looking for RSA pre-master6104408dff00e6a69e942bbca1848c290b3173ca6a797944... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 03 42 2a 8e 24 08 2f da ae 13 78 5c e4 38 99 62 |.B*.$./...x\.8.b| | 28 d1 70 fd 72 e9 76 ba 73 30 c7 4a 26 42 3b e5 |(.p.r.v.s0.J&B;.| | e4 7b e2 83 e8 a3 03 29 90 9d 47 d7 fd 43 f4 b2 |.{.....)..G..C..| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 25 28 0c 4e 7b 0e 4e 70 ca 6f 36 b8 b1 fe c0 6d |%(.N{.Np.o6....m| | ac 16 f7 77 60 aa 7c 9e 8a 15 ab e5 f5 52 34 bf |...w`.|......R4.| | 25 06 e0 8e a2 a0 d6 d2 58 17 2d ce 2e 54 0d a6 |%.......X.-..T..| | c3 c6 40 1c af f3 d7 c4 6d 2b f4 26 51 |..@.....m+.&Q | hash out[72]: | f5 89 5a 2e cd 61 36 f2 dc a2 41 21 05 65 40 33 |..Z..a6...A!.e@3| | 6e e0 b0 13 68 32 0b bd 35 d6 e6 dc d3 e3 33 43 |n...h2..5.....3C| | ae 80 93 ee bf e0 f6 e1 bb ef de 91 9c bf 46 fa |..............F.| | 82 2c 88 0a c4 86 e7 44 47 0d af 08 c7 77 13 b6 |.,.....DG....w..| | ec 5f 1d d8 0e d6 ec 11 |._...... | PRF out[72]: | f5 89 5a 2e cd 61 36 f2 dc a2 41 21 05 65 40 33 |..Z..a6...A!.e@3| | 6e e0 b0 13 68 32 0b bd 35 d6 e6 dc d3 e3 33 43 |n...h2..5.....3C| | ae 80 93 ee bf e0 f6 e1 bb ef de 91 9c bf 46 fa |..............F.| | 82 2c 88 0a c4 86 e7 44 47 0d af 08 c7 77 13 b6 |.,.....DG....w..| | ec 5f 1d d8 0e d6 ec 11 |._...... | key expansion[72]: | f5 89 5a 2e cd 61 36 f2 dc a2 41 21 05 65 40 33 |..Z..a6...A!.e@3| | 6e e0 b0 13 68 32 0b bd 35 d6 e6 dc d3 e3 33 43 |n...h2..5.....3C| | ae 80 93 ee bf e0 f6 e1 bb ef de 91 9c bf 46 fa |..............F.| | 82 2c 88 0a c4 86 e7 44 47 0d af 08 c7 77 13 b6 |.,.....DG....w..| | ec 5f 1d d8 0e d6 ec 11 |._...... | Client MAC key[20]: | f5 89 5a 2e cd 61 36 f2 dc a2 41 21 05 65 40 33 |..Z..a6...A!.e@3| | 6e e0 b0 13 |n... | Server MAC key[20]: | 68 32 0b bd 35 d6 e6 dc d3 e3 33 43 ae 80 93 ee |h2..5.....3C....| | bf e0 f6 e1 |.... | Client Write key[16]: | bb ef de 91 9c bf 46 fa 82 2c 88 0a c4 86 e7 44 |......F..,.....D| Server Write key[16]: | 47 0d af 08 c7 77 13 b6 ec 5f 1d d8 0e d6 ec 11 |G....w..._......| Client Write IV[8]: | 00 00 00 00 00 00 00 00 |........ | Server Write IV[8]: | 40 bd 73 03 00 00 00 00 |@.s..... | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: ARCFOUR decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: ARCFOUR decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 03 42 2a 8e 24 08 2f da ae 13 78 5c e4 38 99 62 |.B*.$./...x\.8.b| | 28 d1 70 fd 72 e9 76 ba 73 30 c7 4a 26 42 3b e5 |(.p.r.v.s0.J&B;.| | e4 7b e2 83 e8 a3 03 29 90 9d 47 d7 fd 43 f4 b2 |.{.....)..G..C..| dissect_ssl3_handshake session keys successfully generated record: offset = 107, reported_length_remaining = 47 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 113, reported_length_remaining = 41 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 36, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 36 Ciphertext[36]: | b2 ea 4b a9 c3 7a ae 92 00 3a c0 4e e8 0c 5e 87 |..K..z...:.N..^.| | 6c 1c f0 4d 9c 6c 07 9a dd c8 a9 c5 5a 62 06 81 |l..M.l......Zb..| | b4 b9 93 b9 |.... | Plaintext[36]: | 14 00 00 0c 75 5f fb 5f 7d 83 4e b3 99 6a 0d 6c |....u_._}.N..j.l| | ce b7 bf 51 2e 45 65 9a ef bb a1 d0 41 11 0e 3a |...Q.Ee.....A..:| | 87 b9 3f f9 |..?. | checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | ce b7 bf 51 2e 45 65 9a ef bb a1 d0 41 11 0e 3a |...Q.Ee.....A..:| | 87 b9 3f f9 |..?. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #414 (first time) conversation = 0x7facef99aa38, ssl_session = 0x7facc384e4b0 record: offset = 0, reported_length_remaining = 222 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 47 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 41 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 36, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 36 Ciphertext[36]: | e3 0e 63 dc 28 8a ef 67 d2 56 17 8f 2e f8 e4 3c |..c.(..g.V.....<| | 1b 65 76 d4 1a 06 bb d0 1a 4a d4 7a b2 42 25 fc |.ev......J.z.B%.| | 49 20 b2 82 |I .. | Plaintext[36]: | 14 00 00 0c cb ad 8d 7a fd c5 52 dd ea 0d 5d f3 |.......z..R...].| | 30 21 6c 30 41 33 94 32 87 4f db db 77 4b 7c 25 |0!l0A3.2.O..wK|%| | 54 ed bb 0d |T... | checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 30 21 6c 30 41 33 94 32 87 4f db db 77 4b 7c 25 |0!l0A3.2.O..wK|%| | 54 ed bb 0d |T... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #415 (first time) conversation = 0x7facef99aa38, ssl_session = 0x7facc384e4b0 record: offset = 0, reported_length_remaining = 97 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 92, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 92 Ciphertext[92]: | 37 81 57 36 d9 41 a4 b7 a7 40 e3 ba eb b3 b4 57 |7.W6.A...@.....W| | 25 df 83 6e c0 72 67 6b 34 a7 cc 5c 33 e9 0d 07 |%..n.rgk4..\3...| | 10 d3 a2 43 10 96 6a c7 b7 9a 1c b8 2d 46 90 51 |...C..j.....-F.Q| | 82 29 71 dd 6f 7f c1 42 22 99 d7 c6 ca dd 40 78 |.)q.o..B".....@x| | 8f d8 9b fe d2 f1 2a e6 92 bb c4 c4 fe 81 6b 2e |......*.......k.| | de 70 6b 8f f3 df c1 36 5a 03 92 c2 |.pk....6Z... | Plaintext[92]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa| | 2d 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |-rc4-sha.local.a| | 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:| | 34 34 37 39 0d 0a 0d 0a 6c 7d 56 2f 88 41 10 14 |4479....l}V/.A..| | 2d ba 2a ca b1 a4 80 06 0d 5b 2a 7f |-.*......[*. | checking mac (len 72, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 6c 7d 56 2f 88 41 10 14 2d ba 2a ca b1 a4 80 06 |l}V/.A..-.*.....| | 0d 5b 2a 7f |.[*. | ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 72, seq = 0, nxtseq = 72 association_find: TCP port 34183 found (nil) association_find: TCP port 4479 found 0x3430b70 dissect_ssl3_record decrypted len 72 decrypted app data fragment[72]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa| | 2d 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |-rc4-sha.local.a| | 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:| | 34 34 37 39 0d 0a 0d 0a |4479.... | dissect_ssl3_record found association 0x3430b70 dissect_ssl enter frame #416 (first time) conversation = 0x7facef99aa38, ssl_session = 0x7facc384e4b0 record: offset = 0, reported_length_remaining = 375 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 370, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 370 Ciphertext[370]: | 81 3a 61 c1 4d ce c0 99 59 75 42 ae 68 a8 02 5e |.:a.M...YuB.h..^| | 70 23 65 b0 85 19 11 d8 85 70 14 6b e5 1b 8b 38 |p#e......p.k...8| | 23 f4 29 af ac 5d 90 9d 99 2c 01 5e d5 b1 96 4d |#.)..]...,.^...M| | 4c b2 99 8e bb 39 22 30 10 28 d2 37 95 25 04 c1 |L....9"0.(.7.%..| | 44 08 73 60 5e 23 6c 63 b7 63 79 73 c2 0c c1 d4 |D.s`^#lc.cys....| | 39 03 04 4e a4 cc de fe 3e 57 f6 1b 67 a9 f1 31 |9..N....>W..g..1| | 9f b6 2a 59 e7 0e 76 4a 96 f9 55 c5 32 fe ca cc |..*Y..vJ..U.2...| | 2b 44 81 42 14 85 27 e4 a1 80 c4 55 7c 4d ab 1f |+D.B..'....U|M..| | af 62 f0 0b f3 28 c9 8d b0 d4 18 8c 41 b5 a3 dd |.b...(......A...| | a1 ff fc 9d bb 52 d5 4c f6 73 be ce e7 3a 3d 98 |.....R.L.s...:=.| | 0e c0 85 de 8a e7 13 5c c0 c2 7a 41 a8 06 f6 b8 |.......\..zA....| | 36 73 f7 34 e6 62 d1 a7 15 a9 5f fb 89 4c 0d af |6s.4.b...._..L..| | 06 b5 46 61 91 f6 c9 ff b4 49 65 23 8f a3 6e e0 |..Fa.....Ie#..n.| | bd 11 3d 4a 6e 85 66 b7 ed 51 95 10 e5 a7 15 f1 |..=Jn.f..Q......| | 8f 59 33 98 4e 6d 42 6d 1e 7c 9a 9c 1c 63 22 03 |.Y3.NmBm.|...c".| | 52 03 8f b1 4f 63 42 41 dc 83 f5 ef 41 e8 13 f8 |R...OcBA....A...| | 60 e2 8e 57 9a f9 b3 7c ac c0 a0 cb 36 2a 31 c2 |`..W...|....6*1.| | 69 c8 c0 cc 03 6c 99 14 2a ea e0 df de d9 5d 7a |i....l..*.....]z| | 3d 09 9e 03 12 01 5f a3 09 47 ea f2 a7 47 cf 66 |=....._..G...G.f| | 67 d3 8d 58 9a 0e 77 c1 44 b6 a4 c8 be a5 48 aa |g..X..w.D.....H.| | 97 a5 11 bd e8 a7 f3 b2 bb 45 6a fb 31 ef c1 72 |.........Ej.1..r| | 0a f6 49 6c 98 28 ff 3d 4e 18 fe 28 0f cb a5 0c |..Il.(.=N..(....| | 34 12 e1 2f 85 7a 06 2a 76 72 26 2b b1 56 b0 07 |4../.z.*vr&+.V..| | dc 86 |.. | Plaintext[370]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:| | 35 35 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:17 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 30 32 20 2d 20 45 43 44 48 2d |xC0,0x02 - ECDH-| | 45 43 44 53 41 2d 52 43 34 2d 53 48 41 20 20 20 |ECDSA-RC4-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH| | 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E| | 6e 63 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 |nc=RC4(128) Mac| | 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1U.| | c9 e6 ac 3e ed 25 b1 26 2c 85 68 32 3d 0b b9 43 |...>.%.&,.h2=..C| | 60 37 |`7 | checking mac (len 350, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 55 18 c9 e6 ac 3e ed 25 b1 26 2c 85 68 32 3d 0b |U....>.%.&,.h2=.| | b9 43 60 37 |.C`7 | ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 350, seq = 0, nxtseq = 350 association_find: TCP port 4479 found 0x3430b70 dissect_ssl3_record decrypted len 350 decrypted app data fragment[350]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:| | 35 35 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:17 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 30 32 20 2d 20 45 43 44 48 2d |xC0,0x02 - ECDH-| | 45 43 44 53 41 2d 52 43 34 2d 53 48 41 20 20 20 |ECDSA-RC4-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH| | 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E| | 6e 63 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 |nc=RC4(128) Mac| | 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1 | dissect_ssl3_record found association 0x3430b70 dissect_ssl enter frame #417 (first time) conversation = 0x7facef99aa38, ssl_session = 0x7facc384e4b0 record: offset = 0, reported_length_remaining = 27 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 22, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 22 Ciphertext[22]: | 7b d8 92 2e 47 f6 95 a9 07 9e 5a 34 82 65 30 d8 |{...G.....Z4.e0.| | a8 c8 4c 6b ef 8b |..Lk.. | Plaintext[22]: | 01 00 bd b1 03 9f ac 7b d8 db dd 33 37 ff 25 e0 |.......{...37.%.| | 96 79 09 29 30 2b |.y.)0+ | checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | bd b1 03 9f ac 7b d8 db dd 33 37 ff 25 e0 96 79 |.....{...37.%..y| | 09 29 30 2b |.)0+ | ssl_decrypt_record: mac ok dissect_ssl enter frame #419 (first time) conversation = 0x7facef99aa38, ssl_session = 0x7facc384e4b0 record: offset = 0, reported_length_remaining = 27 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 22, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 22 Ciphertext[22]: | 73 e9 7d 8b 80 b8 88 71 be 58 08 f4 17 e3 26 f9 |s.}....q.X....&.| | cf a8 41 f6 66 31 |..A.f1 | Plaintext[22]: | 01 00 a4 3a bf 4b de d8 f9 4a 82 44 37 1e 99 01 |...:.K...J.D7...| | 0e 80 bf db 8d 06 |...... | checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | a4 3a bf 4b de d8 f9 4a 82 44 37 1e 99 01 0e 80 |.:.K...J.D7.....| | bf db 8d 06 |.... | ssl_decrypt_record: mac ok dissect_ssl enter frame #424 (first time) ssl_session_init: initializing ptr 0x7facc3850da0 size 688 conversation = 0x7facef99ad90, ssl_session = 0x7facc3850da0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 45570 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4480 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #426 (first time) conversation = 0x7facef99ad90, ssl_session = 0x7facc3850da0 record: offset = 0, reported_length_remaining = 565 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 66, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0xC003 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 03 42 2a 8e 24 08 2f da ae 13 78 5c e4 38 99 62 |.B*.$./...x\.8.b| | 28 d1 70 fd 72 e9 76 ba 73 30 c7 4a 26 42 3b e5 |(.p.r.v.s0.J&B;.| | e4 7b e2 83 e8 a3 03 29 90 9d 47 d7 fd 43 f4 b2 |.{.....)..G..C..| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 25 13 8e 82 a2 1f 8e 47 09 de fd e3 48 1d ea c7 |%......G....H...| | 39 9e 4b 1b 80 b6 24 a5 c5 5f ab 33 e5 52 34 bf |9.K...$.._.3.R4.| | 25 02 42 88 2d 3c 8f 20 bc 8f 3e b6 3f 84 29 ad |%.B.-<. ..>.?.).| | 4e ef a1 78 53 30 d2 77 dd 09 12 98 12 |N..xS0.w..... | hash out[104]: | 87 40 03 63 c7 fb 69 59 19 b5 47 05 4b f8 12 9d |.@.c..iY..G.K...| | 96 89 b0 a6 86 38 3e c8 4d f7 c0 fc 19 5b 2b 86 |.....8>.M....[+.| | 89 5a 32 c4 45 2b f8 d0 fc 8c 74 33 5a ba 40 39 |.Z2.E+....t3Z.@9| | 3b 7b e6 95 50 2e b7 ae 6b 89 da 67 05 3d 6a 8d |;{..P...k..g.=j.| | a9 3b da d1 54 84 d5 76 0f 9a 2b a5 7c 21 d8 5f |.;..T..v..+.|!._| | 96 e4 c2 46 4e 55 42 a3 f0 ff 5f b7 1c ba 4f e5 |...FNUB..._...O.| | bb 78 4c ec 08 f8 e7 d6 |.xL..... | PRF out[104]: | 87 40 03 63 c7 fb 69 59 19 b5 47 05 4b f8 12 9d |.@.c..iY..G.K...| | 96 89 b0 a6 86 38 3e c8 4d f7 c0 fc 19 5b 2b 86 |.....8>.M....[+.| | 89 5a 32 c4 45 2b f8 d0 fc 8c 74 33 5a ba 40 39 |.Z2.E+....t3Z.@9| | 3b 7b e6 95 50 2e b7 ae 6b 89 da 67 05 3d 6a 8d |;{..P...k..g.=j.| | a9 3b da d1 54 84 d5 76 0f 9a 2b a5 7c 21 d8 5f |.;..T..v..+.|!._| | 96 e4 c2 46 4e 55 42 a3 f0 ff 5f b7 1c ba 4f e5 |...FNUB..._...O.| | bb 78 4c ec 08 f8 e7 d6 |.xL..... | key expansion[104]: | 87 40 03 63 c7 fb 69 59 19 b5 47 05 4b f8 12 9d |.@.c..iY..G.K...| | 96 89 b0 a6 86 38 3e c8 4d f7 c0 fc 19 5b 2b 86 |.....8>.M....[+.| | 89 5a 32 c4 45 2b f8 d0 fc 8c 74 33 5a ba 40 39 |.Z2.E+....t3Z.@9| | 3b 7b e6 95 50 2e b7 ae 6b 89 da 67 05 3d 6a 8d |;{..P...k..g.=j.| | a9 3b da d1 54 84 d5 76 0f 9a 2b a5 7c 21 d8 5f |.;..T..v..+.|!._| | 96 e4 c2 46 4e 55 42 a3 f0 ff 5f b7 1c ba 4f e5 |...FNUB..._...O.| | bb 78 4c ec 08 f8 e7 d6 |.xL..... | Client MAC key[20]: | 87 40 03 63 c7 fb 69 59 19 b5 47 05 4b f8 12 9d |.@.c..iY..G.K...| | 96 89 b0 a6 |.... | Server MAC key[20]: | 86 38 3e c8 4d f7 c0 fc 19 5b 2b 86 89 5a 32 c4 |.8>.M....[+..Z2.| | 45 2b f8 d0 |E+.. | Client Write key[24]: | fc 8c 74 33 5a ba 40 39 3b 7b e6 95 50 2e b7 ae |..t3Z.@9;{..P...| | 6b 89 da 67 05 3d 6a 8d |k..g.=j. | Server Write key[24]: | a9 3b da d1 54 84 d5 76 0f 9a 2b a5 7c 21 d8 5f |.;..T..v..+.|!._| | 96 e4 c2 46 4e 55 42 a3 |...FNUB. | Client Write IV[8]: | f0 ff 5f b7 1c ba 4f e5 |.._...O. | Server Write IV[8]: | bb 78 4c ec 08 f8 e7 d6 |.xL..... | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 71, reported_length_remaining = 494 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 480, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556 record: offset = 556, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 561 length 0 bytes, remaining 565 dissect_ssl enter frame #428 (first time) conversation = 0x7facef99ad90, ssl_session = 0x7facc3850da0 record: offset = 0, reported_length_remaining = 166 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 102, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 98 bytes, remaining 107 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa17853... looking for RSA pre-master6104bc9ef092887a313a5a0b59d6b695eef1f38fdb5c55d0... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | c3 67 02 e3 a0 9b 22 ed 92 5b 2d 18 29 17 66 c3 |.g...."..[-.).f.| | b2 ec fe 5b 80 56 99 6f 7d 5c af 5e 87 08 e1 c4 |...[.V.o}\.^....| | 32 37 96 18 af 58 35 b8 18 90 f6 de 4c fc 1d a2 |27...X5.....L...| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 25 13 8e 82 a2 1f 8e 47 09 de fd e3 48 1d ea c7 |%......G....H...| | 39 9e 4b 1b 80 b6 24 a5 c5 5f ab 33 e5 52 34 bf |9.K...$.._.3.R4.| | 25 02 42 88 2d 3c 8f 20 bc 8f 3e b6 3f 84 29 ad |%.B.-<. ..>.?.).| | 4e ef a1 78 53 30 d2 77 dd 09 12 98 12 |N..xS0.w..... | hash out[104]: | 99 21 8e 93 af 80 75 7a 43 e1 80 67 c8 83 18 51 |.!....uzC..g...Q| | 4e 48 31 7e 27 16 68 6c 9c 81 1c c6 7f 27 87 33 |NH1~'.hl.....'.3| | 71 f4 fe ab f2 38 3b 0d a0 e3 ee 6f 35 9f f6 13 |q....8;....o5...| | b1 f0 b7 66 af 01 23 b4 02 66 59 6c b6 ff 77 b7 |...f..#..fYl..w.| | 8b ff dc 7e 12 6a 2f f0 23 ae 8e ee c3 17 9d 10 |...~.j/.#.......| | 34 22 8a 44 56 cd d8 f3 7c 64 0c b4 ef c5 c8 34 |4".DV...|d.....4| | a8 76 0b c5 fe 92 fb 29 |.v.....) | PRF out[104]: | 99 21 8e 93 af 80 75 7a 43 e1 80 67 c8 83 18 51 |.!....uzC..g...Q| | 4e 48 31 7e 27 16 68 6c 9c 81 1c c6 7f 27 87 33 |NH1~'.hl.....'.3| | 71 f4 fe ab f2 38 3b 0d a0 e3 ee 6f 35 9f f6 13 |q....8;....o5...| | b1 f0 b7 66 af 01 23 b4 02 66 59 6c b6 ff 77 b7 |...f..#..fYl..w.| | 8b ff dc 7e 12 6a 2f f0 23 ae 8e ee c3 17 9d 10 |...~.j/.#.......| | 34 22 8a 44 56 cd d8 f3 7c 64 0c b4 ef c5 c8 34 |4".DV...|d.....4| | a8 76 0b c5 fe 92 fb 29 |.v.....) | key expansion[104]: | 99 21 8e 93 af 80 75 7a 43 e1 80 67 c8 83 18 51 |.!....uzC..g...Q| | 4e 48 31 7e 27 16 68 6c 9c 81 1c c6 7f 27 87 33 |NH1~'.hl.....'.3| | 71 f4 fe ab f2 38 3b 0d a0 e3 ee 6f 35 9f f6 13 |q....8;....o5...| | b1 f0 b7 66 af 01 23 b4 02 66 59 6c b6 ff 77 b7 |...f..#..fYl..w.| | 8b ff dc 7e 12 6a 2f f0 23 ae 8e ee c3 17 9d 10 |...~.j/.#.......| | 34 22 8a 44 56 cd d8 f3 7c 64 0c b4 ef c5 c8 34 |4".DV...|d.....4| | a8 76 0b c5 fe 92 fb 29 |.v.....) | Client MAC key[20]: | 99 21 8e 93 af 80 75 7a 43 e1 80 67 c8 83 18 51 |.!....uzC..g...Q| | 4e 48 31 7e |NH1~ | Server MAC key[20]: | 27 16 68 6c 9c 81 1c c6 7f 27 87 33 71 f4 fe ab |'.hl.....'.3q...| | f2 38 3b 0d |.8;. | Client Write key[24]: | a0 e3 ee 6f 35 9f f6 13 b1 f0 b7 66 af 01 23 b4 |...o5......f..#.| | 02 66 59 6c b6 ff 77 b7 |.fYl..w. | Server Write key[24]: | 8b ff dc 7e 12 6a 2f f0 23 ae 8e ee c3 17 9d 10 |...~.j/.#.......| | 34 22 8a 44 56 cd d8 f3 |4".DV... | Client Write IV[8]: | 7c 64 0c b4 ef c5 c8 34 ||d.....4 | Server Write IV[8]: | a8 76 0b c5 fe 92 fb 29 |.v.....) | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | c3 67 02 e3 a0 9b 22 ed 92 5b 2d 18 29 17 66 c3 |.g...."..[-.).f.| | b2 ec fe 5b 80 56 99 6f 7d 5c af 5e 87 08 e1 c4 |...[.V.o}\.^....| | 32 37 96 18 af 58 35 b8 18 90 f6 de 4c fc 1d a2 |27...X5.....L...| dissect_ssl3_handshake session keys successfully generated record: offset = 107, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 113, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 70 03 37 a1 d3 fd cb dd 99 3f 92 07 04 26 4d 15 |p.7......?...&M.| | ef fa 4d 65 62 e0 68 f8 10 45 99 f9 ad e2 4a f4 |..Meb.h..E....J.| | 4f e1 cd 9a 6e eb e3 e1 fe 87 3a 55 25 eb 8e f9 |O...n.....:U%...| Plaintext[48]: | ee 13 49 7c da a6 78 49 14 00 00 0c 67 df ec 09 |..I|..xI....g...| | 81 93 13 cb dc 73 a4 98 b8 cc e7 0e a2 f0 46 2b |.....s........F+| | c8 3b fc 5c 64 64 0b 61 91 4d b1 ce 03 03 03 03 |.;.\dd.a.M......| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | b8 cc e7 0e a2 f0 46 2b c8 3b fc 5c 64 64 0b 61 |......F+.;.\dd.a| | 91 4d b1 ce |.M.. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #429 (first time) conversation = 0x7facef99ad90, ssl_session = 0x7facc3850da0 record: offset = 0, reported_length_remaining = 234 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | d3 f8 94 13 8a 90 79 08 62 84 1f f5 43 12 48 6c |......y.b...C.Hl| | da 41 be 03 cc ce 13 33 d7 43 b8 c3 9d 9e 41 63 |.A.....3.C....Ac| | f5 d4 ed e1 74 36 69 52 fd df 3f 94 b3 99 79 6c |....t6iR..?...yl| Plaintext[48]: | 4b 03 56 8f 95 06 11 54 14 00 00 0c 0b 0b 6f a9 |K.V....T......o.| | e5 fa e5 21 51 a7 ff 42 a4 2c 9c 8d 4b bc 62 f5 |...!Q..B.,..K.b.| | e0 a2 c9 21 a7 3c 2e 0b 6f 70 63 f4 03 03 03 03 |...!.<..opc.....| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | a4 2c 9c 8d 4b bc 62 f5 e0 a2 c9 21 a7 3c 2e 0b |.,..K.b....!.<..| | 6f 70 63 f4 |opc. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #430 (first time) conversation = 0x7facef99ad90, ssl_session = 0x7facc3850da0 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | af a2 41 f7 0e 1c e9 3f 48 81 26 37 5f cb 3c c8 |..A....?H.&7_.<.| | 20 2a bd 3c c0 ba 22 00 37 a3 dd a6 dc d0 8e 09 | *.<..".7.......| | 03 cf d0 12 d6 d3 ad b1 01 09 cc 86 69 3c 50 af |............iT| | 67 38 db 4a |g8.J | ssl_decrypt_record: mac failed association_find: TCP port 45570 found (nil) association_find: TCP port 4480 found 0x3430c00 dissect_ssl enter frame #431 (first time) conversation = 0x7facef99ad90, ssl_session = 0x7facc3850da0 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | 50 de b3 20 d9 ea 40 54 6e cf 50 fb 4e fd e8 21 |P.. ..@Tn.P.N..!| | 47 ec 5c 0a 0c a9 d3 53 34 3f f7 6f b1 56 aa ec |G.\....S4?.o.V..| | e5 75 c4 c7 25 3a de 33 6e fa 1d 3d 5f b6 a6 c1 |.u..%:.3n..=_...| | 11 18 c1 6f eb 16 66 e0 26 a3 7a 59 ed 64 80 af |...o..f.&.zY.d..| | d4 55 1b 1e c2 0f 12 33 79 87 06 61 f2 ba 81 f2 |.U.....3y..a....| | c8 6a 86 32 0d 2a 46 54 d2 ff a1 c4 e8 52 d7 7d |.j.2.*FT.....R.}| | 19 a3 be a9 87 fd a8 60 e3 8d e0 26 b8 ff f4 af |.......`...&....| | 0f cf 02 52 2a b8 f8 00 63 14 84 39 6a 59 66 54 |...R*...c..9jYfT| | d8 31 36 7c 71 d8 37 0d 45 21 c8 5e 23 11 01 71 |.16|q.7.E!.^#..q| | 00 f8 68 49 a8 27 fa 60 a0 d7 02 f2 b6 d5 19 27 |..hI.'.`.......'| | fd e4 12 d0 2b 81 c1 18 91 7c 54 9f 78 84 e3 5b |....+....|T.x..[| | ea e2 6f d2 03 09 97 6a 27 ec 7c 76 a0 0a 8e 4f |..o....j'.|v...O| | 9f 4c 51 2f d4 fc 7e 44 48 42 3f cb 7d fb b0 dd |.LQ/..~DHB?.}...| | 2c bf 1e 9b 92 d6 57 ec 5d 07 fe 0b 4f 60 b4 21 |,.....W.]...O`.!| | 01 0b c5 a7 e8 83 af 4f 7a c3 e8 9e 70 4f a9 7b |.......Oz...pO.{| | cb 66 b2 eb 47 82 5c fb d9 51 d0 f5 c8 09 b7 31 |.f..G.\..Q.....1| | 58 3a e9 f7 0c 7b 07 63 52 43 f2 0d d1 cf 5a c7 |X:...{.cRC....Z.| | 04 bc c1 56 fa cf 1a e6 58 11 68 2f 65 63 23 54 |...V....X.h/ec#T| | dd 8d 80 1e 12 b1 c0 a4 1f 8e e7 1e 0f d9 dc 35 |...............5| | a1 0d 67 7d 6b d7 9e 0d 69 22 86 80 1f 41 4d 72 |..g}k...i"...AMr| | cc 57 e4 ab a0 88 56 38 a1 cf 78 07 5c c0 f8 e5 |.W....V8..x.\...| | 5a 54 7b 0c 9e 1b 92 1b b7 2c 78 a3 99 92 32 af |ZT{......,x...2.| | 78 6d 66 43 5b b3 98 dd 56 ec 5a 04 6c fb f0 12 |xmfC[...V.Z.l...| | 51 e9 06 8d 26 3d ad b6 36 f4 24 be ec 69 a4 3b |Q...&=..6.$..i.;| Plaintext[384]: | ec 69 d2 96 bc 0a 7b 78 48 54 54 50 2f 31 2e 31 |.i....{xHTTP/1.1| | 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:| | 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da| | 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep | | 32 30 31 33 20 31 39 3a 35 35 3a 31 37 20 47 4d |2013 19:55:17 GM| | 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:| | 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont| | 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 33 0d |ent-Length: 143.| | 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo| | 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu| | 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00| | 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach| | 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca| | 63 68 65 0d 0a 0d 0a 30 78 43 30 2c 30 78 30 33 |che....0xC0,0x03| | 20 2d 20 45 43 44 48 2d 45 43 44 53 41 2d 44 45 | - ECDH-ECDSA-DE| | 53 2d 43 42 43 33 2d 53 48 41 20 53 53 4c 76 33 |S-CBC3-SHA SSLv3| | 20 4b 78 3d 45 43 44 48 2f 45 43 44 53 41 20 41 | Kx=ECDH/ECDSA A| | 75 3d 45 43 44 48 20 45 6e 63 3d 33 44 45 53 28 |u=ECDH Enc=3DES(| | 31 36 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 |168) Mac=SHA1document.do| | 6d 61 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c |main='local.al.l| | 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 |ekensteyn.nl'r5....y.K1| | 16 96 1b 8c 35 a9 4e 75 1e 4e 05 05 05 05 05 05 |....5.Nu.N......| ssl_decrypt_record found padding 5 final len 378 checking mac (len 350, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 20 53 25 f4 70 8d b9 45 c8 ab 3f 81 0b 85 d7 78 | S%.p..E..?....x| | 12 d7 4e 1e |..N. | ssl_decrypt_record: mac failed association_find: TCP port 4480 found 0x3430c00 dissect_ssl enter frame #432 (first time) conversation = 0x7facef99ad90, ssl_session = 0x7facc3850da0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 05 0f 19 82 1e 06 0a 85 ae 7a c2 b1 84 40 80 6d |.........z...@.m| | 32 57 f5 2a 32 54 e0 c2 39 bc ae 60 2e e8 27 44 |2W.*2T..9..`..'D| Plaintext[32]: | c0 e4 fb 91 41 0e 85 c4 01 00 35 51 58 60 f3 04 |....A.....5QX`..| | 37 94 6a 0a 20 38 cc 21 15 7c 5f 15 9b bf 01 01 |7.j. 8.!.|_.....| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 35 51 58 60 f3 04 37 94 6a 0a 20 38 cc 21 15 7c |5QX`..7.j. 8.!.|| | 5f 15 9b bf |_... | ssl_decrypt_record: mac ok dissect_ssl enter frame #434 (first time) conversation = 0x7facef99ad90, ssl_session = 0x7facc3850da0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 2e 13 8b 64 1d b9 64 51 86 e9 dc 9e f5 19 c5 3f |...d..dQ.......?| | b1 a6 1d 8b 59 d0 70 17 30 7b a0 d9 8b 1a 43 e4 |....Y.p.0{....C.| Plaintext[32]: | ce 1a c6 03 0a 75 f5 3b 01 00 05 c2 40 e6 8f fe |.....u.;....@...| | 6b 3c ec d2 dd 32 25 13 66 76 03 ce 95 2e 01 01 |k<...2%.fv......| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 05 c2 40 e6 8f fe 6b 3c ec d2 dd 32 25 13 66 76 |..@...k<...2%.fv| | 03 ce 95 2e |.... | ssl_decrypt_record: mac ok dissect_ssl enter frame #439 (first time) ssl_session_init: initializing ptr 0x7facc38532c0 size 688 conversation = 0x7facef99b038, ssl_session = 0x7facc38532c0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 35291 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4481 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #441 (first time) conversation = 0x7facef99b038, ssl_session = 0x7facc38532c0 record: offset = 0, reported_length_remaining = 565 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 66, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0xC004 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | c3 67 02 e3 a0 9b 22 ed 92 5b 2d 18 29 17 66 c3 |.g...."..[-.).f.| | b2 ec fe 5b 80 56 99 6f 7d 5c af 5e 87 08 e1 c4 |...[.V.o}\.^....| | 32 37 96 18 af 58 35 b8 18 90 f6 de 4c fc 1d a2 |27...X5.....L...| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 25 50 c5 36 e6 fa 6b 21 55 2a 9c d9 4d f3 ae 7e |%P.6..k!U*..M..~| | 26 f1 9e 79 f3 a9 8d 35 44 2f 37 3b 6f 52 34 bf |&..y...5D/7;oR4.| | 25 d3 23 f9 f2 b3 94 e3 a7 ca 28 a0 8a 38 32 e4 |%.#.......(..82.| | b5 c1 cd ba 6b 86 7f 53 c5 69 65 67 00 |....k..S.ieg. | hash out[104]: | 69 98 cc ad 45 d5 c9 9a ec 01 fe e9 da 08 3f 6a |i...E.........?j| | 0f 6a 64 b9 76 82 96 de 82 80 4c bc 58 9d 24 c4 |.jd.v.....L.X.$.| | 76 fe b7 6e db 4c ef 9a 70 0a 0a 63 22 70 fe 25 |v..n.L..p..c"p.%| | b9 ec 73 1e c5 2e 38 be 71 7e 61 ee 8a 6f 52 38 |..s...8.q~a..oR8| | ff ab f2 cd 46 f5 ba 07 57 78 9e 14 e8 53 92 bf |....F...Wx...S..| | e9 1f 6d af e2 3b 49 cf 68 8b 18 23 a1 1b 44 14 |..m..;I.h..#..D.| | 5f 4d 6b 97 01 04 b6 e2 |_Mk..... | PRF out[104]: | 69 98 cc ad 45 d5 c9 9a ec 01 fe e9 da 08 3f 6a |i...E.........?j| | 0f 6a 64 b9 76 82 96 de 82 80 4c bc 58 9d 24 c4 |.jd.v.....L.X.$.| | 76 fe b7 6e db 4c ef 9a 70 0a 0a 63 22 70 fe 25 |v..n.L..p..c"p.%| | b9 ec 73 1e c5 2e 38 be 71 7e 61 ee 8a 6f 52 38 |..s...8.q~a..oR8| | ff ab f2 cd 46 f5 ba 07 57 78 9e 14 e8 53 92 bf |....F...Wx...S..| | e9 1f 6d af e2 3b 49 cf 68 8b 18 23 a1 1b 44 14 |..m..;I.h..#..D.| | 5f 4d 6b 97 01 04 b6 e2 |_Mk..... | key expansion[104]: | 69 98 cc ad 45 d5 c9 9a ec 01 fe e9 da 08 3f 6a |i...E.........?j| | 0f 6a 64 b9 76 82 96 de 82 80 4c bc 58 9d 24 c4 |.jd.v.....L.X.$.| | 76 fe b7 6e db 4c ef 9a 70 0a 0a 63 22 70 fe 25 |v..n.L..p..c"p.%| | b9 ec 73 1e c5 2e 38 be 71 7e 61 ee 8a 6f 52 38 |..s...8.q~a..oR8| | ff ab f2 cd 46 f5 ba 07 57 78 9e 14 e8 53 92 bf |....F...Wx...S..| | e9 1f 6d af e2 3b 49 cf 68 8b 18 23 a1 1b 44 14 |..m..;I.h..#..D.| | 5f 4d 6b 97 01 04 b6 e2 |_Mk..... | Client MAC key[20]: | 69 98 cc ad 45 d5 c9 9a ec 01 fe e9 da 08 3f 6a |i...E.........?j| | 0f 6a 64 b9 |.jd. | Server MAC key[20]: | 76 82 96 de 82 80 4c bc 58 9d 24 c4 76 fe b7 6e |v.....L.X.$.v..n| | db 4c ef 9a |.L.. | Client Write key[16]: | 70 0a 0a 63 22 70 fe 25 b9 ec 73 1e c5 2e 38 be |p..c"p.%..s...8.| Server Write key[16]: | 71 7e 61 ee 8a 6f 52 38 ff ab f2 cd 46 f5 ba 07 |q~a..oR8....F...| Client Write IV[16]: | 57 78 9e 14 e8 53 92 bf e9 1f 6d af e2 3b 49 cf |Wx...S....m..;I.| Server Write IV[16]: | 68 8b 18 23 a1 1b 44 14 5f 4d 6b 97 01 04 b6 e2 |h..#..D._Mk.....| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 71, reported_length_remaining = 494 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 480, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556 record: offset = 556, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 561 length 0 bytes, remaining 565 dissect_ssl enter frame #443 (first time) conversation = 0x7facef99b038, ssl_session = 0x7facc38532c0 record: offset = 0, reported_length_remaining = 182 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 102, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 98 bytes, remaining 107 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b... looking for RSA pre-master61049253a2d836006b56eb0fce73adc57dd6f0dc24475d45... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 0c 30 49 ae 3e 3b b6 d5 12 bf 30 4b 8a 47 76 68 |.0I.>;....0K.Gvh| | 87 91 88 9c ef 14 48 c7 53 e2 e8 a7 c0 1e 62 13 |......H.S.....b.| | d2 5e 92 5b 15 7c f3 b2 82 79 94 1b 2f 88 90 45 |.^.[.|...y../..E| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 25 50 c5 36 e6 fa 6b 21 55 2a 9c d9 4d f3 ae 7e |%P.6..k!U*..M..~| | 26 f1 9e 79 f3 a9 8d 35 44 2f 37 3b 6f 52 34 bf |&..y...5D/7;oR4.| | 25 d3 23 f9 f2 b3 94 e3 a7 ca 28 a0 8a 38 32 e4 |%.#.......(..82.| | b5 c1 cd ba 6b 86 7f 53 c5 69 65 67 00 |....k..S.ieg. | hash out[104]: | 3d eb eb 3e a1 d4 90 b9 c3 0e 06 9d f9 09 02 17 |=..>............| | d8 66 92 05 f4 b2 ce 12 58 2d 7a d3 01 ae 91 7f |.f......X-z.....| | a0 ea 41 cc aa c4 7a 33 d0 a5 84 15 60 02 50 38 |..A...z3....`.P8| | 85 d9 f3 4c 48 c1 21 84 f4 6a a0 86 da 96 f2 ea |...LH.!..j......| | b3 3f 39 01 15 6c 98 31 0f 9f 24 69 29 0f fe 92 |.?9..l.1..$i)...| | 81 53 31 ee 8f b3 c6 ec f9 2e c5 f2 5c a9 1e 78 |.S1.........\..x| | 09 1b c7 2c bd c8 dc 40 |...,...@ | PRF out[104]: | 3d eb eb 3e a1 d4 90 b9 c3 0e 06 9d f9 09 02 17 |=..>............| | d8 66 92 05 f4 b2 ce 12 58 2d 7a d3 01 ae 91 7f |.f......X-z.....| | a0 ea 41 cc aa c4 7a 33 d0 a5 84 15 60 02 50 38 |..A...z3....`.P8| | 85 d9 f3 4c 48 c1 21 84 f4 6a a0 86 da 96 f2 ea |...LH.!..j......| | b3 3f 39 01 15 6c 98 31 0f 9f 24 69 29 0f fe 92 |.?9..l.1..$i)...| | 81 53 31 ee 8f b3 c6 ec f9 2e c5 f2 5c a9 1e 78 |.S1.........\..x| | 09 1b c7 2c bd c8 dc 40 |...,...@ | key expansion[104]: | 3d eb eb 3e a1 d4 90 b9 c3 0e 06 9d f9 09 02 17 |=..>............| | d8 66 92 05 f4 b2 ce 12 58 2d 7a d3 01 ae 91 7f |.f......X-z.....| | a0 ea 41 cc aa c4 7a 33 d0 a5 84 15 60 02 50 38 |..A...z3....`.P8| | 85 d9 f3 4c 48 c1 21 84 f4 6a a0 86 da 96 f2 ea |...LH.!..j......| | b3 3f 39 01 15 6c 98 31 0f 9f 24 69 29 0f fe 92 |.?9..l.1..$i)...| | 81 53 31 ee 8f b3 c6 ec f9 2e c5 f2 5c a9 1e 78 |.S1.........\..x| | 09 1b c7 2c bd c8 dc 40 |...,...@ | Client MAC key[20]: | 3d eb eb 3e a1 d4 90 b9 c3 0e 06 9d f9 09 02 17 |=..>............| | d8 66 92 05 |.f.. | Server MAC key[20]: | f4 b2 ce 12 58 2d 7a d3 01 ae 91 7f a0 ea 41 cc |....X-z.......A.| | aa c4 7a 33 |..z3 | Client Write key[16]: | d0 a5 84 15 60 02 50 38 85 d9 f3 4c 48 c1 21 84 |....`.P8...LH.!.| Server Write key[16]: | f4 6a a0 86 da 96 f2 ea b3 3f 39 01 15 6c 98 31 |.j.......?9..l.1| Client Write IV[16]: | 0f 9f 24 69 29 0f fe 92 81 53 31 ee 8f b3 c6 ec |..$i)....S1.....| Server Write IV[16]: | f9 2e c5 f2 5c a9 1e 78 09 1b c7 2c bd c8 dc 40 |....\..x...,...@| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 0c 30 49 ae 3e 3b b6 d5 12 bf 30 4b 8a 47 76 68 |.0I.>;....0K.Gvh| | 87 91 88 9c ef 14 48 c7 53 e2 e8 a7 c0 1e 62 13 |......H.S.....b.| | d2 5e 92 5b 15 7c f3 b2 82 79 94 1b 2f 88 90 45 |.^.[.|...y../..E| dissect_ssl3_handshake session keys successfully generated record: offset = 107, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 113, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 75 bf 62 a4 f8 a3 56 b2 46 e3 4f 33 64 24 6c 14 |u.b...V.F.O3d$l.| | 0a 6d 35 c1 bf a3 af a7 74 f3 b3 30 d6 44 86 c4 |.m5.....t..0.D..| | c9 21 93 e7 81 4d ee 21 14 d4 1a 9d 9a 73 ea cc |.!...M.!.....s..| | d4 eb d6 9b 5c 25 1e 70 14 41 c9 fe 41 56 8d cd |....\%.p.A..AV..| Plaintext[64]: | 06 2e 78 f0 0f 9d 30 40 95 7d cc a9 0a 24 ee ae |..x...0@.}...$..| | 14 00 00 0c fd bf 9a cb 14 b6 e4 fa 41 e7 ce 8e |............A...| | 75 af 2e 7d 2e 1e 64 13 d2 03 d8 74 42 17 76 33 |u..}..d....tB.v3| | 19 52 ae 9d 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.R..............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 75 af 2e 7d 2e 1e 64 13 d2 03 d8 74 42 17 76 33 |u..}..d....tB.v3| | 19 52 ae 9d |.R.. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #444 (first time) conversation = 0x7facef99b038, ssl_session = 0x7facc38532c0 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | fe a7 fb fd 27 b4 e6 f9 fe 9f d0 10 00 ef b4 c9 |....'...........| | bf 56 37 a3 85 c9 3a 52 36 d8 d0 18 34 62 78 4b |.V7...:R6...4bxK| | f4 c1 8b 32 e0 c0 d0 c5 e9 0f 67 d6 d5 f0 95 87 |...2......g.....| | f3 43 29 31 aa 22 06 8c 33 a6 3f 9a 8e 78 c6 6b |.C)1."..3.?..x.k| Plaintext[64]: | 96 05 18 ca 7c 2a cc 08 9e e0 eb 25 34 bd d3 27 |....|*.....%4..'| | 14 00 00 0c 0c 5a 41 2b ca 34 b9 ed 46 c0 b2 59 |.....ZA+.4..F..Y| | 45 e8 72 39 3c 95 06 b1 2d 09 70 84 ad c6 4e 00 |E.r9<...-.p...N.| | 7a ec 1b bd 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |z...............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 45 e8 72 39 3c 95 06 b1 2d 09 70 84 ad c6 4e 00 |E.r9<...-.p...N.| | 7a ec 1b bd |z... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #445 (first time) conversation = 0x7facef99b038, ssl_session = 0x7facc38532c0 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | eb ea bb c5 42 22 1b cc e7 8f 02 91 b7 9b aa 29 |....B".........)| | 72 26 8b b2 5d c7 ab 4d cb 58 3d 50 59 83 87 71 |r&..]..M.X=PY..q| | b9 f6 f6 61 85 b0 e7 10 c0 70 96 2d 8f 02 4c c4 |...a.....p.-..L.| | 38 a5 7e 09 91 2c e2 1d 35 5f b6 51 02 34 bf 0d |8.~..,..5_.Q.4..| | 19 d4 48 be 21 b2 ec 63 d2 45 13 62 f8 b0 2f 7e |..H.!..c.E.b../~| | 4e bc 75 1d 7b d5 5d 9c 90 2d 8c 1b 6b 74 d5 d7 |N.u.{.]..-..kt..| | a5 b5 d0 08 aa 8a 6c cd ce 61 65 b7 63 25 1a d4 |......l..ae.c%..| Plaintext[112]: | a8 f9 c1 d6 91 b9 6b be 1e 3b c3 72 7e 8d 03 d3 |......k..;.r~...| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa| | 2d 61 65 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 |-aes128-sha.loca| | 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.| | 6e 6c 3a 34 34 38 31 0d 0a 0d 0a f7 ba 44 d4 94 |nl:4481......D..| | f7 4c 3d ce 63 a9 8b 65 06 78 34 5c 9a 32 71 00 |.L=.c..e.x4\.2q.| ssl_decrypt_record found padding 0 final len 111 checking mac (len 75, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | bd a5 61 5a 0a 32 d0 5d 92 e2 aa 5f 2a 84 f7 80 |..aZ.2.]..._*...| | 69 ba 6d bd |i.m. | ssl_decrypt_record: mac failed association_find: TCP port 35291 found (nil) association_find: TCP port 4481 found 0x3430c90 dissect_ssl enter frame #446 (first time) conversation = 0x7facef99b038, ssl_session = 0x7facc38532c0 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | 51 29 df f3 28 35 9a 91 4e 9a b6 35 a4 86 b9 1f |Q)..(5..N..5....| | 31 74 b8 7e 01 31 87 37 bb 07 ec 56 34 a6 d9 c0 |1t.~.1.7...V4...| | ad b8 7e 05 f9 fb d5 93 30 de 14 a1 45 3a 1c db |..~.....0...E:..| | ce bd 04 be 98 32 c7 4f 3b 36 10 54 54 5a 8b 91 |.....2.O;6.TTZ..| | a3 f7 5e 68 1a bd 1e fb 27 f5 ad 59 14 99 8c b0 |..^h....'..Y....| | 60 0c 74 2e bc b6 63 02 c2 3e 9a 76 7f 69 c8 9c |`.t...c..>.v.i..| | 8c 08 e4 1e 98 6e bc 8d 8a fc fa f6 08 0c d2 93 |.....n..........| | 79 e6 62 e4 cb af 18 2f 75 25 b8 11 3e 31 ec ed |y.b..../u%..>1..| | 94 aa b8 d0 d4 78 6f 24 7b 5d 10 1b 9b 3c c2 da |.....xo${]...<..| | 58 31 f9 8c fb 56 a6 ea 7e 3c 6a 53 8d ff 0f b0 |X1...V..~*....k^|@| | 1d 10 73 9e ff c1 7d 8f 2e 35 85 7e 93 5c ce 76 |..s...}..5.~.\.v| | 19 03 83 42 a7 88 d4 18 68 1d e0 42 dc be d1 b1 |...B....h..B....| Plaintext[400]: | bd 10 31 61 37 d4 69 67 18 e6 b7 96 37 2a 27 2a |..1a7.ig....7*'*| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:| | 35 35 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:17 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 30 34 20 2d 20 45 43 44 48 2d |xC0,0x04 - ECDH-| | 45 43 44 53 41 2d 41 45 53 31 32 38 2d 53 48 41 |ECDSA-AES128-SHA| | 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH| | 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E| | 6e 63 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 |nc=AES(128) Mac| | 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1..| | e1 5d 38 8b c0 38 96 65 e2 af 6b 8c a3 fb 93 c9 |.]8..8.e..k.....| | b7 d7 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d |................| ssl_decrypt_record found padding 13 final len 386 checking mac (len 350, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | b3 1a bb 57 65 99 ca b4 9e ef 5e 89 9f 2a fb 4b |...We.....^..*.K| | 26 8c 25 cf |&.%. | ssl_decrypt_record: mac failed association_find: TCP port 4481 found 0x3430c90 dissect_ssl enter frame #447 (first time) conversation = 0x7facef99b038, ssl_session = 0x7facc38532c0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | b4 f5 18 d0 43 34 fe c7 c7 3f 87 73 7d 64 92 bc |....C4...?.s}d..| | 29 a7 d0 ed fd c8 57 54 e2 99 35 74 67 14 f6 b8 |).....WT..5tg...| | a1 b0 c2 83 d6 73 9e ae a7 6c 43 41 78 7d aa c7 |.....s...lCAx}..| Plaintext[48]: | 79 19 51 7f 84 21 f3 17 eb b8 6f f2 fd ef 09 78 |y.Q..!....o....x| | 01 00 0e 5b 36 82 40 dc be 1a 15 e1 67 c3 8b 5d |...[6.@.....g..]| | c8 d9 49 dc 64 ed 09 09 09 09 09 09 09 09 09 09 |..I.d...........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 0e 5b 36 82 40 dc be 1a 15 e1 67 c3 8b 5d c8 d9 |.[6.@.....g..]..| | 49 dc 64 ed |I.d. | ssl_decrypt_record: mac ok dissect_ssl enter frame #449 (first time) conversation = 0x7facef99b038, ssl_session = 0x7facc38532c0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 91 73 4c b2 33 cb e3 ce c5 56 23 76 f1 56 64 a7 |.sL.3....V#v.Vd.| | be f6 34 62 8d 10 41 26 86 a8 61 b9 26 56 33 4d |..4b..A&..a.&V3M| | e9 a1 f3 6a d1 e2 30 5e e2 71 d0 02 10 29 e7 51 |...j..0^.q...).Q| Plaintext[48]: | 18 c7 bd 0c 40 79 14 42 fa b6 c2 2b 19 8f 95 75 |....@y.B...+...u| | 01 00 f8 6a 60 84 77 c4 38 3e 49 38 d0 5d 82 3e |...j`.w.8>I8.].>| | 68 ac f2 86 f9 c4 09 09 09 09 09 09 09 09 09 09 |h...............| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | f8 6a 60 84 77 c4 38 3e 49 38 d0 5d 82 3e 68 ac |.j`.w.8>I8.].>h.| | f2 86 f9 c4 |.... | ssl_decrypt_record: mac ok dissect_ssl enter frame #454 (first time) ssl_session_init: initializing ptr 0x7facc38557a0 size 688 conversation = 0x7facef99b2e0, ssl_session = 0x7facc38557a0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 60875 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4482 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #456 (first time) conversation = 0x7facef99b2e0, ssl_session = 0x7facc38557a0 record: offset = 0, reported_length_remaining = 565 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 66, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0xC005 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 0c 30 49 ae 3e 3b b6 d5 12 bf 30 4b 8a 47 76 68 |.0I.>;....0K.Gvh| | 87 91 88 9c ef 14 48 c7 53 e2 e8 a7 c0 1e 62 13 |......H.S.....b.| | d2 5e 92 5b 15 7c f3 b2 82 79 94 1b 2f 88 90 45 |.^.[.|...y../..E| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 25 80 8d ed eb bd 3b d0 5b 31 a2 1d 90 f8 a9 2a |%.....;.[1.....*| | 66 61 5f 19 52 fa e6 5b d0 65 fd 0a 9f 52 34 bf |fa_.R..[.e...R4.| | 25 dd 94 8c 65 1c 8c f3 3a 31 16 2b b4 23 86 31 |%...e...:1.+.#.1| | 08 c3 77 f8 e9 56 1e b5 3d c5 d5 35 c4 |..w..V..=..5. | hash out[136]: | 51 cd 86 dd 7f f6 35 0b 50 41 3d 55 b1 7f 82 41 |Q.....5.PA=U...A| | 2c 4e d1 9b 57 c3 e6 04 34 c5 29 17 9d 9b 94 76 |,N..W...4.)....v| | 93 05 ad f7 14 85 14 12 5a 11 f6 20 3f 6f 4a ce |........Z.. ?oJ.| | f9 78 07 82 ad f0 1e 12 7d 02 40 44 0e fd 16 b6 |.x......}.@D....| | 07 ae 76 68 8a 19 da 50 02 8f 8d 2c fb 6f 07 e8 |..vh...P...,.o..| | 5f 99 5e c1 8c 62 72 4f 83 cc 33 93 4b b9 89 4c |_.^..brO..3.K..L| | c1 15 1e 38 4b aa 23 cd 7e 18 d1 f6 d1 30 81 2e |...8K.#.~....0..| | 41 6d f8 a9 4d 50 fd 05 d4 70 40 54 21 2b be b6 |Am..MP...p@T!+..| | 11 1e bb 07 67 2b c0 8b |....g+.. | PRF out[136]: | 51 cd 86 dd 7f f6 35 0b 50 41 3d 55 b1 7f 82 41 |Q.....5.PA=U...A| | 2c 4e d1 9b 57 c3 e6 04 34 c5 29 17 9d 9b 94 76 |,N..W...4.)....v| | 93 05 ad f7 14 85 14 12 5a 11 f6 20 3f 6f 4a ce |........Z.. ?oJ.| | f9 78 07 82 ad f0 1e 12 7d 02 40 44 0e fd 16 b6 |.x......}.@D....| | 07 ae 76 68 8a 19 da 50 02 8f 8d 2c fb 6f 07 e8 |..vh...P...,.o..| | 5f 99 5e c1 8c 62 72 4f 83 cc 33 93 4b b9 89 4c |_.^..brO..3.K..L| | c1 15 1e 38 4b aa 23 cd 7e 18 d1 f6 d1 30 81 2e |...8K.#.~....0..| | 41 6d f8 a9 4d 50 fd 05 d4 70 40 54 21 2b be b6 |Am..MP...p@T!+..| | 11 1e bb 07 67 2b c0 8b |....g+.. | key expansion[136]: | 51 cd 86 dd 7f f6 35 0b 50 41 3d 55 b1 7f 82 41 |Q.....5.PA=U...A| | 2c 4e d1 9b 57 c3 e6 04 34 c5 29 17 9d 9b 94 76 |,N..W...4.)....v| | 93 05 ad f7 14 85 14 12 5a 11 f6 20 3f 6f 4a ce |........Z.. ?oJ.| | f9 78 07 82 ad f0 1e 12 7d 02 40 44 0e fd 16 b6 |.x......}.@D....| | 07 ae 76 68 8a 19 da 50 02 8f 8d 2c fb 6f 07 e8 |..vh...P...,.o..| | 5f 99 5e c1 8c 62 72 4f 83 cc 33 93 4b b9 89 4c |_.^..brO..3.K..L| | c1 15 1e 38 4b aa 23 cd 7e 18 d1 f6 d1 30 81 2e |...8K.#.~....0..| | 41 6d f8 a9 4d 50 fd 05 d4 70 40 54 21 2b be b6 |Am..MP...p@T!+..| | 11 1e bb 07 67 2b c0 8b |....g+.. | Client MAC key[20]: | 51 cd 86 dd 7f f6 35 0b 50 41 3d 55 b1 7f 82 41 |Q.....5.PA=U...A| | 2c 4e d1 9b |,N.. | Server MAC key[20]: | 57 c3 e6 04 34 c5 29 17 9d 9b 94 76 93 05 ad f7 |W...4.)....v....| | 14 85 14 12 |.... | Client Write key[32]: | 5a 11 f6 20 3f 6f 4a ce f9 78 07 82 ad f0 1e 12 |Z.. ?oJ..x......| | 7d 02 40 44 0e fd 16 b6 07 ae 76 68 8a 19 da 50 |}.@D......vh...P| Server Write key[32]: | 02 8f 8d 2c fb 6f 07 e8 5f 99 5e c1 8c 62 72 4f |...,.o.._.^..brO| | 83 cc 33 93 4b b9 89 4c c1 15 1e 38 4b aa 23 cd |..3.K..L...8K.#.| Client Write IV[16]: | 7e 18 d1 f6 d1 30 81 2e 41 6d f8 a9 4d 50 fd 05 |~....0..Am..MP..| Server Write IV[16]: | d4 70 40 54 21 2b be b6 11 1e bb 07 67 2b c0 8b |.p@T!+......g+..| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 71, reported_length_remaining = 494 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 480, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556 record: offset = 556, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 561 length 0 bytes, remaining 565 dissect_ssl enter frame #458 (first time) conversation = 0x7facef99b2e0, ssl_session = 0x7facc38557a0 record: offset = 0, reported_length_remaining = 182 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 102, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 98 bytes, remaining 107 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9... looking for RSA pre-master61040104fe730d1a5fed30a8d6f3f23fa1cc83517c116595... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2550c536e6fa6b21552a9cd94df3ae7e26f19e79f3a98d35442f373b6f 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25808dedebbd3bd05b31a21d90f8a92a66615f1952fae65bd065fd0a9f 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9561eb53dc5d535c4 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 05 10 e9 e2 7a 95 d0 0e 69 51 79 2b 35 87 d8 2d |....z...iQy+5..-| | aa 7c 21 87 b1 6f bd 52 81 d2 d3 18 f9 df 7a a5 |.|!..o.R......z.| | 5c 58 6a a9 38 ce 34 6a f7 89 13 01 9d 5f d3 20 |\Xj.8.4j....._. | tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 25 80 8d ed eb bd 3b d0 5b 31 a2 1d 90 f8 a9 2a |%.....;.[1.....*| | 66 61 5f 19 52 fa e6 5b d0 65 fd 0a 9f 52 34 bf |fa_.R..[.e...R4.| | 25 dd 94 8c 65 1c 8c f3 3a 31 16 2b b4 23 86 31 |%...e...:1.+.#.1| | 08 c3 77 f8 e9 56 1e b5 3d c5 d5 35 c4 |..w..V..=..5. | hash out[136]: | fd af 1d 89 26 c0 cc 98 24 86 bb cf d7 49 ff 73 |....&...$....I.s| | a1 02 55 0b 94 eb 19 d9 bb bb b2 a8 e9 2c cf d5 |..U..........,..| | b6 22 25 d4 60 8d e5 fc 97 38 49 5f 2f d1 9b 02 |."%.`....8I_/...| | 02 11 91 0c 14 6e 3c 66 cf aa a7 1d 85 d3 cf 35 |.....nY....Os| | 15 0d b1 77 a1 23 4c 7e 1a b5 a1 6c 08 35 aa 7b |...w.#L~...l.5.{| Plaintext[64]: | 96 07 63 c8 08 b0 ca 4d 5f f3 8d 51 45 7a c4 80 |..c....M_..QEz..| | 14 00 00 0c 76 c0 c9 7f 9f 3e 1d ac 8b 12 f3 ad |....v....>......| | d8 52 55 fe 4e 30 ff d8 b9 ae 30 55 93 cb 01 6b |.RU.N0....0U...k| | 24 e3 eb f6 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |$...............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | d8 52 55 fe 4e 30 ff d8 b9 ae 30 55 93 cb 01 6b |.RU.N0....0U...k| | 24 e3 eb f6 |$... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #459 (first time) conversation = 0x7facef99b2e0, ssl_session = 0x7facc38557a0 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 3b 02 8e 3c 38 7b 10 1e 56 20 c3 41 f7 53 ce 1a |;..<8{..V .A.S..| | 22 dd 49 2b 41 16 15 a6 dd 23 6b 19 ec f1 8a 97 |".I+A....#k.....| | 47 01 07 39 75 59 66 08 29 a5 a0 80 88 29 d1 a8 |G..9uYf.)....)..| | 14 9f b7 c5 8d c6 6d c4 c6 b3 06 e1 b5 c3 19 d7 |......m.........| Plaintext[64]: | db 1c 72 a8 c1 f7 b8 d5 b2 07 b7 62 c6 b6 67 f5 |..r........b..g.| | 14 00 00 0c 5b ef 6b 9d 33 f4 75 91 a0 45 9a 52 |....[.k.3.u..E.R| | ce 16 59 45 7a b3 77 78 07 69 b6 85 14 47 5d 48 |..YEz.wx.i...G]H| | 42 d2 ae 05 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |B...............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | ce 16 59 45 7a b3 77 78 07 69 b6 85 14 47 5d 48 |..YEz.wx.i...G]H| | 42 d2 ae 05 |B... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #460 (first time) conversation = 0x7facef99b2e0, ssl_session = 0x7facc38557a0 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | 6f ec f7 59 0d 5f 81 c6 b5 28 80 83 ba 82 4b ff |o..Y._...(....K.| | 3e 6a a8 24 23 3b b2 ee bd 37 a3 c5 69 42 22 f8 |>j.$#;...7..iB".| | c0 6d d5 cc 87 24 db fb 30 7a 00 89 55 c9 df 02 |.m...$..0z..U...| | 9f 56 52 08 e6 ed bd 42 71 86 2c da 00 f6 95 34 |.VR....Bq.,....4| | ec f7 3c f7 a4 f9 c5 26 f5 b6 ca 7d d4 dc f9 91 |..<....&...}....| | cf 3b 5a be 7c 4f dc 7b 3c 5a 30 90 87 22 4d d9 |.;Z.|O.{..<.2| | a9 00 f6 b9 e2 86 cf 0d 42 39 7f fa 16 9a 3a 38 |........B9....:8| | 43 6e 3d 39 9c f9 88 c5 dd f1 b6 a7 56 6a 17 54 |Cn=9........Vj.T| | 50 ea c5 9b c8 79 7c 80 14 4e 46 21 6d 32 ad 84 |P....y|..NF!m2..| | 1a 5a 80 0f 9b d6 f7 90 a1 ff 93 1e 5a d5 1c 10 |.Z..........Z...| | 69 35 0a 23 67 8e d9 30 fb 86 3b b4 0a 71 f1 09 |i5.#g..0..;..q..| | 31 70 54 0f 28 bc 3d b3 29 bc ce 5a 4e 25 5f e9 |1pT.(.=.)..ZN%_.| | 02 e3 e2 fc 6f 3f 7e 55 3d 51 51 4e 18 7d 0f d5 |....o?~U=QQN.}..| | 43 51 e4 b8 be 97 9d be 9e dd 54 4e e6 d6 ad ab |CQ........TN....| | 82 96 5c a7 ca 9d 58 8a 75 e9 2d 34 87 73 93 f9 |..\...X.u.-4.s..| | 4d 5e f5 87 3b 8d 4a 77 92 7f 8a 91 38 63 e1 df |M^..;.Jw....8c..| | e2 dc 58 c9 55 47 5b 18 1f 5d 0a 71 f9 7d 63 2c |..X.UG[..].q.}c,| | ea 98 44 b3 fc a0 3a 8b 5e 3b 0e e3 7e 1c d4 7b |..D...:.^;..~..{| | a0 0f 3b 33 80 65 c1 f6 47 e1 64 fc 03 dd 3c 3f |..;3.e..G.d...doc| | 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f |ument.domain='lo| | 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey| | 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e c7 50 |n.nl'.P| | 4f 0f 5d 32 96 72 59 0c 4a 96 c0 71 3e 0f a7 d5 |O.]2.rY.J..q>...| | 43 de 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d |C...............| ssl_decrypt_record found padding 13 final len 386 checking mac (len 350, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 03 16 0b 97 e0 f2 a8 38 51 1d f8 c8 2c 3c bf 6a |.......8Q...,<.j| | 8c 98 39 82 |..9. | ssl_decrypt_record: mac failed association_find: TCP port 4482 found 0x3430d20 dissect_ssl enter frame #462 (first time) conversation = 0x7facef99b2e0, ssl_session = 0x7facc38557a0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 26 4b 3b 3b 40 da a9 bd a1 cc 9f fd 77 f8 65 9f |&K;;@.......w.e.| | 04 0e bf fe de 3c de 88 64 dc 1e 4f 73 b8 ca 21 |.....<..d..Os..!| | 03 62 21 37 1e f3 57 bb 05 e3 96 b5 c8 48 7a b3 |.b!7..W......Hz.| Plaintext[48]: | 9c bc 84 c1 65 72 ae 5c 32 75 23 89 82 51 c2 e8 |....er.\2u#..Q..| | 01 00 81 64 71 ae b5 b2 b9 41 08 0a 64 e3 1c 35 |...dq....A..d..5| | cb 76 01 3f b4 7b 09 09 09 09 09 09 09 09 09 09 |.v.?.{..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 81 64 71 ae b5 b2 b9 41 08 0a 64 e3 1c 35 cb 76 |.dq....A..d..5.v| | 01 3f b4 7b |.?.{ | ssl_decrypt_record: mac ok dissect_ssl enter frame #464 (first time) conversation = 0x7facef99b2e0, ssl_session = 0x7facc38557a0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 6a d1 a6 c4 76 79 0a 8d a3 9f af 8e a1 19 03 fb |j...vy..........| | 7c 8c ea aa ec e5 0e 34 7d 50 05 be 3d 25 c9 cc ||......4}P..=%..| | ba 01 0d 55 c8 8c 27 63 a5 e3 62 8d b5 51 87 94 |...U..'c..b..Q..| Plaintext[48]: | 92 71 31 33 22 30 f4 d8 1b c0 37 46 c9 89 53 ef |.q13"0....7F..S.| | 01 00 dd 34 a5 a3 bd 69 e8 61 84 cb 09 20 b2 68 |...4...i.a... .h| | 6d 95 ba 01 56 05 09 09 09 09 09 09 09 09 09 09 |m...V...........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | dd 34 a5 a3 bd 69 e8 61 84 cb 09 20 b2 68 6d 95 |.4...i.a... .hm.| | ba 01 56 05 |..V. | ssl_decrypt_record: mac ok dissect_ssl enter frame #469 (first time) ssl_session_init: initializing ptr 0x7facc3857c80 size 688 conversation = 0x7facef99b588, ssl_session = 0x7facc3857c80 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 42810 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4483 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #471 (first time) conversation = 0x7facef99b588, ssl_session = 0x7facc3857c80 record: offset = 0, reported_length_remaining = 751 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 66, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0xC007 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 05 10 e9 e2 7a 95 d0 0e 69 51 79 2b 35 87 d8 2d |....z...iQy+5..-| | aa 7c 21 87 b1 6f bd 52 81 d2 d3 18 f9 df 7a a5 |.|!..o.R......z.| | 5c 58 6a a9 38 ce 34 6a f7 89 13 01 9d 5f d3 20 |\Xj.8.4j....._. | tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 25 be cb 55 c6 ba dc 80 91 52 b9 ad 79 ee 35 c3 |%..U.....R..y.5.| | c4 b2 ff 61 cb c0 9a 02 5d 1b 12 45 53 52 34 bf |...a....]..ESR4.| | 25 36 41 17 b6 4e 6c d3 32 95 37 71 73 08 7b 12 |%6A..Nl.2.7qs.{.| | dc f7 b8 17 99 d0 88 12 3c bc c2 77 46 |........<..wF | hash out[72]: | 87 8c 83 a0 77 53 8b f7 13 8e d2 05 91 9d 02 95 |....wS..........| | 07 70 ab b9 18 b0 ec 7c 33 dd ea f4 94 60 a3 9c |.p.....|3....`..| | 51 2b 22 a4 3c 72 eb fa 43 ec cd 46 4e 23 94 49 |Q+".h...| | d1 a0 74 82 |..t. | Plaintext[36]: | 14 00 00 0c ee 62 f1 67 47 d3 1d da cf 2c 7d 1c |.....b.gG....,}.| | 3f c2 a4 ec 7a 1b b5 16 3e 0c 6f ca 18 cc 60 cd |?...z...>.o...`.| | 11 fa 61 d8 |..a. | checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 3f c2 a4 ec 7a 1b b5 16 3e 0c 6f ca 18 cc 60 cd |?...z...>.o...`.| | 11 fa 61 d8 |..a. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #474 (first time) conversation = 0x7facef99b588, ssl_session = 0x7facc3857c80 record: offset = 0, reported_length_remaining = 222 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 47 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 41 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 36, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 36 Ciphertext[36]: | ba 97 7a 31 c8 e9 66 87 80 47 3a ab 1b 9f 70 89 |..z1..f..G:...p.| | 31 e8 64 10 0d d4 e8 4d 82 87 45 16 58 c0 b0 9c |1.d....M..E.X...| | 4a 3e 52 fa |J>R. | Plaintext[36]: | 14 00 00 0c e0 e7 60 19 fa 1f 79 0c c8 60 ab 81 |......`...y..`..| | 07 48 84 a6 eb c8 f8 4a 57 e1 16 c8 27 f0 88 fa |.H.....JW...'...| | b5 3f 9b 01 |.?.. | checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 07 48 84 a6 eb c8 f8 4a 57 e1 16 c8 27 f0 88 fa |.H.....JW...'...| | b5 3f 9b 01 |.?.. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #475 (first time) conversation = 0x7facef99b588, ssl_session = 0x7facc3857c80 record: offset = 0, reported_length_remaining = 98 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 93, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 93 Ciphertext[93]: | d4 c9 e6 1e 68 aa a0 94 f4 bc 84 fd a7 95 7b 3b |....h.........{;| | 02 b1 7a bf 65 57 a5 31 d1 e1 e9 6c 37 da 0a c4 |..z.eW.1...l7...| | 08 c0 3a dd c1 d3 67 07 d5 8c 1b dd d7 06 d3 43 |..:...g........C| | ef 53 04 36 cc c1 1a 3b 28 a3 2a 3c 77 cd 48 d8 |.S.6...;(.*docu| | 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 |ment.domain='loc| | 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn| | 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 7d 92 d3 |.nl'}..| | 03 69 9e 5b 68 86 cf e6 eb bd 43 f0 59 7d 08 33 |.i.[h.....C.Y}.3| | 3b |; | checking mac (len 349, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 7d 92 d3 03 69 9e 5b 68 86 cf e6 eb bd 43 f0 59 |}...i.[h.....C.Y| | 7d 08 33 3b |}.3; | ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 349, seq = 0, nxtseq = 349 association_find: TCP port 4483 found 0x3430db0 dissect_ssl3_record decrypted len 349 decrypted app data fragment[349]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:| | 35 35 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:17 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 32 0d 0a 43 6f 6e 6e 65 63 74 |th: 142..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 30 37 20 2d 20 45 43 44 48 45 |xC0,0x07 - ECDHE| | 2d 45 43 44 53 41 2d 52 43 34 2d 53 48 41 20 20 |-ECDSA-RC4-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH| | 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 6e | Au=ECDSA En| | 63 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d |c=RC4(128) Mac=| | 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 |SHA1 | dissect_ssl3_record found association 0x3430db0 dissect_ssl enter frame #477 (first time) conversation = 0x7facef99b588, ssl_session = 0x7facc3857c80 record: offset = 0, reported_length_remaining = 27 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 22, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 22 Ciphertext[22]: | 91 eb 41 55 a6 69 2b b3 b8 d0 ab 4f b5 37 f4 cf |..AU.i+....O.7..| | 67 c0 18 15 f2 d7 |g..... | Plaintext[22]: | 01 00 b3 72 3d 19 41 db 4e 37 4b 91 75 e7 a7 d9 |...r=.A.N7K.u...| | 56 c8 92 fc 14 eb |V..... | checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | b3 72 3d 19 41 db 4e 37 4b 91 75 e7 a7 d9 56 c8 |.r=.A.N7K.u...V.| | 92 fc 14 eb |.... | ssl_decrypt_record: mac ok dissect_ssl enter frame #479 (first time) conversation = 0x7facef99b588, ssl_session = 0x7facc3857c80 record: offset = 0, reported_length_remaining = 27 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 22, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 22 Ciphertext[22]: | 17 04 df 10 8e cf b7 65 de 05 75 56 3a 9f 8c 4d |.......e..uV:..M| | b4 31 49 a5 bf 33 |.1I..3 | Plaintext[22]: | 01 00 75 37 2b d5 78 bc f0 9d f8 f5 2c 27 01 e3 |..u7+.x.....,'..| | 90 4c 2d ce d1 3c |.L-..< | checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 75 37 2b d5 78 bc f0 9d f8 f5 2c 27 01 e3 90 4c |u7+.x.....,'...L| | 2d ce d1 3c |-..< | ssl_decrypt_record: mac ok dissect_ssl enter frame #484 (first time) ssl_session_init: initializing ptr 0x7facc385a590 size 688 conversation = 0x7facef99b8e0, ssl_session = 0x7facc385a590 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 36532 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4484 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #486 (first time) conversation = 0x7facef99b8e0, ssl_session = 0x7facc385a590 record: offset = 0, reported_length_remaining = 749 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 66, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0xC008 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 6f 30 ea c9 06 18 43 84 a4 d0 48 03 39 db 0a 88 |o0....C...H.9...| | 11 ee 7c 09 45 4b f8 19 a8 03 bf 82 3b f3 ff ef |..|.EK......;...| | 60 a8 b0 47 ea 71 e3 66 c5 0f af f1 84 dc b2 59 |`..G.q.f.......Y| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 26 63 75 18 a1 69 ea 50 83 57 47 1e b7 43 54 10 |&cu..i.P.WG..CT.| | 58 0c ac 52 59 b1 d9 6a 75 21 53 a1 90 52 34 bf |X..RY..ju!S..R4.| | 26 4e 71 d4 63 88 17 c3 e3 1b ea ef 04 7e fe 0b |&Nq.c........~..| | 65 a6 4c 7c f5 a8 7a b0 39 b4 09 0e 7a |e.L|..z.9...z | hash out[104]: | 3c eb 91 77 4b 5f 4d c7 8b 16 76 39 0d 6b 24 2a |<..wK_M...v9.k$*| | 21 2a 52 36 27 51 df fd 26 07 ed 9a e8 84 a5 e3 |!*R6'Q..&.......| | e7 93 f5 c1 a8 e6 6d bd 41 ff f5 14 86 0c 83 e0 |......m.A.......| | 4f 0c 8f 83 c7 ac ad d2 a7 3a bb 09 da 06 16 21 |O........:.....!| | 50 3e ba e2 93 fe 40 9f 1b ca b4 9d 04 e7 18 4d |P>....@........M| | cf e0 d6 d1 fa e0 39 52 ce a2 aa 3c ec 47 fa de |......9R...<.G..| | 4a c6 7e b0 e4 2d 68 dc |J.~..-h. | PRF out[104]: | 3c eb 91 77 4b 5f 4d c7 8b 16 76 39 0d 6b 24 2a |<..wK_M...v9.k$*| | 21 2a 52 36 27 51 df fd 26 07 ed 9a e8 84 a5 e3 |!*R6'Q..&.......| | e7 93 f5 c1 a8 e6 6d bd 41 ff f5 14 86 0c 83 e0 |......m.A.......| | 4f 0c 8f 83 c7 ac ad d2 a7 3a bb 09 da 06 16 21 |O........:.....!| | 50 3e ba e2 93 fe 40 9f 1b ca b4 9d 04 e7 18 4d |P>....@........M| | cf e0 d6 d1 fa e0 39 52 ce a2 aa 3c ec 47 fa de |......9R...<.G..| | 4a c6 7e b0 e4 2d 68 dc |J.~..-h. | key expansion[104]: | 3c eb 91 77 4b 5f 4d c7 8b 16 76 39 0d 6b 24 2a |<..wK_M...v9.k$*| | 21 2a 52 36 27 51 df fd 26 07 ed 9a e8 84 a5 e3 |!*R6'Q..&.......| | e7 93 f5 c1 a8 e6 6d bd 41 ff f5 14 86 0c 83 e0 |......m.A.......| | 4f 0c 8f 83 c7 ac ad d2 a7 3a bb 09 da 06 16 21 |O........:.....!| | 50 3e ba e2 93 fe 40 9f 1b ca b4 9d 04 e7 18 4d |P>....@........M| | cf e0 d6 d1 fa e0 39 52 ce a2 aa 3c ec 47 fa de |......9R...<.G..| | 4a c6 7e b0 e4 2d 68 dc |J.~..-h. | Client MAC key[20]: | 3c eb 91 77 4b 5f 4d c7 8b 16 76 39 0d 6b 24 2a |<..wK_M...v9.k$*| | 21 2a 52 36 |!*R6 | Server MAC key[20]: | 27 51 df fd 26 07 ed 9a e8 84 a5 e3 e7 93 f5 c1 |'Q..&...........| | a8 e6 6d bd |..m. | Client Write key[24]: | 41 ff f5 14 86 0c 83 e0 4f 0c 8f 83 c7 ac ad d2 |A.......O.......| | a7 3a bb 09 da 06 16 21 |.:.....! | Server Write key[24]: | 50 3e ba e2 93 fe 40 9f 1b ca b4 9d 04 e7 18 4d |P>....@........M| | cf e0 d6 d1 fa e0 39 52 |......9R | Client Write IV[8]: | ce a2 aa 3c ec 47 fa de |...<.G.. | Server Write IV[8]: | 4a c6 7e b0 e4 2d 68 dc |J.~..-h. | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 71, reported_length_remaining = 678 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 480, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556 record: offset = 556, reported_length_remaining = 193 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 179, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 561 length 175 bytes, remaining 740 record: offset = 740, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 745 length 0 bytes, remaining 749 dissect_ssl enter frame #488 (first time) conversation = 0x7facef99b8e0, ssl_session = 0x7facc385a590 record: offset = 0, reported_length_remaining = 134 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 70, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf264e71d4638817c3e31beaef047efe0b65a64c7cf5... looking for RSA pre-master41048d81014331c4904f5fb9f90ff4fb8410ee7d7640b337... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2550c536e6fa6b21552a9cd94df3ae7e26f19e79f3a98d35442f373b6f 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25808dedebbd3bd05b31a21d90f8a92a66615f1952fae65bd065fd0a9f 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9561eb53dc5d535c4 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25becb55c6badc809152b9ad79ee35c3c4b2ff61cbc09a025d1b124553 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25364117b64e6cd33295377173087b12dcf7b81799d088123cbcc27746 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf264e71d4638817c3e31beaef047efe0b65a64c7cf5a87ab039b4090e7a 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 7f e2 cb 3e 30 76 72 29 b5 11 af c5 32 6b 71 1d |...>0vr)....2kq.| | 1f 62 de 94 c3 22 cb 25 55 6a 95 2c f1 4c 83 86 |.b...".%Uj.,.L..| | db 1b 73 26 81 7a a8 fb a6 b3 0b 9c db b0 3b d2 |..s&.z........;.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 26 63 75 18 a1 69 ea 50 83 57 47 1e b7 43 54 10 |&cu..i.P.WG..CT.| | 58 0c ac 52 59 b1 d9 6a 75 21 53 a1 90 52 34 bf |X..RY..ju!S..R4.| | 26 4e 71 d4 63 88 17 c3 e3 1b ea ef 04 7e fe 0b |&Nq.c........~..| | 65 a6 4c 7c f5 a8 7a b0 39 b4 09 0e 7a |e.L|..z.9...z | hash out[104]: | cd 2b fc 05 5a 6e a0 26 0e c6 f4 f2 95 fa 02 5e |.+..Zn.&.......^| | ef 49 27 42 d9 c4 d7 39 99 61 e5 fe af 74 2e 63 |.I'B...9.a...t.c| | 6d 28 dc c8 c6 e7 2f a0 66 54 12 d7 09 08 36 b8 |m(..../.fT....6.| | ba b7 e8 7b b3 88 e5 8b 8d e3 4c 2c bf 71 5c 88 |...{......L,.q\.| | 90 77 12 e6 8c cf dc 8d 2c dc a2 02 50 9a 40 7e |.w......,...P.@~| | c9 ed 03 44 f9 5b e6 10 11 da ea a9 d6 e1 bb 0e |...D.[..........| | 32 09 fc eb 05 43 4c 35 |2....CL5 | PRF out[104]: | cd 2b fc 05 5a 6e a0 26 0e c6 f4 f2 95 fa 02 5e |.+..Zn.&.......^| | ef 49 27 42 d9 c4 d7 39 99 61 e5 fe af 74 2e 63 |.I'B...9.a...t.c| | 6d 28 dc c8 c6 e7 2f a0 66 54 12 d7 09 08 36 b8 |m(..../.fT....6.| | ba b7 e8 7b b3 88 e5 8b 8d e3 4c 2c bf 71 5c 88 |...{......L,.q\.| | 90 77 12 e6 8c cf dc 8d 2c dc a2 02 50 9a 40 7e |.w......,...P.@~| | c9 ed 03 44 f9 5b e6 10 11 da ea a9 d6 e1 bb 0e |...D.[..........| | 32 09 fc eb 05 43 4c 35 |2....CL5 | key expansion[104]: | cd 2b fc 05 5a 6e a0 26 0e c6 f4 f2 95 fa 02 5e |.+..Zn.&.......^| | ef 49 27 42 d9 c4 d7 39 99 61 e5 fe af 74 2e 63 |.I'B...9.a...t.c| | 6d 28 dc c8 c6 e7 2f a0 66 54 12 d7 09 08 36 b8 |m(..../.fT....6.| | ba b7 e8 7b b3 88 e5 8b 8d e3 4c 2c bf 71 5c 88 |...{......L,.q\.| | 90 77 12 e6 8c cf dc 8d 2c dc a2 02 50 9a 40 7e |.w......,...P.@~| | c9 ed 03 44 f9 5b e6 10 11 da ea a9 d6 e1 bb 0e |...D.[..........| | 32 09 fc eb 05 43 4c 35 |2....CL5 | Client MAC key[20]: | cd 2b fc 05 5a 6e a0 26 0e c6 f4 f2 95 fa 02 5e |.+..Zn.&.......^| | ef 49 27 42 |.I'B | Server MAC key[20]: | d9 c4 d7 39 99 61 e5 fe af 74 2e 63 6d 28 dc c8 |...9.a...t.cm(..| | c6 e7 2f a0 |../. | Client Write key[24]: | 66 54 12 d7 09 08 36 b8 ba b7 e8 7b b3 88 e5 8b |fT....6....{....| | 8d e3 4c 2c bf 71 5c 88 |..L,.q\. | Server Write key[24]: | 90 77 12 e6 8c cf dc 8d 2c dc a2 02 50 9a 40 7e |.w......,...P.@~| | c9 ed 03 44 f9 5b e6 10 |...D.[.. | Client Write IV[8]: | 11 da ea a9 d6 e1 bb 0e |........ | Server Write IV[8]: | 32 09 fc eb 05 43 4c 35 |2....CL5 | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 7f e2 cb 3e 30 76 72 29 b5 11 af c5 32 6b 71 1d |...>0vr)....2kq.| | 1f 62 de 94 c3 22 cb 25 55 6a 95 2c f1 4c 83 86 |.b...".%Uj.,.L..| | db 1b 73 26 81 7a a8 fb a6 b3 0b 9c db b0 3b d2 |..s&.z........;.| dissect_ssl3_handshake session keys successfully generated record: offset = 75, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 81, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 3d 5c 24 34 49 df 11 1f 88 f8 10 8d 0c 45 a5 85 |=\$4I........E..| | 81 b9 4c 0c d0 92 93 8b 48 7e 99 79 6b 97 85 e5 |..L.....H~.yk...| | e7 06 29 f4 93 43 18 cc a8 17 f6 ba 81 74 b4 e1 |..)..C.......t..| Plaintext[48]: | 6d f5 51 62 95 30 1e 66 14 00 00 0c bb 70 ed f7 |m.Qb.0.f.....p..| | 9c 48 f1 8c bc be 44 cd 25 95 cf e3 9d 53 c3 f1 |.H....D.%....S..| | b7 64 e1 da 31 60 a0 9e f7 12 5f 15 03 03 03 03 |.d..1`...._.....| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 25 95 cf e3 9d 53 c3 f1 b7 64 e1 da 31 60 a0 9e |%....S...d..1`..| | f7 12 5f 15 |.._. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #489 (first time) conversation = 0x7facef99b8e0, ssl_session = 0x7facc385a590 record: offset = 0, reported_length_remaining = 234 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 43 75 06 06 0c e5 61 8f e4 8a 5f 4e 2d a3 7d 00 |Cu....a..._N-.}.| | 6b 91 2e ee 8a ff 12 b4 97 99 26 f4 4d d1 f2 9d |k.........&.M...| | 66 82 b7 b6 9d a3 8e b8 11 ca c9 59 07 04 df 6e |f..........Y...n| Plaintext[48]: | ff de 57 1b 17 2e 9e 0f 14 00 00 0c 99 9d 64 0a |..W...........d.| | 48 ce 30 75 fb 26 7e d7 52 ce 51 aa bf 46 80 eb |H.0u.&~.R.Q..F..| | df 86 20 e0 ba b4 dd 5b 8f 48 c2 e8 03 03 03 03 |.. ....[.H......| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 52 ce 51 aa bf 46 80 eb df 86 20 e0 ba b4 dd 5b |R.Q..F.... ....[| | 8f 48 c2 e8 |.H.. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #490 (first time) conversation = 0x7facef99b8e0, ssl_session = 0x7facc385a590 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | 1b 72 0f a2 1b 36 0a 91 7b e8 d7 a1 da c8 e7 ad |.r...6..{.......| | 23 c4 12 6f a6 4b 79 97 7c 4a ab 09 fe 7f 20 3d |#..o.Ky.|J.... =| | 98 af 7d 9d f6 43 b0 54 73 66 90 e2 51 7a 88 19 |..}..C.Tsf..Qz..| | a2 77 8f 09 a8 f2 47 97 cc 6a 42 cc d2 62 ae cf |.w....G..jB..b..| | 1e 64 d7 98 42 1f 19 25 91 90 b3 0d 36 06 2e 95 |.d..B..%....6...| | a5 8a 15 91 ff 21 2b b0 dd 96 68 d5 f0 ad 7b b1 |.....!+...h...{.| | f1 24 a2 59 ac a2 51 e4 8c 0f 34 ab 06 9f 23 9b |.$.Y..Q...4...#.| Plaintext[112]: | 59 6e f5 de 2b 6a 5e 58 47 45 54 20 2f 20 48 54 |Yn..+j^XGET / HT| | 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 63 |TP/1.1..Host: ec| | 64 68 65 2d 65 63 64 73 61 2d 64 65 73 2d 63 62 |dhe-ecdsa-des-cb| | 63 33 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e |c3-sha.local.al.| | 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 |lekensteyn.nl:44| | 38 34 0d 0a 0d 0a b7 ce 64 82 ec 01 38 20 f5 c5 |84......d...8 ..| | d0 ac 05 85 fb 66 c6 01 69 05 05 05 05 05 05 05 |.....f..i.......| ssl_decrypt_record found padding 5 final len 106 checking mac (len 78, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 1d 9c 0c af ee b0 17 71 c8 d9 42 c5 de d8 da 9c |.......q..B.....| | ba 10 6d 30 |..m0 | ssl_decrypt_record: mac failed association_find: TCP port 36532 found (nil) association_find: TCP port 4484 found 0x3430e40 dissect_ssl enter frame #491 (first time) conversation = 0x7facef99b8e0, ssl_session = 0x7facc385a590 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | 6d 94 19 90 42 6f 88 28 fa 85 6d 21 d1 f3 86 8a |m...Bo.(..m!....| | d6 fd e9 1a c8 e0 dc d0 df 46 06 27 49 cf 54 aa |.........F.'I.T.| | 2d 17 6e 00 db 2a 4f b4 74 9e fb 95 9b 26 34 f9 |-.n..*O.t....&4.| | 06 8d f6 0f 3f 5a bd 56 06 65 32 2b 64 89 6c fa |....?Z.V.e2+d.l.| | de e9 fa 35 e7 46 b7 f5 aa cd c9 b5 0a c5 40 c1 |...5.F........@.| | 16 33 47 90 c7 cd 37 e6 68 ca 6d 4f cc 1f 18 d0 |.3G...7.h.mO....| | 8b 33 48 a0 22 b4 92 3d 2e 83 d7 0b 25 e0 f3 28 |.3H."..=....%..(| | d8 33 b4 0c 9a 9f f6 42 23 73 5c 24 c1 54 d0 29 |.3.....B#s\$.T.)| | 83 26 4e 77 80 11 e6 b2 4a 05 32 08 68 4e 8a f8 |.&Nw....J.2.hN..| | ce 4d 89 1e 2e 91 84 2c cf f1 3e ae 4e 54 55 68 |.M.....,..>.NTUh| | 1b f0 2e c9 52 38 79 49 09 b6 6e 28 aa 69 29 05 |....R8yI..n(.i).| | 76 79 f1 99 72 d0 68 cf 07 0b 44 b5 62 fc ea 2f |vy..r.h...D.b../| | cc 2d 63 6d 5e 40 a9 de b4 40 bd 5a 21 7f 72 9a |.-cm^@...@.Z!.r.| | dc f3 a1 59 1f b5 49 f5 57 ce 59 ba 21 58 3c 35 |...Y..I.W.Y.!X<5| | a0 b8 85 c1 70 a5 29 8b dc 7e 4d 75 7a b9 21 67 |....p.)..~Muz.!g| | 86 0f 14 9c 48 62 3f 4f 53 91 8e 06 fa 92 b0 22 |....Hb?OS......"| | fd b1 37 2e 41 9d 0e 82 d3 a8 c3 46 7d 8c 46 40 |..7.A......F}.F@| | f7 cd a5 eb f4 02 c4 58 1c 73 12 e7 eb 76 bd 18 |.......X.s...v..| | 2c 8a 23 36 47 38 94 fd 43 88 3a 9c ca 46 28 bc |,.#6G8..C.:..F(.| | c5 11 38 dd e1 ae 73 15 a3 42 74 55 6e 27 0c aa |..8...s..BtUn'..| | 2d 51 4c 8d c9 f6 21 b5 42 71 a4 9a 8c 02 45 5d |-QL...!.Bq....E]| | 60 24 27 7c 73 c9 91 30 21 c2 db 28 db cc a3 2d |`$'|s..0!..(...-| | 1a b0 f1 8e 73 dd 20 fe cd 7e ea 3f 10 d2 f0 b7 |....s. ..~.?....| | 3b 72 3b 36 a1 25 be d7 2d bc 44 20 ca b9 0b d0 |;r;6.%..-.D ....| Plaintext[384]: | 6d f2 a3 0b 4f c4 20 03 48 54 54 50 2f 31 2e 31 |m...O. .HTTP/1.1| | 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:| | 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da| | 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep | | 32 30 31 33 20 31 39 3a 35 35 3a 31 38 20 47 4d |2013 19:55:18 GM| | 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:| | 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont| | 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 33 0d |ent-Length: 143.| | 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo| | 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu| | 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00| | 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach| | 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca| | 63 68 65 0d 0a 0d 0a 30 78 43 30 2c 30 78 30 38 |che....0xC0,0x08| | 20 2d 20 45 43 44 48 45 2d 45 43 44 53 41 2d 44 | - ECDHE-ECDSA-D| | 45 53 2d 43 42 43 33 2d 53 48 41 20 53 53 4c 76 |ES-CBC3-SHA SSLv| | 33 20 4b 78 3d 45 43 44 48 20 20 20 20 20 41 75 |3 Kx=ECDH Au| | 3d 45 43 44 53 41 20 45 6e 63 3d 33 44 45 53 28 |=ECDSA Enc=3DES(| | 31 36 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 |168) Mac=SHA1document.do| | 6d 61 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c |main='local.al.l| | 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 |ekensteyn.nl'.......Pt#| | 81 e8 8e fb af 96 08 a4 5f 21 05 05 05 05 05 05 |........_!......| ssl_decrypt_record found padding 5 final len 378 checking mac (len 350, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 4d c3 3e 6b cd b7 cd 8c 19 ad f8 6a f1 a8 cf d2 |M.>k.......j....| | 48 4f 77 04 |HOw. | ssl_decrypt_record: mac failed association_find: TCP port 4484 found 0x3430e40 dissect_ssl enter frame #492 (first time) conversation = 0x7facef99b8e0, ssl_session = 0x7facc385a590 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 3e b9 b5 3b 53 b8 6f 54 a7 a1 36 2f 24 01 77 5d |>..;S.oT..6/$.w]| | 5b f0 43 e4 8b 64 cf 85 82 41 27 f9 b0 12 64 0c |[.C..d...A'...d.| Plaintext[32]: | 7c e1 7e ef 91 21 98 ed 01 00 fd 03 a8 5e 8e 9c ||.~..!.......^..| | 1d f3 0f b0 18 94 c3 db d5 07 29 fc dc 09 01 01 |..........).....| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | fd 03 a8 5e 8e 9c 1d f3 0f b0 18 94 c3 db d5 07 |...^............| | 29 fc dc 09 |)... | ssl_decrypt_record: mac ok dissect_ssl enter frame #494 (first time) conversation = 0x7facef99b8e0, ssl_session = 0x7facc385a590 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | c4 53 be c4 c4 03 1e 8c d4 fa 9a fa 70 f1 25 85 |.S..........p.%.| | 64 be b1 7e b1 c8 0d 02 8f 24 b2 9f 6f 6e 4f f1 |d..~.....$..onO.| Plaintext[32]: | 29 86 58 2a f2 ef 5d a1 01 00 27 c7 2b d9 6e ff |).X*..]...'.+.n.| | 81 21 3f f5 a6 6b 6f 13 45 f6 10 5e cd 36 01 01 |.!?..ko.E..^.6..| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 27 c7 2b d9 6e ff 81 21 3f f5 a6 6b 6f 13 45 f6 |'.+.n..!?..ko.E.| | 10 5e cd 36 |.^.6 | ssl_decrypt_record: mac ok dissect_ssl enter frame #499 (first time) ssl_session_init: initializing ptr 0x7facc385ca50 size 688 conversation = 0x7facef99bb88, ssl_session = 0x7facc385ca50 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 39630 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4485 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #501 (first time) conversation = 0x7facef99bb88, ssl_session = 0x7facc385ca50 record: offset = 0, reported_length_remaining = 750 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 66, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0xC009 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 7f e2 cb 3e 30 76 72 29 b5 11 af c5 32 6b 71 1d |...>0vr)....2kq.| | 1f 62 de 94 c3 22 cb 25 55 6a 95 2c f1 4c 83 86 |.b...".%Uj.,.L..| | db 1b 73 26 81 7a a8 fb a6 b3 0b 9c db b0 3b d2 |..s&.z........;.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 26 71 56 d7 fa 01 ff 15 62 7d 9b 9a ce 03 51 1c |&qV.....b}....Q.| | a7 df de 84 61 af f9 71 20 c4 fd d3 87 52 34 bf |....a..q ....R4.| | 26 77 b4 93 f8 e1 66 8f 05 35 c7 c5 61 25 77 1b |&w....f..5..a%w.| | 4a 55 b7 33 38 ea 0f f7 72 1a 67 e2 98 |JU.38...r.g.. | hash out[104]: | 6b 95 91 3e 25 56 8e a7 3d 58 96 cd 66 51 bb c0 |k..>%V..=X..fQ..| | 70 0e f8 d8 5f 7b 09 f4 a0 80 af 85 b7 b5 b2 90 |p..._{..........| | 3b 3e 90 da a0 28 68 bb 68 d0 95 37 99 0f 50 ed |;>...(h.h..7..P.| | 75 c1 f5 07 50 4b fa 1b e0 3b 62 1a 65 5b 9a e0 |u...PK...;b.e[..| | 91 47 fd b6 2b c7 ab f4 b4 e8 d8 92 28 9d d8 f5 |.G..+.......(...| | 18 e0 7f 31 43 c1 20 4a bd 18 be 1d 6d 00 7f c9 |...1C. J....m...| | 26 c7 57 9e 42 9d 83 ef |&.W.B... | PRF out[104]: | 6b 95 91 3e 25 56 8e a7 3d 58 96 cd 66 51 bb c0 |k..>%V..=X..fQ..| | 70 0e f8 d8 5f 7b 09 f4 a0 80 af 85 b7 b5 b2 90 |p..._{..........| | 3b 3e 90 da a0 28 68 bb 68 d0 95 37 99 0f 50 ed |;>...(h.h..7..P.| | 75 c1 f5 07 50 4b fa 1b e0 3b 62 1a 65 5b 9a e0 |u...PK...;b.e[..| | 91 47 fd b6 2b c7 ab f4 b4 e8 d8 92 28 9d d8 f5 |.G..+.......(...| | 18 e0 7f 31 43 c1 20 4a bd 18 be 1d 6d 00 7f c9 |...1C. J....m...| | 26 c7 57 9e 42 9d 83 ef |&.W.B... | key expansion[104]: | 6b 95 91 3e 25 56 8e a7 3d 58 96 cd 66 51 bb c0 |k..>%V..=X..fQ..| | 70 0e f8 d8 5f 7b 09 f4 a0 80 af 85 b7 b5 b2 90 |p..._{..........| | 3b 3e 90 da a0 28 68 bb 68 d0 95 37 99 0f 50 ed |;>...(h.h..7..P.| | 75 c1 f5 07 50 4b fa 1b e0 3b 62 1a 65 5b 9a e0 |u...PK...;b.e[..| | 91 47 fd b6 2b c7 ab f4 b4 e8 d8 92 28 9d d8 f5 |.G..+.......(...| | 18 e0 7f 31 43 c1 20 4a bd 18 be 1d 6d 00 7f c9 |...1C. J....m...| | 26 c7 57 9e 42 9d 83 ef |&.W.B... | Client MAC key[20]: | 6b 95 91 3e 25 56 8e a7 3d 58 96 cd 66 51 bb c0 |k..>%V..=X..fQ..| | 70 0e f8 d8 |p... | Server MAC key[20]: | 5f 7b 09 f4 a0 80 af 85 b7 b5 b2 90 3b 3e 90 da |_{..........;>..| | a0 28 68 bb |.(h. | Client Write key[16]: | 68 d0 95 37 99 0f 50 ed 75 c1 f5 07 50 4b fa 1b |h..7..P.u...PK..| Server Write key[16]: | e0 3b 62 1a 65 5b 9a e0 91 47 fd b6 2b c7 ab f4 |.;b.e[...G..+...| Client Write IV[16]: | b4 e8 d8 92 28 9d d8 f5 18 e0 7f 31 43 c1 20 4a |....(......1C. J| Server Write IV[16]: | bd 18 be 1d 6d 00 7f c9 26 c7 57 9e 42 9d 83 ef |....m...&.W.B...| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 71, reported_length_remaining = 679 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 480, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556 record: offset = 556, reported_length_remaining = 194 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 180, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 561 length 176 bytes, remaining 741 record: offset = 741, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 746 length 0 bytes, remaining 750 dissect_ssl enter frame #503 (first time) conversation = 0x7facef99bb88, ssl_session = 0x7facc385ca50 record: offset = 0, reported_length_remaining = 150 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 70, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf2677b493f8e1668f0535c7c56125771b4a55b73338... looking for RSA pre-master41045172346374c18ca3903255dc325746d328a62dbde1b4... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2550c536e6fa6b21552a9cd94df3ae7e26f19e79f3a98d35442f373b6f 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25808dedebbd3bd05b31a21d90f8a92a66615f1952fae65bd065fd0a9f 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9561eb53dc5d535c4 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25becb55c6badc809152b9ad79ee35c3c4b2ff61cbc09a025d1b124553 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25364117b64e6cd33295377173087b12dcf7b81799d088123cbcc27746 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf264e71d4638817c3e31beaef047efe0b65a64c7cf5a87ab039b4090e7a 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf26637518a169ea508357471eb7435410580cac5259b1d96a752153a190 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf267156d7fa01ff15627d9b9ace03511ca7dfde8461aff97120c4fdd387 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2677b493f8e1668f0535c7c56125771b4a55b73338ea0ff7721a67e298 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 91 80 a8 30 a0 bc 0a 0e 18 47 25 44 e7 5c 31 ea |...0.....G%D.\1.| | 26 e5 4c e5 52 11 e0 24 c1 96 da ae c1 45 7c 6b |&.L.R..$.....E|k| | 2e 73 89 77 87 82 af e0 e8 63 a8 cc 88 bf 81 2d |.s.w.....c.....-| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 26 71 56 d7 fa 01 ff 15 62 7d 9b 9a ce 03 51 1c |&qV.....b}....Q.| | a7 df de 84 61 af f9 71 20 c4 fd d3 87 52 34 bf |....a..q ....R4.| | 26 77 b4 93 f8 e1 66 8f 05 35 c7 c5 61 25 77 1b |&w....f..5..a%w.| | 4a 55 b7 33 38 ea 0f f7 72 1a 67 e2 98 |JU.38...r.g.. | hash out[104]: | 85 22 9f 30 ce b8 fa b1 53 f9 d4 1c c8 59 bc c9 |.".0....S....Y..| | 3c ce 6b f0 30 ee 49 3c fb d8 10 c7 05 7c 13 79 |<.k.0.I<.....|.y| | 3c 91 60 64 2a 4e ed e4 de d9 bd 5c e4 4d 4e 87 |<.`d*N.....\.MN.| | 7e a9 5a 6f 5b ac 18 dc 28 1a 17 90 36 80 46 0e |~.Zo[...(...6.F.| | fb 4a 5a e3 73 e9 15 48 1b d9 94 9e 81 f9 25 43 |.JZ.s..H......%C| | 8f 95 5b af 06 3f 77 63 14 7d 70 82 74 85 5c a5 |..[..?wc.}p.t.\.| | 96 e3 19 07 78 39 33 4d |....x93M | PRF out[104]: | 85 22 9f 30 ce b8 fa b1 53 f9 d4 1c c8 59 bc c9 |.".0....S....Y..| | 3c ce 6b f0 30 ee 49 3c fb d8 10 c7 05 7c 13 79 |<.k.0.I<.....|.y| | 3c 91 60 64 2a 4e ed e4 de d9 bd 5c e4 4d 4e 87 |<.`d*N.....\.MN.| | 7e a9 5a 6f 5b ac 18 dc 28 1a 17 90 36 80 46 0e |~.Zo[...(...6.F.| | fb 4a 5a e3 73 e9 15 48 1b d9 94 9e 81 f9 25 43 |.JZ.s..H......%C| | 8f 95 5b af 06 3f 77 63 14 7d 70 82 74 85 5c a5 |..[..?wc.}p.t.\.| | 96 e3 19 07 78 39 33 4d |....x93M | key expansion[104]: | 85 22 9f 30 ce b8 fa b1 53 f9 d4 1c c8 59 bc c9 |.".0....S....Y..| | 3c ce 6b f0 30 ee 49 3c fb d8 10 c7 05 7c 13 79 |<.k.0.I<.....|.y| | 3c 91 60 64 2a 4e ed e4 de d9 bd 5c e4 4d 4e 87 |<.`d*N.....\.MN.| | 7e a9 5a 6f 5b ac 18 dc 28 1a 17 90 36 80 46 0e |~.Zo[...(...6.F.| | fb 4a 5a e3 73 e9 15 48 1b d9 94 9e 81 f9 25 43 |.JZ.s..H......%C| | 8f 95 5b af 06 3f 77 63 14 7d 70 82 74 85 5c a5 |..[..?wc.}p.t.\.| | 96 e3 19 07 78 39 33 4d |....x93M | Client MAC key[20]: | 85 22 9f 30 ce b8 fa b1 53 f9 d4 1c c8 59 bc c9 |.".0....S....Y..| | 3c ce 6b f0 |<.k. | Server MAC key[20]: | 30 ee 49 3c fb d8 10 c7 05 7c 13 79 3c 91 60 64 |0.I<.....|.y<.`d| | 2a 4e ed e4 |*N.. | Client Write key[16]: | de d9 bd 5c e4 4d 4e 87 7e a9 5a 6f 5b ac 18 dc |...\.MN.~.Zo[...| Server Write key[16]: | 28 1a 17 90 36 80 46 0e fb 4a 5a e3 73 e9 15 48 |(...6.F..JZ.s..H| Client Write IV[16]: | 1b d9 94 9e 81 f9 25 43 8f 95 5b af 06 3f 77 63 |......%C..[..?wc| Server Write IV[16]: | 14 7d 70 82 74 85 5c a5 96 e3 19 07 78 39 33 4d |.}p.t.\.....x93M| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 91 80 a8 30 a0 bc 0a 0e 18 47 25 44 e7 5c 31 ea |...0.....G%D.\1.| | 26 e5 4c e5 52 11 e0 24 c1 96 da ae c1 45 7c 6b |&.L.R..$.....E|k| | 2e 73 89 77 87 82 af e0 e8 63 a8 cc 88 bf 81 2d |.s.w.....c.....-| dissect_ssl3_handshake session keys successfully generated record: offset = 75, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 81, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | a1 c1 46 05 29 05 f5 ed 80 3e 6d ca cb 26 66 be |..F.)....>m..&f.| | 56 90 62 c8 0b ee 38 91 71 c0 2f ca 8d ae 03 ad |V.b...8.q./.....| | b8 1f cb d8 62 a8 51 54 1f 95 e7 15 4b 90 7f e2 |....b.QT....K...| | f8 bf b8 9e 8b 0e f8 b6 fe d7 5f f7 18 1a 3b 60 |.........._...;`| Plaintext[64]: | 26 7d a6 22 45 f3 c6 ce 4d 75 84 3f 92 8d 57 ef |&}."E...Mu.?..W.| | 14 00 00 0c 39 8f f6 d9 2c 21 01 78 43 1b 26 fa |....9...,!.xC.&.| | e0 da 79 2a c4 14 00 0c 14 61 15 0a 07 66 56 fd |..y*.....a...fV.| | 98 8a 85 a2 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | e0 da 79 2a c4 14 00 0c 14 61 15 0a 07 66 56 fd |..y*.....a...fV.| | 98 8a 85 a2 |.... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #504 (first time) conversation = 0x7facef99bb88, ssl_session = 0x7facc385ca50 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 06 45 ae f9 af 1a 81 4d 26 c4 63 c7 fd 3e b3 9c |.E.....M&.c..>..| | 16 d6 0f a2 95 bf 75 0d 5a 4b c4 df 06 8b 0e 99 |......u.ZK......| | 8f 0e 9b 9b fc e8 2f 5c 8e ba 9b 8a 49 3e 93 51 |....../\....I>.Q| | cc 6f 0e 9a 18 2a 46 5e 9e 10 4e ab f2 bb fe d9 |.o...*F^..N.....| Plaintext[64]: | 94 0e 11 48 51 3a 0b 9b 94 a9 43 7d 3f a3 70 69 |...HQ:....C}?.pi| | 14 00 00 0c a1 2f 1b 1f a6 87 0e e7 1d 08 05 fe |...../..........| | 4c cb 7a 61 12 8b e5 bc 76 2a fd 27 fc 9a 54 a2 |L.za....v*.'..T.| | ff 9e 5b 03 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..[.............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 4c cb 7a 61 12 8b e5 bc 76 2a fd 27 fc 9a 54 a2 |L.za....v*.'..T.| | ff 9e 5b 03 |..[. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #505 (first time) conversation = 0x7facef99bb88, ssl_session = 0x7facc385ca50 record: offset = 0, reported_length_remaining = 133 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 128, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 128 Ciphertext[128]: | 5b 32 33 80 67 98 f0 77 14 da 1d 98 43 59 16 49 |[23.g..w....CY.I| | 27 ae 49 2f aa 89 7a 77 a2 1f 2b cb 24 ff 93 ea |'.I/..zw..+.$...| | 5e ca 07 b9 1f 4e d7 f7 6d 53 d9 2d d2 e9 4b bf |^....N..mS.-..K.| | 8d 44 eb 28 52 b0 2a 36 a9 0b a8 2e 32 3b 59 13 |.D.(R.*6....2;Y.| | a2 1c 8d 6f 42 c2 1c ab 75 14 9d 48 04 a0 03 2c |...oB...u..H...,| | 95 00 d7 14 4e d3 3f 52 d1 52 3c ff 86 e6 f4 8d |....N.?R.R<.....| | f0 60 83 8b 85 19 18 04 26 4f 84 94 44 e4 3e 6a |.`......&O..D.>j| | 1b c3 17 25 cf b5 30 fd db b2 5b 6a cf df c6 32 |...%..0...[j...2| Plaintext[128]: | c5 d0 f3 8a f6 92 89 0d 9d cd 43 41 14 4f f7 39 |..........CA.O.9| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds| | 61 2d 61 65 73 31 32 38 2d 73 68 61 2e 6c 6f 63 |a-aes128-sha.loc| | 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn| | 2e 6e 6c 3a 34 34 38 35 0d 0a 0d 0a 70 fc 2f d0 |.nl:4485....p./.| | d4 f6 49 2f 5a 35 1f 26 6f c9 a2 65 45 72 90 f4 |..I/Z5.&o..eEr..| | 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................| ssl_decrypt_record found padding 15 final len 112 checking mac (len 76, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 76 79 ac e0 65 55 32 b8 45 8b db 31 7f be 3a 0e |vy..eU2.E..1..:.| | 1d 9f a0 95 |.... | ssl_decrypt_record: mac failed association_find: TCP port 39630 found (nil) association_find: TCP port 4485 found 0x3430ed0 dissect_ssl enter frame #506 (first time) conversation = 0x7facef99bb88, ssl_session = 0x7facc385ca50 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | 80 7c 26 53 16 c3 6f fa 4e b1 0b 83 19 e9 6a 3b |.|&S..o.N.....j;| | 34 08 c9 54 17 b9 fd 53 6e b1 9a 45 3a b0 55 33 |4..T...Sn..E:.U3| | 98 8a b8 47 30 35 a9 5c a3 19 25 ec 6b 12 17 70 |...G05.\..%.k..p| | 8c a5 ba de b5 b1 11 2e 89 6c 4a 19 87 cc 08 9d |.........lJ.....| | 25 6e c1 d2 1f 13 92 e7 bc 2a 23 6c 19 13 a0 59 |%n.......*#l...Y| | 6e d2 a3 30 fc 64 6f b3 c2 d6 ec eb 00 e3 4e b5 |n..0.do.......N.| | 38 b3 83 34 f7 f4 26 c2 be 46 7d d0 35 8c 75 5d |8..4..&..F}.5.u]| | f8 9e 69 07 88 8f ae b6 9d 9f fb 93 c5 7e 73 a5 |..i..........~s.| | 5c 0f 90 f9 39 18 81 b5 c6 7a 6e 8c 2d 30 6c 54 |\...9....zn.-0lT| | f4 3e 0a 0d 56 82 e5 bb 73 32 a5 e9 0d ce f0 f4 |.>..V...s2......| | 0a d2 07 ad cd a8 db 9d c2 4b ff 28 ac d1 7d 82 |.........K.(..}.| | b3 52 7f 3b 4b ac 27 70 78 93 db 07 c6 25 1b dc |.R.;K.'px....%..| | 0a bc 8d 10 c2 5e d1 a1 3d 76 1b bf da dd a2 63 |.....^..=v.....c| | 86 94 60 2a 00 b4 68 c1 54 ba 3b 1a 57 0f 2e 7b |..`*..h.T.;.W..{| | 46 bf 89 03 67 b5 8f 79 f2 90 61 94 c9 d3 a7 cd |F...g..y..a.....| | d8 32 b0 33 e0 12 52 a8 fe dc 04 2d 3e aa 4e e9 |.2.3..R....->.N.| | 89 8e cd 7b 80 76 4b 34 22 8d 78 4d b9 d9 a9 fa |...{.vK4".xM....| | 80 34 c8 b0 8d 5c 91 4d 4a 07 b7 1d f2 46 02 8b |.4...\.MJ....F..| | 90 fb 2d a7 b1 5d 92 a9 e4 10 e5 a4 c3 0a 34 a9 |..-..]........4.| | 03 53 e5 a2 8a f0 82 82 01 49 3b b7 96 7b 89 10 |.S.......I;..{..| | 08 5e 75 bb 91 99 7f e1 1a 0e bc f4 ae 29 01 73 |.^u..........).s| | cf e4 88 fa 50 a5 ed de 9f b6 83 67 b7 45 38 ea |....P......g.E8.| | 55 62 b0 81 bc 38 68 02 20 a2 70 05 62 89 8c 17 |Ub...8h. .p.b...| | d8 1d 68 b4 3d fe 15 de 59 8a 65 18 8c c6 62 8f |..h.=...Y.e...b.| | 74 5f 66 de 21 aa 2e 9e d2 74 cf 40 88 4e 8e cf |t_f.!....t.@.N..| Plaintext[400]: | c2 cc 2a 67 87 4f 81 bd 18 26 5e ff da 38 7a 91 |..*g.O...&^..8z.| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:| | 35 35 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:18 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 32 0d 0a 43 6f 6e 6e 65 63 74 |th: 142..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 30 39 20 2d 20 45 43 44 48 45 |xC0,0x09 - ECDHE| | 2d 45 43 44 53 41 2d 41 45 53 31 32 38 2d 53 48 |-ECDSA-AES128-SH| | 41 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 |A SSLv3 Kx=ECDH| | 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 6e | Au=ECDSA En| | 63 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d |c=AES(128) Mac=| | 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 |SHA1...| | e4 76 39 2a 21 64 9d 41 ff 81 7d 27 6d 78 21 57 |.v9*!d.A..}'mx!W| | 62 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |b...............| ssl_decrypt_record found padding 14 final len 385 checking mac (len 349, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | a4 04 59 eb b1 ac 1c 11 b4 8d 3f d2 9e e1 12 28 |..Y.......?....(| | 81 3b 8d 4c |.;.L | ssl_decrypt_record: mac failed association_find: TCP port 4485 found 0x3430ed0 dissect_ssl enter frame #507 (first time) conversation = 0x7facef99bb88, ssl_session = 0x7facc385ca50 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 9b 73 db fb 73 23 d2 0b 97 1e 94 d4 94 08 41 dd |.s..s#........A.| | 8c c4 ce b2 35 79 cd 87 fb 7c d9 f7 9a 56 5c 5d |....5y...|...V\]| | ea 9c ca 29 31 d4 17 28 69 0f 68 7c a5 7c 53 98 |...)1..(i.h|.|S.| Plaintext[48]: | 44 6d 88 f1 45 a7 2a 3a c3 43 d1 5a e3 f0 57 ac |Dm..E.*:.C.Z..W.| | 01 00 0c 9c 89 8e 10 6c 5b 1a 77 f5 ce 0c 8f 76 |.......l[.w....v| | 42 ce 86 fd 85 5d 09 09 09 09 09 09 09 09 09 09 |B....]..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 0c 9c 89 8e 10 6c 5b 1a 77 f5 ce 0c 8f 76 42 ce |.....l[.w....vB.| | 86 fd 85 5d |...] | ssl_decrypt_record: mac ok dissect_ssl enter frame #509 (first time) conversation = 0x7facef99bb88, ssl_session = 0x7facc385ca50 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | d8 50 4e 35 32 91 d7 a2 c0 7b 48 ef 68 c7 10 96 |.PN52....{H.h...| | 51 8d ba a7 e0 7c 9e 68 81 77 98 05 03 d1 3c 23 |Q....|.h.w....<#| | a9 cf 2a 08 d6 f4 41 76 61 51 f0 72 52 ac 07 19 |..*...AvaQ.rR...| Plaintext[48]: | f3 bd 87 f6 5f f2 79 05 bd 9c 06 19 18 e8 5c 0b |...._.y.......\.| | 01 00 62 77 fc 01 b2 af 45 00 f8 2a 23 37 7d 42 |..bw....E..*#7}B| | a3 e6 b2 7d 45 40 09 09 09 09 09 09 09 09 09 09 |...}E@..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 62 77 fc 01 b2 af 45 00 f8 2a 23 37 7d 42 a3 e6 |bw....E..*#7}B..| | b2 7d 45 40 |.}E@ | ssl_decrypt_record: mac ok dissect_ssl enter frame #514 (first time) ssl_session_init: initializing ptr 0x7facc385ef50 size 688 conversation = 0x7facef99be30, ssl_session = 0x7facc385ef50 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 48166 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4486 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #516 (first time) conversation = 0x7facef99be30, ssl_session = 0x7facc385ef50 record: offset = 0, reported_length_remaining = 750 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 66, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0xC00A -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 91 80 a8 30 a0 bc 0a 0e 18 47 25 44 e7 5c 31 ea |...0.....G%D.\1.| | 26 e5 4c e5 52 11 e0 24 c1 96 da ae c1 45 7c 6b |&.L.R..$.....E|k| | 2e 73 89 77 87 82 af e0 e8 63 a8 cc 88 bf 81 2d |.s.w.....c.....-| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 26 1d 17 49 82 95 63 01 08 6e d9 2b ab 07 d2 cb |&..I..c..n.+....| | c2 f3 00 87 8f 81 35 45 61 98 f1 f4 38 52 34 bf |......5Ea...8R4.| | 26 21 49 16 45 7a 4a c3 9d 83 2c 5c e1 ab ea 41 |&!I.EzJ...,\...A| | 1f 00 f2 39 be 71 bd c0 87 f9 a3 72 32 |...9.q.....r2 | hash out[136]: | e3 f3 e2 0c 2d 74 31 71 97 9a 15 5e 63 99 07 51 |....-t1q...^c..Q| | 56 f2 6a 06 1a a2 cb 38 01 0c 3d 7c 1e 29 26 b2 |V.j....8..=|.)&.| | c7 ee 3a a3 2f 06 1a 65 59 34 80 fb ff 4c c1 43 |..:./..eY4...L.C| | a3 55 f7 15 9d 0a 10 96 bb 94 4a e9 92 33 cd 95 |.U........J..3..| | e8 ae 8c be 72 3d b8 5b 7e 8c 72 8d bf 83 96 02 |....r=.[~.r.....| | 5d 79 1a 77 ba 1d de e7 9c 85 d9 ca 6c 8d cd 09 |]y.w........l...| | 12 0e 6a 7f 1e 30 50 98 dc 8f 0c 1a 3f 47 0b cb |..j..0P.....?G..| | 9d 8a 7c a0 95 18 ae 73 e4 d8 e8 c1 f0 2d da 72 |..|....s.....-.r| | ce aa a9 e7 91 d5 16 7a |.......z | PRF out[136]: | e3 f3 e2 0c 2d 74 31 71 97 9a 15 5e 63 99 07 51 |....-t1q...^c..Q| | 56 f2 6a 06 1a a2 cb 38 01 0c 3d 7c 1e 29 26 b2 |V.j....8..=|.)&.| | c7 ee 3a a3 2f 06 1a 65 59 34 80 fb ff 4c c1 43 |..:./..eY4...L.C| | a3 55 f7 15 9d 0a 10 96 bb 94 4a e9 92 33 cd 95 |.U........J..3..| | e8 ae 8c be 72 3d b8 5b 7e 8c 72 8d bf 83 96 02 |....r=.[~.r.....| | 5d 79 1a 77 ba 1d de e7 9c 85 d9 ca 6c 8d cd 09 |]y.w........l...| | 12 0e 6a 7f 1e 30 50 98 dc 8f 0c 1a 3f 47 0b cb |..j..0P.....?G..| | 9d 8a 7c a0 95 18 ae 73 e4 d8 e8 c1 f0 2d da 72 |..|....s.....-.r| | ce aa a9 e7 91 d5 16 7a |.......z | key expansion[136]: | e3 f3 e2 0c 2d 74 31 71 97 9a 15 5e 63 99 07 51 |....-t1q...^c..Q| | 56 f2 6a 06 1a a2 cb 38 01 0c 3d 7c 1e 29 26 b2 |V.j....8..=|.)&.| | c7 ee 3a a3 2f 06 1a 65 59 34 80 fb ff 4c c1 43 |..:./..eY4...L.C| | a3 55 f7 15 9d 0a 10 96 bb 94 4a e9 92 33 cd 95 |.U........J..3..| | e8 ae 8c be 72 3d b8 5b 7e 8c 72 8d bf 83 96 02 |....r=.[~.r.....| | 5d 79 1a 77 ba 1d de e7 9c 85 d9 ca 6c 8d cd 09 |]y.w........l...| | 12 0e 6a 7f 1e 30 50 98 dc 8f 0c 1a 3f 47 0b cb |..j..0P.....?G..| | 9d 8a 7c a0 95 18 ae 73 e4 d8 e8 c1 f0 2d da 72 |..|....s.....-.r| | ce aa a9 e7 91 d5 16 7a |.......z | Client MAC key[20]: | e3 f3 e2 0c 2d 74 31 71 97 9a 15 5e 63 99 07 51 |....-t1q...^c..Q| | 56 f2 6a 06 |V.j. | Server MAC key[20]: | 1a a2 cb 38 01 0c 3d 7c 1e 29 26 b2 c7 ee 3a a3 |...8..=|.)&...:.| | 2f 06 1a 65 |/..e | Client Write key[32]: | 59 34 80 fb ff 4c c1 43 a3 55 f7 15 9d 0a 10 96 |Y4...L.C.U......| | bb 94 4a e9 92 33 cd 95 e8 ae 8c be 72 3d b8 5b |..J..3......r=.[| Server Write key[32]: | 7e 8c 72 8d bf 83 96 02 5d 79 1a 77 ba 1d de e7 |~.r.....]y.w....| | 9c 85 d9 ca 6c 8d cd 09 12 0e 6a 7f 1e 30 50 98 |....l.....j..0P.| Client Write IV[16]: | dc 8f 0c 1a 3f 47 0b cb 9d 8a 7c a0 95 18 ae 73 |....?G....|....s| Server Write IV[16]: | e4 d8 e8 c1 f0 2d da 72 ce aa a9 e7 91 d5 16 7a |.....-.r.......z| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 71, reported_length_remaining = 679 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 480, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556 record: offset = 556, reported_length_remaining = 194 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 180, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 561 length 176 bytes, remaining 741 record: offset = 741, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 746 length 0 bytes, remaining 750 dissect_ssl enter frame #518 (first time) conversation = 0x7facef99be30, ssl_session = 0x7facc385ef50 record: offset = 0, reported_length_remaining = 150 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 70, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf26214916457a4ac39d832c5ce1abea411f00f239be... looking for RSA pre-master4104b796016af771dcad1b81edf48ced974e752bb098d260... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2550c536e6fa6b21552a9cd94df3ae7e26f19e79f3a98d35442f373b6f 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25808dedebbd3bd05b31a21d90f8a92a66615f1952fae65bd065fd0a9f 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9561eb53dc5d535c4 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25becb55c6badc809152b9ad79ee35c3c4b2ff61cbc09a025d1b124553 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25364117b64e6cd33295377173087b12dcf7b81799d088123cbcc27746 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf264e71d4638817c3e31beaef047efe0b65a64c7cf5a87ab039b4090e7a 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf26637518a169ea508357471eb7435410580cac5259b1d96a752153a190 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf267156d7fa01ff15627d9b9ace03511ca7dfde8461aff97120c4fdd387 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2677b493f8e1668f0535c7c56125771b4a55b73338ea0ff7721a67e298 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf261d174982956301086ed92bab07d2cbc2f300878f8135456198f1f438 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf26214916457a4ac39d832c5ce1abea411f00f239be71bdc087f9a37232 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | f1 97 4f 79 aa 4a 7f 5d 01 c0 fa 24 a8 00 09 88 |..Oy.J.]...$....| | 01 5e 47 5e 5d b4 2b 6e 88 f4 07 aa 4a a0 b9 9a |.^G^].+n....J...| | d3 a5 57 ae 70 d4 cb a7 96 68 76 00 68 34 af 19 |..W.p....hv.h4..| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 26 1d 17 49 82 95 63 01 08 6e d9 2b ab 07 d2 cb |&..I..c..n.+....| | c2 f3 00 87 8f 81 35 45 61 98 f1 f4 38 52 34 bf |......5Ea...8R4.| | 26 21 49 16 45 7a 4a c3 9d 83 2c 5c e1 ab ea 41 |&!I.EzJ...,\...A| | 1f 00 f2 39 be 71 bd c0 87 f9 a3 72 32 |...9.q.....r2 | hash out[136]: | d0 d3 8d 47 e7 60 f6 c6 f4 7a 8b f9 d7 fe 37 d5 |...G.`...z....7.| | bc 4a a8 6f b6 e2 92 c4 17 69 b3 25 5d 46 37 5b |.J.o.....i.%]F7[| | f1 51 46 3b 24 1f 78 a2 8c 5e 82 f8 36 d9 cc d4 |.QF;$.x..^..6...| | 4b 68 c3 9a 9d 9c 65 27 6a 77 21 6f d4 1f bb a1 |Kh....e'jw!o....| | b7 a8 0b 46 29 40 15 fb 61 e5 49 42 45 85 53 7d |...F)@..a.IBE.S}| | 78 75 a5 b3 43 2a c6 21 07 67 38 71 eb 7a 9c 14 |xu..C*.!.g8q.z..| | 07 e5 24 a8 3c 59 7d c0 89 34 b2 12 41 71 87 62 |..$..| | 14 00 00 0c 93 d9 61 28 a3 1f a7 bd 3e 31 8f 93 |......a(....>1..| | 45 a9 4a 29 49 80 d3 14 78 90 23 35 aa b2 69 2f |E.J)I...x.#5..i/| | c7 f4 14 8f 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 45 a9 4a 29 49 80 d3 14 78 90 23 35 aa b2 69 2f |E.J)I...x.#5..i/| | c7 f4 14 8f |.... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #519 (first time) conversation = 0x7facef99be30, ssl_session = 0x7facc385ef50 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 28 2b 33 59 8b 05 e9 31 60 30 04 e6 27 d6 05 54 |(+3Y...1`0..'..T| | 4d e8 27 61 c1 68 43 f4 1f 1c 6c a5 e0 44 b5 49 |M.'a.hC...l..D.I| | 39 d5 0e 3e dc 4f 3e fe 8a ad 6a 81 ee f9 73 7d |9..>.O>...j...s}| | c4 75 1a a9 f9 92 72 28 68 5c 3c ca 15 a8 81 a1 |.u....r(h\<.....| Plaintext[64]: | d0 f2 0d ac 72 be 66 e9 83 17 40 ff c5 20 41 3f |....r.f...@.. A?| | 14 00 00 0c d2 d3 c7 2e be 8c 5e 86 fd 6b 31 20 |..........^..k1 | | 78 64 aa 67 e8 2d 60 9d 66 24 78 4e 4d 89 67 dd |xd.g.-`.f$xNM.g.| | b0 d5 b5 c7 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 78 64 aa 67 e8 2d 60 9d 66 24 78 4e 4d 89 67 dd |xd.g.-`.f$xNM.g.| | b0 d5 b5 c7 |.... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #520 (first time) conversation = 0x7facef99be30, ssl_session = 0x7facc385ef50 record: offset = 0, reported_length_remaining = 133 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 128, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 128 Ciphertext[128]: | c1 6c b4 be 02 d2 8d d8 8a 0d 25 5b 7f 2c b1 c4 |.l........%[.,..| | 0d f0 82 4c d6 d0 bf d5 55 5c 4f e1 8a 2d 37 06 |...L....U\O..-7.| | 30 17 d8 ba 48 e3 36 71 3b 80 a7 83 1f fe e9 7f |0...H.6q;.......| | 2f 91 f0 1a f3 8a 49 75 a6 0e 3e b2 de 50 40 fb |/.....Iu..>..P@.| | 59 eb 72 f7 fb 80 e7 d6 05 16 26 0f a9 fa 5b e5 |Y.r.......&...[.| | 31 3d 99 0e f8 be ae 23 79 3b 5f 7e d9 25 1b b9 |1=.....#y;_~.%..| | 7d 02 de 29 20 d6 6b 64 90 b0 7e f8 99 5b 4c c2 |}..) .kd..~..[L.| | a7 60 fa 58 b6 d5 56 dd b2 cf 49 bd 67 8b 37 b4 |.`.X..V...I.g.7.| Plaintext[128]: | 2a 6b 15 42 04 6d 93 85 dd 8b f9 e3 dc 29 af 36 |*k.B.m.......).6| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds| | 61 2d 61 65 73 32 35 36 2d 73 68 61 2e 6c 6f 63 |a-aes256-sha.loc| | 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn| | 2e 6e 6c 3a 34 34 38 36 0d 0a 0d 0a ef c9 47 c8 |.nl:4486......G.| | c3 10 9c 61 c5 26 54 1d 13 0e 12 d5 61 2c 0c 21 |...a.&T.....a,.!| | 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................| ssl_decrypt_record found padding 15 final len 112 checking mac (len 76, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 95 66 5b 10 09 6d db 3e c2 bf a6 a1 e2 87 54 d1 |.f[..m.>......T.| | 70 e6 bf 5b |p..[ | ssl_decrypt_record: mac failed association_find: TCP port 48166 found (nil) association_find: TCP port 4486 found 0x3430f60 dissect_ssl enter frame #521 (first time) conversation = 0x7facef99be30, ssl_session = 0x7facc385ef50 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | e5 c4 9c c4 15 61 f8 ff fd 42 16 fc 66 51 d1 49 |.....a...B..fQ.I| | 5b 8b ae eb 95 d1 b2 7d 28 b5 7e 16 43 24 42 b8 |[......}(.~.C$B.| | a2 00 7b 87 2a 66 a7 b8 79 72 61 8f 58 0d 5b 5d |..{.*f..yra.X.[]| | 13 a3 4f 0c 64 a5 df 8a 5d 9f fc 90 5c 4a 73 78 |..O.d...]...\Jsx| | ca 50 49 8b 71 49 24 9e c3 c5 73 0f 63 92 56 8c |.PI.qI$...s.c.V.| | 09 4d 55 84 d6 63 1d 34 36 f9 c6 05 19 ac 8c 03 |.MU..c.46.......| | 19 48 62 da 4a 67 05 01 75 7a ce bb 56 3f 6f 65 |.Hb.Jg..uz..V?oe| | a6 fb b7 24 f7 df 67 83 66 0c 23 fb 3b b0 94 de |...$..g.f.#.;...| | 3d 5a c2 47 a7 5e e1 64 a9 f4 ea 47 6c da 18 cc |=Z.G.^.d...Gl...| | ea 6e 05 41 7a aa 28 9d 54 00 0f 8f dd 7b 3a 2f |.n.Az.(.T....{:/| | a0 8a f6 61 66 af 99 32 ed c8 00 15 ce 27 7b 21 |...af..2.....'{!| | 4a 5a e9 51 76 cc 4d d3 a5 5f ac 41 ee 21 d7 01 |JZ.Qv.M.._.A.!..| | 88 6a 30 5b aa 1b 6c c4 5a c3 49 5f 8b a6 d4 23 |.j0[..l.Z.I_...#| | 71 ba 26 79 8c e0 81 50 19 63 ab 0a 1a 52 8e 28 |q.&y...P.c...R.(| | eb dd 4e 53 e9 22 70 d6 5e c7 5c 49 b9 84 53 28 |..NS."p.^.\I..S(| | 85 bd 12 0d 69 0a 96 44 ec 60 b3 db 9e 3e 5a 37 |....i..D.`...>Z7| | f9 04 ef 36 70 62 11 70 c3 96 50 12 25 18 7c a2 |...6pb.p..P.%.|.| | 7a 97 60 ae 31 07 98 bc 02 a3 c8 92 7b 95 b2 2d |z.`.1.......{..-| | dd b1 c4 c1 a5 b5 b6 e1 d0 6a 4d 6c 1b 46 be 5a |.........jMl.F.Z| | d9 b5 e2 e4 e6 49 e9 4d 1f f7 2b ca 20 63 67 d2 |.....I.M..+. cg.| | dd b8 b1 46 ac b7 fc 01 f6 9f f5 b0 43 66 d3 ec |...F........Cf..| | fc e6 22 01 cc 68 37 dd 11 6b d4 e3 21 91 3a fb |.."..h7..k..!.:.| | ea 40 bb 38 8c 95 dd 70 38 de d7 a0 2b 66 06 cc |.@.8...p8...+f..| | 79 38 8e 7d d0 98 ab 64 52 7e e2 24 4d b9 65 c0 |y8.}...dR~.$M.e.| | 7a ad 51 4f 25 12 35 b4 01 c5 7e 92 2d f5 1b 42 |z.QO%.5...~.-..B| Plaintext[400]: | e6 3e 5c 96 06 2e a4 70 a7 58 3a 5a 78 3d 6a 14 |.>\....p.X:Zx=j.| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:| | 35 35 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:18 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 32 0d 0a 43 6f 6e 6e 65 63 74 |th: 142..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 30 41 20 2d 20 45 43 44 48 45 |xC0,0x0A - ECDHE| | 2d 45 43 44 53 41 2d 41 45 53 32 35 36 2d 53 48 |-ECDSA-AES256-SH| | 41 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 |A SSLv3 Kx=ECDH| | 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 6e | Au=ECDSA En| | 63 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d |c=AES(256) Mac=| | 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 |SHA1...| | 7a f7 c3 96 8f fd 57 31 af b8 f0 fd b8 51 45 70 |z.....W1.....QEp| | b4 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |................| ssl_decrypt_record found padding 14 final len 385 checking mac (len 349, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 88 9a c5 1d 56 8c a5 21 6a 92 8c 09 31 01 b9 8e |....V..!j...1...| | 90 09 a8 87 |.... | ssl_decrypt_record: mac failed association_find: TCP port 4486 found 0x3430f60 dissect_ssl enter frame #522 (first time) conversation = 0x7facef99be30, ssl_session = 0x7facc385ef50 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | b9 be 9e b1 fe 22 91 9d 9f 5b 1b 3b d7 a2 a1 4c |....."...[.;...L| | a6 a9 64 0c b6 2a f6 77 25 be 63 0c 57 8c 4e 59 |..d..*.w%.c.W.NY| | b1 c0 16 7b 2f 05 a6 a2 60 e9 e0 d7 5f da 4d de |...{/...`..._.M.| Plaintext[48]: | c9 63 38 c9 1f 7b e2 32 4c 53 87 08 a1 3d 3f 29 |.c8..{.2LS...=?)| | 01 00 c0 5e 0b 48 f9 ef 00 38 04 9e 69 cf ab 19 |...^.H...8..i...| | 1f f1 e4 cf 78 b6 09 09 09 09 09 09 09 09 09 09 |....x...........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | c0 5e 0b 48 f9 ef 00 38 04 9e 69 cf ab 19 1f f1 |.^.H...8..i.....| | e4 cf 78 b6 |..x. | ssl_decrypt_record: mac ok dissect_ssl enter frame #524 (first time) conversation = 0x7facef99be30, ssl_session = 0x7facc385ef50 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | c9 36 0f 15 31 65 21 e1 dd 68 d6 16 d3 c0 a7 27 |.6..1e!..h.....'| | 1f 64 aa f6 4e 12 88 10 32 57 7a 2e 4c 04 27 be |.d..N...2Wz.L.'.| | f3 ee 15 07 1c 01 e6 59 06 56 37 c1 2c 70 41 fe |.......Y.V7.,pA.| Plaintext[48]: | a9 c4 f0 c5 40 e2 ea ba 1f 98 00 3d 48 b1 43 74 |....@......=H.Ct| | 01 00 91 24 a6 88 14 43 8f ff 91 c7 5a 2c ec fe |...$...C....Z,..| | 6c 80 09 b9 45 61 09 09 09 09 09 09 09 09 09 09 |l...Ea..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 91 24 a6 88 14 43 8f ff 91 c7 5a 2c ec fe 6c 80 |.$...C....Z,..l.| | 09 b9 45 61 |..Ea | ssl_decrypt_record: mac ok dissect_ssl enter frame #529 (first time) ssl_session_init: initializing ptr 0x7facc3861410 size 688 conversation = 0x7facef99c0d8, ssl_session = 0x7facc3861410 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 57501 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4491 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #531 (first time) conversation = 0x7facef99c0d8, ssl_session = 0x7facc3861410 record: offset = 0, reported_length_remaining = 1230 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 66, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0xC011 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | f1 97 4f 79 aa 4a 7f 5d 01 c0 fa 24 a8 00 09 88 |..Oy.J.]...$....| | 01 5e 47 5e 5d b4 2b 6e 88 f4 07 aa 4a a0 b9 9a |.^G^].+n....J...| | d3 a5 57 ae 70 d4 cb a7 96 68 76 00 68 34 af 19 |..W.p....hv.h4..| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 26 54 48 16 d3 cd 07 60 9f 77 62 60 51 f0 f4 79 |&TH....`.wb`Q..y| | 00 e3 f1 66 90 46 20 6e 28 70 93 eb 20 52 34 bf |...f.F n(p.. R4.| | 26 c8 be 86 bf b1 14 f1 61 cf ec 4d 6f d9 a4 61 |&.......a..Mo..a| | 17 e4 4d 82 f6 8e 38 1c 7d 69 27 01 f7 |..M...8.}i'.. | hash out[72]: | f9 a5 bc 89 a4 25 4a ed 32 91 4d 00 d5 3c fc d5 |.....%J.2.M..<..| | 37 80 6a cf fb 50 89 e5 61 84 48 08 d0 52 40 5f |7.j..P..a.H..R@_| | 56 7a 01 f3 4e 10 82 91 ec 3a ef 45 ce 8f f9 3b |Vz..N....:.E...;| | 0f 5e c1 91 e2 03 35 82 87 82 b9 1c ab 07 d8 5c |.^....5........\| | b7 d9 51 bf c3 f0 36 0c |..Q...6. | PRF out[72]: | f9 a5 bc 89 a4 25 4a ed 32 91 4d 00 d5 3c fc d5 |.....%J.2.M..<..| | 37 80 6a cf fb 50 89 e5 61 84 48 08 d0 52 40 5f |7.j..P..a.H..R@_| | 56 7a 01 f3 4e 10 82 91 ec 3a ef 45 ce 8f f9 3b |Vz..N....:.E...;| | 0f 5e c1 91 e2 03 35 82 87 82 b9 1c ab 07 d8 5c |.^....5........\| | b7 d9 51 bf c3 f0 36 0c |..Q...6. | key expansion[72]: | f9 a5 bc 89 a4 25 4a ed 32 91 4d 00 d5 3c fc d5 |.....%J.2.M..<..| | 37 80 6a cf fb 50 89 e5 61 84 48 08 d0 52 40 5f |7.j..P..a.H..R@_| | 56 7a 01 f3 4e 10 82 91 ec 3a ef 45 ce 8f f9 3b |Vz..N....:.E...;| | 0f 5e c1 91 e2 03 35 82 87 82 b9 1c ab 07 d8 5c |.^....5........\| | b7 d9 51 bf c3 f0 36 0c |..Q...6. | Client MAC key[20]: | f9 a5 bc 89 a4 25 4a ed 32 91 4d 00 d5 3c fc d5 |.....%J.2.M..<..| | 37 80 6a cf |7.j. | Server MAC key[20]: | fb 50 89 e5 61 84 48 08 d0 52 40 5f 56 7a 01 f3 |.P..a.H..R@_Vz..| | 4e 10 82 91 |N... | Client Write key[16]: | ec 3a ef 45 ce 8f f9 3b 0f 5e c1 91 e2 03 35 82 |.:.E...;.^....5.| Server Write key[16]: | 87 82 b9 1c ab 07 d8 5c b7 d9 51 bf c3 f0 36 0c |.......\..Q...6.| Client Write IV[8]: | 01 00 00 00 00 00 00 00 |........ | Server Write IV[8]: | 14 00 00 00 00 00 00 00 |........ | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: ARCFOUR decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: ARCFOUR decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 71, reported_length_remaining = 1159 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 76 length 803 bytes, remaining 883 record: offset = 883, reported_length_remaining = 347 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 333, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 888 length 329 bytes, remaining 1221 record: offset = 1221, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1226 length 0 bytes, remaining 1230 dissect_ssl enter frame #533 (first time) conversation = 0x7facef99c0d8, ssl_session = 0x7facc3861410 record: offset = 0, reported_length_remaining = 122 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 70, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf26c8be86bfb114f161cfec4d6fd9a46117e44d82f6... looking for RSA pre-master4104ea3d5891a5452e2664fae464b13c68e6d659a0d51bba... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2550c536e6fa6b21552a9cd94df3ae7e26f19e79f3a98d35442f373b6f 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25808dedebbd3bd05b31a21d90f8a92a66615f1952fae65bd065fd0a9f 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9561eb53dc5d535c4 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25becb55c6badc809152b9ad79ee35c3c4b2ff61cbc09a025d1b124553 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25364117b64e6cd33295377173087b12dcf7b81799d088123cbcc27746 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf264e71d4638817c3e31beaef047efe0b65a64c7cf5a87ab039b4090e7a 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf26637518a169ea508357471eb7435410580cac5259b1d96a752153a190 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf267156d7fa01ff15627d9b9ace03511ca7dfde8461aff97120c4fdd387 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2677b493f8e1668f0535c7c56125771b4a55b73338ea0ff7721a67e298 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf261d174982956301086ed92bab07d2cbc2f300878f8135456198f1f438 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf26214916457a4ac39d832c5ce1abea411f00f239be71bdc087f9a37232 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf26544816d3cd07609f77626051f0f47900e3f1669046206e287093eb20 FEFF41C0447C2AD11D4580E7D462BDB5BA05A77A3E13F0EE986427202D5136973BECF20BF934AB2B420FBFEC4D0796DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf26c8be86bfb114f161cfec4d6fd9a46117e44d82f68e381c7d692701f7 FEFF41C0447C2AD11D4580E7D462BDB5BA05A77A3E13F0EE986427202D5136973BECF20BF934AB2B420FBFEC4D0796DF found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | fe ff 41 c0 44 7c 2a d1 1d 45 80 e7 d4 62 bd b5 |..A.D|*..E...b..| | ba 05 a7 7a 3e 13 f0 ee 98 64 27 20 2d 51 36 97 |...z>....d' -Q6.| | 3b ec f2 0b f9 34 ab 2b 42 0f bf ec 4d 07 96 df |;....4.+B...M...| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 26 54 48 16 d3 cd 07 60 9f 77 62 60 51 f0 f4 79 |&TH....`.wb`Q..y| | 00 e3 f1 66 90 46 20 6e 28 70 93 eb 20 52 34 bf |...f.F n(p.. R4.| | 26 c8 be 86 bf b1 14 f1 61 cf ec 4d 6f d9 a4 61 |&.......a..Mo..a| | 17 e4 4d 82 f6 8e 38 1c 7d 69 27 01 f7 |..M...8.}i'.. | hash out[72]: | 2e 65 b0 35 57 20 a7 ef 9f 41 e9 a4 64 76 8a 5b |.e.5W ...A..dv.[| | 2e 44 aa 56 15 78 34 7e a2 88 dd 51 f2 2f 67 66 |.D.V.x4~...Q./gf| | fc 52 52 8e 78 51 d6 56 d4 bf 40 1f bf 39 c4 41 |.RR.xQ.V..@..9.A| | ad 9a 53 d9 f6 eb 8d 8a 4c b1 f2 62 68 91 3f 47 |..S.....L..bh.?G| | 77 5f 96 38 f1 48 22 fe |w_.8.H". | PRF out[72]: | 2e 65 b0 35 57 20 a7 ef 9f 41 e9 a4 64 76 8a 5b |.e.5W ...A..dv.[| | 2e 44 aa 56 15 78 34 7e a2 88 dd 51 f2 2f 67 66 |.D.V.x4~...Q./gf| | fc 52 52 8e 78 51 d6 56 d4 bf 40 1f bf 39 c4 41 |.RR.xQ.V..@..9.A| | ad 9a 53 d9 f6 eb 8d 8a 4c b1 f2 62 68 91 3f 47 |..S.....L..bh.?G| | 77 5f 96 38 f1 48 22 fe |w_.8.H". | key expansion[72]: | 2e 65 b0 35 57 20 a7 ef 9f 41 e9 a4 64 76 8a 5b |.e.5W ...A..dv.[| | 2e 44 aa 56 15 78 34 7e a2 88 dd 51 f2 2f 67 66 |.D.V.x4~...Q./gf| | fc 52 52 8e 78 51 d6 56 d4 bf 40 1f bf 39 c4 41 |.RR.xQ.V..@..9.A| | ad 9a 53 d9 f6 eb 8d 8a 4c b1 f2 62 68 91 3f 47 |..S.....L..bh.?G| | 77 5f 96 38 f1 48 22 fe |w_.8.H". | Client MAC key[20]: | 2e 65 b0 35 57 20 a7 ef 9f 41 e9 a4 64 76 8a 5b |.e.5W ...A..dv.[| | 2e 44 aa 56 |.D.V | Server MAC key[20]: | 15 78 34 7e a2 88 dd 51 f2 2f 67 66 fc 52 52 8e |.x4~...Q./gf.RR.| | 78 51 d6 56 |xQ.V | Client Write key[16]: | d4 bf 40 1f bf 39 c4 41 ad 9a 53 d9 f6 eb 8d 8a |..@..9.A..S.....| Server Write key[16]: | 4c b1 f2 62 68 91 3f 47 77 5f 96 38 f1 48 22 fe |L..bh.?Gw_.8.H".| Client Write IV[8]: | 00 00 00 00 00 00 00 00 |........ | Server Write IV[8]: | 20 bb 73 03 00 00 00 00 | .s..... | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: ARCFOUR decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: ARCFOUR decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | fe ff 41 c0 44 7c 2a d1 1d 45 80 e7 d4 62 bd b5 |..A.D|*..E...b..| | ba 05 a7 7a 3e 13 f0 ee 98 64 27 20 2d 51 36 97 |...z>....d' -Q6.| | 3b ec f2 0b f9 34 ab 2b 42 0f bf ec 4d 07 96 df |;....4.+B...M...| dissect_ssl3_handshake session keys successfully generated record: offset = 75, reported_length_remaining = 47 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 81, reported_length_remaining = 41 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 36, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 36 Ciphertext[36]: | 63 0c b4 36 af 40 02 fc 08 c8 24 f7 2e f3 ca a6 |c..6.@....$.....| | 72 07 ee 48 c5 e0 78 1a a5 b0 74 29 ed cc 9a ce |r..H..x...t)....| | 5c ad dc d2 |\... | Plaintext[36]: | 14 00 00 0c 1f a1 4a 75 76 c8 9c 7c 6c 22 e2 4c |......Juv..|l".L| | 05 a0 ef b1 a8 00 d8 9f da bd 75 4c 50 9e 04 be |..........uLP...| | 39 aa 0c b4 |9... | checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 05 a0 ef b1 a8 00 d8 9f da bd 75 4c 50 9e 04 be |..........uLP...| | 39 aa 0c b4 |9... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #534 (first time) conversation = 0x7facef99c0d8, ssl_session = 0x7facc3861410 record: offset = 0, reported_length_remaining = 222 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 47 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 41 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 36, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 36 Ciphertext[36]: | 1a a6 19 a1 55 f1 6c 65 10 27 08 ad 0c 3c 0f 7e |....U.le.'...<.~| | 4b e0 90 47 26 e5 97 4d d3 75 d1 1f 6f 5b 15 6e |K..G&..M.u..o[.n| | 55 92 4d d3 |U.M. | Plaintext[36]: | 14 00 00 0c b3 19 f6 37 e4 56 be 99 32 d4 d1 5a |.......7.V..2..Z| | 71 f7 cf 2a db 3b 14 d6 b8 5c b6 e3 51 44 02 6e |q..*.;...\..QD.n| | 2c a8 cf 4a |,..J | checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 71 f7 cf 2a db 3b 14 d6 b8 5c b6 e3 51 44 02 6e |q..*.;...\..QD.n| | 2c a8 cf 4a |,..J | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #535 (first time) conversation = 0x7facef99c0d8, ssl_session = 0x7facc3861410 record: offset = 0, reported_length_remaining = 96 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 91, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 91 Ciphertext[91]: | 03 c4 fe d6 32 19 9e 23 82 79 a1 8d 42 14 5e 4d |....2..#.y..B.^M| | ea e9 54 65 1b 74 be fb c8 37 ac 51 e0 f6 8b 48 |..Te.t...7.Q...H| | f0 fa b2 e5 60 e5 16 75 71 b8 04 9b e6 8c 83 92 |....`..uq.......| | 3a 7f 48 b8 eb d7 0b 4c 7d bc 87 9d 44 50 fe 89 |:.H....L}...DP..| | e6 4f cb d3 1f 13 21 a5 ab ab b9 e6 b7 dc 5e fd |.O....!.......^.| | 0f c0 ef 9b 70 a5 d7 43 89 7f ac |....p..C... | Plaintext[91]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-| | 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c |rc4-sha.local.al| | 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 |.lekensteyn.nl:4| | 34 39 31 0d 0a 0d 0a 93 11 f4 3a e1 af 2a 80 60 |491.......:..*.`| | 9e 35 ab 35 c9 a3 a5 0f ba e5 b7 |.5.5....... | checking mac (len 71, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 93 11 f4 3a e1 af 2a 80 60 9e 35 ab 35 c9 a3 a5 |...:..*.`.5.5...| | 0f ba e5 b7 |.... | ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 71, seq = 0, nxtseq = 71 association_find: TCP port 57501 found (nil) association_find: TCP port 4491 found 0x3431840 dissect_ssl3_record decrypted len 71 decrypted app data fragment[71]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-| | 72 63 34 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c |rc4-sha.local.al| | 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 |.lekensteyn.nl:4| | 34 39 31 0d 0a 0d 0a |491.... | dissect_ssl3_record found association 0x3431840 dissect_ssl enter frame #536 (first time) conversation = 0x7facef99c0d8, ssl_session = 0x7facc3861410 record: offset = 0, reported_length_remaining = 373 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 368, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 368 Ciphertext[368]: | ea 1a dc 71 3a e8 49 57 84 35 3b a9 4f 54 f2 a4 |...q:.IW.5;.OT..| | 1e f7 61 e5 c0 84 8d 7a 5d a8 64 13 79 04 08 3a |..a....z].d.y..:| | 78 f3 ca fc cb f9 82 d6 78 85 ae e0 2c e3 4c 30 |x.......x...,.L0| | 7e c8 9b bb 38 b1 4e 37 fe 62 da 37 2f 6e 81 fc |~...8.N7.b.7/n..| | c1 ea 66 a7 da 12 cf 70 7f cb b7 3a 26 10 e8 86 |..f....p...:&...| | d3 96 30 6c 3a 49 1a 97 d2 9c e1 f2 c8 34 a7 9b |..0l:I.......4..| | 18 e1 59 c2 9d 89 09 e7 00 a0 40 86 49 7c 0e 10 |..Y.......@.I|..| | e2 77 40 6f ad cd ca 05 e6 29 09 6e f2 1f 96 ee |.w@o.....).n....| | 3c bf 32 bb 39 a8 da 5a 79 74 ec 0f 68 27 6b 75 |<.2.9..Zyt..h'ku| | b6 69 6e e1 8c 80 99 af 00 a1 3d c8 30 b7 4e 51 |.in.......=.0.NQ| | 60 77 d2 02 a9 16 a3 1b 91 c1 c9 00 8d 24 49 48 |`w...........$IH| | 8f 59 51 94 3b 70 2a fe 25 26 0a 17 ea e2 9e 8c |.YQ.;p*.%&......| | 95 fe 27 29 9d 6a fb 23 b0 fd a6 84 1e 5e b5 34 |..').j.#.....^.4| | ee cc 6a 92 05 84 cb 36 e1 a0 4c 5b 13 99 3d f3 |..j....6..L[..=.| | 76 3f 85 35 0f bd 81 f0 99 bd 54 5b 2a 6b 55 dd |v?.5......T[*kU.| | 2e dc 6e df 7f 51 3c 66 89 76 35 e2 09 ab 85 e3 |..n..Qdocum| | 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca| | 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.| | 6e 6c 27 3c 2f 73 63 72 69 70 74 3e ab a5 3d 92 |nl'..=.| | e1 a1 74 03 2e ee 44 94 eb fb 46 bf c1 b0 ab d1 |..t...D...F.....| checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | ab a5 3d 92 e1 a1 74 03 2e ee 44 94 eb fb 46 bf |..=...t...D...F.| | c1 b0 ab d1 |.... | ssl_decrypt_record: mac ok ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348 association_find: TCP port 4491 found 0x3431840 dissect_ssl3_record decrypted len 348 decrypted app data fragment[348]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:| | 35 35 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:18 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 31 31 20 2d 20 45 43 44 48 45 |xC0,0x11 - ECDHE| | 2d 52 53 41 2d 52 43 34 2d 53 48 41 20 20 20 20 |-RSA-RC4-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH| | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 53 |=RC4(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1 | dissect_ssl3_record found association 0x3431840 dissect_ssl enter frame #537 (first time) conversation = 0x7facef99c0d8, ssl_session = 0x7facc3861410 record: offset = 0, reported_length_remaining = 27 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 22, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 22 Ciphertext[22]: | 17 1f 56 00 42 af 59 ed 14 72 0d 9b bd ae c6 f6 |..V.B.Y..r......| | 94 5b cc ff 20 96 |.[.. . | Plaintext[22]: | 01 00 e1 74 23 83 48 30 f3 84 07 e4 15 cf 10 0b |...t#.H0........| | 7c eb 9f c5 d8 5d ||....] | checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | e1 74 23 83 48 30 f3 84 07 e4 15 cf 10 0b 7c eb |.t#.H0........|.| | 9f c5 d8 5d |...] | ssl_decrypt_record: mac ok dissect_ssl enter frame #539 (first time) conversation = 0x7facef99c0d8, ssl_session = 0x7facc3861410 record: offset = 0, reported_length_remaining = 27 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 22, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 22 Ciphertext[22]: | 38 00 8b 45 cb 30 36 09 3e 69 16 08 49 66 be af |8..E.06.>i..If..| | b0 b4 30 1f cc 25 |..0..% | Plaintext[22]: | 01 00 50 dd 9e c8 b8 83 66 09 ea 7b 07 17 3b a1 |..P.....f..{..;.| | bf 7b de d4 9d e5 |.{.... | checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 50 dd 9e c8 b8 83 66 09 ea 7b 07 17 3b a1 bf 7b |P.....f..{..;..{| | de d4 9d e5 |.... | ssl_decrypt_record: mac ok dissect_ssl enter frame #544 (first time) ssl_session_init: initializing ptr 0x7facc3863d20 size 688 conversation = 0x7facef99c430, ssl_session = 0x7facc3863d20 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 34592 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4492 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #546 (first time) conversation = 0x7facef99c430, ssl_session = 0x7facc3863d20 record: offset = 0, reported_length_remaining = 1230 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 66, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0xC012 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | fe ff 41 c0 44 7c 2a d1 1d 45 80 e7 d4 62 bd b5 |..A.D|*..E...b..| | ba 05 a7 7a 3e 13 f0 ee 98 64 27 20 2d 51 36 97 |...z>....d' -Q6.| | 3b ec f2 0b f9 34 ab 2b 42 0f bf ec 4d 07 96 df |;....4.+B...M...| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 26 e5 39 48 98 98 bf fa 5b 4d 1e 24 c8 88 c7 30 |&.9H....[M.$...0| | e7 0b 48 99 89 63 f6 10 fa 0c 1c 1f 10 52 34 bf |..H..c.......R4.| | 26 d7 23 92 e6 c6 7c c5 69 c9 dc 18 61 0f fd df |&.#...|.i...a...| | 12 47 42 b6 8e f9 50 e4 35 7b 73 1a 99 |.GB...P.5{s.. | hash out[104]: | e8 c4 36 40 9d 6c c8 67 72 04 b4 d1 ea f9 e1 7b |..6@.l.gr......{| | bf 41 98 5e 92 d4 26 61 34 e0 12 e2 0d c7 1e 6f |.A.^..&a4......o| | d3 5d 9f fc 53 20 52 6e 3e 96 18 82 b4 45 c5 1c |.]..S Rn>....E..| | 93 65 6f 96 76 b5 2c 54 1f 7f 4c ce cb 4d 89 ee |.eo.v.,T..L..M..| | ae cd a5 09 6b 00 23 af 6d 31 e0 99 c7 92 41 78 |....k.#.m1....Ax| | 28 a4 18 27 57 74 9e 11 26 03 a8 e7 05 fc cf 68 |(..'Wt..&......h| | 8c 8f 44 bb 8a 26 63 ee |..D..&c. | PRF out[104]: | e8 c4 36 40 9d 6c c8 67 72 04 b4 d1 ea f9 e1 7b |..6@.l.gr......{| | bf 41 98 5e 92 d4 26 61 34 e0 12 e2 0d c7 1e 6f |.A.^..&a4......o| | d3 5d 9f fc 53 20 52 6e 3e 96 18 82 b4 45 c5 1c |.]..S Rn>....E..| | 93 65 6f 96 76 b5 2c 54 1f 7f 4c ce cb 4d 89 ee |.eo.v.,T..L..M..| | ae cd a5 09 6b 00 23 af 6d 31 e0 99 c7 92 41 78 |....k.#.m1....Ax| | 28 a4 18 27 57 74 9e 11 26 03 a8 e7 05 fc cf 68 |(..'Wt..&......h| | 8c 8f 44 bb 8a 26 63 ee |..D..&c. | key expansion[104]: | e8 c4 36 40 9d 6c c8 67 72 04 b4 d1 ea f9 e1 7b |..6@.l.gr......{| | bf 41 98 5e 92 d4 26 61 34 e0 12 e2 0d c7 1e 6f |.A.^..&a4......o| | d3 5d 9f fc 53 20 52 6e 3e 96 18 82 b4 45 c5 1c |.]..S Rn>....E..| | 93 65 6f 96 76 b5 2c 54 1f 7f 4c ce cb 4d 89 ee |.eo.v.,T..L..M..| | ae cd a5 09 6b 00 23 af 6d 31 e0 99 c7 92 41 78 |....k.#.m1....Ax| | 28 a4 18 27 57 74 9e 11 26 03 a8 e7 05 fc cf 68 |(..'Wt..&......h| | 8c 8f 44 bb 8a 26 63 ee |..D..&c. | Client MAC key[20]: | e8 c4 36 40 9d 6c c8 67 72 04 b4 d1 ea f9 e1 7b |..6@.l.gr......{| | bf 41 98 5e |.A.^ | Server MAC key[20]: | 92 d4 26 61 34 e0 12 e2 0d c7 1e 6f d3 5d 9f fc |..&a4......o.]..| | 53 20 52 6e |S Rn | Client Write key[24]: | 3e 96 18 82 b4 45 c5 1c 93 65 6f 96 76 b5 2c 54 |>....E...eo.v.,T| | 1f 7f 4c ce cb 4d 89 ee |..L..M.. | Server Write key[24]: | ae cd a5 09 6b 00 23 af 6d 31 e0 99 c7 92 41 78 |....k.#.m1....Ax| | 28 a4 18 27 57 74 9e 11 |(..'Wt.. | Client Write IV[8]: | 26 03 a8 e7 05 fc cf 68 |&......h | Server Write IV[8]: | 8c 8f 44 bb 8a 26 63 ee |..D..&c. | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 71, reported_length_remaining = 1159 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 76 length 803 bytes, remaining 883 record: offset = 883, reported_length_remaining = 347 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 333, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 888 length 329 bytes, remaining 1221 record: offset = 1221, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1226 length 0 bytes, remaining 1230 dissect_ssl enter frame #548 (first time) conversation = 0x7facef99c430, ssl_session = 0x7facc3863d20 record: offset = 0, reported_length_remaining = 134 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 70, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf26d72392e6c67cc569c9dc18610ffddf124742b68e... looking for RSA pre-master4104eebcabcbcb46841a360b5987f25cde894bce45b8777e... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2550c536e6fa6b21552a9cd94df3ae7e26f19e79f3a98d35442f373b6f 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25808dedebbd3bd05b31a21d90f8a92a66615f1952fae65bd065fd0a9f 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9561eb53dc5d535c4 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25becb55c6badc809152b9ad79ee35c3c4b2ff61cbc09a025d1b124553 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25364117b64e6cd33295377173087b12dcf7b81799d088123cbcc27746 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf264e71d4638817c3e31beaef047efe0b65a64c7cf5a87ab039b4090e7a 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf26637518a169ea508357471eb7435410580cac5259b1d96a752153a190 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf267156d7fa01ff15627d9b9ace03511ca7dfde8461aff97120c4fdd387 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2677b493f8e1668f0535c7c56125771b4a55b73338ea0ff7721a67e298 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf261d174982956301086ed92bab07d2cbc2f300878f8135456198f1f438 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf26214916457a4ac39d832c5ce1abea411f00f239be71bdc087f9a37232 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf26544816d3cd07609f77626051f0f47900e3f1669046206e287093eb20 FEFF41C0447C2AD11D4580E7D462BDB5BA05A77A3E13F0EE986427202D5136973BECF20BF934AB2B420FBFEC4D0796DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf26c8be86bfb114f161cfec4d6fd9a46117e44d82f68e381c7d692701f7 FEFF41C0447C2AD11D4580E7D462BDB5BA05A77A3E13F0EE986427202D5136973BECF20BF934AB2B420FBFEC4D0796DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf26e539489898bffa5b4d1e24c888c730e70b48998963f610fa0c1c1f10 1937D83BA05DBDED62884D7B910A42AA69AFDC2AA421E6FD3DD4F681084E26A880E634C78D1242F5603F9411D550DA1E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf26d72392e6c67cc569c9dc18610ffddf124742b68ef950e4357b731a99 1937D83BA05DBDED62884D7B910A42AA69AFDC2AA421E6FD3DD4F681084E26A880E634C78D1242F5603F9411D550DA1E found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 19 37 d8 3b a0 5d bd ed 62 88 4d 7b 91 0a 42 aa |.7.;.]..b.M{..B.| | 69 af dc 2a a4 21 e6 fd 3d d4 f6 81 08 4e 26 a8 |i..*.!..=....N&.| | 80 e6 34 c7 8d 12 42 f5 60 3f 94 11 d5 50 da 1e |..4...B.`?...P..| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 26 e5 39 48 98 98 bf fa 5b 4d 1e 24 c8 88 c7 30 |&.9H....[M.$...0| | e7 0b 48 99 89 63 f6 10 fa 0c 1c 1f 10 52 34 bf |..H..c.......R4.| | 26 d7 23 92 e6 c6 7c c5 69 c9 dc 18 61 0f fd df |&.#...|.i...a...| | 12 47 42 b6 8e f9 50 e4 35 7b 73 1a 99 |.GB...P.5{s.. | hash out[104]: | 6a 63 23 b5 45 98 4d eb b8 11 63 c9 f1 45 6d 61 |jc#.E.M...c..Ema| | ce 82 db 75 c9 90 b1 a9 98 38 f8 6f 94 5e ae 6e |...u.....8.o.^.n| | b0 63 8a 48 ef 8c b8 9e 84 ed e3 89 57 0e 75 46 |.c.H........W.uF| | a2 2e ff f8 cd bc 14 88 e4 c4 a2 1c 42 d9 bd 13 |............B...| | 9f 66 a5 f1 28 13 b3 a0 90 34 9b 52 59 c6 ed 3b |.f..(....4.RY..;| | dd c3 6e 27 95 99 38 e8 09 4f 36 d1 e8 d0 7a 46 |..n'..8..O6...zF| | f6 d1 b2 78 5c 07 8c 04 |...x\... | PRF out[104]: | 6a 63 23 b5 45 98 4d eb b8 11 63 c9 f1 45 6d 61 |jc#.E.M...c..Ema| | ce 82 db 75 c9 90 b1 a9 98 38 f8 6f 94 5e ae 6e |...u.....8.o.^.n| | b0 63 8a 48 ef 8c b8 9e 84 ed e3 89 57 0e 75 46 |.c.H........W.uF| | a2 2e ff f8 cd bc 14 88 e4 c4 a2 1c 42 d9 bd 13 |............B...| | 9f 66 a5 f1 28 13 b3 a0 90 34 9b 52 59 c6 ed 3b |.f..(....4.RY..;| | dd c3 6e 27 95 99 38 e8 09 4f 36 d1 e8 d0 7a 46 |..n'..8..O6...zF| | f6 d1 b2 78 5c 07 8c 04 |...x\... | key expansion[104]: | 6a 63 23 b5 45 98 4d eb b8 11 63 c9 f1 45 6d 61 |jc#.E.M...c..Ema| | ce 82 db 75 c9 90 b1 a9 98 38 f8 6f 94 5e ae 6e |...u.....8.o.^.n| | b0 63 8a 48 ef 8c b8 9e 84 ed e3 89 57 0e 75 46 |.c.H........W.uF| | a2 2e ff f8 cd bc 14 88 e4 c4 a2 1c 42 d9 bd 13 |............B...| | 9f 66 a5 f1 28 13 b3 a0 90 34 9b 52 59 c6 ed 3b |.f..(....4.RY..;| | dd c3 6e 27 95 99 38 e8 09 4f 36 d1 e8 d0 7a 46 |..n'..8..O6...zF| | f6 d1 b2 78 5c 07 8c 04 |...x\... | Client MAC key[20]: | 6a 63 23 b5 45 98 4d eb b8 11 63 c9 f1 45 6d 61 |jc#.E.M...c..Ema| | ce 82 db 75 |...u | Server MAC key[20]: | c9 90 b1 a9 98 38 f8 6f 94 5e ae 6e b0 63 8a 48 |.....8.o.^.n.c.H| | ef 8c b8 9e |.... | Client Write key[24]: | 84 ed e3 89 57 0e 75 46 a2 2e ff f8 cd bc 14 88 |....W.uF........| | e4 c4 a2 1c 42 d9 bd 13 |....B... | Server Write key[24]: | 9f 66 a5 f1 28 13 b3 a0 90 34 9b 52 59 c6 ed 3b |.f..(....4.RY..;| | dd c3 6e 27 95 99 38 e8 |..n'..8. | Client Write IV[8]: | 09 4f 36 d1 e8 d0 7a 46 |.O6...zF | Server Write IV[8]: | f6 d1 b2 78 5c 07 8c 04 |...x\... | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 19 37 d8 3b a0 5d bd ed 62 88 4d 7b 91 0a 42 aa |.7.;.]..b.M{..B.| | 69 af dc 2a a4 21 e6 fd 3d d4 f6 81 08 4e 26 a8 |i..*.!..=....N&.| | 80 e6 34 c7 8d 12 42 f5 60 3f 94 11 d5 50 da 1e |..4...B.`?...P..| dissect_ssl3_handshake session keys successfully generated record: offset = 75, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 81, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | a2 32 a0 6b 7d bd 41 bc ea 88 38 15 fb ec c0 8f |.2.k}.A...8.....| | 65 77 61 73 06 29 de 95 68 49 f5 f3 e7 0e a2 e8 |ewas.)..hI......| | 45 18 a0 3d 2c b1 53 30 57 c2 d9 d3 87 d6 d3 80 |E..=,.S0W.......| Plaintext[48]: | 96 bf b5 57 84 89 ea c9 14 00 00 0c e5 ed 95 02 |...W............| | a0 35 36 a5 e0 04 77 2c 3e 6e 31 b3 9f 64 16 87 |.56...w,>n1..d..| | 0c a9 c2 1c f8 22 a5 6e 14 58 bc 89 03 03 03 03 |.....".n.X......| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 3e 6e 31 b3 9f 64 16 87 0c a9 c2 1c f8 22 a5 6e |>n1..d.......".n| | 14 58 bc 89 |.X.. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #549 (first time) conversation = 0x7facef99c430, ssl_session = 0x7facc3863d20 record: offset = 0, reported_length_remaining = 234 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 52 96 93 fd ce ca f6 fa 14 44 a7 22 6f 72 dc 49 |R........D."or.I| | e8 97 cf f5 70 eb 93 3d b9 7d c1 c5 a4 02 e7 15 |....p..=.}......| | 3e 07 22 dd 69 08 64 32 47 35 c0 89 ed 93 a7 e1 |>.".i.d2G5......| Plaintext[48]: | 26 18 e2 17 1b c2 1f 19 14 00 00 0c 3b 15 3c 03 |&...........;.<.| | ba 4c 95 4e af 14 e0 d7 8b 93 42 04 1b be ea cf |.L.N......B.....| | 27 61 fb 88 cd a2 05 77 1a 03 2b d5 03 03 03 03 |'a.....w..+.....| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 8b 93 42 04 1b be ea cf 27 61 fb 88 cd a2 05 77 |..B.....'a.....w| | 1a 03 2b d5 |..+. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #550 (first time) conversation = 0x7facef99c430, ssl_session = 0x7facc3863d20 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | 9b 0b 21 f5 40 3e a0 f6 33 51 e5 e6 92 68 fc 97 |..!.@>..3Q...h..| | 36 3b fb 54 31 09 3c b2 6e 8e 66 d6 96 7b 06 b8 |6;.T1.<.n.f..{..| | 4c 33 10 3b a6 dd 1d 8f 5e 01 48 68 c6 c9 e5 25 |L3.;....^.Hh...%| | b5 f7 b4 89 56 db 66 f4 07 e4 08 48 c1 88 0c 5f |....V.f....H..._| | 8c cb 5e 3a af 8c 4d 46 31 3f 08 f2 28 75 59 44 |..^:..MF1?..(uYD| | a1 78 95 b1 ea f4 eb c4 2c e4 64 2f b2 03 5b ee |.x......,.d/..[.| | 62 5f b9 a9 39 3c 5d e9 61 f2 f6 43 c9 37 76 6d |b_..9<].a..C.7vm| Plaintext[112]: | b2 26 f3 4a 21 50 23 44 47 45 54 20 2f 20 48 54 |.&.J!P#DGET / HT| | 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 63 |TP/1.1..Host: ec| | 64 68 65 2d 72 73 61 2d 64 65 73 2d 63 62 63 33 |dhe-rsa-des-cbc3| | 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 |-sha.local.al.le| | 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 39 32 |kensteyn.nl:4492| | 0d 0a 0d 0a 36 40 ce 3e e1 92 01 e6 93 32 8c 19 |....6@.>.....2..| | a6 67 46 d5 7d 3c 2e 32 07 07 07 07 07 07 07 07 |.gF.}<.2........| ssl_decrypt_record found padding 7 final len 104 checking mac (len 76, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | ec c3 4a d5 b1 fb a4 c8 74 d8 64 72 2c 17 0d fe |..J.....t.dr,...| | d9 bb de ce |.... | ssl_decrypt_record: mac failed association_find: TCP port 34592 found (nil) association_find: TCP port 4492 found 0x34318d0 dissect_ssl enter frame #551 (first time) conversation = 0x7facef99c430, ssl_session = 0x7facc3863d20 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | c9 d1 11 f4 7b cc 69 dd bf 7c ab a2 bf c7 ca 2a |....{.i..|.....*| | 88 46 f4 a6 35 96 29 d2 31 95 41 e7 01 61 b6 e1 |.F..5.).1.A..a..| | 79 ed 5f fd 0c 2c 0d 6a b0 f9 0f 98 4c d9 27 14 |y._..,.j....L.'.| | 58 5f 6f 87 3b d8 43 2a b6 54 85 52 6b 26 6c b3 |X_o.;.C*.T.Rk&l.| | bf ea da a8 5c d6 eb 42 78 2d 88 c9 d2 8c fc e2 |....\..Bx-......| | 59 a8 19 2c 18 2a fe 40 1a 9a c6 30 d8 5f de 5d |Y..,.*.@...0._.]| | 19 e0 63 41 f6 12 b3 57 1b f6 af 33 a7 87 24 38 |..cA...W...3..$8| | 18 0c 92 4c 02 f6 77 2c e1 8c fd 3e 63 97 5c f5 |...L..w,...>c.\.| | 88 58 52 36 a5 6f d0 26 c6 03 93 23 d0 73 4e cb |.XR6.o.&...#.sN.| | 71 73 da 4b e7 e0 75 2f 7b 06 43 90 f6 0e 2e 35 |qs.K..u/{.C....5| | 94 e6 b2 0e d9 db 4a 3b 23 12 42 92 11 0b 66 d0 |......J;#.B...f.| | a0 36 6e d5 6b eb 8a e2 3a 0e 28 6e 38 75 5e 02 |.6n.k...:.(n8u^.| | 93 5f 11 b6 15 d2 40 77 c7 ac 58 11 0a 78 5c 2f |._....@w..X..x\/| | 35 88 9a d6 8d 85 1f fb b1 8e ef 3d 4b 0e 88 c1 |5..........=K...| | ed 7e fe 21 a9 a3 12 a0 83 30 44 3d 91 6d 18 4d |.~.!.....0D=.m.M| | 21 80 c5 c6 52 85 af 15 13 20 01 89 50 e7 a4 d3 |!...R.... ..P...| | d8 63 f2 09 74 e1 c7 6d 7b 1b 00 c0 f6 b5 08 85 |.c..t..m{.......| | 69 63 99 6a a3 77 26 05 38 6f 9f 72 bf 01 a1 95 |ic.j.w&.8o.r....| | db 06 0b 0b 68 bb 05 cd 21 0a 31 2d d7 29 91 28 |....h...!.1-.).(| | ff ef 30 12 8a 4d 69 0c 0f 37 ea 22 85 db 45 83 |..0..Mi..7."..E.| | c5 10 e4 df d8 a1 85 07 c4 99 35 df ed d9 c6 b7 |..........5.....| | 94 2e 54 3b bc e4 2b 3a b5 e9 56 30 11 1a 40 60 |..T;..+:..V0..@`| | 58 dc e5 5c f3 1b 23 1e f1 6b d3 5d ce 34 91 76 |X..\..#..k.].4.v| | 6e 5c ed fd b0 b0 1d 5d be 89 6f 47 67 99 b2 f9 |n\.....]..oGg...| Plaintext[384]: | 48 9b 94 99 84 7c ab 56 48 54 54 50 2f 31 2e 31 |H....|.VHTTP/1.1| | 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:| | 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da| | 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep | | 32 30 31 33 20 31 39 3a 35 35 3a 31 38 20 47 4d |2013 19:55:18 GM| | 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:| | 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont| | 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.| | 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo| | 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu| | 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00| | 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach| | 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca| | 63 68 65 0d 0a 0d 0a 30 78 43 30 2c 30 78 31 32 |che....0xC0,0x12| | 20 2d 20 45 43 44 48 45 2d 52 53 41 2d 44 45 53 | - ECDHE-RSA-DES| | 2d 43 42 43 33 2d 53 48 41 20 20 53 53 4c 76 33 |-CBC3-SHA SSLv3| | 20 4b 78 3d 45 43 44 48 20 20 20 20 20 41 75 3d | Kx=ECDH Au=| | 52 53 41 20 20 45 6e 63 3d 33 44 45 53 28 31 36 |RSA Enc=3DES(16| | 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 |8) Mac=SHA1document.doma| | 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek| | 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'.....z{~/...| | c5 2c 0a 7a 35 86 16 48 07 07 07 07 07 07 07 07 |.,.z5..H........| ssl_decrypt_record found padding 7 final len 376 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 0b 8c 9f fa 5c b9 86 2d da 90 1c fb 95 12 64 c4 |....\..-......d.| | ec cf 31 5d |..1] | ssl_decrypt_record: mac failed association_find: TCP port 4492 found 0x34318d0 dissect_ssl enter frame #552 (first time) conversation = 0x7facef99c430, ssl_session = 0x7facc3863d20 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 13 87 84 14 ce 22 02 a6 e7 19 a7 17 d7 db cd 9e |....."..........| | 21 a9 30 2c 83 a5 3d be 91 bf 60 e4 49 ce 08 68 |!.0,..=...`.I..h| Plaintext[32]: | c6 d3 ea d3 d3 52 73 cf 01 00 b0 ca 07 80 79 bd |.....Rs.......y.| | 4f 17 18 cc 24 2a 62 6e c1 93 e7 fe f9 1e 01 01 |O...$*bn........| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | b0 ca 07 80 79 bd 4f 17 18 cc 24 2a 62 6e c1 93 |....y.O...$*bn..| | e7 fe f9 1e |.... | ssl_decrypt_record: mac ok dissect_ssl enter frame #554 (first time) conversation = 0x7facef99c430, ssl_session = 0x7facc3863d20 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | ad 0e 58 f1 8d c2 d9 eb 7d b2 93 07 5c 0d da f0 |..X.....}...\...| | 7a d6 16 93 12 5c f1 63 0a 11 67 f6 ca 86 89 9a |z....\.c..g.....| Plaintext[32]: | 00 94 e0 88 23 72 8f 91 01 00 f3 37 24 45 dd 05 |....#r.....7$E..| | fa ae 86 00 9b ce dc ef 85 1f 16 23 75 c9 01 01 |...........#u...| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | f3 37 24 45 dd 05 fa ae 86 00 9b ce dc ef 85 1f |.7$E............| | 16 23 75 c9 |.#u. | ssl_decrypt_record: mac ok dissect_ssl enter frame #559 (first time) ssl_session_init: initializing ptr 0x7facc3866220 size 688 conversation = 0x7facef99c6d8, ssl_session = 0x7facc3866220 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 55294 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4493 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #561 (first time) conversation = 0x7facef99c6d8, ssl_session = 0x7facc3866220 record: offset = 0, reported_length_remaining = 1230 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 66, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0xC013 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 19 37 d8 3b a0 5d bd ed 62 88 4d 7b 91 0a 42 aa |.7.;.]..b.M{..B.| | 69 af dc 2a a4 21 e6 fd 3d d4 f6 81 08 4e 26 a8 |i..*.!..=....N&.| | 80 e6 34 c7 8d 12 42 f5 60 3f 94 11 d5 50 da 1e |..4...B.`?...P..| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 27 25 87 db 66 ce 4f af b1 e8 4f 7d a8 a9 66 d5 |'%..f.O...O}..f.| | 42 14 31 0f 64 4e cf ec d2 18 38 7e b1 52 34 bf |B.1.dN....8~.R4.| | 27 0d 31 84 a1 0d fb a3 73 43 ad 12 f1 15 c7 08 |'.1.....sC......| | e3 e7 46 e8 8e ff 05 15 a4 37 35 7f bc |..F......75.. | hash out[104]: | 83 27 8c 81 9b 1f c7 43 4e 18 f7 11 8c c8 d0 2f |.'.....CN....../| | 8e 85 e4 84 3c 05 58 0b 0a 72 bb 27 4e 5f 04 c5 |....<.X..r.'N_..| | 6f f9 19 0d 3a 8e 97 5b 5d 6a 9f 0f e2 2f d3 10 |o...:..[]j.../..| | 07 21 fe 5c 30 86 8d 05 82 f6 10 4e 8c ba 3a 64 |.!.\0......N..:d| | cd 78 2e 52 5b a6 ed 51 c0 fb f6 0b 25 aa 6e 75 |.x.R[..Q....%.nu| | f1 fe a7 c2 26 39 b2 9d 8c 04 da 95 a6 53 c4 55 |....&9.......S.U| | 19 8d 7d b8 fc 26 ea 93 |..}..&.. | PRF out[104]: | 83 27 8c 81 9b 1f c7 43 4e 18 f7 11 8c c8 d0 2f |.'.....CN....../| | 8e 85 e4 84 3c 05 58 0b 0a 72 bb 27 4e 5f 04 c5 |....<.X..r.'N_..| | 6f f9 19 0d 3a 8e 97 5b 5d 6a 9f 0f e2 2f d3 10 |o...:..[]j.../..| | 07 21 fe 5c 30 86 8d 05 82 f6 10 4e 8c ba 3a 64 |.!.\0......N..:d| | cd 78 2e 52 5b a6 ed 51 c0 fb f6 0b 25 aa 6e 75 |.x.R[..Q....%.nu| | f1 fe a7 c2 26 39 b2 9d 8c 04 da 95 a6 53 c4 55 |....&9.......S.U| | 19 8d 7d b8 fc 26 ea 93 |..}..&.. | key expansion[104]: | 83 27 8c 81 9b 1f c7 43 4e 18 f7 11 8c c8 d0 2f |.'.....CN....../| | 8e 85 e4 84 3c 05 58 0b 0a 72 bb 27 4e 5f 04 c5 |....<.X..r.'N_..| | 6f f9 19 0d 3a 8e 97 5b 5d 6a 9f 0f e2 2f d3 10 |o...:..[]j.../..| | 07 21 fe 5c 30 86 8d 05 82 f6 10 4e 8c ba 3a 64 |.!.\0......N..:d| | cd 78 2e 52 5b a6 ed 51 c0 fb f6 0b 25 aa 6e 75 |.x.R[..Q....%.nu| | f1 fe a7 c2 26 39 b2 9d 8c 04 da 95 a6 53 c4 55 |....&9.......S.U| | 19 8d 7d b8 fc 26 ea 93 |..}..&.. | Client MAC key[20]: | 83 27 8c 81 9b 1f c7 43 4e 18 f7 11 8c c8 d0 2f |.'.....CN....../| | 8e 85 e4 84 |.... | Server MAC key[20]: | 3c 05 58 0b 0a 72 bb 27 4e 5f 04 c5 6f f9 19 0d |<.X..r.'N_..o...| | 3a 8e 97 5b |:..[ | Client Write key[16]: | 5d 6a 9f 0f e2 2f d3 10 07 21 fe 5c 30 86 8d 05 |]j.../...!.\0...| Server Write key[16]: | 82 f6 10 4e 8c ba 3a 64 cd 78 2e 52 5b a6 ed 51 |...N..:d.x.R[..Q| Client Write IV[16]: | c0 fb f6 0b 25 aa 6e 75 f1 fe a7 c2 26 39 b2 9d |....%.nu....&9..| Server Write IV[16]: | 8c 04 da 95 a6 53 c4 55 19 8d 7d b8 fc 26 ea 93 |.....S.U..}..&..| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 71, reported_length_remaining = 1159 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 76 length 803 bytes, remaining 883 record: offset = 883, reported_length_remaining = 347 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 333, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 888 length 329 bytes, remaining 1221 record: offset = 1221, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1226 length 0 bytes, remaining 1230 dissect_ssl enter frame #563 (first time) conversation = 0x7facef99c6d8, ssl_session = 0x7facc3866220 record: offset = 0, reported_length_remaining = 150 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 70, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf270d3184a10dfba37343ad12f115c708e3e746e88e... looking for RSA pre-master4104c46d44bde4db0259182c556118f4cc0c5e9c77bccce0... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2550c536e6fa6b21552a9cd94df3ae7e26f19e79f3a98d35442f373b6f 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25808dedebbd3bd05b31a21d90f8a92a66615f1952fae65bd065fd0a9f 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9561eb53dc5d535c4 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25becb55c6badc809152b9ad79ee35c3c4b2ff61cbc09a025d1b124553 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25364117b64e6cd33295377173087b12dcf7b81799d088123cbcc27746 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf264e71d4638817c3e31beaef047efe0b65a64c7cf5a87ab039b4090e7a 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf26637518a169ea508357471eb7435410580cac5259b1d96a752153a190 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf267156d7fa01ff15627d9b9ace03511ca7dfde8461aff97120c4fdd387 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2677b493f8e1668f0535c7c56125771b4a55b73338ea0ff7721a67e298 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf261d174982956301086ed92bab07d2cbc2f300878f8135456198f1f438 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf26214916457a4ac39d832c5ce1abea411f00f239be71bdc087f9a37232 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf26544816d3cd07609f77626051f0f47900e3f1669046206e287093eb20 FEFF41C0447C2AD11D4580E7D462BDB5BA05A77A3E13F0EE986427202D5136973BECF20BF934AB2B420FBFEC4D0796DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf26c8be86bfb114f161cfec4d6fd9a46117e44d82f68e381c7d692701f7 FEFF41C0447C2AD11D4580E7D462BDB5BA05A77A3E13F0EE986427202D5136973BECF20BF934AB2B420FBFEC4D0796DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf26e539489898bffa5b4d1e24c888c730e70b48998963f610fa0c1c1f10 1937D83BA05DBDED62884D7B910A42AA69AFDC2AA421E6FD3DD4F681084E26A880E634C78D1242F5603F9411D550DA1E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf26d72392e6c67cc569c9dc18610ffddf124742b68ef950e4357b731a99 1937D83BA05DBDED62884D7B910A42AA69AFDC2AA421E6FD3DD4F681084E26A880E634C78D1242F5603F9411D550DA1E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf270d3184a10dfba37343ad12f115c708e3e746e88eff0515a437357fbc F929F9CF5219545A93E8A181E459F8AF1CEED077AAD5631B1841E43ECFDB92098AC190A0ED65AFBA16BC4BF300A34054 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | f9 29 f9 cf 52 19 54 5a 93 e8 a1 81 e4 59 f8 af |.)..R.TZ.....Y..| | 1c ee d0 77 aa d5 63 1b 18 41 e4 3e cf db 92 09 |...w..c..A.>....| | 8a c1 90 a0 ed 65 af ba 16 bc 4b f3 00 a3 40 54 |.....e....K...@T| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 27 25 87 db 66 ce 4f af b1 e8 4f 7d a8 a9 66 d5 |'%..f.O...O}..f.| | 42 14 31 0f 64 4e cf ec d2 18 38 7e b1 52 34 bf |B.1.dN....8~.R4.| | 27 0d 31 84 a1 0d fb a3 73 43 ad 12 f1 15 c7 08 |'.1.....sC......| | e3 e7 46 e8 8e ff 05 15 a4 37 35 7f bc |..F......75.. | hash out[104]: | 16 4b 03 b8 b9 0f 74 a5 4a 98 05 3c e8 42 49 e8 |.K....t.J..<.BI.| | 9a 61 bf 0c 30 56 77 e1 6f 45 a3 92 e4 68 55 a3 |.a..0Vw.oE...hU.| | f6 8c 6f ac bb 31 1d ae 61 55 5f 74 03 d5 63 a8 |..o..1..aU_t..c.| | 46 6d a4 e6 d6 d8 5b d3 c0 2e a3 39 81 2f 37 d2 |Fm....[....9./7.| | 20 72 ef 96 af db 8c dd f4 ca 3d 05 f8 3a 14 9c | r........=..:..| | 4c 39 48 58 05 af c1 c1 2a 9e bb 97 ee 8c 85 ad |L9HX....*.......| | c3 54 53 f2 2e 3f 8a b3 |.TS..?.. | PRF out[104]: | 16 4b 03 b8 b9 0f 74 a5 4a 98 05 3c e8 42 49 e8 |.K....t.J..<.BI.| | 9a 61 bf 0c 30 56 77 e1 6f 45 a3 92 e4 68 55 a3 |.a..0Vw.oE...hU.| | f6 8c 6f ac bb 31 1d ae 61 55 5f 74 03 d5 63 a8 |..o..1..aU_t..c.| | 46 6d a4 e6 d6 d8 5b d3 c0 2e a3 39 81 2f 37 d2 |Fm....[....9./7.| | 20 72 ef 96 af db 8c dd f4 ca 3d 05 f8 3a 14 9c | r........=..:..| | 4c 39 48 58 05 af c1 c1 2a 9e bb 97 ee 8c 85 ad |L9HX....*.......| | c3 54 53 f2 2e 3f 8a b3 |.TS..?.. | key expansion[104]: | 16 4b 03 b8 b9 0f 74 a5 4a 98 05 3c e8 42 49 e8 |.K....t.J..<.BI.| | 9a 61 bf 0c 30 56 77 e1 6f 45 a3 92 e4 68 55 a3 |.a..0Vw.oE...hU.| | f6 8c 6f ac bb 31 1d ae 61 55 5f 74 03 d5 63 a8 |..o..1..aU_t..c.| | 46 6d a4 e6 d6 d8 5b d3 c0 2e a3 39 81 2f 37 d2 |Fm....[....9./7.| | 20 72 ef 96 af db 8c dd f4 ca 3d 05 f8 3a 14 9c | r........=..:..| | 4c 39 48 58 05 af c1 c1 2a 9e bb 97 ee 8c 85 ad |L9HX....*.......| | c3 54 53 f2 2e 3f 8a b3 |.TS..?.. | Client MAC key[20]: | 16 4b 03 b8 b9 0f 74 a5 4a 98 05 3c e8 42 49 e8 |.K....t.J..<.BI.| | 9a 61 bf 0c |.a.. | Server MAC key[20]: | 30 56 77 e1 6f 45 a3 92 e4 68 55 a3 f6 8c 6f ac |0Vw.oE...hU...o.| | bb 31 1d ae |.1.. | Client Write key[16]: | 61 55 5f 74 03 d5 63 a8 46 6d a4 e6 d6 d8 5b d3 |aU_t..c.Fm....[.| Server Write key[16]: | c0 2e a3 39 81 2f 37 d2 20 72 ef 96 af db 8c dd |...9./7. r......| Client Write IV[16]: | f4 ca 3d 05 f8 3a 14 9c 4c 39 48 58 05 af c1 c1 |..=..:..L9HX....| Server Write IV[16]: | 2a 9e bb 97 ee 8c 85 ad c3 54 53 f2 2e 3f 8a b3 |*........TS..?..| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | f9 29 f9 cf 52 19 54 5a 93 e8 a1 81 e4 59 f8 af |.)..R.TZ.....Y..| | 1c ee d0 77 aa d5 63 1b 18 41 e4 3e cf db 92 09 |...w..c..A.>....| | 8a c1 90 a0 ed 65 af ba 16 bc 4b f3 00 a3 40 54 |.....e....K...@T| dissect_ssl3_handshake session keys successfully generated record: offset = 75, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 81, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 39 62 cb 33 71 c3 fd ae 15 ae 5c 2c e8 ca d3 02 |9b.3q.....\,....| | 57 0f 8b df e0 42 e8 cd 70 58 5a ef ee d1 06 2d |W....B..pXZ....-| | 8b cd c9 07 cd c7 a6 39 a5 6c b4 e9 70 24 18 26 |.......9.l..p$.&| | ea 8d a0 39 d7 30 82 bc e2 db e1 db 94 da 97 80 |...9.0..........| Plaintext[64]: | 50 1f 07 fa 0d 0b 39 a0 0a 64 7e 64 e9 3b aa 4c |P.....9..d~d.;.L| | 14 00 00 0c 12 9d d4 f8 27 09 99 d2 72 a8 cf 85 |........'...r...| | 3e 05 25 db bf 0c 15 aa 2a 40 95 31 9c ac 60 e3 |>.%.....*@.1..`.| | 12 34 55 3c 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.4U<............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 3e 05 25 db bf 0c 15 aa 2a 40 95 31 9c ac 60 e3 |>.%.....*@.1..`.| | 12 34 55 3c |.4U< | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #564 (first time) conversation = 0x7facef99c6d8, ssl_session = 0x7facc3866220 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 9a 82 e6 8c aa 36 3d 97 51 bd 1e 2d 4b f8 c0 1c |.....6=.Q..-K...| | 1f 60 86 a2 f9 d7 64 f4 3a 25 34 37 6d 7c df 4b |.`....d.:%47m|.K| | 7c c8 15 01 cd 92 ab fe 59 f6 89 a5 6b 7d 50 e5 ||.......Y...k}P.| | cb d7 d5 67 98 10 29 65 d5 f1 e4 ec 25 2b 19 0e |...g..)e....%+..| Plaintext[64]: | 61 a9 fb c3 d4 5c 11 af 0a 1e 47 f0 12 6a b7 04 |a....\....G..j..| | 14 00 00 0c 3a ce 0c 81 41 3f 76 af 1a 98 59 48 |....:...A?v...YH| | db 3b f3 3c 74 82 bc 2f f9 94 48 87 11 14 c7 83 |.;.| | 80 1d df 49 f7 b7 b9 b4 51 76 27 8b c1 32 01 01 |...I....Qv'..2..| ssl_decrypt_record found padding 1 final len 110 checking mac (len 74, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | a6 f1 8a eb 0c b2 be 05 01 61 51 20 07 fb d6 e5 |.........aQ ....| | 04 b9 f4 43 |...C | ssl_decrypt_record: mac failed association_find: TCP port 55294 found (nil) association_find: TCP port 4493 found 0x3431960 dissect_ssl enter frame #566 (first time) conversation = 0x7facef99c6d8, ssl_session = 0x7facc3866220 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | 0c 1a ed 62 67 7c d3 bf 24 2c b8 62 2e 87 c9 14 |...bg|..$,.b....| | 11 d7 0d a5 a4 06 0a 81 41 4d d8 8b 1b 32 f5 df |........AM...2..| | 5d 96 be 73 c1 44 c0 9e da c5 00 f5 7a 40 d7 9e |]..s.D......z@..| | f4 e0 e6 94 59 a2 2f 9c 17 80 53 aa 47 e0 ed bc |....Y./...S.G...| | c8 19 69 ac 89 b8 7f 76 de a9 15 f4 e2 ec f0 18 |..i....v........| | e8 75 d1 1d d6 78 90 4a 5b 0a 90 55 b1 ac ce 01 |.u...x.J[..U....| | 63 a2 b2 ec 72 f3 cc 2a b0 a2 86 14 20 27 6c 6d |c...r..*.... 'lm| | d3 8a 2b 20 92 6e a4 f8 0d 3d e9 74 2f b3 ca d4 |..+ .n...=.t/...| | 12 c9 58 99 dc 48 46 3e a7 2a d8 09 2e be 25 e8 |..X..HF>.*....%.| | ae 8d ad a7 8b 54 b9 2f 3e c8 29 19 6c 91 e9 25 |.....T./>.).l..%| | d9 95 43 9f 12 66 15 88 11 c9 93 fa bf c2 0e fa |..C..f..........| | 8a b4 d1 41 7f 77 17 da 3b a0 fe c0 f2 9e 8b 90 |...A.w..;.......| | be 3c c8 92 07 87 1c 3e fb 4f c0 07 be 04 22 35 |.<.....>.O...."5| | 63 a5 e4 9e 2b f5 d7 d8 de 0e e2 f0 c2 6b 25 e4 |c...+........k%.| | 73 87 41 f1 26 96 3d 09 e9 0d 27 89 4a a3 ec e9 |s.A.&.=...'.J...| | c2 75 94 35 bb 6b 59 37 6b b9 30 f8 91 c5 e4 fc |.u.5.kY7k.0.....| | 3e 90 8b 16 d9 96 7d cc f8 c2 ef a6 d4 86 86 d0 |>.....}.........| | 12 b0 9a 4f 46 d7 73 7d 40 ff 65 c9 37 e6 f0 a3 |...OF.s}@.e.7...| | 62 66 ab 6d 54 8a a9 a0 26 b4 cf 22 a3 68 04 b2 |bf.mT...&..".h..| | c2 aa 01 5e d5 b0 32 78 9f 97 6b bb 82 8b 25 46 |...^..2x..k...%F| | 6b 7d 9c 5e d8 99 0f e7 07 a7 44 aa 6f 32 57 00 |k}.^......D.o2W.| | f6 a4 4c cc ea bc 33 96 94 d8 77 8c 8b f3 45 fa |..L...3...w...E.| | fc 4a f2 2c 75 05 c2 55 25 3a 1b 7b 3b aa e0 1b |.J.,u..U%:.{;...| | 8f d7 5e 91 1c da 0f 25 6d 05 8d b3 cf e1 54 e1 |..^....%m.....T.| | 68 0f 5e 1d b1 18 c5 47 44 b1 e2 24 53 c9 d5 04 |h.^....GD..$S...| Plaintext[400]: | 7d 51 f2 64 a1 0c f4 c8 11 5a 58 94 04 fa d4 a3 |}Q.d.....ZX.....| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:| | 35 35 3a 31 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:19 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 31 33 20 2d 20 45 43 44 48 45 |xC0,0x13 - ECDHE| | 2d 52 53 41 2d 41 45 53 31 32 38 2d 53 48 41 20 |-RSA-AES128-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH| | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1...H| | 96 c2 91 2e c1 9d ad 32 d6 bd 70 12 c7 13 00 7f |.......2..p.....| | 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................| ssl_decrypt_record found padding 15 final len 384 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 71 53 c7 1f 72 64 3d ba a1 32 da 30 ba 36 07 de |qS..rd=..2.0.6..| | bf 85 bc e3 |.... | ssl_decrypt_record: mac failed association_find: TCP port 4493 found 0x3431960 dissect_ssl enter frame #567 (first time) conversation = 0x7facef99c6d8, ssl_session = 0x7facc3866220 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | dc cf 24 89 c6 0c 56 f9 f2 db af b4 d0 27 67 4c |..$...V......'gL| | c5 14 8a ab 4f bc 57 ba 76 ed fe 60 99 de cf 92 |....O.W.v..`....| | 82 4f a6 6d 19 57 c9 e8 80 a5 9d 43 a2 9c 27 b4 |.O.m.W.....C..'.| Plaintext[48]: | 70 49 5b ce d8 7a ce e0 09 b9 ab e7 a3 a2 ad bc |pI[..z..........| | 01 00 ad c1 c2 b0 a8 7e fb 3c ac 92 ca 7d 2a a7 |.......~.<...}*.| | f6 15 8e 50 42 ad 09 09 09 09 09 09 09 09 09 09 |...PB...........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | ad c1 c2 b0 a8 7e fb 3c ac 92 ca 7d 2a a7 f6 15 |.....~.<...}*...| | 8e 50 42 ad |.PB. | ssl_decrypt_record: mac ok dissect_ssl enter frame #569 (first time) conversation = 0x7facef99c6d8, ssl_session = 0x7facc3866220 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 02 e1 53 d6 bb 96 1f 4a e4 be 8d 0c 23 7b c0 9b |..S....J....#{..| | 35 c1 91 f9 0d 31 5c f0 0d 48 f2 ac f4 b4 4a 8a |5....1\..H....J.| | dc 2a 6b 8c 83 4d 85 bf 08 ab a4 ba 5b bd f2 49 |.*k..M......[..I| Plaintext[48]: | 16 a5 5d ba 7f 87 ad ca a4 c1 f6 5e 95 e5 db 76 |..]........^...v| | 01 00 c1 02 59 a4 a3 ee 13 07 27 f1 71 cc fa 01 |....Y.....'.q...| | d7 ba fc ff 77 d7 09 09 09 09 09 09 09 09 09 09 |....w...........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | c1 02 59 a4 a3 ee 13 07 27 f1 71 cc fa 01 d7 ba |..Y.....'.q.....| | fc ff 77 d7 |..w. | ssl_decrypt_record: mac ok dissect_ssl enter frame #574 (first time) ssl_session_init: initializing ptr 0x7facc38686e0 size 688 conversation = 0x7facef99c980, ssl_session = 0x7facc38686e0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 41513 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4494 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #576 (first time) conversation = 0x7facef99c980, ssl_session = 0x7facc38686e0 record: offset = 0, reported_length_remaining = 1230 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 66, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0xC014 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | f9 29 f9 cf 52 19 54 5a 93 e8 a1 81 e4 59 f8 af |.)..R.TZ.....Y..| | 1c ee d0 77 aa d5 63 1b 18 41 e4 3e cf db 92 09 |...w..c..A.>....| | 8a c1 90 a0 ed 65 af ba 16 bc 4b f3 00 a3 40 54 |.....e....K...@T| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 27 6e 08 25 c8 74 53 58 ef 2c 57 1c be 4f ab 12 |'n.%.tSX.,W..O..| | 69 d0 ff 82 05 d1 7d 42 c7 c0 f3 3a c0 52 34 bf |i.....}B...:.R4.| | 27 1b 22 ce ab 55 97 4c 25 6d b5 76 91 27 09 ca |'."..U.L%m.v.'..| | 19 5a b5 77 8d b5 2b 06 2f 85 5f 08 05 |.Z.w..+./._.. | hash out[136]: | d8 7a ed 96 ff b1 71 34 80 c3 88 8e 11 3c 9a 97 |.z....q4.....<..| | ff c8 fb 3e 8c bb cc 54 cc db cc 63 b7 e2 14 fe |...>...T...c....| | 2c b3 9b d0 52 c8 38 1c 4a c3 ef 9f 0f 1b 58 bf |,...R.8.J.....X.| | 50 24 98 f3 73 84 91 7a 7c 77 1c b8 00 ae 66 fb |P$..s..z|w....f.| | ef 14 46 f2 15 2c e6 7a 0c a2 81 6d c8 e2 bb ed |..F..,.z...m....| | a6 d8 0b 48 7b 1e bc 81 16 b1 ce b7 d2 79 ee 58 |...H{........y.X| | ee 74 bb fb 2b 6a b9 97 92 52 a9 9e 18 bf 8e 2f |.t..+j...R...../| | 19 45 20 49 eb e2 e6 8b 29 9c d3 cb 1e d8 f2 5f |.E I....)......_| | 4d 4d 61 91 1d 30 3e f9 |MMa..0>. | PRF out[136]: | d8 7a ed 96 ff b1 71 34 80 c3 88 8e 11 3c 9a 97 |.z....q4.....<..| | ff c8 fb 3e 8c bb cc 54 cc db cc 63 b7 e2 14 fe |...>...T...c....| | 2c b3 9b d0 52 c8 38 1c 4a c3 ef 9f 0f 1b 58 bf |,...R.8.J.....X.| | 50 24 98 f3 73 84 91 7a 7c 77 1c b8 00 ae 66 fb |P$..s..z|w....f.| | ef 14 46 f2 15 2c e6 7a 0c a2 81 6d c8 e2 bb ed |..F..,.z...m....| | a6 d8 0b 48 7b 1e bc 81 16 b1 ce b7 d2 79 ee 58 |...H{........y.X| | ee 74 bb fb 2b 6a b9 97 92 52 a9 9e 18 bf 8e 2f |.t..+j...R...../| | 19 45 20 49 eb e2 e6 8b 29 9c d3 cb 1e d8 f2 5f |.E I....)......_| | 4d 4d 61 91 1d 30 3e f9 |MMa..0>. | key expansion[136]: | d8 7a ed 96 ff b1 71 34 80 c3 88 8e 11 3c 9a 97 |.z....q4.....<..| | ff c8 fb 3e 8c bb cc 54 cc db cc 63 b7 e2 14 fe |...>...T...c....| | 2c b3 9b d0 52 c8 38 1c 4a c3 ef 9f 0f 1b 58 bf |,...R.8.J.....X.| | 50 24 98 f3 73 84 91 7a 7c 77 1c b8 00 ae 66 fb |P$..s..z|w....f.| | ef 14 46 f2 15 2c e6 7a 0c a2 81 6d c8 e2 bb ed |..F..,.z...m....| | a6 d8 0b 48 7b 1e bc 81 16 b1 ce b7 d2 79 ee 58 |...H{........y.X| | ee 74 bb fb 2b 6a b9 97 92 52 a9 9e 18 bf 8e 2f |.t..+j...R...../| | 19 45 20 49 eb e2 e6 8b 29 9c d3 cb 1e d8 f2 5f |.E I....)......_| | 4d 4d 61 91 1d 30 3e f9 |MMa..0>. | Client MAC key[20]: | d8 7a ed 96 ff b1 71 34 80 c3 88 8e 11 3c 9a 97 |.z....q4.....<..| | ff c8 fb 3e |...> | Server MAC key[20]: | 8c bb cc 54 cc db cc 63 b7 e2 14 fe 2c b3 9b d0 |...T...c....,...| | 52 c8 38 1c |R.8. | Client Write key[32]: | 4a c3 ef 9f 0f 1b 58 bf 50 24 98 f3 73 84 91 7a |J.....X.P$..s..z| | 7c 77 1c b8 00 ae 66 fb ef 14 46 f2 15 2c e6 7a ||w....f...F..,.z| Server Write key[32]: | 0c a2 81 6d c8 e2 bb ed a6 d8 0b 48 7b 1e bc 81 |...m.......H{...| | 16 b1 ce b7 d2 79 ee 58 ee 74 bb fb 2b 6a b9 97 |.....y.X.t..+j..| Client Write IV[16]: | 92 52 a9 9e 18 bf 8e 2f 19 45 20 49 eb e2 e6 8b |.R...../.E I....| Server Write IV[16]: | 29 9c d3 cb 1e d8 f2 5f 4d 4d 61 91 1d 30 3e f9 |)......_MMa..0>.| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 71, reported_length_remaining = 1159 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 76 length 803 bytes, remaining 883 record: offset = 883, reported_length_remaining = 347 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 333, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 888 length 329 bytes, remaining 1221 record: offset = 1221, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1226 length 0 bytes, remaining 1230 dissect_ssl enter frame #578 (first time) conversation = 0x7facef99c980, ssl_session = 0x7facc38686e0 record: offset = 0, reported_length_remaining = 150 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 70, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt looking for CLIENT_RANDOM 5234bf271b22ceab55974c256db576912709ca195ab5778d... looking for RSA pre-master41046cd693c8d494ffed8f2f2cc05fcaf360a4732284d113... checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2473e6ebc0a0073f11e5c1d406a70ebec7a3f3f861dab003b2a2b48672 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf242e0cdc759275a7f885a97a0b0f2e3be07d9a46a049b316c0a0971517 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf24d313759a6389f1fdd3f77e998a4bea35c770d5673b329f06d2913ae5 6E0F503CCE1F28D649810631E41D67DBD6726BF510B3BF220D58D64BFEB76936EFC1507DC7210C3DEF8B8465EAA91384 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2506e08ea2a0d6d258172dce2e540da6c3c6401caff3d7c46d2bf42651 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25280c4e7b0e4e70ca6f36b8b1fec06dac16f77760aa7c9e8a15abe5f5 03422A8E24082FDAAE13785CE438996228D170FD72E976BA7330C74A26423BE5E47BE283E8A30329909D47D7FD43F4B2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf250242882d3c8f20bc8f3eb63f8429ad4eefa1785330d277dd09129812 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25138e82a21f8e4709defde3481deac7399e4b1b80b624a5c55fab33e5 C36702E3A09B22ED925B2D18291766C3B2ECFE5B8056996F7D5CAF5E8708E1C432379618AF5835B81890F6DE4CFC1DA2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25d323f9f2b394e3a7ca28a08a3832e4b5c1cdba6b867f53c569656700 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2550c536e6fa6b21552a9cd94df3ae7e26f19e79f3a98d35442f373b6f 0C3049AE3E3BB6D512BF304B8A4776688791889CEF1448C753E2E8A7C01E6213D25E925B157CF3B28279941B2F889045 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25808dedebbd3bd05b31a21d90f8a92a66615f1952fae65bd065fd0a9f 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25dd948c651c8cf33a31162bb423863108c377f8e9561eb53dc5d535c4 0510E9E27A95D00E6951792B3587D82DAA7C2187B16FBD5281D2D318F9DF7AA55C586AA938CE346AF78913019D5FD320 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25becb55c6badc809152b9ad79ee35c3c4b2ff61cbc09a025d1b124553 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf25364117b64e6cd33295377173087b12dcf7b81799d088123cbcc27746 6F30EAC906184384A4D0480339DB0A8811EE7C09454BF819A803BF823BF3FFEF60A8B047EA71E366C50FAFF184DCB259 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf264e71d4638817c3e31beaef047efe0b65a64c7cf5a87ab039b4090e7a 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf26637518a169ea508357471eb7435410580cac5259b1d96a752153a190 7FE2CB3E30767229B511AFC5326B711D1F62DE94C322CB25556A952CF14C8386DB1B7326817AA8FBA6B30B9CDBB03BD2 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf267156d7fa01ff15627d9b9ace03511ca7dfde8461aff97120c4fdd387 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf2677b493f8e1668f0535c7c56125771b4a55b73338ea0ff7721a67e298 9180A830A0BC0A0E18472544E75C31EA26E54CE55211E024C196DAAEC1457C6B2E7389778782AFE0E863A8CC88BF812D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf261d174982956301086ed92bab07d2cbc2f300878f8135456198f1f438 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf26214916457a4ac39d832c5ce1abea411f00f239be71bdc087f9a37232 F1974F79AA4A7F5D01C0FA24A8000988015E475E5DB42B6E88F407AA4AA0B99AD3A557AE70D4CBA7966876006834AF19 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf26544816d3cd07609f77626051f0f47900e3f1669046206e287093eb20 FEFF41C0447C2AD11D4580E7D462BDB5BA05A77A3E13F0EE986427202D5136973BECF20BF934AB2B420FBFEC4D0796DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf26c8be86bfb114f161cfec4d6fd9a46117e44d82f68e381c7d692701f7 FEFF41C0447C2AD11D4580E7D462BDB5BA05A77A3E13F0EE986427202D5136973BECF20BF934AB2B420FBFEC4D0796DF line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf26e539489898bffa5b4d1e24c888c730e70b48998963f610fa0c1c1f10 1937D83BA05DBDED62884D7B910A42AA69AFDC2AA421E6FD3DD4F681084E26A880E634C78D1242F5603F9411D550DA1E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf26d72392e6c67cc569c9dc18610ffddf124742b68ef950e4357b731a99 1937D83BA05DBDED62884D7B910A42AA69AFDC2AA421E6FD3DD4F681084E26A880E634C78D1242F5603F9411D550DA1E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf270d3184a10dfba37343ad12f115c708e3e746e88eff0515a437357fbc F929F9CF5219545A93E8A181E459F8AF1CEED077AAD5631B1841E43ECFDB92098AC190A0ED65AFBA16BC4BF300A34054 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf272587db66ce4fafb1e84f7da8a966d54214310f644ecfecd218387eb1 F929F9CF5219545A93E8A181E459F8AF1CEED077AAD5631B1841E43ECFDB92098AC190A0ED65AFBA16BC4BF300A34054 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234bf271b22ceab55974c256db576912709ca195ab5778db52b062f855f0805 3DDB569F9B91F25331B2B8C79610C0B590751A6969406661DD5090DC831B5FE6921811128F1BC26CD96B2949724BC603 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 3d db 56 9f 9b 91 f2 53 31 b2 b8 c7 96 10 c0 b5 |=.V....S1.......| | 90 75 1a 69 69 40 66 61 dd 50 90 dc 83 1b 5f e6 |.u.ii@fa.P...._.| | 92 18 11 12 8f 1b c2 6c d9 6b 29 49 72 4b c6 03 |.......l.k)IrK..| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.| | 27 6e 08 25 c8 74 53 58 ef 2c 57 1c be 4f ab 12 |'n.%.tSX.,W..O..| | 69 d0 ff 82 05 d1 7d 42 c7 c0 f3 3a c0 52 34 bf |i.....}B...:.R4.| | 27 1b 22 ce ab 55 97 4c 25 6d b5 76 91 27 09 ca |'."..U.L%m.v.'..| | 19 5a b5 77 8d b5 2b 06 2f 85 5f 08 05 |.Z.w..+./._.. | hash out[136]: | 48 24 63 6e 59 42 e8 93 3e b2 c2 c7 7a dc 1d 9c |H$cnYB..>...z...| | 89 13 7c f5 9e 8f 22 c7 b2 a7 0e c2 08 8b 50 53 |..|...".......PS| | f0 4f c4 28 58 d1 58 43 de e7 18 9c be 1c 31 bf |.O.(X.XC......1.| | d1 1b a1 81 f5 cb 0b 15 84 df cf b9 46 11 cb ca |............F...| | 50 90 70 e9 9e cc bd 8e bb 42 3a 51 10 6e 7a 3c |P.p......B:Q.nz<| | 2f d2 d6 bc 99 00 e1 3e fc 4f 6e f4 33 12 55 ac |/......>.On.3.U.| | ce 9e b4 01 85 6c d8 f9 59 3b ae 12 2b c8 3f 72 |.....l..Y;..+.?r| | b4 c1 47 2a f0 05 ed 57 f2 6a 76 10 19 17 3a eb |..G*...W.jv...:.| | 53 95 86 05 01 d7 72 3c |S.....r< | PRF out[136]: | 48 24 63 6e 59 42 e8 93 3e b2 c2 c7 7a dc 1d 9c |H$cnYB..>...z...| | 89 13 7c f5 9e 8f 22 c7 b2 a7 0e c2 08 8b 50 53 |..|...".......PS| | f0 4f c4 28 58 d1 58 43 de e7 18 9c be 1c 31 bf |.O.(X.XC......1.| | d1 1b a1 81 f5 cb 0b 15 84 df cf b9 46 11 cb ca |............F...| | 50 90 70 e9 9e cc bd 8e bb 42 3a 51 10 6e 7a 3c |P.p......B:Q.nz<| | 2f d2 d6 bc 99 00 e1 3e fc 4f 6e f4 33 12 55 ac |/......>.On.3.U.| | ce 9e b4 01 85 6c d8 f9 59 3b ae 12 2b c8 3f 72 |.....l..Y;..+.?r| | b4 c1 47 2a f0 05 ed 57 f2 6a 76 10 19 17 3a eb |..G*...W.jv...:.| | 53 95 86 05 01 d7 72 3c |S.....r< | key expansion[136]: | 48 24 63 6e 59 42 e8 93 3e b2 c2 c7 7a dc 1d 9c |H$cnYB..>...z...| | 89 13 7c f5 9e 8f 22 c7 b2 a7 0e c2 08 8b 50 53 |..|...".......PS| | f0 4f c4 28 58 d1 58 43 de e7 18 9c be 1c 31 bf |.O.(X.XC......1.| | d1 1b a1 81 f5 cb 0b 15 84 df cf b9 46 11 cb ca |............F...| | 50 90 70 e9 9e cc bd 8e bb 42 3a 51 10 6e 7a 3c |P.p......B:Q.nz<| | 2f d2 d6 bc 99 00 e1 3e fc 4f 6e f4 33 12 55 ac |/......>.On.3.U.| | ce 9e b4 01 85 6c d8 f9 59 3b ae 12 2b c8 3f 72 |.....l..Y;..+.?r| | b4 c1 47 2a f0 05 ed 57 f2 6a 76 10 19 17 3a eb |..G*...W.jv...:.| | 53 95 86 05 01 d7 72 3c |S.....r< | Client MAC key[20]: | 48 24 63 6e 59 42 e8 93 3e b2 c2 c7 7a dc 1d 9c |H$cnYB..>...z...| | 89 13 7c f5 |..|. | Server MAC key[20]: | 9e 8f 22 c7 b2 a7 0e c2 08 8b 50 53 f0 4f c4 28 |..".......PS.O.(| | 58 d1 58 43 |X.XC | Client Write key[32]: | de e7 18 9c be 1c 31 bf d1 1b a1 81 f5 cb 0b 15 |......1.........| | 84 df cf b9 46 11 cb ca 50 90 70 e9 9e cc bd 8e |....F...P.p.....| Server Write key[32]: | bb 42 3a 51 10 6e 7a 3c 2f d2 d6 bc 99 00 e1 3e |.B:Q.nz| | fc 4f 6e f4 33 12 55 ac ce 9e b4 01 85 6c d8 f9 |.On.3.U......l..| Client Write IV[16]: | 59 3b ae 12 2b c8 3f 72 b4 c1 47 2a f0 05 ed 57 |Y;..+.?r..G*...W| Server Write IV[16]: | f2 6a 76 10 19 17 3a eb 53 95 86 05 01 d7 72 3c |.jv...:.S.....r<| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 3d db 56 9f 9b 91 f2 53 31 b2 b8 c7 96 10 c0 b5 |=.V....S1.......| | 90 75 1a 69 69 40 66 61 dd 50 90 dc 83 1b 5f e6 |.u.ii@fa.P...._.| | 92 18 11 12 8f 1b c2 6c d9 6b 29 49 72 4b c6 03 |.......l.k)IrK..| dissect_ssl3_handshake session keys successfully generated record: offset = 75, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 81, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | b2 e5 ce a9 70 28 1f c8 ff f9 56 00 45 39 6f 6d |....p(....V.E9om| | 26 86 a8 8d 5e 07 99 e0 03 8a 8a 46 c9 a0 82 9f |&...^......F....| | 09 a3 48 3a d9 9c 22 19 a3 e9 0a 0d 15 1c 0a a3 |..H:..".........| | 95 78 94 83 67 93 8c da 1b 7b 93 55 7b b8 d4 d4 |.x..g....{.U{...| Plaintext[64]: | b6 87 6e bc 4b 76 09 de a7 71 2a d5 eb 57 58 ff |..n.Kv...q*..WX.| | 14 00 00 0c d4 31 1c 85 5d dc 59 d9 c7 1a c8 34 |.....1..].Y....4| | 0a 7d 21 5e b2 68 a9 40 d7 78 bd 52 13 7b 48 e4 |.}!^.h.@.x.R.{H.| | ce 1f a1 f4 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 0a 7d 21 5e b2 68 a9 40 d7 78 bd 52 13 7b 48 e4 |.}!^.h.@.x.R.{H.| | ce 1f a1 f4 |.... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #579 (first time) conversation = 0x7facef99c980, ssl_session = 0x7facc38686e0 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 2a 19 9a 9d 49 71 4a cb a6 84 97 ca 5a ff e2 d8 |*...IqJ.....Z...| | f9 42 ec 97 55 20 1f 54 ad e2 9d 06 5f 73 13 dc |.B..U .T...._s..| | 0e bc ad 1e e9 cf 4c 12 24 36 29 03 c0 b4 31 5b |......L.$6)...1[| | f5 7f db 78 22 2a bf f5 69 2b c4 fd a3 3f 6d 70 |...x"*..i+...?mp| Plaintext[64]: | d1 dd 68 ce 8d 2c 35 58 b0 8c df 31 fa 7e 9d 26 |..h..,5X...1.~.&| | 14 00 00 0c 79 c4 59 e5 00 cd 78 e3 60 c0 60 7d |....y.Y...x.`.`}| | b9 cc 76 a2 70 1c da 74 62 dc 98 1a e1 7b 9d 35 |..v.p..tb....{.5| | 3f 70 ae ec 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |?p..............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | b9 cc 76 a2 70 1c da 74 62 dc 98 1a e1 7b 9d 35 |..v.p..tb....{.5| | 3f 70 ae ec |?p.. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #580 (first time) conversation = 0x7facef99c980, ssl_session = 0x7facc38686e0 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | ca 7a 92 64 b4 c9 aa 19 0f 19 3e 97 70 aa 0b ed |.z.d......>.p...| | c0 2e 63 bc 3d 91 ef 86 1c 6b 80 3c 98 d2 41 03 |..c.=....k.<..A.| | db 04 c1 c3 eb 7f 90 0f d3 1f b2 e6 8b bc f3 d7 |................| | a0 3a 04 d4 8b f5 3b 01 aa 5d 46 08 3d fb 8f e0 |.:....;..]F.=...| | ae 47 9b fc cb 8e f8 7e cd 29 10 37 f3 49 bb a1 |.G.....~.).7.I..| | c0 2f 2b a6 69 3d 45 e1 b6 2d fa 62 92 5d 60 01 |./+.i=E..-.b.]`.| | 11 3d b8 d5 d4 a4 e1 57 37 96 4c a1 ad bf 02 60 |.=.....W7.L....`| Plaintext[112]: | 2c 40 d8 2c 17 51 aa 1a 4b 96 ba 95 a7 38 60 17 |,@.,.Q..K....8`.| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-| | 61 65 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 6c |aes256-sha.local| | 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n| | 6c 3a 34 34 39 34 0d 0a 0d 0a af b4 b9 bc 7f e1 |l:4494..........| | dc 9a 51 8f c8 e5 87 7f 28 09 dd 18 cd ec 01 01 |..Q.....(.......| ssl_decrypt_record found padding 1 final len 110 checking mac (len 74, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | a3 90 e0 62 9f 41 4c 23 19 40 d8 84 6e 36 b7 4f |...b.AL#.@..n6.O| | 50 8e 40 af |P.@. | ssl_decrypt_record: mac failed association_find: TCP port 41513 found (nil) association_find: TCP port 4494 found 0x34319f0 dissect_ssl enter frame #581 (first time) conversation = 0x7facef99c980, ssl_session = 0x7facc38686e0 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | b8 da 63 57 52 36 26 1b 47 d0 de 68 e8 b6 6c 04 |..cWR6&.G..h..l.| | b8 06 e8 50 28 94 5d fb b8 f4 4a 72 08 51 58 38 |...P(.]...Jr.QX8| | 37 1c ec 44 c2 ef 68 78 cf 1d e9 d2 d7 48 4c 79 |7..D..hx.....HLy| | ba d7 ee 04 4e 50 0b 24 ca b8 23 25 93 e4 bc b4 |....NP.$..#%....| | 8e 55 a4 39 eb e7 69 87 57 96 75 b9 de f7 52 ba |.U.9..i.W.u...R.| | 45 0c db 52 e0 99 44 e4 38 a9 ca 87 90 b3 1b e3 |E..R..D.8.......| | 45 96 79 a4 e0 b9 0a 8f ae dc 09 ed 8e 53 50 cf |E.y..........SP.| | c4 e2 80 57 c6 c2 44 69 5b 65 0b e9 e6 ca 02 e7 |...W..Di[e......| | 1f f1 42 e4 f3 19 03 2b 4f ee 24 f2 44 aa 4c 19 |..B....+O.$.D.L.| | 8b fd fa ed db c0 b3 af 8f 27 c8 9d a8 54 b0 19 |.........'...T..| | ea 94 35 d2 68 b9 90 a3 8f d5 a8 bc 9f 2b b8 4a |..5.h........+.J| | c3 40 c0 3b c5 aa de aa e3 11 9f d6 17 95 2a 48 |.@.;..........*H| | 9c 18 14 2c 4e e0 5a 0b 26 5f a5 88 d9 46 0f ef |...,N.Z.&_...F..| | 51 ac 5f 74 0e 63 e6 be c1 eb 95 44 c4 d2 d2 ca |Q._t.c.....D....| | 51 3d 27 f6 20 ef 8b 5d e5 d0 56 a4 4a 31 12 a8 |Q='. ..]..V.J1..| | db 94 c5 ea b1 9c 9e b4 5d f4 ef 3e b0 24 a8 0c |........]..>.$..| | 95 9d 51 79 87 b3 74 5e 06 ee 8a 87 87 0f 64 17 |..Qy..t^......d.| | f9 7b 8d df a4 0a e7 0a 07 4e d7 ce 74 df 3a 38 |.{.......N..t.:8| | a1 51 e3 94 ff b2 63 e0 66 ef 82 7d 87 30 46 3a |.Q....c.f..}.0F:| | e7 5e e9 0a fa 93 ff ae 1d f6 45 09 c6 23 06 ca |.^........E..#..| | 73 12 a2 6c ad c6 94 99 29 c4 cd 15 f8 6c b7 db |s..l....)....l..| | 87 e6 ff 07 57 55 72 9e 5d 5a db 8e 94 f6 0e 06 |....WUr.]Z......| | 71 9f c7 44 92 49 aa 3d 8f bc c0 e1 2a 64 2d 0b |q..D.I.=....*d-.| | a8 9d e8 48 1e 2e 42 36 b6 a7 74 97 2d b1 3a b5 |...H..B6..t.-.:.| | cf fe 5b e6 7d 72 2e 22 d5 16 25 a0 e1 2e 0e f8 |..[.}r."..%.....| Plaintext[400]: | 9c 23 65 2a 6e 85 5d b9 46 3c 12 21 7d 6e 19 2c |.#e*n.].F<.!}n.,| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:| | 35 35 3a 31 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:19 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 31 34 20 2d 20 45 43 44 48 45 |xC0,0x14 - ECDHE| | 2d 52 53 41 2d 41 45 53 32 35 36 2d 53 48 41 20 |-RSA-AES256-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH| | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1Xf..| | d9 73 c8 a3 eb 8b 98 83 a7 72 69 2d 1f e2 11 26 |.s.......ri-...&| | 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................| ssl_decrypt_record found padding 15 final len 384 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 6a 86 7d 10 91 da 1f 86 1f 43 33 e2 2a 04 1b f4 |j.}......C3.*...| | fe af 57 14 |..W. | ssl_decrypt_record: mac failed association_find: TCP port 4494 found 0x34319f0 dissect_ssl enter frame #582 (first time) conversation = 0x7facef99c980, ssl_session = 0x7facc38686e0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 0d 9f 7c 74 f8 87 71 8e 5e 38 9a 57 a1 5b 60 41 |..|t..q.^8.W.[`A| | 6b ed d6 f2 79 d0 70 05 aa cc 1e 64 ef df 5a e1 |k...y.p....d..Z.| | c0 c6 55 70 67 03 c5 15 28 69 da 7f 25 32 1f b8 |..Upg...(i..%2..| Plaintext[48]: | 1d 5a e8 74 d0 2b 86 61 e7 5f 0e 98 f2 32 7e b2 |.Z.t.+.a._...2~.| | 01 00 b1 97 4c 4b 89 1e c1 dd ce e1 52 86 9e 65 |....LK......R..e| | fb 50 9f 1a cb 62 09 09 09 09 09 09 09 09 09 09 |.P...b..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | b1 97 4c 4b 89 1e c1 dd ce e1 52 86 9e 65 fb 50 |..LK......R..e.P| | 9f 1a cb 62 |...b | ssl_decrypt_record: mac ok dissect_ssl enter frame #584 (first time) conversation = 0x7facef99c980, ssl_session = 0x7facc38686e0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | ff 13 52 38 01 4f 68 66 3c 33 42 cf 61 f0 65 5e |..R8.Ohf<3B.a.e^| | 6e a5 b3 0b e5 01 d3 66 b0 ef e0 3e 5a da 8e 8c |n......f...>Z...| | d5 19 c6 95 eb 2f 15 1e 5d aa 0b 72 4f 96 a4 a3 |...../..]..rO...| Plaintext[48]: | 42 5e 49 b1 26 1f 4f a1 0e 6e 12 8b 1c 74 64 f6 |B^I.&.O..n...td.| | 01 00 80 22 ef 86 b1 fa 0b 63 8e bf 56 65 22 c9 |...".....c..Ve".| | 25 c3 1e 5e 60 df 09 09 09 09 09 09 09 09 09 09 |%..^`...........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 80 22 ef 86 b1 fa 0b 63 8e bf 56 65 22 c9 25 c3 |.".....c..Ve".%.| | 1e 5e 60 df |.^`. | ssl_decrypt_record: mac ok dissect_ssl enter frame #4 (already visited) conversation = 0x7facef996088, ssl_session = (nil) record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 dissect_ssl enter frame #6 (already visited) conversation = 0x7facef996088, ssl_session = (nil) record: offset = 0, reported_length_remaining = 1224 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 record: offset = 63, reported_length_remaining = 1161 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 349 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 12 offset 880 length 331 bytes, remaining 1215 record: offset = 1215, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 14 offset 1220 length 0 bytes, remaining 1224 dissect_ssl enter frame #8 (already visited) conversation = 0x7facef996088, ssl_session = (nil) record: offset = 0, reported_length_remaining = 118 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 record: offset = 75, reported_length_remaining = 43 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec record: offset = 81, reported_length_remaining = 37 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #128 (already visited) conversation = 0x7facef9977c0, ssl_session = (nil) record: offset = 0, reported_length_remaining = 198 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 record: offset = 139, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec record: offset = 145, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #9 (already visited) conversation = 0x7facef996088, ssl_session = (nil) record: offset = 0, reported_length_remaining = 218 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 43 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec record: offset = 181, reported_length_remaining = 37 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #10 (already visited) conversation = 0x7facef996088, ssl_session = (nil) record: offset = 0, reported_length_remaining = 86 dissect_ssl3_record: content_type 23 Application Data association_find: TCP port 40165 found (nil) association_find: TCP port 4434 found 0x33f9600 dissect_ssl3_record decrypted len 65 decrypted app data fragment[65]: | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 78 70 2d 72 63 34 2d 6d 64 |Host: exp-rc4-md| | 35 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |5.local.al.leken| | 73 74 65 79 6e 2e 6e 6c 3a 34 34 33 34 0d 0a 0d |steyn.nl:4434...| | 0a |. | dissect_ssl3_record found association 0x33f9600 dissect_ssl enter frame #11 (already visited) conversation = 0x7facef996088, ssl_session = (nil) record: offset = 0, reported_length_remaining = 376 dissect_ssl3_record: content_type 23 Application Data association_find: TCP port 4434 found 0x33f9600 dissect_ssl3_record decrypted len 355 decrypted app data fragment[355]: | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:| | 35 35 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:11 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 38 0d 0a 43 6f 6e 6e 65 63 74 |th: 148..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 30 33 20 2d 20 45 58 50 2d 52 |x00,0x03 - EXP-R| | 43 34 2d 4d 44 35 20 20 20 20 20 20 20 20 20 20 |C4-MD5 | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 28 | SSLv3 Kx=RSA(| | 35 31 32 29 20 41 75 3d 52 53 41 20 20 45 6e 63 |512) Au=RSA Enc| | 3d 52 43 34 28 34 30 29 20 20 20 4d 61 63 3d 4d |=RC4(40) Mac=M| | 44 35 20 20 65 78 70 6f 72 74 3c 73 63 72 69 70 |D5 exportdocument.domai| | 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |n='local.al.leke| | 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 |nsteyn.nl' | dissect_ssl3_record found association 0x33f9600 dissect_ssl enter frame #12 (already visited) conversation = 0x7facef996088, ssl_session = (nil) record: offset = 0, reported_length_remaining = 23 dissect_ssl3_record: content_type 21 Alert dissect_ssl enter frame #14 (already visited) conversation = 0x7facef996088, ssl_session = (nil) record: offset = 0, reported_length_remaining = 23 dissect_ssl3_record: content_type 21 Alert