Wireshark SSL debug log dissect_ssl enter frame #4 (first time) ssl_session_init: initializing ptr 0x7fca45bc7060 size 688 conversation = 0x7fca71dec088, ssl_session = 0x7fca45bc7060 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 43113 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4437 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #6 (first time) conversation = 0x7fca71dec088, ssl_session = 0x7fca45bc7060 record: offset = 0, reported_length_remaining = 1224 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session can't find stored session trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA found master secret in key log cannot find master secret in keylog file either dissect_ssl3_hnd_srv_hello found CIPHER 0x0006 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 10 22 80 71 ca 87 eb 4b b1 84 ac ec 91 eb 50 78 |.".q...K......Px| | 75 dd e5 f6 01 00 0e 99 cf 82 e8 17 6d 45 b6 af |u...........mE..| | a4 16 a6 8a 6e 54 56 10 17 ae 71 1d 7d 48 94 fa |....nTV...q.}H..| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | ee c1 c5 a3 50 c9 24 cc 9b 3b 9e 48 af 39 91 ec |....P.$..;.H.9..| | ab b7 b8 62 bd cd 03 92 7b 29 e6 5f a5 52 34 c2 |...b....{)._.R4.| | ee 38 b6 26 be 64 58 49 cc 59 84 f3 01 47 08 e6 |.8.&.dXI.Y...G..| | d5 34 b0 9f d6 e5 ce aa 97 99 ae 72 06 |.4.........r. | hash out[88]: | 46 37 9d c8 4c 87 74 a9 80 dd ad 17 ee b7 55 a8 |F7..L.t.......U.| | 79 d7 00 e7 6f 24 06 60 4f 04 d3 91 9a 4c 1a 8b |y...o$.`O....L..| | 0c 2a 6c 2c c7 16 0d c7 b2 d1 b1 8c e4 77 08 46 |.*l,.........w.F| | e8 c7 f4 83 8e 3e f7 7d 6b e9 94 94 39 96 d7 a9 |.....>.}k...9...| | 2f 21 98 f5 af cc da f8 22 c5 f0 99 c2 b1 5b 17 |/!......".....[.| | 43 5a 67 91 d3 be 45 96 |CZg...E. | PRF out[88]: | 46 37 9d c8 4c 87 74 a9 80 dd ad 17 ee b7 55 a8 |F7..L.t.......U.| | 79 d7 00 e7 6f 24 06 60 4f 04 d3 91 9a 4c 1a 8b |y...o$.`O....L..| | 0c 2a 6c 2c c7 16 0d c7 b2 d1 b1 8c e4 77 08 46 |.*l,.........w.F| | e8 c7 f4 83 8e 3e f7 7d 6b e9 94 94 39 96 d7 a9 |.....>.}k...9...| | 2f 21 98 f5 af cc da f8 22 c5 f0 99 c2 b1 5b 17 |/!......".....[.| | 43 5a 67 91 d3 be 45 96 |CZg...E. | key expansion[88]: | 46 37 9d c8 4c 87 74 a9 80 dd ad 17 ee b7 55 a8 |F7..L.t.......U.| | 79 d7 00 e7 6f 24 06 60 4f 04 d3 91 9a 4c 1a 8b |y...o$.`O....L..| | 0c 2a 6c 2c c7 16 0d c7 b2 d1 b1 8c e4 77 08 46 |.*l,.........w.F| | e8 c7 f4 83 8e 3e f7 7d 6b e9 94 94 39 96 d7 a9 |.....>.}k...9...| | 2f 21 98 f5 af cc da f8 22 c5 f0 99 c2 b1 5b 17 |/!......".....[.| | 43 5a 67 91 d3 be 45 96 |CZg...E. | ssl_generate_keyring_material prf(iv_block) tls12_prf: tls_hash(hash_alg SHA256 secret_len 0 seed_len 72 ) tls_hash: hash secret[0]: tls_hash: hash seed[72]: | 49 56 20 62 6c 6f 63 6b 52 34 c2 ee 38 b6 26 be |IV blockR4..8.&.| | 64 58 49 cc 59 84 f3 01 47 08 e6 d5 34 b0 9f d6 |dXI.Y...G...4...| | e5 ce aa 97 99 ae 72 06 52 34 c2 ee c1 c5 a3 50 |......r.R4.....P| | c9 24 cc 9b 3b 9e 48 af 39 91 ec ab b7 b8 62 bd |.$..;.H.9.....b.| | cd 03 92 7b 29 e6 5f a5 |...{)._. | hash out[16]: | b0 73 be 7d 7d b6 27 9b ad 51 55 fa 0c eb 2b c7 |.s.}}.'..QU...+.| PRF out[16]: | b0 73 be 7d 7d b6 27 9b ad 51 55 fa 0c eb 2b c7 |.s.}}.'..QU...+.| ssl_generate_keyring_material PRF(key_c) tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 ) tls_hash: hash secret[5]: | b2 d1 b1 8c e4 |..... | tls_hash: hash seed[80]: | 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key| | 52 34 c2 ee 38 b6 26 be 64 58 49 cc 59 84 f3 01 |R4..8.&.dXI.Y...| | 47 08 e6 d5 34 b0 9f d6 e5 ce aa 97 99 ae 72 06 |G...4.........r.| | 52 34 c2 ee c1 c5 a3 50 c9 24 cc 9b 3b 9e 48 af |R4.....P.$..;.H.| | 39 91 ec ab b7 b8 62 bd cd 03 92 7b 29 e6 5f a5 |9.....b....{)._.| hash out[32]: | a2 f6 2c 86 b7 94 82 41 92 96 64 27 ef 62 d4 c7 |..,....A..d'.b..| | a5 88 98 f8 d5 f6 a3 fa 9a f6 f3 89 6c 22 c4 1d |............l"..| PRF out[32]: | a2 f6 2c 86 b7 94 82 41 92 96 64 27 ef 62 d4 c7 |..,....A..d'.b..| | a5 88 98 f8 d5 f6 a3 fa 9a f6 f3 89 6c 22 c4 1d |............l"..| ssl_generate_keyring_material PRF(key_s) tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 ) tls_hash: hash secret[5]: | 77 08 46 e8 c7 |w.F.. | tls_hash: hash seed[80]: | 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key| | 52 34 c2 ee 38 b6 26 be 64 58 49 cc 59 84 f3 01 |R4..8.&.dXI.Y...| | 47 08 e6 d5 34 b0 9f d6 e5 ce aa 97 99 ae 72 06 |G...4.........r.| | 52 34 c2 ee c1 c5 a3 50 c9 24 cc 9b 3b 9e 48 af |R4.....P.$..;.H.| | 39 91 ec ab b7 b8 62 bd cd 03 92 7b 29 e6 5f a5 |9.....b....{)._.| hash out[32]: | 91 32 2f eb c9 a1 0e 7f 91 bc f1 5b d5 9b f3 c4 |.2/........[....| | b4 45 3f 39 31 dd 82 4c e9 49 5e c1 e6 16 bf a8 |.E?91..L.I^.....| PRF out[32]: | 91 32 2f eb c9 a1 0e 7f 91 bc f1 5b d5 9b f3 c4 |.2/........[....| | b4 45 3f 39 31 dd 82 4c e9 49 5e c1 e6 16 bf a8 |.E?91..L.I^.....| Client MAC key[20]: | 46 37 9d c8 4c 87 74 a9 80 dd ad 17 ee b7 55 a8 |F7..L.t.......U.| | 79 d7 00 e7 |y... | Server MAC key[20]: | 6f 24 06 60 4f 04 d3 91 9a 4c 1a 8b 0c 2a 6c 2c |o$.`O....L...*l,| | c7 16 0d c7 |.... | Client Write key[16]: | a2 f6 2c 86 b7 94 82 41 92 96 64 27 ef 62 d4 c7 |..,....A..d'.b..| Server Write key[16]: | 91 32 2f eb c9 a1 0e 7f 91 bc f1 5b d5 9b f3 c4 |.2/........[....| Client Write IV[8]: | b0 73 be 7d 7d b6 27 9b |.s.}}.'. | Server Write IV[8]: | ad 51 55 fa 0c eb 2b c7 |.QU...+. | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: RC2 ssl_create_decoder can't find cipher RC2 ssl_generate_keyring_material can't init client decoder dissect_ssl3_hnd_srv_hello can't generate keyring material record: offset = 63, reported_length_remaining = 1161 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x37 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 349 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 335, ssl state 0x37 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 880 length 331 bytes, remaining 1215 record: offset = 1215, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x37 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1220 length 0 bytes, remaining 1224 dissect_ssl enter frame #8 (first time) conversation = 0x7fca71dec088, ssl_session = 0x7fca45bc7060 record: offset = 0, reported_length_remaining = 134 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 70, ssl state 0x37 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6... looking for RSA pre-master30a7a60a13047dcb872bf94c040e59eacf05bf8ac168b7ad... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 10 22 80 71 ca 87 eb 4b b1 84 ac ec 91 eb 50 78 |.".q...K......Px| | 75 dd e5 f6 01 00 0e 99 cf 82 e8 17 6d 45 b6 af |u...........mE..| | a4 16 a6 8a 6e 54 56 10 17 ae 71 1d 7d 48 94 fa |....nTV...q.}H..| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | ee c1 c5 a3 50 c9 24 cc 9b 3b 9e 48 af 39 91 ec |....P.$..;.H.9..| | ab b7 b8 62 bd cd 03 92 7b 29 e6 5f a5 52 34 c2 |...b....{)._.R4.| | ee 38 b6 26 be 64 58 49 cc 59 84 f3 01 47 08 e6 |.8.&.dXI.Y...G..| | d5 34 b0 9f d6 e5 ce aa 97 99 ae 72 06 |.4.........r. | hash out[88]: | 46 37 9d c8 4c 87 74 a9 80 dd ad 17 ee b7 55 a8 |F7..L.t.......U.| | 79 d7 00 e7 6f 24 06 60 4f 04 d3 91 9a 4c 1a 8b |y...o$.`O....L..| | 0c 2a 6c 2c c7 16 0d c7 b2 d1 b1 8c e4 77 08 46 |.*l,.........w.F| | e8 c7 f4 83 8e 3e f7 7d 6b e9 94 94 39 96 d7 a9 |.....>.}k...9...| | 2f 21 98 f5 af cc da f8 22 c5 f0 99 c2 b1 5b 17 |/!......".....[.| | 43 5a 67 91 d3 be 45 96 |CZg...E. | PRF out[88]: | 46 37 9d c8 4c 87 74 a9 80 dd ad 17 ee b7 55 a8 |F7..L.t.......U.| | 79 d7 00 e7 6f 24 06 60 4f 04 d3 91 9a 4c 1a 8b |y...o$.`O....L..| | 0c 2a 6c 2c c7 16 0d c7 b2 d1 b1 8c e4 77 08 46 |.*l,.........w.F| | e8 c7 f4 83 8e 3e f7 7d 6b e9 94 94 39 96 d7 a9 |.....>.}k...9...| | 2f 21 98 f5 af cc da f8 22 c5 f0 99 c2 b1 5b 17 |/!......".....[.| | 43 5a 67 91 d3 be 45 96 |CZg...E. | key expansion[88]: | 46 37 9d c8 4c 87 74 a9 80 dd ad 17 ee b7 55 a8 |F7..L.t.......U.| | 79 d7 00 e7 6f 24 06 60 4f 04 d3 91 9a 4c 1a 8b |y...o$.`O....L..| | 0c 2a 6c 2c c7 16 0d c7 b2 d1 b1 8c e4 77 08 46 |.*l,.........w.F| | e8 c7 f4 83 8e 3e f7 7d 6b e9 94 94 39 96 d7 a9 |.....>.}k...9...| | 2f 21 98 f5 af cc da f8 22 c5 f0 99 c2 b1 5b 17 |/!......".....[.| | 43 5a 67 91 d3 be 45 96 |CZg...E. | ssl_generate_keyring_material prf(iv_block) tls12_prf: tls_hash(hash_alg SHA256 secret_len 0 seed_len 72 ) tls_hash: hash secret[0]: tls_hash: hash seed[72]: | 49 56 20 62 6c 6f 63 6b 52 34 c2 ee 38 b6 26 be |IV blockR4..8.&.| | 64 58 49 cc 59 84 f3 01 47 08 e6 d5 34 b0 9f d6 |dXI.Y...G...4...| | e5 ce aa 97 99 ae 72 06 52 34 c2 ee c1 c5 a3 50 |......r.R4.....P| | c9 24 cc 9b 3b 9e 48 af 39 91 ec ab b7 b8 62 bd |.$..;.H.9.....b.| | cd 03 92 7b 29 e6 5f a5 |...{)._. | hash out[16]: | b0 73 be 7d 7d b6 27 9b ad 51 55 fa 0c eb 2b c7 |.s.}}.'..QU...+.| PRF out[16]: | b0 73 be 7d 7d b6 27 9b ad 51 55 fa 0c eb 2b c7 |.s.}}.'..QU...+.| ssl_generate_keyring_material PRF(key_c) tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 ) tls_hash: hash secret[5]: | b2 d1 b1 8c e4 |..... | tls_hash: hash seed[80]: | 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key| | 52 34 c2 ee 38 b6 26 be 64 58 49 cc 59 84 f3 01 |R4..8.&.dXI.Y...| | 47 08 e6 d5 34 b0 9f d6 e5 ce aa 97 99 ae 72 06 |G...4.........r.| | 52 34 c2 ee c1 c5 a3 50 c9 24 cc 9b 3b 9e 48 af |R4.....P.$..;.H.| | 39 91 ec ab b7 b8 62 bd cd 03 92 7b 29 e6 5f a5 |9.....b....{)._.| hash out[32]: | a2 f6 2c 86 b7 94 82 41 92 96 64 27 ef 62 d4 c7 |..,....A..d'.b..| | a5 88 98 f8 d5 f6 a3 fa 9a f6 f3 89 6c 22 c4 1d |............l"..| PRF out[32]: | a2 f6 2c 86 b7 94 82 41 92 96 64 27 ef 62 d4 c7 |..,....A..d'.b..| | a5 88 98 f8 d5 f6 a3 fa 9a f6 f3 89 6c 22 c4 1d |............l"..| ssl_generate_keyring_material PRF(key_s) tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 ) tls_hash: hash secret[5]: | 77 08 46 e8 c7 |w.F.. | tls_hash: hash seed[80]: | 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key| | 52 34 c2 ee 38 b6 26 be 64 58 49 cc 59 84 f3 01 |R4..8.&.dXI.Y...| | 47 08 e6 d5 34 b0 9f d6 e5 ce aa 97 99 ae 72 06 |G...4.........r.| | 52 34 c2 ee c1 c5 a3 50 c9 24 cc 9b 3b 9e 48 af |R4.....P.$..;.H.| | 39 91 ec ab b7 b8 62 bd cd 03 92 7b 29 e6 5f a5 |9.....b....{)._.| hash out[32]: | 91 32 2f eb c9 a1 0e 7f 91 bc f1 5b d5 9b f3 c4 |.2/........[....| | b4 45 3f 39 31 dd 82 4c e9 49 5e c1 e6 16 bf a8 |.E?91..L.I^.....| PRF out[32]: | 91 32 2f eb c9 a1 0e 7f 91 bc f1 5b d5 9b f3 c4 |.2/........[....| | b4 45 3f 39 31 dd 82 4c e9 49 5e c1 e6 16 bf a8 |.E?91..L.I^.....| Client MAC key[20]: | 46 37 9d c8 4c 87 74 a9 80 dd ad 17 ee b7 55 a8 |F7..L.t.......U.| | 79 d7 00 e7 |y... | Server MAC key[20]: | 6f 24 06 60 4f 04 d3 91 9a 4c 1a 8b 0c 2a 6c 2c |o$.`O....L...*l,| | c7 16 0d c7 |.... | Client Write key[16]: | a2 f6 2c 86 b7 94 82 41 92 96 64 27 ef 62 d4 c7 |..,....A..d'.b..| Server Write key[16]: | 91 32 2f eb c9 a1 0e 7f 91 bc f1 5b d5 9b f3 c4 |.2/........[....| Client Write IV[8]: | b0 73 be 7d 7d b6 27 9b |.s.}}.'. | Server Write IV[8]: | ad 51 55 fa 0c eb 2b c7 |.QU...+. | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: RC2 ssl_create_decoder can't find cipher RC2 ssl_generate_keyring_material can't init client decoder dissect_ssl3_handshake can't generate keyring material record: offset = 75, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 81, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x37 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 9 offset 86 length 8168366 bytes, remaining 134 dissect_ssl enter frame #9 (first time) conversation = 0x7fca71dec088, ssl_session = 0x7fca45bc7060 record: offset = 0, reported_length_remaining = 234 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x37 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x37 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 9 offset 186 length 12721791 bytes, remaining 234 dissect_ssl enter frame #10 (first time) conversation = 0x7fca71dec088, ssl_session = 0x7fca45bc7060 record: offset = 0, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 96, ssl state 0x37 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available association_find: TCP port 43113 found (nil) association_find: TCP port 4437 found 0x27eeca0 dissect_ssl enter frame #11 (first time) conversation = 0x7fca71dec088, ssl_session = 0x7fca45bc7060 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x37 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available association_find: TCP port 4437 found 0x27eeca0 dissect_ssl enter frame #12 (first time) conversation = 0x7fca71dec088, ssl_session = 0x7fca45bc7060 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x37 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl enter frame #14 (first time) conversation = 0x7fca71dec088, ssl_session = 0x7fca45bc7060 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x37 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl enter frame #19 (first time) ssl_session_init: initializing ptr 0x7fca45bc8f50 size 688 conversation = 0x7fca71dec330, ssl_session = 0x7fca45bc8f50 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 53191 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4438 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #21 (first time) conversation = 0x7fca71dec330, ssl_session = 0x7fca45bc8f50 record: offset = 0, reported_length_remaining = 884 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session can't find stored session trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C found master secret in key log cannot find master secret in keylog file either dissect_ssl3_hnd_srv_hello found CIPHER 0x0007 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 0a a2 45 17 50 13 8d 1d c5 8d a3 c7 37 10 55 9e |..E.P.......7.U.| | 43 07 ea a2 c7 86 07 d4 b2 21 92 df d0 03 1d af |C........!......| | cf 5e 6e 94 c6 af 47 2d ef 55 e1 60 24 84 99 9c |.^n...G-.U.`$...| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | ee 0c c7 c1 54 0e 8c e7 b5 23 a2 e1 31 b7 54 1e |....T....#..1.T.| | 93 f1 7a 52 3b 4f 4a ab 3e 02 8c 7d 33 52 34 c2 |..zR;OJ.>..}3R4.| | ee d1 30 5b 25 3a 1e ed 99 b3 a4 1b 17 2a 37 8c |..0[%:.......*7.| | 35 07 3d b2 c9 c7 e7 87 24 86 27 6f e5 |5.=.....$.'o. | hash out[88]: | 0b 01 07 6a 16 80 b9 6b db 87 a6 02 bd db 8f 5c |...j...k.......\| | 5f fb fc 41 a6 51 f0 3a b7 1f e8 3f a1 3b b7 a6 |_..A.Q.:...?.;..| | 06 7e a1 5e 1d 17 a7 20 be 2c ee ac cb 66 30 e2 |.~.^... .,...f0.| | 39 0e 4f 63 e7 fe b2 c3 6e 4d 85 06 06 34 05 6e |9.Oc....nM...4.n| | 90 1e 4d 70 cd 5d d1 47 5e a4 65 6c 46 d6 c5 4c |..Mp.].G^.elF..L| | c0 97 04 bf 12 84 6c 9d |......l. | PRF out[88]: | 0b 01 07 6a 16 80 b9 6b db 87 a6 02 bd db 8f 5c |...j...k.......\| | 5f fb fc 41 a6 51 f0 3a b7 1f e8 3f a1 3b b7 a6 |_..A.Q.:...?.;..| | 06 7e a1 5e 1d 17 a7 20 be 2c ee ac cb 66 30 e2 |.~.^... .,...f0.| | 39 0e 4f 63 e7 fe b2 c3 6e 4d 85 06 06 34 05 6e |9.Oc....nM...4.n| | 90 1e 4d 70 cd 5d d1 47 5e a4 65 6c 46 d6 c5 4c |..Mp.].G^.elF..L| | c0 97 04 bf 12 84 6c 9d |......l. | key expansion[88]: | 0b 01 07 6a 16 80 b9 6b db 87 a6 02 bd db 8f 5c |...j...k.......\| | 5f fb fc 41 a6 51 f0 3a b7 1f e8 3f a1 3b b7 a6 |_..A.Q.:...?.;..| | 06 7e a1 5e 1d 17 a7 20 be 2c ee ac cb 66 30 e2 |.~.^... .,...f0.| | 39 0e 4f 63 e7 fe b2 c3 6e 4d 85 06 06 34 05 6e |9.Oc....nM...4.n| | 90 1e 4d 70 cd 5d d1 47 5e a4 65 6c 46 d6 c5 4c |..Mp.].G^.elF..L| | c0 97 04 bf 12 84 6c 9d |......l. | Client MAC key[20]: | 0b 01 07 6a 16 80 b9 6b db 87 a6 02 bd db 8f 5c |...j...k.......\| | 5f fb fc 41 |_..A | Server MAC key[20]: | a6 51 f0 3a b7 1f e8 3f a1 3b b7 a6 06 7e a1 5e |.Q.:...?.;...~.^| | 1d 17 a7 20 |... | Client Write key[16]: | be 2c ee ac cb 66 30 e2 39 0e 4f 63 e7 fe b2 c3 |.,...f0.9.Oc....| Server Write key[16]: | 6e 4d 85 06 06 34 05 6e 90 1e 4d 70 cd 5d d1 47 |nM...4.n..Mp.].G| Client Write IV[8]: | 5e a4 65 6c 46 d6 c5 4c |^.elF..L | Server Write IV[8]: | c0 97 04 bf 12 84 6c 9d |......l. | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: IDEA decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: IDEA decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 821 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884 dissect_ssl enter frame #23 (first time) conversation = 0x7fca71dec330, ssl_session = 0x7fca45bc8f50 record: offset = 0, reported_length_remaining = 326 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 262, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9... looking for RSA pre-master52f8202b517f99057c766288a8a758a0459e87d4f295bf1b... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 0a a2 45 17 50 13 8d 1d c5 8d a3 c7 37 10 55 9e |..E.P.......7.U.| | 43 07 ea a2 c7 86 07 d4 b2 21 92 df d0 03 1d af |C........!......| | cf 5e 6e 94 c6 af 47 2d ef 55 e1 60 24 84 99 9c |.^n...G-.U.`$...| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | ee 0c c7 c1 54 0e 8c e7 b5 23 a2 e1 31 b7 54 1e |....T....#..1.T.| | 93 f1 7a 52 3b 4f 4a ab 3e 02 8c 7d 33 52 34 c2 |..zR;OJ.>..}3R4.| | ee d1 30 5b 25 3a 1e ed 99 b3 a4 1b 17 2a 37 8c |..0[%:.......*7.| | 35 07 3d b2 c9 c7 e7 87 24 86 27 6f e5 |5.=.....$.'o. | hash out[88]: | 0b 01 07 6a 16 80 b9 6b db 87 a6 02 bd db 8f 5c |...j...k.......\| | 5f fb fc 41 a6 51 f0 3a b7 1f e8 3f a1 3b b7 a6 |_..A.Q.:...?.;..| | 06 7e a1 5e 1d 17 a7 20 be 2c ee ac cb 66 30 e2 |.~.^... .,...f0.| | 39 0e 4f 63 e7 fe b2 c3 6e 4d 85 06 06 34 05 6e |9.Oc....nM...4.n| | 90 1e 4d 70 cd 5d d1 47 5e a4 65 6c 46 d6 c5 4c |..Mp.].G^.elF..L| | c0 97 04 bf 12 84 6c 9d |......l. | PRF out[88]: | 0b 01 07 6a 16 80 b9 6b db 87 a6 02 bd db 8f 5c |...j...k.......\| | 5f fb fc 41 a6 51 f0 3a b7 1f e8 3f a1 3b b7 a6 |_..A.Q.:...?.;..| | 06 7e a1 5e 1d 17 a7 20 be 2c ee ac cb 66 30 e2 |.~.^... .,...f0.| | 39 0e 4f 63 e7 fe b2 c3 6e 4d 85 06 06 34 05 6e |9.Oc....nM...4.n| | 90 1e 4d 70 cd 5d d1 47 5e a4 65 6c 46 d6 c5 4c |..Mp.].G^.elF..L| | c0 97 04 bf 12 84 6c 9d |......l. | key expansion[88]: | 0b 01 07 6a 16 80 b9 6b db 87 a6 02 bd db 8f 5c |...j...k.......\| | 5f fb fc 41 a6 51 f0 3a b7 1f e8 3f a1 3b b7 a6 |_..A.Q.:...?.;..| | 06 7e a1 5e 1d 17 a7 20 be 2c ee ac cb 66 30 e2 |.~.^... .,...f0.| | 39 0e 4f 63 e7 fe b2 c3 6e 4d 85 06 06 34 05 6e |9.Oc....nM...4.n| | 90 1e 4d 70 cd 5d d1 47 5e a4 65 6c 46 d6 c5 4c |..Mp.].G^.elF..L| | c0 97 04 bf 12 84 6c 9d |......l. | Client MAC key[20]: | 0b 01 07 6a 16 80 b9 6b db 87 a6 02 bd db 8f 5c |...j...k.......\| | 5f fb fc 41 |_..A | Server MAC key[20]: | a6 51 f0 3a b7 1f e8 3f a1 3b b7 a6 06 7e a1 5e |.Q.:...?.;...~.^| | 1d 17 a7 20 |... | Client Write key[16]: | be 2c ee ac cb 66 30 e2 39 0e 4f 63 e7 fe b2 c3 |.,...f0.9.Oc....| Server Write key[16]: | 6e 4d 85 06 06 34 05 6e 90 1e 4d 70 cd 5d d1 47 |nM...4.n..Mp.].G| Client Write IV[8]: | 5e a4 65 6c 46 d6 c5 4c |^.elF..L | Server Write IV[8]: | c0 97 04 bf 12 84 6c 9d |......l. | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: IDEA decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: IDEA decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 0a a2 45 17 50 13 8d 1d c5 8d a3 c7 37 10 55 9e |..E.P.......7.U.| | 43 07 ea a2 c7 86 07 d4 b2 21 92 df d0 03 1d af |C........!......| | cf 5e 6e 94 c6 af 47 2d ef 55 e1 60 24 84 99 9c |.^n...G-.U.`$...| dissect_ssl3_handshake session keys successfully generated record: offset = 267, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 273, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 8b 94 d6 88 39 f0 c5 50 f8 b7 72 3f a9 48 43 21 |....9..P..r?.HC!| | c1 13 60 f3 1f 2a 55 5b 23 18 e7 f3 13 c6 96 ac |..`..*U[#.......| | 42 cc f9 44 49 15 40 7b b9 0b 45 5a ff 5d 3a 31 |B..DI.@{..EZ.]:1| ssl_decrypt_record: allocating 80 bytes for decrypt data (old len 32) Plaintext[48]: | 89 cc 8f 2d ad c5 e3 cb 14 00 00 0c 73 d9 ee 6d |...-........s..m| | f6 70 12 03 26 63 19 82 54 12 36 dd 9a 01 28 6f |.p..&c..T.6...(o| | 8b d9 e3 f1 c8 77 e5 f4 7c a0 8e 4c 03 03 03 03 |.....w..|..L....| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 54 12 36 dd 9a 01 28 6f 8b d9 e3 f1 c8 77 e5 f4 |T.6...(o.....w..| | 7c a0 8e 4c ||..L | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #24 (first time) conversation = 0x7fca71dec330, ssl_session = 0x7fca45bc8f50 record: offset = 0, reported_length_remaining = 234 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 5a de 0f 98 f0 44 09 c9 4a 04 53 2e cc 69 aa 69 |Z....D..J.S..i.i| | 8e 42 b9 84 b6 66 5e 62 27 cd 0b c9 96 03 63 c9 |.B...f^b'.....c.| | 9d ee 16 31 9b 0e 51 32 4f 51 fa be e5 e9 9a 88 |...1..Q2OQ......| Plaintext[48]: | 5a ea 94 c9 90 8e c2 e0 14 00 00 0c 7d 92 82 0e |Z...........}...| | ef 51 11 23 3c e7 5f 04 eb 11 9f 11 72 f0 72 8b |.Q.#<._.....r.r.| | bc ea fc ce ae 86 c6 c2 e1 5b bc 0a 03 03 03 03 |.........[......| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | eb 11 9f 11 72 f0 72 8b bc ea fc ce ae 86 c6 c2 |....r.r.........| | e1 5b bc 0a |.[.. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #25 (first time) conversation = 0x7fca71dec330, ssl_session = 0x7fca45bc8f50 record: offset = 0, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 96, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 96 Ciphertext[96]: | db ef 11 b1 a9 cf 7e c2 67 c4 7a 56 00 25 ef f7 |......~.g.zV.%..| | f8 f5 1b b8 60 91 ae 0f 06 0a 3a 04 4b f4 3f d7 |....`.....:.K.?.| | 5d 17 bc d3 c3 93 0d f6 bf b2 1f ef ac 83 ab e2 |]...............| | 61 2f a4 bb 93 77 84 a8 96 73 5c 91 61 bd ae 73 |a/...w...s\.a..s| | 5d ab 76 00 10 dd c4 96 64 9c e0 8d 83 fb 5c 70 |].v.....d.....\p| | 05 d5 e7 ac 0c 43 86 04 da a0 bc 3e 02 c3 5c 37 |.....C.....>..\7| ssl_decrypt_record: allocating 128 bytes for decrypt data (old len 80) Plaintext[96]: | 22 48 fe 5b 33 3b 3f 62 47 45 54 20 2f 20 48 54 |"H.[3;?bGET / HT| | 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 69 64 |TP/1.1..Host: id| | 65 61 2d 63 62 63 2d 73 68 61 2e 6c 6f 63 61 6c |ea-cbc-sha.local| | 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n| | 6c 3a 34 34 33 38 0d 0a 0d 0a 50 bd d3 59 5e 6a |l:4438....P..Y^j| | 7f 7e 76 42 36 4c 81 b2 9b c7 5c 05 66 e8 01 01 |.~vB6L....\.f...| ssl_decrypt_record found padding 1 final len 94 checking mac (len 66, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 1f bc fd b5 97 13 b5 7e 67 5d 51 0d 63 94 b2 c0 |.......~g]Q.c...| | 05 92 3e 50 |..>P | ssl_decrypt_record: mac failed association_find: TCP port 53191 found (nil) association_find: TCP port 4438 found 0x36f72e0 dissect_ssl enter frame #26 (first time) conversation = 0x7fca71dec330, ssl_session = 0x7fca45bc8f50 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | 7e 76 ff c1 b8 94 43 f9 c9 32 9f b7 43 e3 54 c4 |~v....C..2..C.T.| | 27 81 bd 50 0b b4 7e 51 70 c4 6f 99 c0 d7 b1 19 |'..P..~Qp.o.....| | 13 52 6c 7f b6 c4 33 cd 25 61 89 88 c4 f0 19 6c |.Rl...3.%a.....l| | ec 41 63 3b e7 4d 31 21 54 b0 fb 7d 8f dc 6e fc |.Ac;.M1!T..}..n.| | 51 ba 00 73 8f 1e 13 c6 bf af 62 c4 da ee df d6 |Q..s......b.....| | 81 ea a7 a1 9e 6d 81 e5 f5 46 98 7b 6a 11 8f a9 |.....m...F.{j...| | 69 64 36 ae 59 fd 30 3b 7e 90 97 1d f2 c6 a5 54 |id6.Y.0;~......T| | be fa aa 02 3c b7 b0 ba 91 c8 11 99 fc 0d c1 e8 |....<...........| | 21 24 e9 e5 a4 fb bf 07 4b 79 94 73 c7 6b a3 57 |!$......Ky.s.k.W| | 4d 4f 5f 6f aa a2 6f 6d 2e 2c e0 50 4c bf 58 51 |MO_o..om.,.PL.XQ| | c6 5a 68 fd 4e d2 99 51 0f 85 00 94 d2 88 11 72 |.Zh.N..Q.......r| | af 7e 44 d4 1a 6d 26 44 4a 6b a7 25 43 19 72 32 |.~D..m&DJk.%C.r2| | ff 2f 39 e7 60 32 72 36 74 18 78 db b7 04 6a c8 |./9.`2r6t.x...j.| | 05 0b 4d be 0a ac 04 a8 28 d4 97 b4 5d df 48 ce |..M.....(...].H.| | 9a c0 f7 23 68 0a d2 6c 68 b8 f4 17 c9 8b 3a 1c |...#h..lh.....:.| | 42 b2 f9 2b ea 66 6a 40 62 12 91 36 11 15 6c 2e |B..+.fj@b..6..l.| | da f2 28 c4 de 64 21 93 81 b0 ab d5 37 e6 a2 7c |..(..d!.....7..|| | f9 32 57 46 69 71 b1 b5 8b 58 54 f8 99 26 56 68 |.2WFiq...XT..&Vh| | 20 d1 bc 3f a3 20 01 d2 63 fc f9 ba 1d b4 cf e0 | ..?. ..c.......| | 4f 70 5c a0 e1 1b 2e 82 8a 02 cc 8e a4 6d bc 0b |Op\..........m..| | a1 39 b3 08 b4 3e 05 a2 ea 9b 11 b4 f8 10 2a db |.9...>........*.| | 8a ab 94 b6 80 b5 71 6f 9f b0 a4 93 65 5d d8 47 |......qo....e].G| | 88 90 f2 2e fd 9d e2 f0 0b c5 7c bf 25 b2 c2 55 |..........|.%..U| | ad 1a 8d 81 ef 1a cb d4 f4 3d e0 f5 cd 63 e1 c2 |.........=...c..| ssl_decrypt_record: allocating 416 bytes for decrypt data (old len 128) Plaintext[384]: | a9 83 b0 4b bb 6f f2 f6 48 54 54 50 2f 31 2e 31 |...K.o..HTTP/1.1| | 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:| | 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da| | 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep | | 32 30 31 33 20 32 30 3a 31 31 3a 32 36 20 47 4d |2013 20:11:26 GM| | 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:| | 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont| | 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.| | 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo| | 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu| | 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00| | 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach| | 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca| | 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 30 37 |che....0x00,0x07| | 20 2d 20 49 44 45 41 2d 43 42 43 2d 53 48 41 20 | - IDEA-CBC-SHA | | 20 20 20 20 20 20 20 20 20 20 20 53 53 4c 76 33 | SSLv3| | 20 4b 78 3d 52 53 41 20 20 20 20 20 20 41 75 3d | Kx=RSA Au=| | 52 53 41 20 20 45 6e 63 3d 49 44 45 41 28 31 32 |RSA Enc=IDEA(12| | 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 |8) Mac=SHA1document.doma| | 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek| | 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'.o.c.v.O.I.j| | 2f ab f7 d7 a2 c5 cb 54 07 07 07 07 07 07 07 07 |/......T........| ssl_decrypt_record found padding 7 final len 376 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | a5 b3 22 d9 cb ff bb 2d 13 31 8b 0d 99 ae e6 10 |.."....-.1......| | 4d 27 43 48 |M'CH | ssl_decrypt_record: mac failed association_find: TCP port 4438 found 0x36f72e0 dissect_ssl enter frame #27 (first time) conversation = 0x7fca71dec330, ssl_session = 0x7fca45bc8f50 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 58 7d 74 ba 26 4e 44 9f a6 e9 b9 f4 35 d0 3d a4 |X}t.&ND.....5.=.| | 08 17 ce 7f 9c 8b f1 74 16 2b a7 3a 54 88 39 64 |.......t.+.:T.9d| Plaintext[32]: | 37 2a 87 56 dc 8d ae 99 01 00 91 ca 46 c7 48 f0 |7*.V........F.H.| | 6c 31 2b 39 87 04 69 d8 a7 41 ca 6d 78 3d 01 01 |l1+9..i..A.mx=..| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 91 ca 46 c7 48 f0 6c 31 2b 39 87 04 69 d8 a7 41 |..F.H.l1+9..i..A| | ca 6d 78 3d |.mx= | ssl_decrypt_record: mac ok dissect_ssl enter frame #29 (first time) conversation = 0x7fca71dec330, ssl_session = 0x7fca45bc8f50 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | e7 c0 f1 d5 5a f9 6c b2 93 d1 64 d9 1a 7f 63 e7 |....Z.l...d...c.| | 3e 84 b1 ad 6b e7 cc 07 8d f2 e0 67 3f c1 0a 55 |>...k......g?..U| Plaintext[32]: | 2b f5 68 b1 f5 db 20 23 01 00 7d 41 e5 42 17 fe |+.h... #..}A.B..| | 46 bd 0c 3c 4d e3 2f 0f fd 08 22 58 64 f5 01 01 |F.. state 0x01 dissect_ssl enter frame #36 (first time) conversation = 0x7fca71dec5d8, ssl_session = 0x7fca45bcb520 record: offset = 0, reported_length_remaining = 1224 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0008 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 0a a2 45 17 50 13 8d 1d c5 8d a3 c7 37 10 55 9e |..E.P.......7.U.| | 43 07 ea a2 c7 86 07 d4 b2 21 92 df d0 03 1d af |C........!......| | cf 5e 6e 94 c6 af 47 2d ef 55 e1 60 24 84 99 9c |.^n...G-.U.`$...| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | ee bd c1 e5 e7 7a 46 d6 4e b4 b6 05 3c c2 41 1e |.....zF.N...<.A.| | dc 8e 2b ba 74 0c 52 2c 90 0f 0e 6c 5a 52 34 c2 |..+.t.R,...lZR4.| | ee a5 c9 9d c7 f6 a2 83 8e 5f b1 9c 19 e7 ba f5 |........._......| | 82 a5 45 34 b8 58 3e ec 8f c2 59 f2 c7 |..E4.X>...Y.. | hash out[72]: | f3 18 c2 88 d8 68 85 b0 9b 01 40 f5 b9 6c 3e 3e |.....h....@..l>>| | 5b 87 77 05 7c cc 80 d6 7a ee 6a 4b b5 6c 5b 70 |[.w.|...z.jK.l[p| | 2b 5d 00 5e e4 85 4d b6 b1 ef af 37 22 b6 a8 a3 |+].^..M....7"...| | 79 ad c3 8a 20 f3 2b 0e 29 e6 95 c0 d7 8d 85 06 |y... .+.).......| | b7 0f 88 7a 70 cb 20 1b |...zp. . | PRF out[72]: | f3 18 c2 88 d8 68 85 b0 9b 01 40 f5 b9 6c 3e 3e |.....h....@..l>>| | 5b 87 77 05 7c cc 80 d6 7a ee 6a 4b b5 6c 5b 70 |[.w.|...z.jK.l[p| | 2b 5d 00 5e e4 85 4d b6 b1 ef af 37 22 b6 a8 a3 |+].^..M....7"...| | 79 ad c3 8a 20 f3 2b 0e 29 e6 95 c0 d7 8d 85 06 |y... .+.).......| | b7 0f 88 7a 70 cb 20 1b |...zp. . | key expansion[72]: | f3 18 c2 88 d8 68 85 b0 9b 01 40 f5 b9 6c 3e 3e |.....h....@..l>>| | 5b 87 77 05 7c cc 80 d6 7a ee 6a 4b b5 6c 5b 70 |[.w.|...z.jK.l[p| | 2b 5d 00 5e e4 85 4d b6 b1 ef af 37 22 b6 a8 a3 |+].^..M....7"...| | 79 ad c3 8a 20 f3 2b 0e 29 e6 95 c0 d7 8d 85 06 |y... .+.).......| | b7 0f 88 7a 70 cb 20 1b |...zp. . | ssl_generate_keyring_material prf(iv_block) tls12_prf: tls_hash(hash_alg SHA256 secret_len 0 seed_len 72 ) tls_hash: hash secret[0]: tls_hash: hash seed[72]: | 49 56 20 62 6c 6f 63 6b 52 34 c2 ee a5 c9 9d c7 |IV blockR4......| | f6 a2 83 8e 5f b1 9c 19 e7 ba f5 82 a5 45 34 b8 |...._........E4.| | 58 3e ec 8f c2 59 f2 c7 52 34 c2 ee bd c1 e5 e7 |X>...Y..R4......| | 7a 46 d6 4e b4 b6 05 3c c2 41 1e dc 8e 2b ba 74 |zF.N...<.A...+.t| | 0c 52 2c 90 0f 0e 6c 5a |.R,...lZ | hash out[16]: | 79 3b 01 46 6c 9c d2 40 5a b1 9b a2 e8 58 10 ff |y;.Fl..@Z....X..| PRF out[16]: | 79 3b 01 46 6c 9c d2 40 5a b1 9b a2 e8 58 10 ff |y;.Fl..@Z....X..| ssl_generate_keyring_material PRF(key_c) tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 ) tls_hash: hash secret[5]: | b1 ef af 37 22 |...7" | tls_hash: hash seed[80]: | 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key| | 52 34 c2 ee a5 c9 9d c7 f6 a2 83 8e 5f b1 9c 19 |R4.........._...| | e7 ba f5 82 a5 45 34 b8 58 3e ec 8f c2 59 f2 c7 |.....E4.X>...Y..| | 52 34 c2 ee bd c1 e5 e7 7a 46 d6 4e b4 b6 05 3c |R4......zF.N...<| | c2 41 1e dc 8e 2b ba 74 0c 52 2c 90 0f 0e 6c 5a |.A...+.t.R,...lZ| hash out[32]: | bb 81 e4 2d 52 b5 40 1d 87 03 cd bc 73 fb 07 b3 |...-R.@.....s...| | 63 8a 2f 9e 36 81 38 39 33 e4 f4 39 f2 d7 a0 f1 |c./.6.893..9....| PRF out[32]: | bb 81 e4 2d 52 b5 40 1d 87 03 cd bc 73 fb 07 b3 |...-R.@.....s...| | 63 8a 2f 9e 36 81 38 39 33 e4 f4 39 f2 d7 a0 f1 |c./.6.893..9....| ssl_generate_keyring_material PRF(key_s) tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 ) tls_hash: hash secret[5]: | b6 a8 a3 79 ad |...y. | tls_hash: hash seed[80]: | 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key| | 52 34 c2 ee a5 c9 9d c7 f6 a2 83 8e 5f b1 9c 19 |R4.........._...| | e7 ba f5 82 a5 45 34 b8 58 3e ec 8f c2 59 f2 c7 |.....E4.X>...Y..| | 52 34 c2 ee bd c1 e5 e7 7a 46 d6 4e b4 b6 05 3c |R4......zF.N...<| | c2 41 1e dc 8e 2b ba 74 0c 52 2c 90 0f 0e 6c 5a |.A...+.t.R,...lZ| hash out[32]: | 48 d8 eb 1f 78 6f 23 0e fd 7e 5b f4 43 c0 07 93 |H...xo#..~[.C...| | a0 cf 99 1b 8b 2c 5b df 3d 01 43 b1 8d b8 0d 1f |.....,[.=.C.....| PRF out[32]: | 48 d8 eb 1f 78 6f 23 0e fd 7e 5b f4 43 c0 07 93 |H...xo#..~[.C...| | a0 cf 99 1b 8b 2c 5b df 3d 01 43 b1 8d b8 0d 1f |.....,[.=.C.....| Client MAC key[20]: | f3 18 c2 88 d8 68 85 b0 9b 01 40 f5 b9 6c 3e 3e |.....h....@..l>>| | 5b 87 77 05 |[.w. | Server MAC key[20]: | 7c cc 80 d6 7a ee 6a 4b b5 6c 5b 70 2b 5d 00 5e ||...z.jK.l[p+].^| | e4 85 4d b6 |..M. | Client Write key[8]: | bb 81 e4 2d 52 b5 40 1d |...-R.@. | Server Write key[8]: | 48 d8 eb 1f 78 6f 23 0e |H...xo#. | Client Write IV[8]: | 79 3b 01 46 6c 9c d2 40 |y;.Fl..@ | Server Write IV[8]: | 5a b1 9b a2 e8 58 10 ff |Z....X.. | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 1161 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 349 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 335, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 880 length 331 bytes, remaining 1215 record: offset = 1215, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1220 length 0 bytes, remaining 1224 dissect_ssl enter frame #38 (first time) conversation = 0x7fca71dec5d8, ssl_session = 0x7fca45bcb520 record: offset = 0, reported_length_remaining = 134 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 70, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8... looking for RSA pre-masterb4507d09a2027556a9d42252a65b30544a40764ba079ffc6... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 0b ab 27 4b 82 b7 19 b4 62 14 9d 8f cb fc 23 54 |..'K....b.....#T| | 42 76 2b 08 29 3b 1f f7 a3 1e 8e 12 eb e4 20 6e |Bv+.);........ n| | 58 52 a2 3e 32 7b de d1 83 be 8f f4 ea c0 3b e8 |XR.>2{........;.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | ee bd c1 e5 e7 7a 46 d6 4e b4 b6 05 3c c2 41 1e |.....zF.N...<.A.| | dc 8e 2b ba 74 0c 52 2c 90 0f 0e 6c 5a 52 34 c2 |..+.t.R,...lZR4.| | ee a5 c9 9d c7 f6 a2 83 8e 5f b1 9c 19 e7 ba f5 |........._......| | 82 a5 45 34 b8 58 3e ec 8f c2 59 f2 c7 |..E4.X>...Y.. | hash out[72]: | 59 7e d8 91 0e 7c 40 46 72 2f f9 74 d2 42 00 1f |Y~...|@Fr/.t.B..| | 4c 8b 48 e6 cd 5d 7e bf ec a3 60 94 a1 c6 df ba |L.H..]~...`.....| | 11 84 c8 ba 63 fe d9 6b c8 9d fc ac a7 63 5b 26 |....c..k.....c[&| | fe c8 1d 98 40 bd 2c f3 55 c9 5c 12 fb 06 cf 7a |....@.,.U.\....z| | f9 fa 51 fd 78 fc 9a 34 |..Q.x..4 | PRF out[72]: | 59 7e d8 91 0e 7c 40 46 72 2f f9 74 d2 42 00 1f |Y~...|@Fr/.t.B..| | 4c 8b 48 e6 cd 5d 7e bf ec a3 60 94 a1 c6 df ba |L.H..]~...`.....| | 11 84 c8 ba 63 fe d9 6b c8 9d fc ac a7 63 5b 26 |....c..k.....c[&| | fe c8 1d 98 40 bd 2c f3 55 c9 5c 12 fb 06 cf 7a |....@.,.U.\....z| | f9 fa 51 fd 78 fc 9a 34 |..Q.x..4 | key expansion[72]: | 59 7e d8 91 0e 7c 40 46 72 2f f9 74 d2 42 00 1f |Y~...|@Fr/.t.B..| | 4c 8b 48 e6 cd 5d 7e bf ec a3 60 94 a1 c6 df ba |L.H..]~...`.....| | 11 84 c8 ba 63 fe d9 6b c8 9d fc ac a7 63 5b 26 |....c..k.....c[&| | fe c8 1d 98 40 bd 2c f3 55 c9 5c 12 fb 06 cf 7a |....@.,.U.\....z| | f9 fa 51 fd 78 fc 9a 34 |..Q.x..4 | ssl_generate_keyring_material prf(iv_block) tls12_prf: tls_hash(hash_alg SHA256 secret_len 0 seed_len 72 ) tls_hash: hash secret[0]: tls_hash: hash seed[72]: | 49 56 20 62 6c 6f 63 6b 52 34 c2 ee a5 c9 9d c7 |IV blockR4......| | f6 a2 83 8e 5f b1 9c 19 e7 ba f5 82 a5 45 34 b8 |...._........E4.| | 58 3e ec 8f c2 59 f2 c7 52 34 c2 ee bd c1 e5 e7 |X>...Y..R4......| | 7a 46 d6 4e b4 b6 05 3c c2 41 1e dc 8e 2b ba 74 |zF.N...<.A...+.t| | 0c 52 2c 90 0f 0e 6c 5a |.R,...lZ | hash out[16]: | 79 3b 01 46 6c 9c d2 40 5a b1 9b a2 e8 58 10 ff |y;.Fl..@Z....X..| PRF out[16]: | 79 3b 01 46 6c 9c d2 40 5a b1 9b a2 e8 58 10 ff |y;.Fl..@Z....X..| ssl_generate_keyring_material PRF(key_c) tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 ) tls_hash: hash secret[5]: | c8 9d fc ac a7 |..... | tls_hash: hash seed[80]: | 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key| | 52 34 c2 ee a5 c9 9d c7 f6 a2 83 8e 5f b1 9c 19 |R4.........._...| | e7 ba f5 82 a5 45 34 b8 58 3e ec 8f c2 59 f2 c7 |.....E4.X>...Y..| | 52 34 c2 ee bd c1 e5 e7 7a 46 d6 4e b4 b6 05 3c |R4......zF.N...<| | c2 41 1e dc 8e 2b ba 74 0c 52 2c 90 0f 0e 6c 5a |.A...+.t.R,...lZ| hash out[32]: | 82 d1 7e ec c0 3c df 2b 85 6e 14 a4 f7 af db aa |..~..<.+.n......| | 49 35 c1 53 6b 9e 5f df 5c 51 57 de 96 a3 0d 3a |I5.Sk._.\QW....:| PRF out[32]: | 82 d1 7e ec c0 3c df 2b 85 6e 14 a4 f7 af db aa |..~..<.+.n......| | 49 35 c1 53 6b 9e 5f df 5c 51 57 de 96 a3 0d 3a |I5.Sk._.\QW....:| ssl_generate_keyring_material PRF(key_s) tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 ) tls_hash: hash secret[5]: | 63 5b 26 fe c8 |c[&.. | tls_hash: hash seed[80]: | 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key| | 52 34 c2 ee a5 c9 9d c7 f6 a2 83 8e 5f b1 9c 19 |R4.........._...| | e7 ba f5 82 a5 45 34 b8 58 3e ec 8f c2 59 f2 c7 |.....E4.X>...Y..| | 52 34 c2 ee bd c1 e5 e7 7a 46 d6 4e b4 b6 05 3c |R4......zF.N...<| | c2 41 1e dc 8e 2b ba 74 0c 52 2c 90 0f 0e 6c 5a |.A...+.t.R,...lZ| hash out[32]: | 99 4f 65 84 43 2c a4 4e 2d ce 0e 87 db b3 ec 22 |.Oe.C,.N-......"| | 70 fb 21 83 18 57 f7 14 0c 00 57 a2 0b 86 1f 03 |p.!..W....W.....| PRF out[32]: | 99 4f 65 84 43 2c a4 4e 2d ce 0e 87 db b3 ec 22 |.Oe.C,.N-......"| | 70 fb 21 83 18 57 f7 14 0c 00 57 a2 0b 86 1f 03 |p.!..W....W.....| Client MAC key[20]: | 59 7e d8 91 0e 7c 40 46 72 2f f9 74 d2 42 00 1f |Y~...|@Fr/.t.B..| | 4c 8b 48 e6 |L.H. | Server MAC key[20]: | cd 5d 7e bf ec a3 60 94 a1 c6 df ba 11 84 c8 ba |.]~...`.........| | 63 fe d9 6b |c..k | Client Write key[8]: | 82 d1 7e ec c0 3c df 2b |..~..<.+ | Server Write key[8]: | 99 4f 65 84 43 2c a4 4e |.Oe.C,.N | Client Write IV[8]: | 79 3b 01 46 6c 9c d2 40 |y;.Fl..@ | Server Write IV[8]: | 5a b1 9b a2 e8 58 10 ff |Z....X.. | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 0b ab 27 4b 82 b7 19 b4 62 14 9d 8f cb fc 23 54 |..'K....b.....#T| | 42 76 2b 08 29 3b 1f f7 a3 1e 8e 12 eb e4 20 6e |Bv+.);........ n| | 58 52 a2 3e 32 7b de d1 83 be 8f f4 ea c0 3b e8 |XR.>2{........;.| dissect_ssl3_handshake session keys successfully generated record: offset = 75, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 81, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 8a 34 24 b6 26 72 34 78 a6 37 0c d2 1a 1a f4 39 |.4$.&r4x.7.....9| | 36 93 12 9e c0 a5 a0 53 51 c6 24 31 12 72 33 ea |6......SQ.$1.r3.| | 37 48 c5 0f 16 72 d6 2f ed aa 53 e3 a9 14 fb 31 |7H...r./..S....1| Plaintext[48]: | ff e5 dc bc 7b fc 34 56 14 00 00 0c fd 8d 6f e3 |....{.4V......o.| | 45 29 77 76 c4 01 79 22 02 ed c5 d5 fb 88 2f e9 |E)wv..y"....../.| | b9 e2 5d 59 89 cf 90 0e ae fe c6 05 03 03 03 03 |..]Y............| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 02 ed c5 d5 fb 88 2f e9 b9 e2 5d 59 89 cf 90 0e |....../...]Y....| | ae fe c6 05 |.... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #39 (first time) conversation = 0x7fca71dec5d8, ssl_session = 0x7fca45bcb520 record: offset = 0, reported_length_remaining = 234 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 20 11 b1 62 6b c7 fc 1c fe 89 7d 37 1c 19 b2 94 | ..bk.....}7....| | 25 59 02 7a 7f f4 3a e9 a2 21 83 47 60 44 cb 06 |%Y.z..:..!.G`D..| | 78 54 dd d9 15 51 2b 92 a1 f5 e9 fe e2 27 fc 3b |xT...Q+......'.;| Plaintext[48]: | 37 3a 3b 9c a4 dd 36 e8 14 00 00 0c 5a 79 d7 6d |7:;...6.....Zy.m| | 47 da 53 c8 2b 78 e2 8f 3a 80 95 81 d6 04 07 d4 |G.S.+x..:.......| | 5f 96 c5 47 93 21 69 a6 78 0b c6 9c 03 03 03 03 |_..G.!i.x.......| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 3a 80 95 81 d6 04 07 d4 5f 96 c5 47 93 21 69 a6 |:......._..G.!i.| | 78 0b c6 9c |x... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #40 (first time) conversation = 0x7fca71dec5d8, ssl_session = 0x7fca45bcb520 record: offset = 0, reported_length_remaining = 109 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 104, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 104 Ciphertext[104]: | c2 cf 2b bb e0 dd e6 1e 2f 74 62 58 8b ee 6d 70 |..+...../tbX..mp| | 0f 41 42 ba e7 80 e2 66 82 7d 51 83 49 05 5b a1 |.AB....f.}Q.I.[.| | 99 3c 90 26 9c ca 86 a9 cc a5 c0 18 be 94 1c d0 |.<.&............| | 8b 87 a0 e7 4d 36 2c 04 75 7e 86 e3 3f ff 1b 98 |....M6,.u~..?...| | 5c 48 48 56 5a 2c 21 72 a4 3b 8d df c5 90 db 66 |\HHVZ,!r.;.....f| | a8 b8 3f a1 a9 75 43 78 7f 77 7a 98 ad 63 58 82 |..?..uCx.wz..cX.| | 00 3e 2a c2 46 b1 6b 6f |.>*.F.ko | Plaintext[104]: | 68 9c bf 22 a5 d6 dc 95 47 45 54 20 2f 20 48 54 |h.."....GET / HT| | 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 78 |TP/1.1..Host: ex| | 70 2d 64 65 73 2d 63 62 63 2d 73 68 61 2e 6c 6f |p-des-cbc-sha.lo| | 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey| | 6e 2e 6e 6c 3a 34 34 33 39 0d 0a 0d 0a 95 af b9 |n.nl:4439.......| | 4a 3d 66 64 a8 ba b2 44 a1 71 72 2d 7a 6a 8d 41 |J=fd...D.qr-zj.A| | 24 06 06 06 06 06 06 06 |$....... | ssl_decrypt_record found padding 6 final len 97 checking mac (len 69, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 91 fd 74 1d 69 ab a3 35 10 76 37 1e bb 5e 0f a2 |..t.i..5.v7..^..| | 8c 63 8b 45 |.c.E | ssl_decrypt_record: mac failed association_find: TCP port 52252 found (nil) association_find: TCP port 4439 found 0x372c770 dissect_ssl enter frame #41 (first time) conversation = 0x7fca71dec5d8, ssl_session = 0x7fca45bcb520 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | 81 93 99 db 17 03 1d 65 97 3f 18 6d fb 6f 90 42 |.......e.?.m.o.B| | 60 43 50 a6 82 24 9d 9e 65 d5 a2 ca 01 09 c4 ac |`CP..$..e.......| | dc 7b df 16 e6 c9 9d a0 7f fa e5 ef 35 53 34 0b |.{..........5S4.| | 96 b1 df b3 24 5b ec 66 8c 9e d3 60 e3 c8 c2 e2 |....$[.f...`....| | 15 d7 8d 74 75 3c 77 5d 00 70 8e fc 0e d2 d0 d7 |...tudocume| | 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 6c |nt.domain='local| | 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n| | 6c 27 3c 2f 73 63 72 69 70 74 3e 43 a1 ab 75 a3 |l'C..u.| | ad 4e f7 01 0c 1c 99 0d b3 64 9f 73 b4 ec 30 00 |.N.......d.s..0.| ssl_decrypt_record found padding 0 final len 383 checking mac (len 355, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | cf 56 a9 5a ac ad 32 81 ef e3 59 14 59 15 39 1f |.V.Z..2...Y.Y.9.| | 20 c3 2e e9 | ... | ssl_decrypt_record: mac failed association_find: TCP port 4439 found 0x372c770 dissect_ssl enter frame #42 (first time) conversation = 0x7fca71dec5d8, ssl_session = 0x7fca45bcb520 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | ef d1 1b b2 48 c0 fd 38 0c 6c f1 35 e9 a5 6f 0c |....H..8.l.5..o.| | 4a b2 c2 49 6a 9a f2 01 ac ee 3f 63 68 e5 a5 44 |J..Ij.....?ch..D| Plaintext[32]: | 22 2d 3d 89 53 37 73 ee 01 00 b2 a7 38 7a 54 b2 |"-=.S7s.....8zT.| | 25 67 f9 5b ac c5 57 ca f0 81 43 34 65 fd 01 01 |%g.[..W...C4e...| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | b2 a7 38 7a 54 b2 25 67 f9 5b ac c5 57 ca f0 81 |..8zT.%g.[..W...| | 43 34 65 fd |C4e. | ssl_decrypt_record: mac ok dissect_ssl enter frame #44 (first time) conversation = 0x7fca71dec5d8, ssl_session = 0x7fca45bcb520 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 8f f5 59 27 21 66 fe 44 c8 3e 6c 7e 9c 70 5e d2 |..Y'!f.D.>l~.p^.| | 15 ed 39 ed 7c 90 62 b5 62 62 b3 53 9e b2 e9 74 |..9.|.b.bb.S...t| Plaintext[32]: | 9c 7b 61 50 48 f0 f8 cd 01 00 74 71 ef 35 99 df |.{aPH.....tq.5..| | 9d 41 a5 3c 78 1f 28 e6 d5 a5 f9 bb bc 12 01 01 |.A. state 0x01 dissect_ssl enter frame #51 (first time) conversation = 0x7fca71dec880, ssl_session = 0x7fca45bcda20 record: offset = 0, reported_length_remaining = 884 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0009 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 0b ab 27 4b 82 b7 19 b4 62 14 9d 8f cb fc 23 54 |..'K....b.....#T| | 42 76 2b 08 29 3b 1f f7 a3 1e 8e 12 eb e4 20 6e |Bv+.);........ n| | 58 52 a2 3e 32 7b de d1 83 be 8f f4 ea c0 3b e8 |XR.>2{........;.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | ee 3b ae f1 90 c5 e5 41 12 cc 6e 9a d6 a1 ea 91 |.;.....A..n.....| | ae 19 c3 01 fc 8c f8 e1 86 38 8b c9 fc 52 34 c2 |.........8...R4.| | ee 7b bc 73 08 c9 74 f0 a0 55 5b 67 6c fe e7 19 |.{.s..t..U[gl...| | ca 57 8a 07 46 b6 91 b4 2e fa 4e 74 52 |.W..F.....NtR | hash out[72]: | 05 79 d4 a6 80 bc 8f dd 6f 1d c4 37 f5 d4 db 71 |.y......o..7...q| | 4b ef d9 f8 aa 6a 2d 2f a5 a6 9a b2 71 f3 a1 23 |K....j-/....q..#| | 3c 85 e9 3f 3f 75 a5 95 d9 12 a7 89 73 a2 4e 73 |<..??u......s.Ns| | 25 68 1e 78 19 a3 b5 3b 42 99 ab 28 82 62 9e 0c |%h.x...;B..(.b..| | 15 a7 8d cf 5a 75 44 d9 |....ZuD. | PRF out[72]: | 05 79 d4 a6 80 bc 8f dd 6f 1d c4 37 f5 d4 db 71 |.y......o..7...q| | 4b ef d9 f8 aa 6a 2d 2f a5 a6 9a b2 71 f3 a1 23 |K....j-/....q..#| | 3c 85 e9 3f 3f 75 a5 95 d9 12 a7 89 73 a2 4e 73 |<..??u......s.Ns| | 25 68 1e 78 19 a3 b5 3b 42 99 ab 28 82 62 9e 0c |%h.x...;B..(.b..| | 15 a7 8d cf 5a 75 44 d9 |....ZuD. | key expansion[72]: | 05 79 d4 a6 80 bc 8f dd 6f 1d c4 37 f5 d4 db 71 |.y......o..7...q| | 4b ef d9 f8 aa 6a 2d 2f a5 a6 9a b2 71 f3 a1 23 |K....j-/....q..#| | 3c 85 e9 3f 3f 75 a5 95 d9 12 a7 89 73 a2 4e 73 |<..??u......s.Ns| | 25 68 1e 78 19 a3 b5 3b 42 99 ab 28 82 62 9e 0c |%h.x...;B..(.b..| | 15 a7 8d cf 5a 75 44 d9 |....ZuD. | Client MAC key[20]: | 05 79 d4 a6 80 bc 8f dd 6f 1d c4 37 f5 d4 db 71 |.y......o..7...q| | 4b ef d9 f8 |K... | Server MAC key[20]: | aa 6a 2d 2f a5 a6 9a b2 71 f3 a1 23 3c 85 e9 3f |.j-/....q..#<..?| | 3f 75 a5 95 |?u.. | Client Write key[8]: | d9 12 a7 89 73 a2 4e 73 |....s.Ns | Server Write key[8]: | 25 68 1e 78 19 a3 b5 3b |%h.x...; | Client Write IV[8]: | 42 99 ab 28 82 62 9e 0c |B..(.b.. | Server Write IV[8]: | 15 a7 8d cf 5a 75 44 d9 |....ZuD. | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 821 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884 dissect_ssl enter frame #53 (first time) conversation = 0x7fca71dec880, ssl_session = 0x7fca45bcda20 record: offset = 0, reported_length_remaining = 326 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 262, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746... looking for RSA pre-master409c440a8ec260eb9793215c95c4dd11942f4b6f516c1dbb... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 3d ed 66 7b 21 4e 57 7c 2a e4 22 04 43 36 c7 2a |=.f{!NW|*.".C6.*| | 7d 6b 4d 52 a3 a5 12 13 66 6d 2b c0 03 c9 ba c0 |}kMR....fm+.....| | 2a 86 4b 9c 5b 8d 34 bf 25 c9 9c dc 8c 6c d3 e1 |*.K.[.4.%....l..| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | ee 3b ae f1 90 c5 e5 41 12 cc 6e 9a d6 a1 ea 91 |.;.....A..n.....| | ae 19 c3 01 fc 8c f8 e1 86 38 8b c9 fc 52 34 c2 |.........8...R4.| | ee 7b bc 73 08 c9 74 f0 a0 55 5b 67 6c fe e7 19 |.{.s..t..U[gl...| | ca 57 8a 07 46 b6 91 b4 2e fa 4e 74 52 |.W..F.....NtR | hash out[72]: | 9c 45 43 c3 12 c8 07 c5 3d 5e 4d 9e e6 90 8e 05 |.EC.....=^M.....| | a1 38 18 90 5c ae 4a 74 d7 f5 6e 54 30 5e ab e0 |.8..\.Jt..nT0^..| | 71 c7 85 1c b3 d1 f0 10 90 dd cd c2 41 7a b0 bd |q...........Az..| | 8c b3 9f 99 2d c8 86 ea f5 9d cc 15 36 e3 2c 62 |....-.......6.,b| | e7 07 c8 69 b2 40 84 15 |...i.@.. | PRF out[72]: | 9c 45 43 c3 12 c8 07 c5 3d 5e 4d 9e e6 90 8e 05 |.EC.....=^M.....| | a1 38 18 90 5c ae 4a 74 d7 f5 6e 54 30 5e ab e0 |.8..\.Jt..nT0^..| | 71 c7 85 1c b3 d1 f0 10 90 dd cd c2 41 7a b0 bd |q...........Az..| | 8c b3 9f 99 2d c8 86 ea f5 9d cc 15 36 e3 2c 62 |....-.......6.,b| | e7 07 c8 69 b2 40 84 15 |...i.@.. | key expansion[72]: | 9c 45 43 c3 12 c8 07 c5 3d 5e 4d 9e e6 90 8e 05 |.EC.....=^M.....| | a1 38 18 90 5c ae 4a 74 d7 f5 6e 54 30 5e ab e0 |.8..\.Jt..nT0^..| | 71 c7 85 1c b3 d1 f0 10 90 dd cd c2 41 7a b0 bd |q...........Az..| | 8c b3 9f 99 2d c8 86 ea f5 9d cc 15 36 e3 2c 62 |....-.......6.,b| | e7 07 c8 69 b2 40 84 15 |...i.@.. | Client MAC key[20]: | 9c 45 43 c3 12 c8 07 c5 3d 5e 4d 9e e6 90 8e 05 |.EC.....=^M.....| | a1 38 18 90 |.8.. | Server MAC key[20]: | 5c ae 4a 74 d7 f5 6e 54 30 5e ab e0 71 c7 85 1c |\.Jt..nT0^..q...| | b3 d1 f0 10 |.... | Client Write key[8]: | 90 dd cd c2 41 7a b0 bd |....Az.. | Server Write key[8]: | 8c b3 9f 99 2d c8 86 ea |....-... | Client Write IV[8]: | f5 9d cc 15 36 e3 2c 62 |....6.,b | Server Write IV[8]: | e7 07 c8 69 b2 40 84 15 |...i.@.. | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 3d ed 66 7b 21 4e 57 7c 2a e4 22 04 43 36 c7 2a |=.f{!NW|*.".C6.*| | 7d 6b 4d 52 a3 a5 12 13 66 6d 2b c0 03 c9 ba c0 |}kMR....fm+.....| | 2a 86 4b 9c 5b 8d 34 bf 25 c9 9c dc 8c 6c d3 e1 |*.K.[.4.%....l..| dissect_ssl3_handshake session keys successfully generated record: offset = 267, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 273, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | f2 8f aa dd 4d 21 f9 1c 46 8d a8 a7 df 7d a8 d1 |....M!..F....}..| | 3f 43 46 b2 1b b8 90 7a ed 8a fc 21 ba 93 04 9d |?CF....z...!....| | 3e ea 1e 08 88 af 51 3a fe d8 f0 50 e6 be fc 36 |>.....Q:...P...6| Plaintext[48]: | dc b0 f3 d5 86 56 ff 96 14 00 00 0c 94 11 fe de |.....V..........| | 99 a4 7e d3 a1 9c 8e d8 b8 14 c2 a5 07 89 f3 1e |..~.............| | 04 07 29 4d 0c 59 96 4e 0a d5 56 b2 03 03 03 03 |..)M.Y.N..V.....| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | b8 14 c2 a5 07 89 f3 1e 04 07 29 4d 0c 59 96 4e |..........)M.Y.N| | 0a d5 56 b2 |..V. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #54 (first time) conversation = 0x7fca71dec880, ssl_session = 0x7fca45bcda20 record: offset = 0, reported_length_remaining = 234 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | ad 40 3b eb c2 0d 06 56 53 6f a1 88 b2 82 9b 62 |.@;....VSo.....b| | b4 76 5c 76 3e 71 af ed 0f 98 63 eb 65 02 50 f5 |.v\v>q....c.e.P.| | b4 0c 2f f0 d6 60 1f 34 2a 5e 48 a5 c4 d8 bd a0 |../..`.4*^H.....| Plaintext[48]: | c7 6f 51 5e a7 5e a9 73 14 00 00 0c 4a b2 fd 98 |.oQ^.^.s....J...| | f9 39 f3 70 a1 98 f7 90 88 d4 35 ad 70 ed d9 ab |.9.p......5.p...| | de 0c aa db 2b 82 d0 f6 fe a7 d8 43 03 03 03 03 |....+......C....| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 88 d4 35 ad 70 ed d9 ab de 0c aa db 2b 82 d0 f6 |..5.p.......+...| | fe a7 d8 43 |...C | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #55 (first time) conversation = 0x7fca71dec880, ssl_session = 0x7fca45bcda20 record: offset = 0, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 96, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 96 Ciphertext[96]: | 0b 8a df 47 20 ab 93 b2 94 37 ba ce 5f 78 c0 0b |...G ....7.._x..| | 1c b3 11 15 92 c5 bf 57 6b b9 0c da 5f 01 86 55 |.......Wk..._..U| | 5f a9 cf 23 18 00 0b 69 78 98 dc 00 c1 7b e5 9d |_..#...ix....{..| | ac fd 9f 21 ba cc 8a 58 fc 89 55 a3 c2 be 91 0d |...!...X..U.....| | b7 2c b5 ab c9 38 72 eb 6d d4 73 bd b4 4f cf 86 |.,...8r.m.s..O..| | 6c 3b a0 ac 22 96 5f 65 79 e1 83 58 95 e2 48 62 |l;.."._ey..X..Hb| Plaintext[96]: | 4b bb 61 ee a4 42 14 ab 47 45 54 20 2f 20 48 54 |K.a..B..GET / HT| | 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 64 65 |TP/1.1..Host: de| | 73 2d 63 62 63 2d 73 68 61 2e 6c 6f 63 61 6c 2e |s-cbc-sha.local.| | 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c |al.lekensteyn.nl| | 3a 34 34 34 30 0d 0a 0d 0a 05 6f 16 ce f7 dc 29 |:4440.....o....)| | 03 c8 22 ea df f5 44 d8 93 ec 81 b8 0c 02 02 02 |.."...D.........| ssl_decrypt_record found padding 2 final len 93 checking mac (len 65, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 24 a2 a3 33 b3 59 7f f9 68 f3 1d 6d 5d 3f 8d cb |$..3.Y..h..m]?..| | 44 51 5e ef |DQ^. | ssl_decrypt_record: mac failed association_find: TCP port 50234 found (nil) association_find: TCP port 4440 found 0x37341a0 dissect_ssl enter frame #56 (first time) conversation = 0x7fca71dec880, ssl_session = 0x7fca45bcda20 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | 44 bc 94 6f 1f ec c6 12 b3 7f 4a 9c 0e 76 93 c3 |D..o......J..v..| | ac bd bc c4 0e 1e a6 e1 58 b6 09 87 2e f5 d7 5b |........X......[| | 7f 1d b2 c0 89 4c 14 8a 1d 83 8d 79 db f6 f5 f5 |.....L.....y....| | 12 9d a2 e2 05 5f b7 06 d0 77 da 31 e5 a0 02 3a |....._...w.1...:| | 48 e5 ae 49 5e d6 84 59 3a 72 f4 8f a6 17 48 17 |H..I^..Y:r....H.| | 50 be 77 a1 12 b8 41 e1 c9 c4 f8 ca 99 62 54 b2 |P.w...A......bT.| | da 76 48 34 83 81 15 eb af 54 e9 a4 11 f3 1e 79 |.vH4.....T.....y| | 43 5c fd d4 b8 11 ff dd 19 5c 82 b9 c2 6c e1 00 |C\.......\...l..| | 8c 54 9d 24 20 d7 bc b7 a7 d2 2c ab 37 cd 2a 29 |.T.$ .....,.7.*)| | c0 8d 7c 84 30 d0 ba 63 bb c2 a1 a4 4a 7e 86 8c |..|.0..c....J~..| | 1a 48 30 cd c3 8b 92 c1 de 5c 21 d5 23 f6 1e 04 |.H0......\!.#...| | 59 b6 a1 62 53 c4 8b b5 09 f8 eb 79 8f 48 89 34 |Y..bS......y.H.4| | 3d a0 f2 7f ca 91 6d e2 07 ef 80 77 8d 43 d6 9e |=.....m....w.C..| | fe 15 c5 9c 73 f6 0a ab ad a5 01 a5 bf d7 2e 7b |....s..........{| | 29 1a 07 e1 3a 98 e1 7e 66 54 66 99 55 97 62 3b |)...:..~fTf.U.b;| | f9 b8 c7 2a bb fe a1 41 f9 e1 89 50 d2 a6 e5 91 |...*...A...P....| | af 8c 21 ed 8d ca 5a 24 91 be b0 69 0b 17 e0 22 |..!...Z$...i..."| | 33 19 c9 38 e8 81 48 bf 6c 5b 61 64 95 41 67 02 |3..8..H.l[ad.Ag.| | 1f 8e fc 08 8e a1 6c f8 5e e9 bd 20 12 da e0 7a |......l.^.. ...z| | aa ab 23 37 1d df 08 28 51 90 26 a2 f2 f0 c1 5c |..#7...(Q.&....\| | cc e8 9b 57 8d 9d e2 48 5a b0 af 89 ee 33 47 fc |...W...HZ....3G.| | 9e 35 eb 22 70 ef 58 50 1f 68 48 e8 71 4c 80 1d |.5."p.XP.hH.qL..| | 9f e9 e1 69 0b 91 40 d8 84 c6 dd f4 7d e5 a3 b9 |...i..@.....}...| | c1 95 bd 49 e6 66 b0 9a f8 14 1b d4 bd 96 72 ba |...I.f........r.| Plaintext[384]: | b9 09 91 8c ed ea b7 30 48 54 54 50 2f 31 2e 31 |.......0HTTP/1.1| | 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:| | 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da| | 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep | | 32 30 31 33 20 32 30 3a 31 31 3a 32 36 20 47 4d |2013 20:11:26 GM| | 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:| | 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont| | 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.| | 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo| | 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu| | 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00| | 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach| | 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca| | 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 30 39 |che....0x00,0x09| | 20 2d 20 44 45 53 2d 43 42 43 2d 53 48 41 20 20 | - DES-CBC-SHA | | 20 20 20 20 20 20 20 20 20 20 20 53 53 4c 76 33 | SSLv3| | 20 4b 78 3d 52 53 41 20 20 20 20 20 20 41 75 3d | Kx=RSA Au=| | 52 53 41 20 20 45 6e 63 3d 44 45 53 28 35 36 29 |RSA Enc=DES(56)| | 20 20 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 | Mac=SHA1document.doma| | 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek| | 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'RO..c.......| | f3 49 2e 6d 0b f3 6e 74 07 07 07 07 07 07 07 07 |.I.m..nt........| ssl_decrypt_record found padding 7 final len 376 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | cd 96 ed ff 98 e8 02 f0 e3 84 77 5f 37 a9 ed c0 |..........w_7...| | 17 98 88 43 |...C | ssl_decrypt_record: mac failed association_find: TCP port 4440 found 0x37341a0 dissect_ssl enter frame #57 (first time) conversation = 0x7fca71dec880, ssl_session = 0x7fca45bcda20 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 76 25 57 b4 fd d5 53 79 3a 91 5b 42 aa 63 b0 82 |v%W...Sy:.[B.c..| | 3f 51 fd 71 ab f0 4f 69 8b e0 58 2c 9b 5f 33 37 |?Q.q..Oi..X,._37| Plaintext[32]: | 56 29 84 a4 9f 78 a8 61 01 00 90 1f 04 bb 6a 24 |V)...x.a......j$| | 52 81 e5 43 bc d3 f4 c0 b7 a3 b9 56 8a b6 01 01 |R..C.......V....| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 90 1f 04 bb 6a 24 52 81 e5 43 bc d3 f4 c0 b7 a3 |....j$R..C......| | b9 56 8a b6 |.V.. | ssl_decrypt_record: mac ok dissect_ssl enter frame #59 (first time) conversation = 0x7fca71dec880, ssl_session = 0x7fca45bcda20 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 9d 19 a5 17 27 12 e6 1f f1 59 fc 12 b4 0c d0 ae |....'....Y......| | 77 7d 94 e4 c7 90 ce 12 28 ef 9e 3a 21 c0 67 cd |w}......(..:!.g.| Plaintext[32]: | 9a 46 f6 8d 57 a9 21 e3 01 00 25 12 ed ac 68 f0 |.F..W.!...%...h.| | 7c bb d8 9e 89 e2 a7 fa bd 43 d6 65 00 fa 01 01 ||........C.e....| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 25 12 ed ac 68 f0 7c bb d8 9e 89 e2 a7 fa bd 43 |%...h.|........C| | d6 65 00 fa |.e.. | ssl_decrypt_record: mac ok dissect_ssl enter frame #64 (first time) ssl_session_init: initializing ptr 0x7fca45bcffe0 size 688 conversation = 0x7fca71decb28, ssl_session = 0x7fca45bcffe0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 55842 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4441 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #66 (first time) conversation = 0x7fca71decb28, ssl_session = 0x7fca45bcffe0 record: offset = 0, reported_length_remaining = 884 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x000A -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 3d ed 66 7b 21 4e 57 7c 2a e4 22 04 43 36 c7 2a |=.f{!NW|*.".C6.*| | 7d 6b 4d 52 a3 a5 12 13 66 6d 2b c0 03 c9 ba c0 |}kMR....fm+.....| | 2a 86 4b 9c 5b 8d 34 bf 25 c9 9c dc 8c 6c d3 e1 |*.K.[.4.%....l..| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | ef a0 b5 d9 19 5b 2c d5 9e 83 2b 61 8c 82 1a 47 |.....[,...+a...G| | e9 13 2e 3d 55 99 7c ed 6a c9 b3 8b 06 52 34 c2 |...=U.|.j....R4.| | ef fa 63 d2 3c e8 89 86 60 14 9d 57 8f 6d 08 f0 |..c.<...`..W.m..| | 8c 9e d6 02 2e d3 25 52 34 e3 cb eb 5d |......%R4...] | hash out[104]: | 27 f5 7c c5 d7 f6 30 85 33 92 85 78 89 bc f7 de |'.|...0.3..x....| | 98 78 22 91 f5 5a 47 07 d1 4b 56 2d f4 0a dd 4c |.x"..ZG..KV-...L| | c9 7f 2f 89 5b e6 1f 50 0a b3 55 5b 91 8f 31 8f |../.[..P..U[..1.| | 16 af d3 27 8b 86 ad 24 18 fe 8c a8 95 23 32 fb |...'...$.....#2.| | 6d af 23 01 5e 8c 25 55 0b 31 7f 33 93 2a 38 8b |m.#.^.%U.1.3.*8.| | b6 2f 44 f0 59 e5 3a 06 2d 14 61 fb 58 2d 05 e4 |./D.Y.:.-.a.X-..| | 7c fa 24 df 38 7b b4 d7 ||.$.8{.. | PRF out[104]: | 27 f5 7c c5 d7 f6 30 85 33 92 85 78 89 bc f7 de |'.|...0.3..x....| | 98 78 22 91 f5 5a 47 07 d1 4b 56 2d f4 0a dd 4c |.x"..ZG..KV-...L| | c9 7f 2f 89 5b e6 1f 50 0a b3 55 5b 91 8f 31 8f |../.[..P..U[..1.| | 16 af d3 27 8b 86 ad 24 18 fe 8c a8 95 23 32 fb |...'...$.....#2.| | 6d af 23 01 5e 8c 25 55 0b 31 7f 33 93 2a 38 8b |m.#.^.%U.1.3.*8.| | b6 2f 44 f0 59 e5 3a 06 2d 14 61 fb 58 2d 05 e4 |./D.Y.:.-.a.X-..| | 7c fa 24 df 38 7b b4 d7 ||.$.8{.. | key expansion[104]: | 27 f5 7c c5 d7 f6 30 85 33 92 85 78 89 bc f7 de |'.|...0.3..x....| | 98 78 22 91 f5 5a 47 07 d1 4b 56 2d f4 0a dd 4c |.x"..ZG..KV-...L| | c9 7f 2f 89 5b e6 1f 50 0a b3 55 5b 91 8f 31 8f |../.[..P..U[..1.| | 16 af d3 27 8b 86 ad 24 18 fe 8c a8 95 23 32 fb |...'...$.....#2.| | 6d af 23 01 5e 8c 25 55 0b 31 7f 33 93 2a 38 8b |m.#.^.%U.1.3.*8.| | b6 2f 44 f0 59 e5 3a 06 2d 14 61 fb 58 2d 05 e4 |./D.Y.:.-.a.X-..| | 7c fa 24 df 38 7b b4 d7 ||.$.8{.. | Client MAC key[20]: | 27 f5 7c c5 d7 f6 30 85 33 92 85 78 89 bc f7 de |'.|...0.3..x....| | 98 78 22 91 |.x". | Server MAC key[20]: | f5 5a 47 07 d1 4b 56 2d f4 0a dd 4c c9 7f 2f 89 |.ZG..KV-...L../.| | 5b e6 1f 50 |[..P | Client Write key[24]: | 0a b3 55 5b 91 8f 31 8f 16 af d3 27 8b 86 ad 24 |..U[..1....'...$| | 18 fe 8c a8 95 23 32 fb |.....#2. | Server Write key[24]: | 6d af 23 01 5e 8c 25 55 0b 31 7f 33 93 2a 38 8b |m.#.^.%U.1.3.*8.| | b6 2f 44 f0 59 e5 3a 06 |./D.Y.:. | Client Write IV[8]: | 2d 14 61 fb 58 2d 05 e4 |-.a.X-.. | Server Write IV[8]: | 7c fa 24 df 38 7b b4 d7 ||.$.8{.. | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 821 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884 dissect_ssl enter frame #68 (first time) conversation = 0x7fca71decb28, ssl_session = 0x7fca45bcffe0 record: offset = 0, reported_length_remaining = 326 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 262, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022e... looking for RSA pre-master247cdbb43122a8540fc06d529d5e97d05022d592b848f7ef... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | e5 3f 66 3b 4b 29 36 47 23 9f ea 49 1d d2 2e b9 |.?f;K)6G#..I....| | 89 04 6f 7c e5 34 dd 87 f5 69 b4 cc 06 d4 a7 72 |..o|.4...i.....r| | ef 94 72 fd 34 9c fc 2c f9 41 55 f7 a8 58 79 75 |..r.4..,.AU..Xyu| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | ef a0 b5 d9 19 5b 2c d5 9e 83 2b 61 8c 82 1a 47 |.....[,...+a...G| | e9 13 2e 3d 55 99 7c ed 6a c9 b3 8b 06 52 34 c2 |...=U.|.j....R4.| | ef fa 63 d2 3c e8 89 86 60 14 9d 57 8f 6d 08 f0 |..c.<...`..W.m..| | 8c 9e d6 02 2e d3 25 52 34 e3 cb eb 5d |......%R4...] | hash out[104]: | 6e 71 f0 34 e0 c1 df 65 49 56 92 f0 de aa c9 2d |nq.4...eIV.....-| | db 0e 86 32 84 50 6f b2 4b 1f 62 73 84 af fa bb |...2.Po.K.bs....| | a9 df 11 ae a3 30 b7 f8 a3 43 1f 93 6a 5d 72 ec |.....0...C..j]r.| | 8c ae 20 5c ec 22 21 b2 28 cc d2 ec 6f fc 59 c2 |.. \."!.(...o.Y.| | d9 95 c9 ad 5a 16 c6 0d dd 0a 04 e4 07 00 6b a0 |....Z.........k.| | 35 6d b2 aa 4e 00 a8 1a 0e b8 d7 e6 df 66 a4 b9 |5m..N........f..| | c9 54 fc 42 a5 06 9a c3 |.T.B.... | PRF out[104]: | 6e 71 f0 34 e0 c1 df 65 49 56 92 f0 de aa c9 2d |nq.4...eIV.....-| | db 0e 86 32 84 50 6f b2 4b 1f 62 73 84 af fa bb |...2.Po.K.bs....| | a9 df 11 ae a3 30 b7 f8 a3 43 1f 93 6a 5d 72 ec |.....0...C..j]r.| | 8c ae 20 5c ec 22 21 b2 28 cc d2 ec 6f fc 59 c2 |.. \."!.(...o.Y.| | d9 95 c9 ad 5a 16 c6 0d dd 0a 04 e4 07 00 6b a0 |....Z.........k.| | 35 6d b2 aa 4e 00 a8 1a 0e b8 d7 e6 df 66 a4 b9 |5m..N........f..| | c9 54 fc 42 a5 06 9a c3 |.T.B.... | key expansion[104]: | 6e 71 f0 34 e0 c1 df 65 49 56 92 f0 de aa c9 2d |nq.4...eIV.....-| | db 0e 86 32 84 50 6f b2 4b 1f 62 73 84 af fa bb |...2.Po.K.bs....| | a9 df 11 ae a3 30 b7 f8 a3 43 1f 93 6a 5d 72 ec |.....0...C..j]r.| | 8c ae 20 5c ec 22 21 b2 28 cc d2 ec 6f fc 59 c2 |.. \."!.(...o.Y.| | d9 95 c9 ad 5a 16 c6 0d dd 0a 04 e4 07 00 6b a0 |....Z.........k.| | 35 6d b2 aa 4e 00 a8 1a 0e b8 d7 e6 df 66 a4 b9 |5m..N........f..| | c9 54 fc 42 a5 06 9a c3 |.T.B.... | Client MAC key[20]: | 6e 71 f0 34 e0 c1 df 65 49 56 92 f0 de aa c9 2d |nq.4...eIV.....-| | db 0e 86 32 |...2 | Server MAC key[20]: | 84 50 6f b2 4b 1f 62 73 84 af fa bb a9 df 11 ae |.Po.K.bs........| | a3 30 b7 f8 |.0.. | Client Write key[24]: | a3 43 1f 93 6a 5d 72 ec 8c ae 20 5c ec 22 21 b2 |.C..j]r... \."!.| | 28 cc d2 ec 6f fc 59 c2 |(...o.Y. | Server Write key[24]: | d9 95 c9 ad 5a 16 c6 0d dd 0a 04 e4 07 00 6b a0 |....Z.........k.| | 35 6d b2 aa 4e 00 a8 1a |5m..N... | Client Write IV[8]: | 0e b8 d7 e6 df 66 a4 b9 |.....f.. | Server Write IV[8]: | c9 54 fc 42 a5 06 9a c3 |.T.B.... | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | e5 3f 66 3b 4b 29 36 47 23 9f ea 49 1d d2 2e b9 |.?f;K)6G#..I....| | 89 04 6f 7c e5 34 dd 87 f5 69 b4 cc 06 d4 a7 72 |..o|.4...i.....r| | ef 94 72 fd 34 9c fc 2c f9 41 55 f7 a8 58 79 75 |..r.4..,.AU..Xyu| dissect_ssl3_handshake session keys successfully generated record: offset = 267, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 273, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | ac f9 4c 55 10 ea 1e 05 b3 50 3b 74 ac 07 97 6a |..LU.....P;t...j| | df 05 41 ae c8 1d 95 91 dd a1 63 0b cd 87 1c 57 |..A.......c....W| | 24 0c 15 16 17 96 ac 8c 8e fa dd 06 a5 44 9d 92 |$............D..| Plaintext[48]: | 68 a6 1b 9c 12 d1 74 fa 14 00 00 0c 30 0f 2f d0 |h.....t.....0./.| | e1 f3 f6 11 a1 f2 50 45 a2 b2 af fa f5 29 5c f5 |......PE.....)\.| | a2 59 8e 8e 80 fd 79 b4 47 50 f7 e3 03 03 03 03 |.Y....y.GP......| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | a2 b2 af fa f5 29 5c f5 a2 59 8e 8e 80 fd 79 b4 |.....)\..Y....y.| | 47 50 f7 e3 |GP.. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #69 (first time) conversation = 0x7fca71decb28, ssl_session = 0x7fca45bcffe0 record: offset = 0, reported_length_remaining = 234 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 3e e1 d4 f4 9b 00 9e ef 27 e4 9d 11 03 ed 82 ea |>.......'.......| | ac 6c b0 ea 70 05 a2 bc a8 f2 96 e1 e0 08 92 7a |.l..p..........z| | 5c a6 36 65 05 2d 53 d2 18 65 c3 e9 7d b0 9d 9c |\.6e.-S..e..}...| Plaintext[48]: | 9e 0b c1 84 a2 d6 72 88 14 00 00 0c ec e2 42 1c |......r.......B.| | 2d 14 db 7a 23 c9 38 e7 79 74 34 56 aa 61 50 d8 |-..z#.8.yt4V.aP.| | 46 af 7f 92 83 e1 10 d3 77 dd 08 c8 03 03 03 03 |F.......w.......| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 79 74 34 56 aa 61 50 d8 46 af 7f 92 83 e1 10 d3 |yt4V.aP.F.......| | 77 dd 08 c8 |w... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #70 (first time) conversation = 0x7fca71decb28, ssl_session = 0x7fca45bcffe0 record: offset = 0, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 96, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 96 Ciphertext[96]: | 14 0c 26 ec 54 6c 3c 55 72 8f 8b 03 3b 76 f7 4a |..&.Tl.=....,.LdC.a..| | b7 48 c3 33 4b 0e aa bb 8e 32 01 98 5a 99 97 8a |.H.3K....2..Z...| | 9b 35 6b ac 7e 69 ef db 7f 3d 4b 8e 1d 59 37 50 |.5k.~i...=K..Y7P| | 2a 65 18 f7 0f 22 37 19 a5 f2 c4 d6 06 d5 93 ea |*e..."7.........| Plaintext[96]: | d8 f9 a4 4c 83 4d c1 4f 47 45 54 20 2f 20 48 54 |...L.M.OGET / HT| | 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 64 65 |TP/1.1..Host: de| | 73 2d 63 62 63 33 2d 73 68 61 2e 6c 6f 63 61 6c |s-cbc3-sha.local| | 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n| | 6c 3a 34 34 34 31 0d 0a 0d 0a 04 d1 39 0a b8 49 |l:4441......9..I| | 51 15 a7 9f 8a 45 ea c3 e3 7d f1 5b dc 4d 01 01 |Q....E...}.[.M..| ssl_decrypt_record found padding 1 final len 94 checking mac (len 66, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 7d 6d 73 7a f9 f0 b2 2a f8 82 bb c2 d5 4a 20 6d |}msz...*.....J m| | 7b dd 8d cf |{... | ssl_decrypt_record: mac failed association_find: TCP port 55842 found (nil) association_find: TCP port 4441 found 0x3734230 dissect_ssl enter frame #71 (first time) conversation = 0x7fca71decb28, ssl_session = 0x7fca45bcffe0 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | be ba 44 86 33 9e 1e 79 f0 59 4b 09 1b 57 1c fc |..D.3..y.YK..W..| | 8a 4a fa a5 57 9d 0e 96 b5 bd 38 57 08 d4 a5 a1 |.J..W.....8W....| | 39 50 ef b1 98 1c 56 e6 1a 5d ea 7f 8c 65 4e 19 |9P....V..]...eN.| | 1b a1 e5 d6 cf 81 75 ad 2f fa 32 28 4b dc 87 00 |......u./.2(K...| | 9f ab 2f 5a 1d d5 11 42 85 91 72 c2 8f b9 d9 fb |../Z...B..r.....| | 1d f8 e8 80 6d 86 85 35 4f 84 25 2d a3 51 6d 47 |....m..5O.%-.QmG| | 8a 20 9c e4 1d 23 a6 cf 10 6f 76 b9 37 b1 a0 77 |. ...#...ov.7..w| | 19 17 92 93 be cd d4 fb 13 4f f6 df 91 27 18 1a |.........O...'..| | 13 3b 9b ab a3 70 1e e9 8e d5 b6 b7 43 d4 15 7c |.;...p......C..|| | 09 2f c4 d6 18 4a 79 b4 de df 40 fc fe f2 1b bb |./...Jy...@.....| | fd 25 2b f1 d6 93 a6 fd 9c ff 4d cb d6 d0 d3 92 |.%+.......M.....| | 0b 0a 1a f5 16 17 e9 55 bb 50 9c fe a5 c9 a0 bd |.......U.P......| | ee 08 ee a4 7b a7 2d c4 36 07 3d 19 80 3f a5 77 |....{.-.6.=..?.w| | fa 29 36 88 95 a7 45 87 9a a3 8a 3a 2b b0 61 e3 |.)6...E....:+.a.| | 32 e0 32 8f 1a 96 44 02 f2 e9 51 43 7e 5c ff 08 |2.2...D...QC~\..| | b9 3b ff 53 ee 52 3f 7a 11 67 78 81 6f 5c b8 2f |.;.S.R?z.gx.o\./| | 7e bc f8 99 4f c1 70 60 6b 62 3f 69 23 f7 86 7a |~...O.p`kb?i#..z| | 0f 04 b4 15 bf cd c3 1b a6 bc 70 f2 27 be 93 21 |..........p.'..!| | 80 fa d7 c5 15 46 c8 76 c5 2f 3d 53 20 94 2f 38 |.....F.v./=S ./8| | c8 59 86 33 88 7a d7 2a 78 3a 76 f5 47 cf 51 ef |.Y.3.z.*x:v.G.Q.| | 9f dd 95 d7 e4 d7 aa a3 18 73 5f a0 d1 08 04 b6 |.........s_.....| | e0 10 3e b3 a9 21 05 06 76 ae 53 2b c2 c4 86 11 |..>..!..v.S+....| | ff 98 23 af 9f 46 26 00 0f c9 a5 bc 62 cb 81 b6 |..#..F&.....b...| | 57 73 90 09 0c b5 b6 ab 5c 23 04 08 63 cd 1a f9 |Ws......\#..c...| Plaintext[384]: | d4 a2 d7 3d c8 79 17 ba 48 54 54 50 2f 31 2e 31 |...=.y..HTTP/1.1| | 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:| | 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da| | 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep | | 32 30 31 33 20 32 30 3a 31 31 3a 32 37 20 47 4d |2013 20:11:27 GM| | 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:| | 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont| | 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.| | 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo| | 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu| | 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00| | 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach| | 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca| | 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 30 41 |che....0x00,0x0A| | 20 2d 20 44 45 53 2d 43 42 43 33 2d 53 48 41 20 | - DES-CBC3-SHA | | 20 20 20 20 20 20 20 20 20 20 20 53 53 4c 76 33 | SSLv3| | 20 4b 78 3d 52 53 41 20 20 20 20 20 20 41 75 3d | Kx=RSA Au=| | 52 53 41 20 20 45 6e 63 3d 33 44 45 53 28 31 36 |RSA Enc=3DES(16| | 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 |8) Mac=SHA1document.doma| | 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek| | 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'|*..+.. H.[v| | 0c 05 dd 50 13 e4 f3 41 07 07 07 07 07 07 07 07 |...P...A........| ssl_decrypt_record found padding 7 final len 376 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 36 85 33 07 1d e2 45 ac ac c1 07 4f ea da 6d 37 |6.3...E....O..m7| | 31 cd 88 5e |1..^ | ssl_decrypt_record: mac failed association_find: TCP port 4441 found 0x3734230 dissect_ssl enter frame #72 (first time) conversation = 0x7fca71decb28, ssl_session = 0x7fca45bcffe0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | d9 7b 1a 88 46 f1 ce a6 66 8a c1 05 78 ef f8 e2 |.{..F...f...x...| | f6 d6 12 c6 e6 33 59 5f b5 ff 91 e3 d1 0a f8 e9 |.....3Y_........| Plaintext[32]: | aa 26 b7 a8 a2 00 bc 97 01 00 c9 ad a7 2f 38 14 |.&.........../8.| | c7 ba da c9 1c b6 06 39 56 85 21 21 42 69 01 01 |.......9V.!!Bi..| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | c9 ad a7 2f 38 14 c7 ba da c9 1c b6 06 39 56 85 |.../8........9V.| | 21 21 42 69 |!!Bi | ssl_decrypt_record: mac ok dissect_ssl enter frame #74 (first time) conversation = 0x7fca71decb28, ssl_session = 0x7fca45bcffe0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | ef 2e e8 7e e0 ae f8 5a 54 a3 46 1f 08 8f d0 d3 |...~...ZT.F.....| | fd 9f ab 10 39 6a c4 24 1b d0 f6 c6 cd 1e 71 66 |....9j.$......qf| Plaintext[32]: | 47 ad 30 9f 74 e0 77 3b 01 00 69 e6 e3 83 b6 30 |G.0.t.w;..i....0| | 3f de 46 bf 07 02 d3 2c d0 38 3e 28 df b0 01 01 |?.F....,.8>(....| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 69 e6 e3 83 b6 30 3f de 46 bf 07 02 d3 2c d0 38 |i....0?.F....,.8| | 3e 28 df b0 |>(.. | ssl_decrypt_record: mac ok dissect_ssl enter frame #79 (first time) ssl_session_init: initializing ptr 0x7fca45bd25a0 size 688 conversation = 0x7fca71decdd0, ssl_session = 0x7fca45bd25a0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 47560 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4443 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #81 (first time) conversation = 0x7fca71decdd0, ssl_session = 0x7fca45bd25a0 record: offset = 0, reported_length_remaining = 1134 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0012 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | e5 3f 66 3b 4b 29 36 47 23 9f ea 49 1d d2 2e b9 |.?f;K)6G#..I....| | 89 04 6f 7c e5 34 dd 87 f5 69 b4 cc 06 d4 a7 72 |..o|.4...i.....r| | ef 94 72 fd 34 9c fc 2c f9 41 55 f7 a8 58 79 75 |..r.4..,.AU..Xyu| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | ef b1 f8 c8 d7 d8 42 d4 aa 82 24 fd 04 92 21 4b |......B...$...!K| | 6a 72 96 aa 19 82 aa fb e2 91 97 46 36 52 34 c2 |jr.........F6R4.| | ef b9 59 6d 7b cb 9a 7a 29 49 40 4a 7d 61 87 55 |..Ym{..z)I@J}a.U| | 24 7b 42 3a 69 90 53 f0 a7 2f 00 78 94 |${B:i.S../.x. | hash out[72]: | ca f8 ff 96 17 8c 3c 58 c9 cf 97 94 52 7a 80 96 |..............$| | a6 1d 81 f5 70 01 55 71 c0 68 be 48 38 2b 51 98 |....p.Uq.h.H8+Q.| | c7 ff db 07 ad 10 fb c2 71 19 ae c8 d9 64 ec 45 |........q....d.E| | c4 8e e9 4b d7 86 78 5a |...K..xZ | PRF out[72]: | ca f8 ff 96 17 8c 3c 58 c9 cf 97 94 52 7a 80 96 |..............$| | a6 1d 81 f5 70 01 55 71 c0 68 be 48 38 2b 51 98 |....p.Uq.h.H8+Q.| | c7 ff db 07 ad 10 fb c2 71 19 ae c8 d9 64 ec 45 |........q....d.E| | c4 8e e9 4b d7 86 78 5a |...K..xZ | key expansion[72]: | ca f8 ff 96 17 8c 3c 58 c9 cf 97 94 52 7a 80 96 |..............$| | a6 1d 81 f5 70 01 55 71 c0 68 be 48 38 2b 51 98 |....p.Uq.h.H8+Q.| | c7 ff db 07 ad 10 fb c2 71 19 ae c8 d9 64 ec 45 |........q....d.E| | c4 8e e9 4b d7 86 78 5a |...K..xZ | Client MAC key[20]: | ca f8 ff 96 17 8c 3c 58 c9 cf 97 94 52 7a 80 96 |..............$....| | 70 01 55 71 |p.Uq | Client Write key[8]: | c0 68 be 48 38 2b 51 98 |.h.H8+Q. | Server Write key[8]: | c7 ff db 07 ad 10 fb c2 |........ | Client Write IV[8]: | 71 19 ae c8 d9 64 ec 45 |q....d.E | Server Write IV[8]: | c4 8e e9 4b d7 86 78 5a |...K..xZ | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 1071 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 735, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803 record: offset = 803, reported_length_remaining = 331 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 808 length 313 bytes, remaining 1125 record: offset = 1125, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1130 length 0 bytes, remaining 1134 dissect_ssl enter frame #83 (first time) conversation = 0x7fca71decdd0, ssl_session = 0x7fca45bd25a0 record: offset = 0, reported_length_remaining = 198 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a69... looking for RSA pre-master00805c722254dd2c89207dd19ea589e58776dc10bb2bd423... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | e3 7d 12 96 52 6f 48 cf 56 63 d3 4d 99 91 cd b5 |.}..RoH.Vc.M....| | 3d ab 66 27 d1 fc d5 80 5f 93 5e ef 74 44 3b ea |=.f'...._.^.tD;.| | 11 bf 87 ef 93 d3 56 37 92 bd 25 2d a1 11 95 57 |......V7..%-...W| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | ef b1 f8 c8 d7 d8 42 d4 aa 82 24 fd 04 92 21 4b |......B...$...!K| | 6a 72 96 aa 19 82 aa fb e2 91 97 46 36 52 34 c2 |jr.........F6R4.| | ef b9 59 6d 7b cb 9a 7a 29 49 40 4a 7d 61 87 55 |..Ym{..z)I@J}a.U| | 24 7b 42 3a 69 90 53 f0 a7 2f 00 78 94 |${B:i.S../.x. | hash out[72]: | ab b2 74 a1 16 68 89 b1 7e 31 d9 1e ef 30 8f 47 |..t..h..~1...0.G| | ff 7d 27 13 06 df 16 9a 52 c7 cb e1 ca d7 81 a1 |.}'.....R.......| | fa 8d 63 7d c1 9c eb f8 45 96 60 da e7 6e 2b 44 |..c}....E.`..n+D| | 6c d0 7c 88 e1 d0 13 15 38 e2 72 49 8b ee ed c3 |l.|.....8.rI....| | 78 38 c5 82 65 80 92 08 |x8..e... | PRF out[72]: | ab b2 74 a1 16 68 89 b1 7e 31 d9 1e ef 30 8f 47 |..t..h..~1...0.G| | ff 7d 27 13 06 df 16 9a 52 c7 cb e1 ca d7 81 a1 |.}'.....R.......| | fa 8d 63 7d c1 9c eb f8 45 96 60 da e7 6e 2b 44 |..c}....E.`..n+D| | 6c d0 7c 88 e1 d0 13 15 38 e2 72 49 8b ee ed c3 |l.|.....8.rI....| | 78 38 c5 82 65 80 92 08 |x8..e... | key expansion[72]: | ab b2 74 a1 16 68 89 b1 7e 31 d9 1e ef 30 8f 47 |..t..h..~1...0.G| | ff 7d 27 13 06 df 16 9a 52 c7 cb e1 ca d7 81 a1 |.}'.....R.......| | fa 8d 63 7d c1 9c eb f8 45 96 60 da e7 6e 2b 44 |..c}....E.`..n+D| | 6c d0 7c 88 e1 d0 13 15 38 e2 72 49 8b ee ed c3 |l.|.....8.rI....| | 78 38 c5 82 65 80 92 08 |x8..e... | Client MAC key[20]: | ab b2 74 a1 16 68 89 b1 7e 31 d9 1e ef 30 8f 47 |..t..h..~1...0.G| | ff 7d 27 13 |.}'. | Server MAC key[20]: | 06 df 16 9a 52 c7 cb e1 ca d7 81 a1 fa 8d 63 7d |....R.........c}| | c1 9c eb f8 |.... | Client Write key[8]: | 45 96 60 da e7 6e 2b 44 |E.`..n+D | Server Write key[8]: | 6c d0 7c 88 e1 d0 13 15 |l.|..... | Client Write IV[8]: | 38 e2 72 49 8b ee ed c3 |8.rI.... | Server Write IV[8]: | 78 38 c5 82 65 80 92 08 |x8..e... | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | e3 7d 12 96 52 6f 48 cf 56 63 d3 4d 99 91 cd b5 |.}..RoH.Vc.M....| | 3d ab 66 27 d1 fc d5 80 5f 93 5e ef 74 44 3b ea |=.f'...._.^.tD;.| | 11 bf 87 ef 93 d3 56 37 92 bd 25 2d a1 11 95 57 |......V7..%-...W| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | c5 86 2a 81 34 2b 24 8b 37 04 a0 f0 7d 05 a8 34 |..*.4+$.7...}..4| | c4 6f dc 30 8b 89 17 96 06 37 b5 66 4b 5b 98 cc |.o.0.....7.fK[..| | 09 43 f6 49 6d 8e 92 65 51 5b 8f 0d 74 3e 8b 26 |.C.Im..eQ[..t>.&| Plaintext[48]: | 20 fc 3a 7f da e9 b9 28 14 00 00 0c 92 79 0a 18 | .:....(.....y..| | e9 31 85 97 94 69 aa 49 20 26 e3 f0 c7 83 74 b9 |.1...i.I &....t.| | 30 60 ca 65 b4 b5 f2 6b 46 c9 bf 28 03 03 03 03 |0`.e...kF..(....| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 20 26 e3 f0 c7 83 74 b9 30 60 ca 65 b4 b5 f2 6b | &....t.0`.e...k| | 46 c9 bf 28 |F..( | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #84 (first time) conversation = 0x7fca71decdd0, ssl_session = 0x7fca45bd25a0 record: offset = 0, reported_length_remaining = 234 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | a1 e0 e3 ee e0 58 c5 e9 fa 3f b5 98 8f c6 48 45 |.....X...?....HE| | 1d 79 a7 36 96 4d ad a7 d9 2d 7f 98 a9 1c 4f c5 |.y.6.M...-....O.| | 82 75 86 2e ff 7e 6a 88 11 53 39 d8 d1 93 8b 82 |.u...~j..S9.....| Plaintext[48]: | 38 19 54 3f 1b 56 75 ef 14 00 00 0c bb f7 e9 4a |8.T?.Vu........J| | 87 b5 9a 90 fb ad 61 40 ee 38 ff 7f a9 d0 5d 94 |......a@.8....].| | c8 16 eb 75 d6 f2 22 0c 86 6d 3d 8c 03 03 03 03 |...u.."..m=.....| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | ee 38 ff 7f a9 d0 5d 94 c8 16 eb 75 d6 f2 22 0c |.8....]....u..".| | 86 6d 3d 8c |.m=. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #85 (first time) conversation = 0x7fca71decdd0, ssl_session = 0x7fca45bd25a0 record: offset = 0, reported_length_remaining = 109 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 104, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 104 Ciphertext[104]: | 38 4b 8b 5b cd 79 91 b8 0c a3 1e 0a dd 41 56 a3 |8K.[.y.......AV.| | ba c0 51 85 70 20 c1 8e 7a e3 03 cf ec 20 e1 f2 |..Q.p ..z.... ..| | fd b7 cc 57 1f 37 ad 57 ff e5 25 86 48 48 73 b7 |...W.7.W..%.HHs.| | 7d d2 bb 4c 2e 4b ce 6e d1 16 d8 5d e4 b1 4e f6 |}..L.K.n...]..N.| | 58 f9 99 de 33 eb db e9 d3 d4 cd f8 7d 54 5d c0 |X...3.......}T].| | 9c 4e 89 2b dd 0e d8 5d 2b 59 c7 a2 24 f9 86 4f |.N.+...]+Y..$..O| | ac 74 b9 5d 71 a6 9e b0 |.t.]q... | Plaintext[104]: | f2 b7 93 6e d8 25 62 32 47 45 54 20 2f 20 48 54 |...n.%b2GET / HT| | 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 64 |TP/1.1..Host: ed| | 68 2d 64 73 73 2d 64 65 73 2d 63 62 63 2d 73 68 |h-dss-des-cbc-sh| | 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |a.local.al.leken| | 73 74 65 79 6e 2e 6e 6c 3a 34 34 34 33 0d 0a 0d |steyn.nl:4443...| | 0a 39 d7 a9 2d 0f 2b 49 92 85 b1 66 dd 7d 5c ea |.9..-.+I...f.}\.| | 30 d3 8e 17 db 02 02 02 |0....... | ssl_decrypt_record found padding 2 final len 101 checking mac (len 73, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | d3 e2 f2 5e b4 db 3d 59 09 10 28 2a 5e fb 77 e8 |...^..=Y..(*^.w.| | 68 a9 e2 07 |h... | ssl_decrypt_record: mac failed association_find: TCP port 47560 found (nil) association_find: TCP port 4443 found 0x3734df0 dissect_ssl enter frame #86 (first time) conversation = 0x7fca71decdd0, ssl_session = 0x7fca45bd25a0 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | c8 4d 53 f7 6e 86 c0 31 5f 9e 86 24 2a 82 31 2c |.MS.n..1_..$*.1,| | bb 1c b2 ca 77 85 d8 e5 ec af 17 f8 0e 29 43 5a |....w........)CZ| | ac be 66 84 38 63 02 6d 15 9e d1 06 da 55 90 b1 |..f.8c.m.....U..| | 1f bc 07 65 e7 cb ab fb 87 89 5e 76 c8 4b 81 a4 |...e......^v.K..| | 42 64 02 54 65 8c 24 b9 f4 84 e7 12 3d a3 f1 de |Bd.Te.$.....=...| | 19 da d6 6e a0 91 22 ab f1 cc 0a c6 8a 02 69 ca |...n..".......i.| | c3 14 90 db c5 2e 82 d5 1a 69 c3 39 dd 86 20 46 |.........i.9.. F| | ae 3b 4f c8 b0 3d 35 bc 7b 2c 94 b6 95 ac 25 59 |.;O..=5.{,....%Y| | d5 e1 f7 4b 2e a1 45 b8 49 b0 ac c0 e0 9b ee 33 |...K..E.I......3| | 62 fd a0 6d 3e dc 50 86 10 5b 10 e0 92 c6 5e 81 |b..m>.P..[....^.| | 42 eb ed 4c af 0c c7 fb 07 00 c0 d2 06 27 55 44 |B..L.........'UD| | a8 55 0e ec aa 6b 90 12 e9 14 0c 39 5a 90 bb 3d |.U...k.....9Z..=| | 82 ca 76 8a 05 ea 90 c9 d4 cc 50 e7 4e 36 fc db |..v.......P.N6..| | e5 10 02 e5 bb 6b 88 b5 69 b1 bf 90 c6 47 1f dc |.....k..i....G..| | 73 d5 42 60 5a ff 81 68 f4 4c 98 33 cc db 29 ac |s.B`Z..h.L.3..).| | 4f 6b f1 fd 79 e5 be f8 62 1e 92 6d 88 7b bc 90 |Ok..y...b..m.{..| | cc 39 c0 e3 b1 b3 a0 1c 9a f3 81 37 37 3f 03 79 |.9.........77?.y| | 68 6a 46 b1 3e fc 30 ef 4c 1a 2c ef 8b 2b 59 66 |hjF.>.0.L.,..+Yf| | e5 d4 85 4a bf d7 60 e7 30 2c 55 ba 13 e8 a7 f1 |...J..`.0,U.....| | 0a e8 71 04 7a ba 59 8a eb 9b cd 40 90 ed 79 21 |..q.z.Y....@..y!| | fe 91 5d 1e 04 ab 7f ec c2 38 be 77 e2 83 5d 96 |..]......8.w..].| | de 51 70 fb af b7 28 7d b7 b9 fd 82 e0 15 b7 81 |.Qp...(}........| | 9e 99 74 2c 32 52 f3 c2 2d 39 94 5b 79 4c c3 d9 |..t,2R..-9.[yL..| | 8d 38 64 b0 7a 7c 05 1c 76 e1 90 02 fa aa ac 8c |.8d.z|..v.......| Plaintext[384]: | 1e 40 07 e9 05 89 74 eb 48 54 54 50 2f 31 2e 31 |.@....t.HTTP/1.1| | 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:| | 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da| | 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep | | 32 30 31 33 20 32 30 3a 31 31 3a 32 37 20 47 4d |2013 20:11:27 GM| | 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:| | 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont| | 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.| | 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo| | 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu| | 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00| | 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach| | 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca| | 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 31 32 |che....0x00,0x12| | 20 2d 20 45 44 48 2d 44 53 53 2d 44 45 53 2d 43 | - EDH-DSS-DES-C| | 42 43 2d 53 48 41 20 20 20 20 20 53 53 4c 76 33 |BC-SHA SSLv3| | 20 4b 78 3d 44 48 20 20 20 20 20 20 20 41 75 3d | Kx=DH Au=| | 44 53 53 20 20 45 6e 63 3d 44 45 53 28 35 36 29 |DSS Enc=DES(56)| | 20 20 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 | Mac=SHA1document.doma| | 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek| | 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'.....s.p...1| | ed c4 d7 8e f9 2e 83 49 07 07 07 07 07 07 07 07 |.......I........| ssl_decrypt_record found padding 7 final len 376 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 2b ba 9d 64 0b a5 ed af 56 48 2d ba d0 3f 1b 11 |+..d....VH-..?..| | 48 21 3e 1b |H!>. | ssl_decrypt_record: mac failed association_find: TCP port 4443 found 0x3734df0 dissect_ssl enter frame #87 (first time) conversation = 0x7fca71decdd0, ssl_session = 0x7fca45bd25a0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 68 e1 f0 8e 24 16 62 b7 0a a4 07 bd a4 82 28 13 |h...$.b.......(.| | ee 0b 5e de 06 b0 e3 3f 98 d5 47 71 a8 12 70 01 |..^....?..Gq..p.| Plaintext[32]: | 65 a6 02 bc dd 2b 0a b7 01 00 d8 34 dd 3d 70 2f |e....+.....4.=p/| | 27 f7 47 b7 be 0d b2 2b 1a 92 ce 32 11 a4 01 01 |'.G....+...2....| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | d8 34 dd 3d 70 2f 27 f7 47 b7 be 0d b2 2b 1a 92 |.4.=p/'.G....+..| | ce 32 11 a4 |.2.. | ssl_decrypt_record: mac ok dissect_ssl enter frame #89 (first time) conversation = 0x7fca71decdd0, ssl_session = 0x7fca45bd25a0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 02 c2 1e 30 a1 cc e0 4d 4a 2f 6d 01 b6 98 0d d1 |...0...MJ/m.....| | ed 0f 75 6e c0 e1 c0 62 d2 cf c9 ac 80 da ef b5 |..un...b........| Plaintext[32]: | a2 8c fe ba c9 54 52 29 01 00 80 58 b4 3b 77 c3 |.....TR)...X.;w.| | 5f 48 42 dc b4 ca 18 e0 6b 5a e1 3b 00 5c 01 01 |_HB.....kZ.;.\..| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 80 58 b4 3b 77 c3 5f 48 42 dc b4 ca 18 e0 6b 5a |.X.;w._HB.....kZ| | e1 3b 00 5c |.;.\ | ssl_decrypt_record: mac ok dissect_ssl enter frame #94 (first time) ssl_session_init: initializing ptr 0x7fca45bd4aa0 size 688 conversation = 0x7fca71ded078, ssl_session = 0x7fca45bd4aa0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 60487 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4444 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #96 (first time) conversation = 0x7fca71ded078, ssl_session = 0x7fca45bd4aa0 record: offset = 0, reported_length_remaining = 1134 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0013 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | e3 7d 12 96 52 6f 48 cf 56 63 d3 4d 99 91 cd b5 |.}..RoH.Vc.M....| | 3d ab 66 27 d1 fc d5 80 5f 93 5e ef 74 44 3b ea |=.f'...._.^.tD;.| | 11 bf 87 ef 93 d3 56 37 92 bd 25 2d a1 11 95 57 |......V7..%-...W| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | ef 11 62 75 9c 98 f5 e2 d6 95 90 8d 43 e7 74 4b |..bu........C.tK| | 72 2a 00 eb 3f 4a 3c 22 e8 86 14 2a 20 52 34 c2 |r*..?J<"...* R4.| | ef 44 af 09 1c ca 74 a5 6b 45 c0 bc 18 43 96 73 |.D....t.kE...C.s| | e5 b4 f5 93 52 7a 24 f8 af 3b c7 09 20 |....Rz$..;.. | hash out[104]: | 78 5d 82 c3 5c f3 92 54 2f 6c 72 9d a7 a3 cf 67 |x]..\..T/lr....g| | f4 71 3b 75 da d0 57 07 f4 1e 79 ee 52 9c fb 1c |.q;u..W...y.R...| | 11 b0 9e 83 53 1e c0 9c af 41 90 ef c6 97 45 c3 |....S....A....E.| | d4 dd bc 9d ab a6 5a 52 f2 0d 04 35 13 32 75 15 |......ZR...5.2u.| | 6d fc 80 0b 3c e6 82 f6 53 48 81 5f f2 9f 17 f3 |m...<...SH._....| | d1 bf 6c fb d9 1f 0d d3 16 5f 17 02 0d 87 2d d2 |..l......_....-.| | 89 db b7 68 0c 3a c1 c3 |...h.:.. | PRF out[104]: | 78 5d 82 c3 5c f3 92 54 2f 6c 72 9d a7 a3 cf 67 |x]..\..T/lr....g| | f4 71 3b 75 da d0 57 07 f4 1e 79 ee 52 9c fb 1c |.q;u..W...y.R...| | 11 b0 9e 83 53 1e c0 9c af 41 90 ef c6 97 45 c3 |....S....A....E.| | d4 dd bc 9d ab a6 5a 52 f2 0d 04 35 13 32 75 15 |......ZR...5.2u.| | 6d fc 80 0b 3c e6 82 f6 53 48 81 5f f2 9f 17 f3 |m...<...SH._....| | d1 bf 6c fb d9 1f 0d d3 16 5f 17 02 0d 87 2d d2 |..l......_....-.| | 89 db b7 68 0c 3a c1 c3 |...h.:.. | key expansion[104]: | 78 5d 82 c3 5c f3 92 54 2f 6c 72 9d a7 a3 cf 67 |x]..\..T/lr....g| | f4 71 3b 75 da d0 57 07 f4 1e 79 ee 52 9c fb 1c |.q;u..W...y.R...| | 11 b0 9e 83 53 1e c0 9c af 41 90 ef c6 97 45 c3 |....S....A....E.| | d4 dd bc 9d ab a6 5a 52 f2 0d 04 35 13 32 75 15 |......ZR...5.2u.| | 6d fc 80 0b 3c e6 82 f6 53 48 81 5f f2 9f 17 f3 |m...<...SH._....| | d1 bf 6c fb d9 1f 0d d3 16 5f 17 02 0d 87 2d d2 |..l......_....-.| | 89 db b7 68 0c 3a c1 c3 |...h.:.. | Client MAC key[20]: | 78 5d 82 c3 5c f3 92 54 2f 6c 72 9d a7 a3 cf 67 |x]..\..T/lr....g| | f4 71 3b 75 |.q;u | Server MAC key[20]: | da d0 57 07 f4 1e 79 ee 52 9c fb 1c 11 b0 9e 83 |..W...y.R.......| | 53 1e c0 9c |S... | Client Write key[24]: | af 41 90 ef c6 97 45 c3 d4 dd bc 9d ab a6 5a 52 |.A....E.......ZR| | f2 0d 04 35 13 32 75 15 |...5.2u. | Server Write key[24]: | 6d fc 80 0b 3c e6 82 f6 53 48 81 5f f2 9f 17 f3 |m...<...SH._....| | d1 bf 6c fb d9 1f 0d d3 |..l..... | Client Write IV[8]: | 16 5f 17 02 0d 87 2d d2 |._....-. | Server Write IV[8]: | 89 db b7 68 0c 3a c1 c3 |...h.:.. | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 1071 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 735, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803 record: offset = 803, reported_length_remaining = 331 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 808 length 313 bytes, remaining 1125 record: offset = 1125, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1130 length 0 bytes, remaining 1134 dissect_ssl enter frame #98 (first time) conversation = 0x7fca71ded078, ssl_session = 0x7fca45bd4aa0 record: offset = 0, reported_length_remaining = 198 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f59352... looking for RSA pre-master008020de993b60cfbb0acdba730b666f94fb2461254ea18f... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 86 f6 86 1f 4a c5 1a 48 06 95 d8 d1 bf 20 aa 28 |....J..H..... .(| | 94 f7 fe 1d 63 7f 5c e2 92 c6 67 b6 49 a5 e0 b7 |....c.\...g.I...| | 02 14 6e 8a 0c 68 95 c5 b2 6d 9a 6a c1 61 64 5e |..n..h...m.j.ad^| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | ef 11 62 75 9c 98 f5 e2 d6 95 90 8d 43 e7 74 4b |..bu........C.tK| | 72 2a 00 eb 3f 4a 3c 22 e8 86 14 2a 20 52 34 c2 |r*..?J<"...* R4.| | ef 44 af 09 1c ca 74 a5 6b 45 c0 bc 18 43 96 73 |.D....t.kE...C.s| | e5 b4 f5 93 52 7a 24 f8 af 3b c7 09 20 |....Rz$..;.. | hash out[104]: | 69 f3 3f da 19 0c e3 22 35 7f bb 8f 0b c1 6b a3 |i.?...."5.....k.| | 40 7e 15 a2 6f ad 24 14 6c f9 0b 20 ce 8e 6a c2 |@~..o.$.l.. ..j.| | 1e b4 f1 b5 db 41 1f 65 ef 0c ce 75 64 de 59 e7 |.....A.e...ud.Y.| | 4d e1 16 a7 17 fd cb 2f 78 05 80 54 40 f3 1c 4b |M....../x..T@..K| | cb 51 6d b8 26 2a 00 d0 76 77 eb 9a a7 7b 85 a0 |.Qm.&*..vw...{..| | 19 5d 94 a4 bc b7 f0 d2 9a 4d 10 fc 7f fa cc 0d |.].......M......| | 3f cf c9 c4 4d f4 75 83 |?...M.u. | PRF out[104]: | 69 f3 3f da 19 0c e3 22 35 7f bb 8f 0b c1 6b a3 |i.?...."5.....k.| | 40 7e 15 a2 6f ad 24 14 6c f9 0b 20 ce 8e 6a c2 |@~..o.$.l.. ..j.| | 1e b4 f1 b5 db 41 1f 65 ef 0c ce 75 64 de 59 e7 |.....A.e...ud.Y.| | 4d e1 16 a7 17 fd cb 2f 78 05 80 54 40 f3 1c 4b |M....../x..T@..K| | cb 51 6d b8 26 2a 00 d0 76 77 eb 9a a7 7b 85 a0 |.Qm.&*..vw...{..| | 19 5d 94 a4 bc b7 f0 d2 9a 4d 10 fc 7f fa cc 0d |.].......M......| | 3f cf c9 c4 4d f4 75 83 |?...M.u. | key expansion[104]: | 69 f3 3f da 19 0c e3 22 35 7f bb 8f 0b c1 6b a3 |i.?...."5.....k.| | 40 7e 15 a2 6f ad 24 14 6c f9 0b 20 ce 8e 6a c2 |@~..o.$.l.. ..j.| | 1e b4 f1 b5 db 41 1f 65 ef 0c ce 75 64 de 59 e7 |.....A.e...ud.Y.| | 4d e1 16 a7 17 fd cb 2f 78 05 80 54 40 f3 1c 4b |M....../x..T@..K| | cb 51 6d b8 26 2a 00 d0 76 77 eb 9a a7 7b 85 a0 |.Qm.&*..vw...{..| | 19 5d 94 a4 bc b7 f0 d2 9a 4d 10 fc 7f fa cc 0d |.].......M......| | 3f cf c9 c4 4d f4 75 83 |?...M.u. | Client MAC key[20]: | 69 f3 3f da 19 0c e3 22 35 7f bb 8f 0b c1 6b a3 |i.?...."5.....k.| | 40 7e 15 a2 |@~.. | Server MAC key[20]: | 6f ad 24 14 6c f9 0b 20 ce 8e 6a c2 1e b4 f1 b5 |o.$.l.. ..j.....| | db 41 1f 65 |.A.e | Client Write key[24]: | ef 0c ce 75 64 de 59 e7 4d e1 16 a7 17 fd cb 2f |...ud.Y.M....../| | 78 05 80 54 40 f3 1c 4b |x..T@..K | Server Write key[24]: | cb 51 6d b8 26 2a 00 d0 76 77 eb 9a a7 7b 85 a0 |.Qm.&*..vw...{..| | 19 5d 94 a4 bc b7 f0 d2 |.]...... | Client Write IV[8]: | 9a 4d 10 fc 7f fa cc 0d |.M...... | Server Write IV[8]: | 3f cf c9 c4 4d f4 75 83 |?...M.u. | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 86 f6 86 1f 4a c5 1a 48 06 95 d8 d1 bf 20 aa 28 |....J..H..... .(| | 94 f7 fe 1d 63 7f 5c e2 92 c6 67 b6 49 a5 e0 b7 |....c.\...g.I...| | 02 14 6e 8a 0c 68 95 c5 b2 6d 9a 6a c1 61 64 5e |..n..h...m.j.ad^| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 35 fb 98 49 ec b1 be 7c d7 c0 49 c0 d8 20 7d ac |5..I...|..I.. }.| | 58 18 20 f2 99 73 20 9c f1 50 76 34 1a de ea 4c |X. ..s ..Pv4...L| | 8f 4e 9b 09 6f 63 b8 1d e0 0d 35 07 8c e1 16 38 |.N..oc....5....8| Plaintext[48]: | d4 93 b7 1c 0f e3 dc 47 14 00 00 0c b1 1b 76 f0 |.......G......v.| | 03 db ec 76 17 1f 1e d9 0c 15 74 cc 1a ab 8b af |...v......t.....| | c8 49 6b 98 62 93 08 29 6d d3 3a bb 03 03 03 03 |.Ik.b..)m.:.....| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 0c 15 74 cc 1a ab 8b af c8 49 6b 98 62 93 08 29 |..t......Ik.b..)| | 6d d3 3a bb |m.:. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #99 (first time) conversation = 0x7fca71ded078, ssl_session = 0x7fca45bd4aa0 record: offset = 0, reported_length_remaining = 234 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | d9 d5 d4 38 af 7f a2 68 81 32 fa 9f 86 93 32 86 |...8...h.2....2.| | a7 de 91 be 90 e5 c3 38 cb 68 54 1f 17 36 62 58 |.......8.hT..6bX| | 50 1b c6 85 44 aa 70 fb 63 bf 43 de 4f b6 8a 05 |P...D.p.c.C.O...| Plaintext[48]: | c3 5a aa 2c 9e e9 e0 77 14 00 00 0c 40 96 47 94 |.Z.,...w....@.G.| | fc 68 59 87 c6 7c cb 19 a1 5d 72 08 e6 43 dc 90 |.hY..|...]r..C..| | ce fc 04 e9 05 28 14 1d db 49 bd a7 03 03 03 03 |.....(...I......| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | a1 5d 72 08 e6 43 dc 90 ce fc 04 e9 05 28 14 1d |.]r..C.......(..| | db 49 bd a7 |.I.. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #100 (first time) conversation = 0x7fca71ded078, ssl_session = 0x7fca45bd4aa0 record: offset = 0, reported_length_remaining = 109 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 104, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 104 Ciphertext[104]: | 4a 27 f9 97 f3 de 82 08 bf 0c 15 37 91 e4 d6 5b |J'.........7...[| | 90 97 a8 77 b5 70 f0 b7 1a 22 ed 7d 02 24 83 3f |...w.p...".}.$.?| | 02 a9 32 e7 f5 52 64 e8 91 53 7d 3b 32 b7 59 97 |..2..Rd..S};2.Y.| | fd e2 84 02 df dd 2b 47 c2 de d5 31 58 64 3d 05 |......+G...1Xd=.| | 47 0a 17 24 ca 62 0b a8 71 c8 98 f0 6f 9b 8c 72 |G..$.b..q...o..r| | 86 ea e9 ee 17 f3 77 9d 9b a2 1e ed 3f 19 1d 62 |......w.....?..b| | ad fd 93 80 f9 5c 07 30 |.....\.0 | Plaintext[104]: | 1b 91 1e 10 6f 09 4f 78 47 45 54 20 2f 20 48 54 |....o.OxGET / HT| | 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 64 |TP/1.1..Host: ed| | 68 2d 64 73 73 2d 64 65 73 2d 63 62 63 33 2d 73 |h-dss-des-cbc3-s| | 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |ha.local.al.leke| | 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 34 34 0d 0a |nsteyn.nl:4444..| | 0d 0a a5 65 96 d6 b2 56 0b f1 dd 88 58 59 ae d6 |...e...V....XY..| | 5f de c5 ea ea 3c 01 01 |_....<.. | ssl_decrypt_record found padding 1 final len 102 checking mac (len 74, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | c1 3d af 3c ce 3d 8f cf a0 85 25 92 54 af e9 8a |.=.<.=....%.T...| | 8a 4e 9b 99 |.N.. | ssl_decrypt_record: mac failed association_find: TCP port 60487 found (nil) association_find: TCP port 4444 found 0x3734e80 dissect_ssl enter frame #101 (first time) conversation = 0x7fca71ded078, ssl_session = 0x7fca45bd4aa0 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | 26 ad 0b 0d 35 eb ec 78 89 85 26 7e d8 7c 9e 2f |&...5..x..&~.|./| | f2 e0 2f c4 e4 5e 57 26 82 a3 fe a3 ae 9a 24 cf |../..^W&......$.| | 31 ab d4 93 c6 92 8b ae c2 58 17 82 82 4b b0 fa |1........X...K..| | fb 6e 63 bb fc fa a7 81 5d e5 50 32 bf e8 22 e8 |.nc.....].P2..".| | e1 eb c4 f1 f0 67 a1 16 6d 61 df 78 a9 c5 c1 52 |.....g..ma.x...R| | c0 6e ba ca 44 d2 71 62 a8 42 bb 37 cf 95 48 5f |.n..D.qb.B.7..H_| | 78 7b 36 0a fe d2 9e 50 c1 3f ed fa 2a a7 e2 59 |x{6....P.?..*..Y| | 42 97 9d a5 21 1d f1 b5 ae 0b 58 af 9f 02 22 01 |B...!.....X...".| | be f1 fc c4 31 b0 b1 45 96 de a4 b2 73 62 57 45 |....1..E....sbWE| | 27 6d 0c 12 98 42 ab 3f f6 21 7a 66 37 61 b6 61 |'m...B.?.!zf7a.a| | 70 64 79 9e 80 e0 6b 23 c9 8c 01 98 8e 19 70 7f |pdy...k#......p.| | 46 65 d3 fd e4 07 e3 2d 0a 4f de 9b 9b 1c 9b c7 |Fe.....-.O......| | 1c a3 29 1b 07 19 31 3c b6 97 5a 28 b2 96 89 70 |..)...1<..Z(...p| | 84 a0 7c 6a 27 e7 07 d6 39 84 8b d4 54 0f 06 dc |..|j'...9...T...| | ca 54 49 95 59 48 46 31 8c c2 f5 ac 3c f1 b0 23 |.TI.YHF1....<..#| | b8 8f b0 23 4c 33 8a ab c4 c8 76 79 aa 93 e1 83 |...#L3....vy....| | ee fc 8a 21 6e 44 55 a8 c1 2d 2a 42 bb 91 00 d9 |...!nDU..-*B....| | bb 9e 6d cd 39 2f fd 10 ae 5a 23 e4 2d 56 c2 53 |..m.9/...Z#.-V.S| | be 3a ce 53 a3 59 85 30 6f 15 e2 0a 42 7f bc ee |.:.S.Y.0o...B...| | 44 3a db ad af 4c 13 d7 77 e3 df 2f 8c 49 e5 1f |D:...L..w../.I..| | 01 fc 4f b6 16 cc 54 5c 3c db c3 19 a9 4e f7 53 |..O...T\<....N.S| | af 1b 3d 9e 5e 6a 37 6b bb 1c 85 6c 6e 2f ec 6a |..=.^j7k...ln/.j| | 55 69 c0 60 4b c2 65 df c1 48 e9 2d cb 31 1b 1a |Ui.`K.e..H.-.1..| | 99 8f 5e c1 77 0d 32 e9 72 7b 10 de 85 68 d4 94 |..^.w.2.r{...h..| Plaintext[384]: | 24 73 2f 8d 55 bb 51 e1 48 54 54 50 2f 31 2e 31 |$s/.U.Q.HTTP/1.1| | 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:| | 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da| | 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep | | 32 30 31 33 20 32 30 3a 31 31 3a 32 37 20 47 4d |2013 20:11:27 GM| | 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:| | 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont| | 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.| | 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo| | 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu| | 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00| | 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach| | 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca| | 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 31 33 |che....0x00,0x13| | 20 2d 20 45 44 48 2d 44 53 53 2d 44 45 53 2d 43 | - EDH-DSS-DES-C| | 42 43 33 2d 53 48 41 20 20 20 20 53 53 4c 76 33 |BC3-SHA SSLv3| | 20 4b 78 3d 44 48 20 20 20 20 20 20 20 41 75 3d | Kx=DH Au=| | 44 53 53 20 20 45 6e 63 3d 33 44 45 53 28 31 36 |DSS Enc=3DES(16| | 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 |8) Mac=SHA1document.doma| | 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek| | 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'1.<.._@...iu| | 1f cf 93 55 7a 28 55 d0 07 07 07 07 07 07 07 07 |...Uz(U.........| ssl_decrypt_record found padding 7 final len 376 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | df 04 ff ec 1a a0 5e 39 82 b4 43 27 d8 37 3c b6 |......^9..C'.7<.| | 3a 41 1d 1f |:A.. | ssl_decrypt_record: mac failed association_find: TCP port 4444 found 0x3734e80 dissect_ssl enter frame #102 (first time) conversation = 0x7fca71ded078, ssl_session = 0x7fca45bd4aa0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | c2 f8 35 27 3a 16 4b 1c 9b 34 30 3c cf e1 1c 62 |..5':.K..40<...b| | e2 bf 83 76 44 54 f4 d0 c2 cc 89 d7 2d 9a 94 2f |...vDT......-../| Plaintext[32]: | 09 b8 35 59 cf d3 17 63 01 00 63 7e ab 69 c7 80 |..5Y...c..c~.i..| | b2 dc 9c 02 a0 ff 04 0f 25 35 95 55 68 a3 01 01 |........%5.Uh...| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 63 7e ab 69 c7 80 b2 dc 9c 02 a0 ff 04 0f 25 35 |c~.i..........%5| | 95 55 68 a3 |.Uh. | ssl_decrypt_record: mac ok dissect_ssl enter frame #104 (first time) conversation = 0x7fca71ded078, ssl_session = 0x7fca45bd4aa0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 65 dc c2 7f 58 96 de 4c e1 ad 17 b1 b5 5b 6b 93 |e...X..L.....[k.| | 72 bb e4 e9 fe 49 25 dd f1 1e 05 3d 31 8f 7b 1f |r....I%....=1.{.| Plaintext[32]: | 78 1c 38 f6 f6 2b de d9 01 00 9c fe 29 fd b9 04 |x.8..+......)...| | 9a 1a a8 c3 a3 22 3b 7e d8 e3 40 39 f4 71 01 01 |.....";~..@9.q..| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 9c fe 29 fd b9 04 9a 1a a8 c3 a3 22 3b 7e d8 e3 |..)........";~..| | 40 39 f4 71 |@9.q | ssl_decrypt_record: mac ok dissect_ssl enter frame #109 (first time) ssl_session_init: initializing ptr 0x7fca45bd6fa0 size 688 conversation = 0x7fca71ded320, ssl_session = 0x7fca45bd6fa0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 34497 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4446 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #111 (first time) conversation = 0x7fca71ded320, ssl_session = 0x7fca45bd6fa0 record: offset = 0, reported_length_remaining = 1416 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0015 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 86 f6 86 1f 4a c5 1a 48 06 95 d8 d1 bf 20 aa 28 |....J..H..... .(| | 94 f7 fe 1d 63 7f 5c e2 92 c6 67 b6 49 a5 e0 b7 |....c.\...g.I...| | 02 14 6e 8a 0c 68 95 c5 b2 6d 9a 6a c1 61 64 5e |..n..h...m.j.ad^| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | ef ed f3 e6 31 02 3f b8 ca 90 98 20 c2 4f ee db |....1.?.... .O..| | c6 1f 95 63 7b 7a b7 51 9f 1e 32 a6 64 52 34 c2 |...c{z.Q..2.dR4.| | ef 9c 1b c4 6c 87 f7 d2 f0 e4 41 be 57 74 df 90 |....l.....A.Wt..| | 5d ee 5a ec 15 c7 46 61 e3 bc cd 50 d4 |].Z...Fa...P. | hash out[72]: | 5c 03 20 13 d7 3f 29 34 25 0d 3a 68 68 2f 3e 92 |\. ..?)4%.:hh/>.| | 2e b4 10 e1 da 73 49 68 c5 8b 8f 3b c4 72 dd c8 |.....sIh...;.r..| | 51 eb a2 32 fb 8a 29 b0 1c 2e c3 27 96 76 71 ac |Q..2..)....'.vq.| | c0 4e 98 7a 4f 49 d8 c9 77 4e 80 25 3e bb 1d 25 |.N.zOI..wN.%>..%| | e3 3d 6a 21 88 33 23 13 |.=j!.3#. | PRF out[72]: | 5c 03 20 13 d7 3f 29 34 25 0d 3a 68 68 2f 3e 92 |\. ..?)4%.:hh/>.| | 2e b4 10 e1 da 73 49 68 c5 8b 8f 3b c4 72 dd c8 |.....sIh...;.r..| | 51 eb a2 32 fb 8a 29 b0 1c 2e c3 27 96 76 71 ac |Q..2..)....'.vq.| | c0 4e 98 7a 4f 49 d8 c9 77 4e 80 25 3e bb 1d 25 |.N.zOI..wN.%>..%| | e3 3d 6a 21 88 33 23 13 |.=j!.3#. | key expansion[72]: | 5c 03 20 13 d7 3f 29 34 25 0d 3a 68 68 2f 3e 92 |\. ..?)4%.:hh/>.| | 2e b4 10 e1 da 73 49 68 c5 8b 8f 3b c4 72 dd c8 |.....sIh...;.r..| | 51 eb a2 32 fb 8a 29 b0 1c 2e c3 27 96 76 71 ac |Q..2..)....'.vq.| | c0 4e 98 7a 4f 49 d8 c9 77 4e 80 25 3e bb 1d 25 |.N.zOI..wN.%>..%| | e3 3d 6a 21 88 33 23 13 |.=j!.3#. | Client MAC key[20]: | 5c 03 20 13 d7 3f 29 34 25 0d 3a 68 68 2f 3e 92 |\. ..?)4%.:hh/>.| | 2e b4 10 e1 |.... | Server MAC key[20]: | da 73 49 68 c5 8b 8f 3b c4 72 dd c8 51 eb a2 32 |.sIh...;.r..Q..2| | fb 8a 29 b0 |..). | Client Write key[8]: | 1c 2e c3 27 96 76 71 ac |...'.vq. | Server Write key[8]: | c0 4e 98 7a 4f 49 d8 c9 |.N.zOI.. | Client Write IV[8]: | 77 4e 80 25 3e bb 1d 25 |wN.%>..% | Server Write IV[8]: | e3 3d 6a 21 88 33 23 13 |.=j!.3#. | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 1353 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 541 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 527, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407 record: offset = 1407, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416 dissect_ssl enter frame #113 (first time) conversation = 0x7fca71ded320, ssl_session = 0x7fca45bd6fa0 record: offset = 0, reported_length_remaining = 198 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15... looking for RSA pre-master0080b153193d083e0e7d55db97bb93ac58e64fb42a1b983c... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | b5 83 9e c0 5c 29 da d6 36 e0 d2 4b 94 da 8b 17 |....\)..6..K....| | b7 5b 00 6b 0a b1 49 fb 08 57 92 81 1f df af 08 |.[.k..I..W......| | 87 e1 4a 03 57 cf 73 b1 a5 9f e8 c1 8a ae c7 74 |..J.W.s........t| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | ef ed f3 e6 31 02 3f b8 ca 90 98 20 c2 4f ee db |....1.?.... .O..| | c6 1f 95 63 7b 7a b7 51 9f 1e 32 a6 64 52 34 c2 |...c{z.Q..2.dR4.| | ef 9c 1b c4 6c 87 f7 d2 f0 e4 41 be 57 74 df 90 |....l.....A.Wt..| | 5d ee 5a ec 15 c7 46 61 e3 bc cd 50 d4 |].Z...Fa...P. | hash out[72]: | ea 93 23 3f b9 da a1 11 3a 29 1d 64 b3 ba 9b 1b |..#?....:).d....| | 58 a8 04 fd 45 00 2e cb 34 25 bf b1 cb 92 3d 81 |X...E...4%....=.| | ab df 46 28 8a 35 d8 c2 ca 36 63 18 c9 da 6a 7e |..F(.5...6c...j~| | e6 23 c6 9d 4c 6b 4f f0 48 d5 25 b3 bd 90 e5 18 |.#..LkO.H.%.....| | d2 45 d6 ff 2c 7b 3c 41 |.E..,{document.doma| | 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek| | 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'.7..R.E..T..| | 1e e9 87 fb 8f 76 8f 41 07 07 07 07 07 07 07 07 |.....v.A........| ssl_decrypt_record found padding 7 final len 376 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | c6 f7 05 b7 17 9c 0c 94 4b f2 f5 74 65 57 a5 0a |........K..teW..| | 55 c0 f1 c3 |U... | ssl_decrypt_record: mac failed association_find: TCP port 4446 found 0x3734fa0 dissect_ssl enter frame #117 (first time) conversation = 0x7fca71ded320, ssl_session = 0x7fca45bd6fa0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 0e 8e 18 d1 ab 56 64 be 92 d6 86 bd fc 3b 56 9a |.....Vd......;V.| | f8 24 a8 2d 15 28 4f ba 69 1a d8 14 20 49 31 e9 |.$.-.(O.i... I1.| Plaintext[32]: | ce 6d 59 c2 16 f3 b8 1a 01 00 7d 13 30 34 76 7e |.mY.......}.04v~| | 8b 72 a9 b4 65 d1 0c 74 6c 3a 57 52 bc b1 01 01 |.r..e..tl:WR....| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 7d 13 30 34 76 7e 8b 72 a9 b4 65 d1 0c 74 6c 3a |}.04v~.r..e..tl:| | 57 52 bc b1 |WR.. | ssl_decrypt_record: mac ok dissect_ssl enter frame #119 (first time) conversation = 0x7fca71ded320, ssl_session = 0x7fca45bd6fa0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 22 e0 e6 b6 79 c3 06 2f de a4 b7 cc 46 c6 0f 54 |"...y../....F..T| | 78 95 6b 12 be f4 7f bd 6e d4 43 76 dd 7e 3e 2b |x.k.....n.Cv.~>+| Plaintext[32]: | 4e fc ac 63 df 22 25 87 01 00 11 d4 19 6f 99 8d |N..c."%......o..| | ce 0b cd 1c b6 ef af a2 2a 2d 51 28 ad 72 01 01 |........*-Q(.r..| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 11 d4 19 6f 99 8d ce 0b cd 1c b6 ef af a2 2a 2d |...o..........*-| | 51 28 ad 72 |Q(.r | ssl_decrypt_record: mac ok dissect_ssl enter frame #124 (first time) ssl_session_init: initializing ptr 0x7fca45bd94a0 size 688 conversation = 0x7fca71ded5c8, ssl_session = 0x7fca45bd94a0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 34715 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4447 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #126 (first time) conversation = 0x7fca71ded5c8, ssl_session = 0x7fca45bd94a0 record: offset = 0, reported_length_remaining = 1416 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0016 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | b5 83 9e c0 5c 29 da d6 36 e0 d2 4b 94 da 8b 17 |....\)..6..K....| | b7 5b 00 6b 0a b1 49 fb 08 57 92 81 1f df af 08 |.[.k..I..W......| | 87 e1 4a 03 57 cf 73 b1 a5 9f e8 c1 8a ae c7 74 |..J.W.s........t| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | ef 7a 50 f4 f6 76 42 6b 9d a8 3e e8 67 59 b1 1a |.zP..vBk..>.gY..| | 44 85 0b 1d c7 c1 ce 8a d6 ce e1 9f ed 52 34 c2 |D............R4.| | ef cd 72 18 d5 97 f7 e6 30 f7 2b b4 1f 08 d6 3d |..r.....0.+....=| | cd 1c 21 41 14 e5 3f db 91 00 93 ba 24 |..!A..?.....$ | hash out[104]: | 4a ff ec 37 ef 82 83 8f a8 40 28 3c 66 86 a9 94 |J..7.....@(.gY..| | 44 85 0b 1d c7 c1 ce 8a d6 ce e1 9f ed 52 34 c2 |D............R4.| | ef cd 72 18 d5 97 f7 e6 30 f7 2b b4 1f 08 d6 3d |..r.....0.+....=| | cd 1c 21 41 14 e5 3f db 91 00 93 ba 24 |..!A..?.....$ | hash out[104]: | b7 12 ea c3 46 56 c8 1e 76 8c 59 57 48 84 c6 e0 |....FV..v.YWH...| | b0 39 19 56 70 52 30 87 30 e3 9e 9b 25 dc 7e a0 |.9.VpR0.0...%.~.| | e4 8f 61 0b 9b 73 4e 2b f2 ef d8 4f f6 68 38 f3 |..a..sN+...O.h8.| | 34 a3 c8 94 e9 f1 41 51 89 31 e1 60 9c 57 2e 5a |4.....AQ.1.`.W.Z| | 49 f8 7d 21 2f 36 b0 34 ea 70 ca 83 03 21 5e 49 |I.}!/6.4.p...!^I| | 6c db 30 c7 6e a8 9d b1 30 36 3f b2 37 ec 83 0a |l.0.n...06?.7...| | 78 52 b7 8c 48 38 56 4c |xR..H8VL | PRF out[104]: | b7 12 ea c3 46 56 c8 1e 76 8c 59 57 48 84 c6 e0 |....FV..v.YWH...| | b0 39 19 56 70 52 30 87 30 e3 9e 9b 25 dc 7e a0 |.9.VpR0.0...%.~.| | e4 8f 61 0b 9b 73 4e 2b f2 ef d8 4f f6 68 38 f3 |..a..sN+...O.h8.| | 34 a3 c8 94 e9 f1 41 51 89 31 e1 60 9c 57 2e 5a |4.....AQ.1.`.W.Z| | 49 f8 7d 21 2f 36 b0 34 ea 70 ca 83 03 21 5e 49 |I.}!/6.4.p...!^I| | 6c db 30 c7 6e a8 9d b1 30 36 3f b2 37 ec 83 0a |l.0.n...06?.7...| | 78 52 b7 8c 48 38 56 4c |xR..H8VL | key expansion[104]: | b7 12 ea c3 46 56 c8 1e 76 8c 59 57 48 84 c6 e0 |....FV..v.YWH...| | b0 39 19 56 70 52 30 87 30 e3 9e 9b 25 dc 7e a0 |.9.VpR0.0...%.~.| | e4 8f 61 0b 9b 73 4e 2b f2 ef d8 4f f6 68 38 f3 |..a..sN+...O.h8.| | 34 a3 c8 94 e9 f1 41 51 89 31 e1 60 9c 57 2e 5a |4.....AQ.1.`.W.Z| | 49 f8 7d 21 2f 36 b0 34 ea 70 ca 83 03 21 5e 49 |I.}!/6.4.p...!^I| | 6c db 30 c7 6e a8 9d b1 30 36 3f b2 37 ec 83 0a |l.0.n...06?.7...| | 78 52 b7 8c 48 38 56 4c |xR..H8VL | Client MAC key[20]: | b7 12 ea c3 46 56 c8 1e 76 8c 59 57 48 84 c6 e0 |....FV..v.YWH...| | b0 39 19 56 |.9.V | Server MAC key[20]: | 70 52 30 87 30 e3 9e 9b 25 dc 7e a0 e4 8f 61 0b |pR0.0...%.~...a.| | 9b 73 4e 2b |.sN+ | Client Write key[24]: | f2 ef d8 4f f6 68 38 f3 34 a3 c8 94 e9 f1 41 51 |...O.h8.4.....AQ| | 89 31 e1 60 9c 57 2e 5a |.1.`.W.Z | Server Write key[24]: | 49 f8 7d 21 2f 36 b0 34 ea 70 ca 83 03 21 5e 49 |I.}!/6.4.p...!^I| | 6c db 30 c7 6e a8 9d b1 |l.0.n... | Client Write IV[8]: | 30 36 3f b2 37 ec 83 0a |06?.7... | Server Write IV[8]: | 78 52 b7 8c 48 38 56 4c |xR..H8VL | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 32 1e ca 17 8e 72 c8 b6 cf 4d 06 65 12 1f 99 f5 |2....r...M.e....| | ec 24 8d 3a 1c 08 7c 2b d2 76 f4 fe de 48 88 e2 |.$.:..|+.v...H..| | cb 34 3c c8 44 4c 4c 30 aa eb 10 ab 43 66 c6 b4 |.4<.DLL0....Cf..| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 6f e7 6f 29 2a 3f 3d 60 13 2d a9 70 32 11 d6 8f |o.o)*?=`.-.p2...| | 53 2f 63 00 df 35 66 aa 05 26 c4 73 e1 e7 c1 66 |S/c..5f..&.s...f| | bb 83 af 48 01 ce 66 3e 86 b5 3b f1 03 a8 4a ee |...H..f>..;...J.| Plaintext[48]: | 04 8d 47 99 f6 c6 51 e9 14 00 00 0c 86 a0 09 a7 |..G...Q.........| | 63 20 e5 45 ce a1 b0 c4 0c 6c 24 37 23 01 f6 1b |c .E.....l$7#...| | 1b ec 75 00 f1 f9 68 7c 80 f9 05 e9 03 03 03 03 |..u...h|........| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 0c 6c 24 37 23 01 f6 1b 1b ec 75 00 f1 f9 68 7c |.l$7#.....u...h|| | 80 f9 05 e9 |.... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #129 (first time) conversation = 0x7fca71ded5c8, ssl_session = 0x7fca45bd94a0 record: offset = 0, reported_length_remaining = 234 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 57 5a bb df 56 b7 95 13 b8 52 24 19 87 27 41 70 |WZ..V....R$..'Ap| | 80 08 82 06 f5 87 04 c8 98 68 a7 f3 09 31 25 54 |.........h...1%T| | 02 a7 e2 97 aa 68 9e 83 4c b8 92 bd ac 4a b0 3a |.....h..L....J.:| Plaintext[48]: | a2 8a 9a c8 4b ad ce d8 14 00 00 0c d6 59 35 48 |....K........Y5H| | 87 91 96 c6 32 a3 f5 78 a9 9b 76 e7 db 00 80 1d |....2..x..v.....| | 7c b5 e1 2f 14 2a f6 48 50 42 ac a6 03 03 03 03 ||../.*.HPB......| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | a9 9b 76 e7 db 00 80 1d 7c b5 e1 2f 14 2a f6 48 |..v.....|../.*.H| | 50 42 ac a6 |PB.. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #130 (first time) conversation = 0x7fca71ded5c8, ssl_session = 0x7fca45bd94a0 record: offset = 0, reported_length_remaining = 109 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 104, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 104 Ciphertext[104]: | e5 84 cb 99 e7 f9 44 0a b0 d8 d3 17 dd ec 68 24 |......D.......h$| | 0e 0f c4 e6 32 1c af 92 bc 32 6c 1c 0a 2d cb 7d |....2....2l..-.}| | 9d 71 d1 e7 09 97 45 26 5d b7 e5 1d 04 18 a2 bd |.q....E&].......| | 40 c4 59 30 94 5e 83 44 93 91 73 7d 98 82 63 f5 |@.Y0.^.D..s}..c.| | 5a eb 5e 72 61 53 ba 9d 1f a5 ee dc 75 d2 dd 9e |Z.^raS......u...| | 75 8b c0 8b 65 d2 14 3d 62 3e a0 33 ee f9 91 0a |u...e..=b>.3....| | c2 79 bb 77 76 ad e0 15 |.y.wv... | Plaintext[104]: | 19 d0 53 1e 1a c7 a9 fd 47 45 54 20 2f 20 48 54 |..S.....GET / HT| | 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 64 |TP/1.1..Host: ed| | 68 2d 72 73 61 2d 64 65 73 2d 63 62 63 33 2d 73 |h-rsa-des-cbc3-s| | 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |ha.local.al.leke| | 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 34 37 0d 0a |nsteyn.nl:4447..| | 0d 0a 38 f9 e5 e0 4d 34 89 b9 03 b0 8e a0 d0 da |..8...M4........| | 68 c2 8b ae 1f 40 01 01 |h....@.. | ssl_decrypt_record found padding 1 final len 102 checking mac (len 74, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 61 78 4a 36 22 9d 01 11 fd db 33 20 53 81 6c 56 |axJ6".....3 S.lV| | b1 2d 68 22 |.-h" | ssl_decrypt_record: mac failed association_find: TCP port 34715 found (nil) association_find: TCP port 4447 found 0x3735030 dissect_ssl enter frame #131 (first time) conversation = 0x7fca71ded5c8, ssl_session = 0x7fca45bd94a0 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | c6 8f 12 cf 3b 1d 92 f0 14 4d 22 e0 fd 10 fa 3a |....;....M"....:| | 72 92 ba 37 17 54 bf c2 bb 13 28 f8 e4 e5 b9 b2 |r..7.T....(.....| | 5b d1 87 b0 db 86 53 20 91 6c 63 42 b9 5b 1e 49 |[.....S .lcB.[.I| | d7 ca 56 b5 f2 8a 72 34 2d cd d5 c8 c8 01 1a e1 |..V...r4-.......| | 3b 93 fb a2 30 82 b4 a0 84 55 af ca 9f b8 50 e0 |;...0....U....P.| | 6e 15 ab 74 f4 b7 a6 4f 1d 5d 9b e1 ec 69 2b db |n..t...O.]...i+.| | b9 28 67 5a d4 44 fc ce fc 19 b5 2e 33 9e 85 4e |.(gZ.D......3..N| | 49 85 ea 74 13 a7 37 f1 4d c9 44 d7 30 3a 94 08 |I..t..7.M.D.0:..| | 2c 66 86 2d 3e 7b 45 39 23 8b 36 cc fa 95 6e 98 |,f.->{E9#.6...n.| | a0 47 60 ca 07 f4 85 2d b4 42 4f 98 68 6e cc 33 |.G`....-.BO.hn.3| | 28 ed 94 49 05 e6 a1 ac 49 f8 b7 c7 58 5f 7b de |(..I....I...X_{.| | 32 4c 5f 2e b8 0f 06 75 97 77 9f fa f0 d3 5e 19 |2L_....u.w....^.| | 7e 7c a2 8f 14 7e 45 0d 48 3c 0f 53 7d d0 36 18 |~|...~E.H<.S}.6.| | 3c 10 20 d6 b6 b1 18 78 16 44 e0 e2 96 11 a6 cd |<. ....x.D......| | 24 47 79 85 8a 16 23 49 a4 94 e5 14 57 44 c2 aa |$Gy...#I....WD..| | c8 1b de 7c 41 e9 ea 52 b4 c9 e1 47 c7 fa 2b 40 |...|A..R...G..+@| | 5c 77 d5 1b ed d6 be d2 fa 15 1b a6 04 e4 3c 78 |\w............document.doma| | 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek| | 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'.v....J.k.6.| | 9c c2 59 6c fb 38 94 13 07 07 07 07 07 07 07 07 |..Yl.8..........| ssl_decrypt_record found padding 7 final len 376 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | e1 74 18 dc e1 0d a7 bf e5 2f ce 3d b1 32 9e 99 |.t......./.=.2..| | 78 1c 84 3e |x..> | ssl_decrypt_record: mac failed association_find: TCP port 4447 found 0x3735030 dissect_ssl enter frame #132 (first time) conversation = 0x7fca71ded5c8, ssl_session = 0x7fca45bd94a0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | df f2 25 34 19 80 51 5c ce b1 36 14 a1 c4 cd e3 |..%4..Q\..6.....| | ac 62 ae 89 ed 5e ba 28 4b 2d 04 8c 01 48 ae bb |.b...^.(K-...H..| Plaintext[32]: | 05 21 f5 45 24 49 f0 e7 01 00 b5 b5 65 92 f5 19 |.!.E$I......e...| | ed e5 44 84 44 ed 2c f4 20 99 db c5 c0 26 01 01 |..D.D.,. ....&..| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | b5 b5 65 92 f5 19 ed e5 44 84 44 ed 2c f4 20 99 |..e.....D.D.,. .| | db c5 c0 26 |...& | ssl_decrypt_record: mac ok dissect_ssl enter frame #134 (first time) conversation = 0x7fca71ded5c8, ssl_session = 0x7fca45bd94a0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | ca 52 f6 ed 92 4d 8d 4a 5b 18 ab 42 c1 a8 8c 0e |.R...M.J[..B....| | 96 2a 22 2a 12 7f ec e8 e3 7a 27 e7 c6 d6 f3 0f |.*"*.....z'.....| Plaintext[32]: | bf 88 bd fb b5 fc 8c 67 01 00 db 05 6c c7 2d 89 |.......g....l.-.| | 25 f1 a3 ae c6 5e f4 0f af 9e 09 8c 04 7b 01 01 |%....^.......{..| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | db 05 6c c7 2d 89 25 f1 a3 ae c6 5e f4 0f af 9e |..l.-.%....^....| | 09 8c 04 7b |...{ | ssl_decrypt_record: mac ok dissect_ssl enter frame #139 (first time) ssl_session_init: initializing ptr 0x7fca45bdb9a0 size 688 conversation = 0x7fca71ded870, ssl_session = 0x7fca45bdb9a0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 56670 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4448 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #141 (first time) conversation = 0x7fca71ded870, ssl_session = 0x7fca45bdb9a0 record: offset = 0, reported_length_remaining = 884 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x002F -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 32 1e ca 17 8e 72 c8 b6 cf 4d 06 65 12 1f 99 f5 |2....r...M.e....| | ec 24 8d 3a 1c 08 7c 2b d2 76 f4 fe de 48 88 e2 |.$.:..|+.v...H..| | cb 34 3c c8 44 4c 4c 30 aa eb 10 ab 43 66 c6 b4 |.4<.DLL0....Cf..| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f0 ea c0 25 ba b0 72 a3 1d 4c 31 56 ff 06 22 66 |...%..r..L1V.."f| | 39 d0 19 87 9b 3e c7 46 f5 08 43 e2 b8 52 34 c2 |9....>.F..C..R4.| | f0 fe d3 fb db 79 78 42 dc 68 32 6e c3 42 fa da |.....yxB.h2n.B..| | 96 d5 07 5b 9e cc c8 b2 ba a6 2a 3b c5 |...[......*;. | hash out[104]: | 5b 1d 87 f8 53 c3 62 56 06 55 54 c3 f7 9f e4 5a |[...S.bV.UT....Z| | 1c 46 03 7d a1 f3 f3 c4 d9 75 6f 6e 3b 0d b3 47 |.F.}.....uon;..G| | 5e 3a 47 8b 6e 24 6f 3f 25 91 2b 98 d9 c6 f8 c8 |^:G.n$o?%.+.....| | 84 e7 95 41 e6 ab 4b 27 98 51 38 e0 d8 6c 99 58 |...A..K'.Q8..l.X| | d1 3d 6b f9 20 ff 86 06 dd dd 06 c8 63 ec ad da |.=k. .......c...| | c5 44 94 b4 04 e8 bb 78 2d 04 da 06 eb bd 9e 36 |.D.....x-......6| | 69 25 59 2a 52 83 c9 ce |i%Y*R... | PRF out[104]: | 5b 1d 87 f8 53 c3 62 56 06 55 54 c3 f7 9f e4 5a |[...S.bV.UT....Z| | 1c 46 03 7d a1 f3 f3 c4 d9 75 6f 6e 3b 0d b3 47 |.F.}.....uon;..G| | 5e 3a 47 8b 6e 24 6f 3f 25 91 2b 98 d9 c6 f8 c8 |^:G.n$o?%.+.....| | 84 e7 95 41 e6 ab 4b 27 98 51 38 e0 d8 6c 99 58 |...A..K'.Q8..l.X| | d1 3d 6b f9 20 ff 86 06 dd dd 06 c8 63 ec ad da |.=k. .......c...| | c5 44 94 b4 04 e8 bb 78 2d 04 da 06 eb bd 9e 36 |.D.....x-......6| | 69 25 59 2a 52 83 c9 ce |i%Y*R... | key expansion[104]: | 5b 1d 87 f8 53 c3 62 56 06 55 54 c3 f7 9f e4 5a |[...S.bV.UT....Z| | 1c 46 03 7d a1 f3 f3 c4 d9 75 6f 6e 3b 0d b3 47 |.F.}.....uon;..G| | 5e 3a 47 8b 6e 24 6f 3f 25 91 2b 98 d9 c6 f8 c8 |^:G.n$o?%.+.....| | 84 e7 95 41 e6 ab 4b 27 98 51 38 e0 d8 6c 99 58 |...A..K'.Q8..l.X| | d1 3d 6b f9 20 ff 86 06 dd dd 06 c8 63 ec ad da |.=k. .......c...| | c5 44 94 b4 04 e8 bb 78 2d 04 da 06 eb bd 9e 36 |.D.....x-......6| | 69 25 59 2a 52 83 c9 ce |i%Y*R... | Client MAC key[20]: | 5b 1d 87 f8 53 c3 62 56 06 55 54 c3 f7 9f e4 5a |[...S.bV.UT....Z| | 1c 46 03 7d |.F.} | Server MAC key[20]: | a1 f3 f3 c4 d9 75 6f 6e 3b 0d b3 47 5e 3a 47 8b |.....uon;..G^:G.| | 6e 24 6f 3f |n$o? | Client Write key[16]: | 25 91 2b 98 d9 c6 f8 c8 84 e7 95 41 e6 ab 4b 27 |%.+........A..K'| Server Write key[16]: | 98 51 38 e0 d8 6c 99 58 d1 3d 6b f9 20 ff 86 06 |.Q8..l.X.=k. ...| Client Write IV[16]: | dd dd 06 c8 63 ec ad da c5 44 94 b4 04 e8 bb 78 |....c....D.....x| Server Write IV[16]: | 2d 04 da 06 eb bd 9e 36 69 25 59 2a 52 83 c9 ce |-......6i%Y*R...| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 821 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884 dissect_ssl enter frame #143 (first time) conversation = 0x7fca71ded870, ssl_session = 0x7fca45bdb9a0 record: offset = 0, reported_length_remaining = 342 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 262, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9e... looking for RSA pre-master5715e1b63101862a068c7d7829f47237593d876dc98e895f... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 00 06 42 33 89 8d 6f a2 b7 f2 ab a6 3b c9 69 c2 |..B3..o.....;.i.| | c8 26 4d d9 79 cd 8b fa 53 51 de 37 a2 e1 e9 ab |.&M.y...SQ.7....| | 33 2d e8 9d 9f b3 0f a2 38 c0 5f 2f a2 af 81 0c |3-......8._/....| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f0 ea c0 25 ba b0 72 a3 1d 4c 31 56 ff 06 22 66 |...%..r..L1V.."f| | 39 d0 19 87 9b 3e c7 46 f5 08 43 e2 b8 52 34 c2 |9....>.F..C..R4.| | f0 fe d3 fb db 79 78 42 dc 68 32 6e c3 42 fa da |.....yxB.h2n.B..| | 96 d5 07 5b 9e cc c8 b2 ba a6 2a 3b c5 |...[......*;. | hash out[104]: | 79 63 3e 00 00 33 84 53 3a 8f ba 41 d5 9d 7c 38 |yc>..3.S:..A..|8| | da b2 a5 86 4f 46 1e f0 ac 01 4d a7 04 78 a8 b5 |....OF....M..x..| | 24 b4 30 e9 0c 32 7e f8 2f 33 cf e9 78 41 fb 94 |$.0..2~./3..xA..| | 12 b2 0f 7d 59 b6 66 7d 78 ca cc b1 6d 16 fe 3f |...}Y.f}x...m..?| | c8 34 16 39 f0 60 e2 56 7c 8a c5 2e 2f 40 3b c1 |.4.9.`.V|.../@;.| | b2 8b a9 fb a1 c3 9b b6 87 cd fa a6 2b f0 1f 7a |............+..z| | a2 9f 8e 3a 04 60 8b 6b |...:.`.k | PRF out[104]: | 79 63 3e 00 00 33 84 53 3a 8f ba 41 d5 9d 7c 38 |yc>..3.S:..A..|8| | da b2 a5 86 4f 46 1e f0 ac 01 4d a7 04 78 a8 b5 |....OF....M..x..| | 24 b4 30 e9 0c 32 7e f8 2f 33 cf e9 78 41 fb 94 |$.0..2~./3..xA..| | 12 b2 0f 7d 59 b6 66 7d 78 ca cc b1 6d 16 fe 3f |...}Y.f}x...m..?| | c8 34 16 39 f0 60 e2 56 7c 8a c5 2e 2f 40 3b c1 |.4.9.`.V|.../@;.| | b2 8b a9 fb a1 c3 9b b6 87 cd fa a6 2b f0 1f 7a |............+..z| | a2 9f 8e 3a 04 60 8b 6b |...:.`.k | key expansion[104]: | 79 63 3e 00 00 33 84 53 3a 8f ba 41 d5 9d 7c 38 |yc>..3.S:..A..|8| | da b2 a5 86 4f 46 1e f0 ac 01 4d a7 04 78 a8 b5 |....OF....M..x..| | 24 b4 30 e9 0c 32 7e f8 2f 33 cf e9 78 41 fb 94 |$.0..2~./3..xA..| | 12 b2 0f 7d 59 b6 66 7d 78 ca cc b1 6d 16 fe 3f |...}Y.f}x...m..?| | c8 34 16 39 f0 60 e2 56 7c 8a c5 2e 2f 40 3b c1 |.4.9.`.V|.../@;.| | b2 8b a9 fb a1 c3 9b b6 87 cd fa a6 2b f0 1f 7a |............+..z| | a2 9f 8e 3a 04 60 8b 6b |...:.`.k | Client MAC key[20]: | 79 63 3e 00 00 33 84 53 3a 8f ba 41 d5 9d 7c 38 |yc>..3.S:..A..|8| | da b2 a5 86 |.... | Server MAC key[20]: | 4f 46 1e f0 ac 01 4d a7 04 78 a8 b5 24 b4 30 e9 |OF....M..x..$.0.| | 0c 32 7e f8 |.2~. | Client Write key[16]: | 2f 33 cf e9 78 41 fb 94 12 b2 0f 7d 59 b6 66 7d |/3..xA.....}Y.f}| Server Write key[16]: | 78 ca cc b1 6d 16 fe 3f c8 34 16 39 f0 60 e2 56 |x...m..?.4.9.`.V| Client Write IV[16]: | 7c 8a c5 2e 2f 40 3b c1 b2 8b a9 fb a1 c3 9b b6 ||.../@;.........| Server Write IV[16]: | 87 cd fa a6 2b f0 1f 7a a2 9f 8e 3a 04 60 8b 6b |....+..z...:.`.k| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 00 06 42 33 89 8d 6f a2 b7 f2 ab a6 3b c9 69 c2 |..B3..o.....;.i.| | c8 26 4d d9 79 cd 8b fa 53 51 de 37 a2 e1 e9 ab |.&M.y...SQ.7....| | 33 2d e8 9d 9f b3 0f a2 38 c0 5f 2f a2 af 81 0c |3-......8._/....| dissect_ssl3_handshake session keys successfully generated record: offset = 267, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 273, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | cc 97 2f 88 0c c6 9a 61 40 f9 15 5d 02 b8 42 bf |../....a@..]..B.| | ac 06 ba d7 6d b8 7a c0 9e 2f e5 90 c7 af 9d 46 |....m.z../.....F| | 82 5b 46 c9 8c fb cd 53 07 fd cc d2 88 06 a2 1b |.[F....S........| | 0f 7f 47 69 e2 c0 a8 1b 02 b9 95 1e 9e a3 c1 26 |..Gi...........&| Plaintext[64]: | 2d a2 40 de 81 24 be 00 e3 ac 84 1a a7 55 fa 64 |-.@..$.......U.d| | 14 00 00 0c 2b 8c 3a 60 0a 9e 4e 40 94 20 43 cb |....+.:`..N@. C.| | bb 28 16 a5 2a 51 a2 0c a4 a1 35 98 22 43 48 6b |.(..*Q....5."CHk| | 62 a7 f6 46 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |b..F............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | bb 28 16 a5 2a 51 a2 0c a4 a1 35 98 22 43 48 6b |.(..*Q....5."CHk| | 62 a7 f6 46 |b..F | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #144 (first time) conversation = 0x7fca71ded870, ssl_session = 0x7fca45bdb9a0 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 95 08 ba 9a d0 3f 32 94 0e fa cf 42 9e 41 a3 ab |.....?2....B.A..| | 15 ad 59 09 bc 6b ef 56 3a 2e 88 be 1b d1 ef 28 |..Y..k.V:......(| | 4c 69 ea d1 c7 fd 02 e0 9d ce f0 22 79 27 81 8a |Li........."y'..| | a2 ed 5e 38 dd 45 3e 2b 24 a4 8b 75 8e 0c e3 a9 |..^8.E>+$..u....| Plaintext[64]: | 35 82 d2 e6 55 61 92 49 0e 7e 7d 51 48 f2 6f 30 |5...Ua.I.~}QH.o0| | 14 00 00 0c 0e c4 58 bd a7 03 6e 09 3e 36 1f 58 |......X...n.>6.X| | ec 7d a8 6f 33 2e 6d 96 80 8a 4a 92 d6 80 fd 24 |.}.o3.m...J....$| | b5 2c 98 f1 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.,..............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | ec 7d a8 6f 33 2e 6d 96 80 8a 4a 92 d6 80 fd 24 |.}.o3.m...J....$| | b5 2c 98 f1 |.,.. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #145 (first time) conversation = 0x7fca71ded870, ssl_session = 0x7fca45bdb9a0 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | b5 40 c2 ad ff e8 5b 3e ac 30 b0 5a 33 ea 4b 28 |.@....[>.0.Z3.K(| | 14 17 7d 91 2f df 66 5a 65 17 ed f9 9d 14 97 51 |..}./.fZe......Q| | d7 5c a0 01 53 38 af 5c d6 0b a5 36 90 7c b5 bc |.\..S8.\...6.|..| | 77 1f 1f 50 06 f1 2c 3f b7 d0 c2 3e e0 f8 0a 9c |w..P..,?...>....| | 5d a0 b8 e4 2a 69 4b 24 ef 50 cd 3b 4c cb 2d cb |]...*iK$.P.;L.-.| | 40 b2 37 93 d9 80 85 c4 30 e6 be 10 1a 98 01 dd |@.7.....0.......| | b5 59 12 84 50 90 26 d3 ea 56 d6 dd 89 74 01 59 |.Y..P.&..V...t.Y| Plaintext[112]: | 34 13 d8 83 04 73 d4 60 3d ae a1 14 43 26 22 c7 |4....s.`=...C&".| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 61 65 73 31 32 38 2d 73 68 61 |Host: aes128-sha| | 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 |.local.al.lekens| | 74 65 79 6e 2e 6e 6c 3a 34 34 34 38 0d 0a 0d 0a |teyn.nl:4448....| | b7 4a 25 73 9f 8a d9 84 d3 ad 50 78 44 50 c4 8a |.J%s......PxDP..| | 35 3f 50 41 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |5?PA............| ssl_decrypt_record found padding 11 final len 100 checking mac (len 64, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | fc 02 9f 30 cd e9 20 80 e7 fe 54 67 a3 5c 98 2e |...0.. ...Tg.\..| | b0 21 c2 70 |.!.p | ssl_decrypt_record: mac failed association_find: TCP port 56670 found (nil) association_find: TCP port 4448 found 0x37350c0 dissect_ssl enter frame #146 (first time) conversation = 0x7fca71ded870, ssl_session = 0x7fca45bdb9a0 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | ee b9 cf 97 ac 01 e0 aa 04 3f 8d c8 41 a3 7a 51 |.........?..A.zQ| | b9 29 6d fd 78 f5 29 00 69 44 27 ba 85 fc 08 cd |.)m.x.).iD'.....| | b7 a6 90 f6 5c fd 51 a6 2e 26 a5 b2 ed 32 8f f4 |....\.Q..&...2..| | 38 b6 e5 55 36 d0 5f 2e 99 8a 78 05 a4 67 dd f8 |8..U6._...x..g..| | 27 f1 6f 8b 6d ff 10 6e f7 19 4b 07 4f 47 56 05 |'.o.m..n..K.OGV.| | 0f c0 28 b9 24 75 13 62 eb 93 03 15 0c cb 22 41 |..(.$u.b......"A| | 4f 8c ce c5 58 0e 44 76 ab 34 f6 e8 df 70 e6 41 |O...X.Dv.4...p.A| | aa de ab 50 75 21 a9 74 12 87 13 a4 b0 ae b8 de |...Pu!.t........| | f3 b1 46 08 c0 d2 8e 43 90 79 35 80 98 63 e9 54 |..F....C.y5..c.T| | 3f 18 cf c3 dd a5 25 ba ba 9f 88 b2 44 69 71 e7 |?.....%.....Diq.| | 14 ed 6c bf e2 53 7e 4d d2 ac 04 29 5e 42 4d 94 |..l..S~M...)^BM.| | 8b 37 2e 51 7e 9d 45 44 99 93 1c b3 2a 91 82 78 |.7.Q~.ED....*..x| | c1 5d 1e 29 f3 52 39 4e 2e 80 4f b2 67 0d 3b c7 |.].).R9N..O.g.;.| | ed 83 5a 36 21 6e 1a ad 8c 8d da 3e 14 af fa df |..Z6!n.....>....| | a8 c4 48 69 3d 00 df c2 ba 41 f5 1b 77 4f 5b 83 |..Hi=....A..wO[.| | 75 ce e5 1a 73 63 ff 8a 26 63 5e a1 30 f4 5b e5 |u...sc..&c^.0.[.| | 55 53 91 eb ce 8c cc 4a 00 cb d0 8b f8 df 2b 65 |US.....J......+e| | 4e a3 bc b0 f5 62 08 28 41 3a 33 5c 3d 22 a7 a0 |N....b.(A:3\="..| | 51 24 3a 74 89 d2 b3 2e 5b 42 fc 8c 78 31 a4 10 |Q$:t....[B..x1..| | be de 8e 8d 3e 2d 41 29 e3 4f fa a3 b0 5d 8d e8 |....>-A).O...]..| | a1 b0 41 b5 c1 1a fb a5 d7 ec 45 29 75 07 df d6 |..A.......E)u...| | e1 3b 43 99 6d d7 1e 5e 34 a6 63 dd 25 d0 7d b2 |.;C.m..^4.c.%.}.| | 5d c0 60 bc f9 de 3c be 3a 91 e1 11 d0 66 d6 43 |].`...<.:....f.C| | cb bd 97 44 40 09 6e dd 74 69 4c b4 de fd c0 c9 |...D@.n.tiL.....| | 99 f0 8c 99 f0 ef 4e c8 3a 5a 43 95 c7 ab 80 3c |......N.:ZC....<| Plaintext[400]: | 77 27 ba 54 67 62 9d b3 c4 55 ff cd c6 7c 62 6c |w'.Tgb...U...|bl| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:| | 31 31 3a 32 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:28 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 32 46 20 2d 20 41 45 53 31 32 |x00,0x2F - AES12| | 38 2d 53 48 41 20 20 20 20 20 20 20 20 20 20 20 |8-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1....| | 38 ac 03 86 9f eb 34 0a 8b 68 a9 60 03 e2 02 1c |8.....4..h.`....| | 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................| ssl_decrypt_record found padding 15 final len 384 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 1f 43 f7 05 28 47 61 35 51 75 f6 34 b0 89 aa d6 |.C..(Ga5Qu.4....| | c0 ec 56 a1 |..V. | ssl_decrypt_record: mac failed association_find: TCP port 4448 found 0x37350c0 dissect_ssl enter frame #147 (first time) conversation = 0x7fca71ded870, ssl_session = 0x7fca45bdb9a0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | ad b6 f3 64 9e 66 61 18 73 71 52 f3 a6 48 09 ef |...d.fa.sqR..H..| | df da 12 13 0e 48 35 71 a3 c2 fe 09 25 eb e6 1a |.....H5q....%...| | 61 66 5d 3b a7 16 15 65 56 c3 43 00 6e bb d7 06 |af];...eV.C.n...| Plaintext[48]: | 77 b6 52 0a 47 fd f0 53 e4 56 3c c6 a1 cf 61 77 |w.R.G..S.V<...aw| | 01 00 c0 bc 03 af c0 0a 2c 5c 06 c3 2f 67 9e e5 |........,\../g..| | f5 9e 5c 20 38 35 09 09 09 09 09 09 09 09 09 09 |..\ 85..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | c0 bc 03 af c0 0a 2c 5c 06 c3 2f 67 9e e5 f5 9e |......,\../g....| | 5c 20 38 35 |\ 85 | ssl_decrypt_record: mac ok dissect_ssl enter frame #149 (first time) conversation = 0x7fca71ded870, ssl_session = 0x7fca45bdb9a0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 08 d4 80 0e 80 f2 29 02 19 bf 60 c4 f4 38 fa de |......)...`..8..| | c7 b5 11 a7 ab 97 dc ce bb ff 7c 4d 93 e6 5c 75 |..........|M..\u| | a3 db 13 60 82 81 d8 f6 32 16 4b 1e de bd b2 6d |...`....2.K....m| Plaintext[48]: | 58 e0 ed 94 0d ad 44 83 f3 25 ea 86 53 e4 7a fa |X.....D..%..S.z.| | 01 00 29 ae 9f 0d fd 47 b1 56 0a 9e d8 dd db 6b |..)....G.V.....k| | ce 8e 56 69 19 56 09 09 09 09 09 09 09 09 09 09 |..Vi.V..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 29 ae 9f 0d fd 47 b1 56 0a 9e d8 dd db 6b ce 8e |)....G.V.....k..| | 56 69 19 56 |Vi.V | ssl_decrypt_record: mac ok dissect_ssl enter frame #154 (first time) ssl_session_init: initializing ptr 0x7fca45bddf20 size 688 conversation = 0x7fca71dedb18, ssl_session = 0x7fca45bddf20 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 35259 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4449 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #156 (first time) conversation = 0x7fca71dedb18, ssl_session = 0x7fca45bddf20 record: offset = 0, reported_length_remaining = 1135 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0032 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 00 06 42 33 89 8d 6f a2 b7 f2 ab a6 3b c9 69 c2 |..B3..o.....;.i.| | c8 26 4d d9 79 cd 8b fa 53 51 de 37 a2 e1 e9 ab |.&M.y...SQ.7....| | 33 2d e8 9d 9f b3 0f a2 38 c0 5f 2f a2 af 81 0c |3-......8._/....| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f0 1f 1d b5 2a 59 3d 17 d1 43 69 a5 83 a8 f3 d6 |....*Y=..Ci.....| | c6 b4 7f ad f0 51 3e 64 2e 89 5c b2 1f 52 34 c2 |.....Q>d..\..R4.| | f0 65 c9 d0 ed cc 01 45 d3 86 f0 4d 14 5a 87 cd |.e.....E...M.Z..| | be c2 12 07 0b e8 bc 2d 4f 17 35 ab 34 |.......-O.5.4 | hash out[104]: | 44 dd 74 5a 13 f2 03 96 5c ec 39 9e 27 97 18 ae |D.tZ....\.9.'...| | 52 a3 60 45 b2 81 90 cc c6 77 21 96 0a 22 fa b3 |R.`E.....w!.."..| | 57 a9 6e 5b bf 25 1d 51 1f 6f 01 49 94 cd ec ee |W.n[.%.Q.o.I....| | 5c 9f e4 3a ba 30 fc dd ee 00 00 bf 1a 61 0c 1c |\..:.0.......a..| | 45 25 05 33 e5 4b 17 54 35 fd fc 48 b9 5f e6 0a |E%.3.K.T5..H._..| | 5a d6 0f 56 92 46 5e 50 53 d1 37 64 a6 2e 56 f7 |Z..V.F^PS.7d..V.| | 60 d6 61 ae 08 eb cd 7e |`.a....~ | PRF out[104]: | 44 dd 74 5a 13 f2 03 96 5c ec 39 9e 27 97 18 ae |D.tZ....\.9.'...| | 52 a3 60 45 b2 81 90 cc c6 77 21 96 0a 22 fa b3 |R.`E.....w!.."..| | 57 a9 6e 5b bf 25 1d 51 1f 6f 01 49 94 cd ec ee |W.n[.%.Q.o.I....| | 5c 9f e4 3a ba 30 fc dd ee 00 00 bf 1a 61 0c 1c |\..:.0.......a..| | 45 25 05 33 e5 4b 17 54 35 fd fc 48 b9 5f e6 0a |E%.3.K.T5..H._..| | 5a d6 0f 56 92 46 5e 50 53 d1 37 64 a6 2e 56 f7 |Z..V.F^PS.7d..V.| | 60 d6 61 ae 08 eb cd 7e |`.a....~ | key expansion[104]: | 44 dd 74 5a 13 f2 03 96 5c ec 39 9e 27 97 18 ae |D.tZ....\.9.'...| | 52 a3 60 45 b2 81 90 cc c6 77 21 96 0a 22 fa b3 |R.`E.....w!.."..| | 57 a9 6e 5b bf 25 1d 51 1f 6f 01 49 94 cd ec ee |W.n[.%.Q.o.I....| | 5c 9f e4 3a ba 30 fc dd ee 00 00 bf 1a 61 0c 1c |\..:.0.......a..| | 45 25 05 33 e5 4b 17 54 35 fd fc 48 b9 5f e6 0a |E%.3.K.T5..H._..| | 5a d6 0f 56 92 46 5e 50 53 d1 37 64 a6 2e 56 f7 |Z..V.F^PS.7d..V.| | 60 d6 61 ae 08 eb cd 7e |`.a....~ | Client MAC key[20]: | 44 dd 74 5a 13 f2 03 96 5c ec 39 9e 27 97 18 ae |D.tZ....\.9.'...| | 52 a3 60 45 |R.`E | Server MAC key[20]: | b2 81 90 cc c6 77 21 96 0a 22 fa b3 57 a9 6e 5b |.....w!.."..W.n[| | bf 25 1d 51 |.%.Q | Client Write key[16]: | 1f 6f 01 49 94 cd ec ee 5c 9f e4 3a ba 30 fc dd |.o.I....\..:.0..| Server Write key[16]: | ee 00 00 bf 1a 61 0c 1c 45 25 05 33 e5 4b 17 54 |.....a..E%.3.K.T| Client Write IV[16]: | 35 fd fc 48 b9 5f e6 0a 5a d6 0f 56 92 46 5e 50 |5..H._..Z..V.F^P| Server Write IV[16]: | 53 d1 37 64 a6 2e 56 f7 60 d6 61 ae 08 eb cd 7e |S.7d..V.`.a....~| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 1072 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 735, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803 record: offset = 803, reported_length_remaining = 332 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 318, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 808 length 314 bytes, remaining 1126 record: offset = 1126, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1131 length 0 bytes, remaining 1135 dissect_ssl enter frame #158 (first time) conversation = 0x7fca71dedb18, ssl_session = 0x7fca45bddf20 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070b... looking for RSA pre-master008086b58ca89b01c6f37d92bf892be5f5dbf620f6e6c18a... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 8e 2c 59 cb fc dd b9 aa 12 0a 82 e8 e8 62 87 e9 |.,Y..........b..| | 60 fe 1a 1f 8e dd b4 8b b0 b7 09 8a 39 98 30 44 |`...........9.0D| | dc fd 3e e8 0c fd 93 87 1f 60 11 b3 9b 08 4d d4 |..>......`....M.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f0 1f 1d b5 2a 59 3d 17 d1 43 69 a5 83 a8 f3 d6 |....*Y=..Ci.....| | c6 b4 7f ad f0 51 3e 64 2e 89 5c b2 1f 52 34 c2 |.....Q>d..\..R4.| | f0 65 c9 d0 ed cc 01 45 d3 86 f0 4d 14 5a 87 cd |.e.....E...M.Z..| | be c2 12 07 0b e8 bc 2d 4f 17 35 ab 34 |.......-O.5.4 | hash out[104]: | 38 cc 4d 37 43 c5 ae c8 a4 92 32 f4 eb b6 27 42 |8.M7C.....2...'B| | de d9 bd c1 f8 cc 15 0a 7a 9b b7 28 55 8b 83 88 |........z..(U...| | 3e 8a bc 68 c1 b7 5c bc a6 5a 24 57 6d f8 9d 26 |>..h..\..Z$Wm..&| | 5d 7e 56 3e 28 b2 03 a0 63 1f 93 0d bc 51 ec 55 |]~V>(...c....Q.U| | a4 67 26 91 d6 62 48 2b ee f3 d3 1c e6 82 cc fe |.g&..bH+........| | 50 10 ed 1a b9 0a f9 97 56 d7 10 54 13 e1 9b f1 |P.......V..T....| | 12 62 54 88 c9 18 ea b0 |.bT..... | PRF out[104]: | 38 cc 4d 37 43 c5 ae c8 a4 92 32 f4 eb b6 27 42 |8.M7C.....2...'B| | de d9 bd c1 f8 cc 15 0a 7a 9b b7 28 55 8b 83 88 |........z..(U...| | 3e 8a bc 68 c1 b7 5c bc a6 5a 24 57 6d f8 9d 26 |>..h..\..Z$Wm..&| | 5d 7e 56 3e 28 b2 03 a0 63 1f 93 0d bc 51 ec 55 |]~V>(...c....Q.U| | a4 67 26 91 d6 62 48 2b ee f3 d3 1c e6 82 cc fe |.g&..bH+........| | 50 10 ed 1a b9 0a f9 97 56 d7 10 54 13 e1 9b f1 |P.......V..T....| | 12 62 54 88 c9 18 ea b0 |.bT..... | key expansion[104]: | 38 cc 4d 37 43 c5 ae c8 a4 92 32 f4 eb b6 27 42 |8.M7C.....2...'B| | de d9 bd c1 f8 cc 15 0a 7a 9b b7 28 55 8b 83 88 |........z..(U...| | 3e 8a bc 68 c1 b7 5c bc a6 5a 24 57 6d f8 9d 26 |>..h..\..Z$Wm..&| | 5d 7e 56 3e 28 b2 03 a0 63 1f 93 0d bc 51 ec 55 |]~V>(...c....Q.U| | a4 67 26 91 d6 62 48 2b ee f3 d3 1c e6 82 cc fe |.g&..bH+........| | 50 10 ed 1a b9 0a f9 97 56 d7 10 54 13 e1 9b f1 |P.......V..T....| | 12 62 54 88 c9 18 ea b0 |.bT..... | Client MAC key[20]: | 38 cc 4d 37 43 c5 ae c8 a4 92 32 f4 eb b6 27 42 |8.M7C.....2...'B| | de d9 bd c1 |.... | Server MAC key[20]: | f8 cc 15 0a 7a 9b b7 28 55 8b 83 88 3e 8a bc 68 |....z..(U...>..h| | c1 b7 5c bc |..\. | Client Write key[16]: | a6 5a 24 57 6d f8 9d 26 5d 7e 56 3e 28 b2 03 a0 |.Z$Wm..&]~V>(...| Server Write key[16]: | 63 1f 93 0d bc 51 ec 55 a4 67 26 91 d6 62 48 2b |c....Q.U.g&..bH+| Client Write IV[16]: | ee f3 d3 1c e6 82 cc fe 50 10 ed 1a b9 0a f9 97 |........P.......| Server Write IV[16]: | 56 d7 10 54 13 e1 9b f1 12 62 54 88 c9 18 ea b0 |V..T.....bT.....| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 8e 2c 59 cb fc dd b9 aa 12 0a 82 e8 e8 62 87 e9 |.,Y..........b..| | 60 fe 1a 1f 8e dd b4 8b b0 b7 09 8a 39 98 30 44 |`...........9.0D| | dc fd 3e e8 0c fd 93 87 1f 60 11 b3 9b 08 4d d4 |..>......`....M.| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 35 c3 d4 dc 5e 54 70 4a e2 41 19 df 96 0e c5 99 |5...^TpJ.A......| | e0 6e 2c c6 c9 c7 6b f4 01 e8 8c 3e ba 7f 1e 1c |.n,...k....>....| | c3 25 e4 b0 00 33 da 40 f0 9e ec d8 7c 56 30 93 |.%...3.@....|V0.| | 26 a9 0b 5a e4 b4 92 b0 75 5d ed 30 ee 3d f3 54 |&..Z....u].0.=.T| Plaintext[64]: | f5 76 15 09 b2 31 ce 5a e2 c3 7c 6d 3d 9a d7 7c |.v...1.Z..|m=..|| | 14 00 00 0c cd c3 70 bd 14 27 7c 65 86 7d 8f 63 |......p..'|e.}.c| | ab fa cb 5c 49 83 83 0d 37 47 ef 46 1e d5 a6 87 |...\I...7G.F....| | bd b0 5c c7 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..\.............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | ab fa cb 5c 49 83 83 0d 37 47 ef 46 1e d5 a6 87 |...\I...7G.F....| | bd b0 5c c7 |..\. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #159 (first time) conversation = 0x7fca71dedb18, ssl_session = 0x7fca45bddf20 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | e6 a0 d6 e1 23 3d 99 fc 78 33 a5 3e 95 37 df 71 |....#=..x3.>.7.q| | 24 85 08 b0 b4 cc e7 0b e7 ad 84 9b 5d bd 74 3d |$...........].t=| | a5 2b 53 f4 79 92 43 54 9a 42 4a 67 cf 9e c1 8b |.+S.y.CT.BJg....| | 53 25 25 ee 5e 18 e1 b2 4e b0 36 4b 06 a7 23 80 |S%%.^...N.6K..#.| Plaintext[64]: | 91 b5 f4 12 fa a6 91 cb 42 30 d9 46 eb 87 33 21 |........B0.F..3!| | 14 00 00 0c e9 bf bc 3a 2d 98 02 15 37 91 32 b2 |.......:-...7.2.| | 29 e1 9d e3 ff 87 58 a3 be 32 2e 8b 81 34 7e 2a |).....X..2...4~*| | 4f 5e e5 5b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |O^.[............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 29 e1 9d e3 ff 87 58 a3 be 32 2e 8b 81 34 7e 2a |).....X..2...4~*| | 4f 5e e5 5b |O^.[ | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #160 (first time) conversation = 0x7fca71dedb18, ssl_session = 0x7fca45bddf20 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | 64 0a 93 bc f2 ec 00 87 89 2c 15 d0 39 66 94 3b |d........,..9f.;| | 30 a7 79 c6 4d 34 06 5d 10 be 50 69 d4 13 e6 cb |0.y.M4.]..Pi....| | f9 a7 69 30 94 19 a3 e8 cd 80 a2 b0 31 ee 95 2c |..i0........1..,| | 5a 32 0b 59 5c ee 8e 6c 10 3c 91 d3 4d e4 09 c7 |Z2.Y\..l.<..M...| | 10 35 b5 f8 ec 68 68 59 58 d6 80 ba fe 79 b8 26 |.5...hhYX....y.&| | eb 8f 96 3a f4 44 08 52 47 11 2c 90 4f 12 b8 36 |...:.D.RG.,.O..6| | 16 b8 da 8c e2 da 68 2c 02 ab b4 73 4c 68 55 6e |......h,...sLhUn| Plaintext[112]: | 3f e2 27 19 52 28 7a 35 ee cb fe d6 f8 d9 d7 50 |?.'.R(z5.......P| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 61 65 |Host: dhe-dss-ae| | 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s128-sha.local.a| | 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:| | 34 34 34 39 0d 0a 0d 0a 95 4e f3 47 20 08 71 19 |4449.....N.G .q.| | c1 26 1b 6c 38 7c b4 23 0a 36 ff 84 03 03 03 03 |.&.l8|.#.6......| ssl_decrypt_record found padding 3 final len 108 checking mac (len 72, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | c8 3f 70 ec 90 82 20 ae 46 4e 9c 30 72 2a 8a 7e |.?p... .FN.0r*.~| | 7e c6 2f 27 |~./' | ssl_decrypt_record: mac failed association_find: TCP port 35259 found (nil) association_find: TCP port 4449 found 0x3735150 dissect_ssl enter frame #161 (first time) conversation = 0x7fca71dedb18, ssl_session = 0x7fca45bddf20 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | b2 99 0a 09 7c 79 83 84 d3 eb ac 71 64 0b 42 a3 |....|y.....qd.B.| | 68 a8 d0 57 7f f0 fb f4 cd 82 3d 24 d8 55 eb 80 |h..W......=$.U..| | b2 c0 f0 61 d9 46 25 53 fc 2a c3 7f 24 c0 a9 ca |...a.F%S.*..$...| | ee 3d b7 20 0b f4 a8 8c 1b e3 6b 12 7f 4e 40 5a |.=. ......k..N@Z| | 36 d3 4d 2f 3a fa 8f 05 4e c9 2c 79 28 54 c3 80 |6.M/:...N.,y(T..| | 99 0f cf b0 5a 17 87 d1 bd b0 74 2e 24 72 54 1a |....Z.....t.$rT.| | ae 29 cb f7 fb b8 3e 86 71 32 c1 e5 ab f5 23 14 |.)....>.q2....#.| | 82 71 cf 42 8e 20 41 ef b1 67 6a 6c 39 9d 46 71 |.q.B. A..gjl9.Fq| | 49 0f dd 57 06 fc ba 1a 7f a2 7e c9 a3 cf 36 d3 |I..W......~...6.| | f4 52 62 70 c2 86 11 ca 68 09 94 03 ed 21 54 fe |.Rbp....h....!T.| | c2 36 5e 72 7e 45 6d 9a 50 11 ee 7d 0c d5 5b 86 |.6^r~Em.P..}..[.| | cf 64 dc 8d 65 f4 be 89 ea 7e e1 78 a9 2f 3b 82 |.d..e....~.x./;.| | c4 d6 a4 25 68 9d d7 57 8d ef 4d bc 39 80 0f c7 |...%h..W..M.9...| | d6 61 d3 27 8e ac c8 ff 71 05 7b 25 72 fe fc 88 |.a.'....q.{%r...| | eb b5 a1 8d fc 99 84 df 11 82 99 a4 94 11 8e a3 |................| | 56 f6 03 a9 2d 32 1f ba 3b e5 54 e4 ec 6b 84 a5 |V...-2..;.T..k..| | 25 77 f4 08 f9 c8 4a 10 60 fc e2 b0 3c d6 91 75 |%w....J.`...<..u| | d9 bc 06 9c 79 a6 26 2c 15 46 73 2c f2 85 38 c4 |....y.&,.Fs,..8.| | 2c 81 dc a4 e9 11 b4 56 0d ff 21 54 e4 67 28 4e |,......V..!T.g(N| | d2 7f 69 d4 04 e0 49 66 7f 7d d7 0b e8 f7 4d 37 |..i...If.}....M7| | 7f 71 88 cb 15 7f 39 d1 cc 4b df 7b 44 f1 47 48 |.q....9..K.{D.GH| | 07 70 d1 d6 a1 6b c5 b7 96 6e 3e 4b 63 6e b7 e3 |.p...k...n>Kcn..| | e1 5b a6 c0 ce 38 a0 8b 53 6c 50 4f cd 14 dc c5 |.[...8..SlPO....| | c5 7d ea a4 23 74 fd bc a9 69 df 05 a9 64 2a d8 |.}..#t...i...d*.| | 41 ee 2b 46 2b aa 60 c4 86 06 99 91 89 8e b3 f2 |A.+F+.`.........| Plaintext[400]: | 0b 59 e6 9b f1 bf 02 ba 46 9a 9f c7 ed 33 59 49 |.Y......F....3YI| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:| | 31 31 3a 32 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:28 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 33 32 20 2d 20 44 48 45 2d 44 |x00,0x32 - DHE-D| | 53 53 2d 41 45 53 31 32 38 2d 53 48 41 20 20 20 |SS-AES128-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc| | 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1.C.4| | 59 9e 24 1b bb 70 af 60 f4 8b b7 77 53 7a ee 5a |Y.$..p.`...wSz.Z| | 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................| ssl_decrypt_record found padding 15 final len 384 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | c8 5b 70 f0 ab bd cb 32 b1 14 5c 5e bd 72 45 20 |.[p....2..\^.rE | | 97 56 64 b5 |.Vd. | ssl_decrypt_record: mac failed association_find: TCP port 4449 found 0x3735150 dissect_ssl enter frame #162 (first time) conversation = 0x7fca71dedb18, ssl_session = 0x7fca45bddf20 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 39 e7 dd 4b 44 7e 7c b8 97 97 a6 58 26 f8 ba 7e |9..KD~|....X&..~| | 74 7d 46 37 fb 7b 55 a2 1a 11 de ff f6 d9 cc 9a |t}F7.{U.........| | 6b d4 75 02 e9 7d 49 e4 95 67 02 15 eb 7e 45 e7 |k.u..}I..g...~E.| Plaintext[48]: | 4f a1 ea f2 33 5d d2 77 82 83 3e 5a 79 03 38 da |O...3].w..>Zy.8.| | 01 00 74 1c d4 03 bf 8e 0f 6d 02 07 c5 57 81 24 |..t......m...W.$| | 11 d7 02 a0 ba f1 09 09 09 09 09 09 09 09 09 09 |................| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 74 1c d4 03 bf 8e 0f 6d 02 07 c5 57 81 24 11 d7 |t......m...W.$..| | 02 a0 ba f1 |.... | ssl_decrypt_record: mac ok dissect_ssl enter frame #164 (first time) conversation = 0x7fca71dedb18, ssl_session = 0x7fca45bddf20 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 5c 44 1a 80 fd 82 a7 29 ac 37 7d 81 fb 96 28 5b |\D.....).7}...([| | b1 e0 ce 8c fa e4 c9 65 cc 4d 95 f4 32 7f 6d fa |.......e.M..2.m.| | 5b 61 19 4d 52 3c d0 f2 a8 09 00 b8 c3 77 08 b4 |[a.MR<.......w..| Plaintext[48]: | da 7b 54 ca 06 67 79 b1 9e 46 c9 a4 2f 4f 1e 90 |.{T..gy..F../O..| | 01 00 f5 7f 65 97 0a 15 5d 95 15 51 18 b1 4f df |....e...]..Q..O.| | eb 56 34 54 00 34 09 09 09 09 09 09 09 09 09 09 |.V4T.4..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | f5 7f 65 97 0a 15 5d 95 15 51 18 b1 4f df eb 56 |..e...]..Q..O..V| | 34 54 00 34 |4T.4 | ssl_decrypt_record: mac ok dissect_ssl enter frame #169 (first time) ssl_session_init: initializing ptr 0x7fca45be0420 size 688 conversation = 0x7fca71deddc0, ssl_session = 0x7fca45be0420 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 53479 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4450 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #171 (first time) conversation = 0x7fca71deddc0, ssl_session = 0x7fca45be0420 record: offset = 0, reported_length_remaining = 1416 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0033 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 8e 2c 59 cb fc dd b9 aa 12 0a 82 e8 e8 62 87 e9 |.,Y..........b..| | 60 fe 1a 1f 8e dd b4 8b b0 b7 09 8a 39 98 30 44 |`...........9.0D| | dc fd 3e e8 0c fd 93 87 1f 60 11 b3 9b 08 4d d4 |..>......`....M.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f0 92 dd 25 76 9e f9 12 f0 9d 22 22 4f 83 c9 f8 |...%v.....""O...| | a1 89 06 ca 74 ac 16 4c 7a b6 c9 dc c5 52 34 c2 |....t..Lz....R4.| | f0 a9 0c 69 82 5f cd 60 f7 30 99 75 80 ca 86 83 |...i._.`.0.u....| | 00 8a b3 98 4a f9 69 f7 f5 1b 11 53 29 |....J.i....S) | hash out[104]: | df 25 f2 71 38 16 7d 73 90 10 5d 7c 69 07 3b cf |.%.q8.}s..]|i.;.| | 26 d2 bf 18 2d 07 b9 4a bd 8d f8 43 b1 df ca 69 |&...-..J...C...i| | 2f ef 30 67 1d a8 bf 51 44 1d ea 7d 24 82 9f b4 |/.0g...QD..}$...| | 51 e3 fe de dc 7d 0a ff c4 95 09 f2 61 3e a6 ab |Q....}......a>..| | 10 8c 58 e3 5d e3 9e b9 12 22 d7 32 a7 e6 96 08 |..X.]....".2....| | 40 d4 88 d7 fd 93 63 12 75 29 ab 48 34 e6 88 a7 |@.....c.u).H4...| | d7 a7 98 d2 07 8a 97 6a |.......j | PRF out[104]: | df 25 f2 71 38 16 7d 73 90 10 5d 7c 69 07 3b cf |.%.q8.}s..]|i.;.| | 26 d2 bf 18 2d 07 b9 4a bd 8d f8 43 b1 df ca 69 |&...-..J...C...i| | 2f ef 30 67 1d a8 bf 51 44 1d ea 7d 24 82 9f b4 |/.0g...QD..}$...| | 51 e3 fe de dc 7d 0a ff c4 95 09 f2 61 3e a6 ab |Q....}......a>..| | 10 8c 58 e3 5d e3 9e b9 12 22 d7 32 a7 e6 96 08 |..X.]....".2....| | 40 d4 88 d7 fd 93 63 12 75 29 ab 48 34 e6 88 a7 |@.....c.u).H4...| | d7 a7 98 d2 07 8a 97 6a |.......j | key expansion[104]: | df 25 f2 71 38 16 7d 73 90 10 5d 7c 69 07 3b cf |.%.q8.}s..]|i.;.| | 26 d2 bf 18 2d 07 b9 4a bd 8d f8 43 b1 df ca 69 |&...-..J...C...i| | 2f ef 30 67 1d a8 bf 51 44 1d ea 7d 24 82 9f b4 |/.0g...QD..}$...| | 51 e3 fe de dc 7d 0a ff c4 95 09 f2 61 3e a6 ab |Q....}......a>..| | 10 8c 58 e3 5d e3 9e b9 12 22 d7 32 a7 e6 96 08 |..X.]....".2....| | 40 d4 88 d7 fd 93 63 12 75 29 ab 48 34 e6 88 a7 |@.....c.u).H4...| | d7 a7 98 d2 07 8a 97 6a |.......j | Client MAC key[20]: | df 25 f2 71 38 16 7d 73 90 10 5d 7c 69 07 3b cf |.%.q8.}s..]|i.;.| | 26 d2 bf 18 |&... | Server MAC key[20]: | 2d 07 b9 4a bd 8d f8 43 b1 df ca 69 2f ef 30 67 |-..J...C...i/.0g| | 1d a8 bf 51 |...Q | Client Write key[16]: | 44 1d ea 7d 24 82 9f b4 51 e3 fe de dc 7d 0a ff |D..}$...Q....}..| Server Write key[16]: | c4 95 09 f2 61 3e a6 ab 10 8c 58 e3 5d e3 9e b9 |....a>....X.]...| Client Write IV[16]: | 12 22 d7 32 a7 e6 96 08 40 d4 88 d7 fd 93 63 12 |.".2....@.....c.| Server Write IV[16]: | 75 29 ab 48 34 e6 88 a7 d7 a7 98 d2 07 8a 97 6a |u).H4..........j| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 1353 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 541 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 527, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407 record: offset = 1407, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416 dissect_ssl enter frame #173 (first time) conversation = 0x7fca71deddc0, ssl_session = 0x7fca45be0420 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984a... looking for RSA pre-master008087631ffaab6ac3c1eb4eb18287d48d7c0648ca2d79c1... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | db bb bf 65 08 47 e1 5a f8 07 fb 9d 25 e6 45 89 |...e.G.Z....%.E.| | 85 1a 41 ad 12 ac b5 f6 75 e1 db aa 92 5c 56 ed |..A.....u....\V.| | 2b 8a e8 0d cc 52 e5 ef d9 44 d0 64 78 8b 8d 87 |+....R...D.dx...| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f0 92 dd 25 76 9e f9 12 f0 9d 22 22 4f 83 c9 f8 |...%v.....""O...| | a1 89 06 ca 74 ac 16 4c 7a b6 c9 dc c5 52 34 c2 |....t..Lz....R4.| | f0 a9 0c 69 82 5f cd 60 f7 30 99 75 80 ca 86 83 |...i._.`.0.u....| | 00 8a b3 98 4a f9 69 f7 f5 1b 11 53 29 |....J.i....S) | hash out[104]: | f0 3d 9c 2d dc 7d f7 92 47 46 53 f1 b3 6c 86 c5 |.=.-.}..GFS..l..| | 76 19 df c3 31 c7 20 0d f1 3d 70 25 63 3c c0 12 |v...1. ..=p%c<..| | 32 e5 b9 03 c3 13 2f f1 58 b7 51 ab ca f0 65 f7 |2...../.X.Q...e.| | a5 49 c4 e3 c6 ef a5 b0 04 b4 87 70 85 55 49 6a |.I.........p.UIj| | 89 a0 72 0a 1f 0c 42 30 c7 08 c8 a9 0d 90 b1 c2 |..r...B0........| | 1c 85 25 93 5b 8e 17 74 36 42 4e 37 32 4e 52 61 |..%.[..t6BN72NRa| | 38 47 1e 11 ab aa 8b 6a |8G.....j | PRF out[104]: | f0 3d 9c 2d dc 7d f7 92 47 46 53 f1 b3 6c 86 c5 |.=.-.}..GFS..l..| | 76 19 df c3 31 c7 20 0d f1 3d 70 25 63 3c c0 12 |v...1. ..=p%c<..| | 32 e5 b9 03 c3 13 2f f1 58 b7 51 ab ca f0 65 f7 |2...../.X.Q...e.| | a5 49 c4 e3 c6 ef a5 b0 04 b4 87 70 85 55 49 6a |.I.........p.UIj| | 89 a0 72 0a 1f 0c 42 30 c7 08 c8 a9 0d 90 b1 c2 |..r...B0........| | 1c 85 25 93 5b 8e 17 74 36 42 4e 37 32 4e 52 61 |..%.[..t6BN72NRa| | 38 47 1e 11 ab aa 8b 6a |8G.....j | key expansion[104]: | f0 3d 9c 2d dc 7d f7 92 47 46 53 f1 b3 6c 86 c5 |.=.-.}..GFS..l..| | 76 19 df c3 31 c7 20 0d f1 3d 70 25 63 3c c0 12 |v...1. ..=p%c<..| | 32 e5 b9 03 c3 13 2f f1 58 b7 51 ab ca f0 65 f7 |2...../.X.Q...e.| | a5 49 c4 e3 c6 ef a5 b0 04 b4 87 70 85 55 49 6a |.I.........p.UIj| | 89 a0 72 0a 1f 0c 42 30 c7 08 c8 a9 0d 90 b1 c2 |..r...B0........| | 1c 85 25 93 5b 8e 17 74 36 42 4e 37 32 4e 52 61 |..%.[..t6BN72NRa| | 38 47 1e 11 ab aa 8b 6a |8G.....j | Client MAC key[20]: | f0 3d 9c 2d dc 7d f7 92 47 46 53 f1 b3 6c 86 c5 |.=.-.}..GFS..l..| | 76 19 df c3 |v... | Server MAC key[20]: | 31 c7 20 0d f1 3d 70 25 63 3c c0 12 32 e5 b9 03 |1. ..=p%c<..2...| | c3 13 2f f1 |../. | Client Write key[16]: | 58 b7 51 ab ca f0 65 f7 a5 49 c4 e3 c6 ef a5 b0 |X.Q...e..I......| Server Write key[16]: | 04 b4 87 70 85 55 49 6a 89 a0 72 0a 1f 0c 42 30 |...p.UIj..r...B0| Client Write IV[16]: | c7 08 c8 a9 0d 90 b1 c2 1c 85 25 93 5b 8e 17 74 |..........%.[..t| Server Write IV[16]: | 36 42 4e 37 32 4e 52 61 38 47 1e 11 ab aa 8b 6a |6BN72NRa8G.....j| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | db bb bf 65 08 47 e1 5a f8 07 fb 9d 25 e6 45 89 |...e.G.Z....%.E.| | 85 1a 41 ad 12 ac b5 f6 75 e1 db aa 92 5c 56 ed |..A.....u....\V.| | 2b 8a e8 0d cc 52 e5 ef d9 44 d0 64 78 8b 8d 87 |+....R...D.dx...| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 13 ce 7c 83 1d a5 60 ac 6c 56 39 ac d9 52 55 6b |..|...`.lV9..RUk| | 71 fb 68 ad 21 9b a5 4a df e2 f7 d5 bc da e3 1e |q.h.!..J........| | 3c 22 e7 37 58 e7 90 77 96 0b 76 21 6d 62 b4 0c |<".7X..w..v!mb..| | 91 ad 29 61 3e f2 f7 e4 3e 32 2d 5f 0a ad eb 6f |..)a>...>2-_...o| Plaintext[64]: | ee 92 8f 1e c7 ed f9 90 dd 3d 83 77 b1 40 87 e2 |.........=.w.@..| | 14 00 00 0c 36 f4 bf e0 5e bd 0d 05 7a a7 6c e6 |....6...^...z.l.| | ed d7 4f 68 4b a9 45 11 32 41 e8 d2 7e a9 94 f7 |..OhK.E.2A..~...| | 51 0b 33 3d 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |Q.3=............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | ed d7 4f 68 4b a9 45 11 32 41 e8 d2 7e a9 94 f7 |..OhK.E.2A..~...| | 51 0b 33 3d |Q.3= | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #174 (first time) conversation = 0x7fca71deddc0, ssl_session = 0x7fca45be0420 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 36 3d 52 4f 3e ad f8 77 ff a0 77 8f 80 00 4a a9 |6=RO>..w..w...J.| | 63 06 f4 cf 69 47 a5 8e b2 84 04 5d fd bb 45 f9 |c...iG.....]..E.| | 9a 0a e5 b0 36 b0 29 f2 43 2f 8f 0d c7 66 d4 b0 |....6.).C/...f..| | dc 5c 43 a7 ce f9 cb 25 6a 9a 64 7b 60 26 6c 9a |.\C....%j.d{`&l.| Plaintext[64]: | a5 ed 50 75 4e 7f 5c 92 01 ee 0e 79 c1 27 9c 1a |..PuN.\....y.'..| | 14 00 00 0c 18 75 56 15 80 1c c1 48 f1 ef 6d 7d |.....uV....H..m}| | cc 1c 3b ce 22 92 63 43 ae c0 94 9d 9f 74 fb 74 |..;.".cC.....t.t| | d8 bd 02 d4 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | cc 1c 3b ce 22 92 63 43 ae c0 94 9d 9f 74 fb 74 |..;.".cC.....t.t| | d8 bd 02 d4 |.... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #175 (first time) conversation = 0x7fca71deddc0, ssl_session = 0x7fca45be0420 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | 51 5b 83 11 9a 3e ab 1b 0c 00 e7 2c 5e c0 be 7a |Q[...>.....,^..z| | a0 32 b0 26 5f 53 4b 69 7b 87 a0 ce 63 3c f8 2b |.2.&_SKi{...c<.+| | bd 9f 5d 8c c3 ef be 26 7d 30 de b9 8f 59 1a 69 |..]....&}0...Y.i| | 2b 6d 6d 68 f1 97 4c 7b f2 12 b4 bb 15 ee 68 4c |+mmh..L{......hL| | 30 68 a9 d0 9b cd 31 6f 76 41 80 01 79 87 93 d8 |0h....1ovA..y...| | 1c 56 5f 80 e6 71 57 cd e4 32 4d 3b 62 8c 87 e4 |.V_..qW..2M;b...| | 8c 66 57 d6 5f 66 58 9b dd c0 77 db bc 6f 1a a9 |.fW._fX...w..o..| Plaintext[112]: | 1e 75 a8 8a fa 20 e1 0f 41 ab 20 1b cf 4f 28 6a |.u... ..A. ..O(j| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 61 65 |Host: dhe-rsa-ae| | 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s128-sha.local.a| | 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:| | 34 34 35 30 0d 0a 0d 0a cf 5a ac 9a 4a 9a f9 f8 |4450.....Z..J...| | ac 76 48 0d 7a 72 73 41 57 b8 5e b4 03 03 03 03 |.vH.zrsAW.^.....| ssl_decrypt_record found padding 3 final len 108 checking mac (len 72, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 92 f0 37 5c f3 f9 5c a6 e4 a1 97 eb e0 12 58 4b |..7\..\.......XK| | a6 35 a7 d4 |.5.. | ssl_decrypt_record: mac failed association_find: TCP port 53479 found (nil) association_find: TCP port 4450 found 0x37351e0 dissect_ssl enter frame #176 (first time) conversation = 0x7fca71deddc0, ssl_session = 0x7fca45be0420 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | 37 d1 68 79 fa cf 6d 47 82 bf 9b 70 bb a7 48 e3 |7.hy..mG...p..H.| | ff 45 93 8a b9 57 b5 bc 56 7a a3 af 80 45 78 17 |.E...W..Vz...Ex.| | 45 d1 14 b8 87 49 07 bc 36 7a ba 50 1e a9 a9 c2 |E....I..6z.P....| | 54 d1 79 43 c7 80 c0 19 fb 0e d1 61 a7 97 6e 8f |T.yC.......a..n.| | b9 6e da dc 26 6c f7 17 ce d0 4b fb cf 56 73 94 |.n..&l....K..Vs.| | e1 63 6e 3c 94 0b bd 61 c9 24 24 63 08 f6 b9 73 |.cn<...a.$$c...s| | bc 5c 90 20 ae 8e 7e fe bc c4 5b c3 05 33 49 3a |.\. ..~...[..3I:| | d1 5d 8d 10 6e 61 05 9f 7c 57 99 f1 0c 8e 4e fe |.]..na..|W....N.| | 93 1e 61 57 ab 7d 4f 0f 43 ac ee 51 9d 39 d7 8a |..aW.}O.C..Q.9..| | d7 ed 0d 63 1f bd 28 f3 a8 57 08 08 bc 64 54 47 |...c..(..W...dTG| | f8 58 fa 78 77 c0 f3 f8 8d 83 62 21 3e fc a2 3d |.X.xw.....b!>..=| | 6c ed 80 a8 35 ac ee e8 ba 09 88 d5 80 83 c9 ef |l...5...........| | 24 28 ad 02 ba 45 41 e1 75 d7 01 6e 58 0b 89 4f |$(...EA.u..nX..O| | c6 80 44 f5 71 bb 28 d7 4e 09 57 f6 d3 d2 b9 e6 |..D.q.(.N.W.....| | 09 2a 89 74 5d 73 e3 70 fc db b3 86 91 8c ab 9f |.*.t]s.p........| | 33 14 fa ee 87 b6 04 c6 e5 d9 bd 81 4a d4 b8 1b |3...........J...| | 66 8e 29 d3 5e 16 50 31 27 e6 47 91 9b ce 78 7d |f.).^.P1'.G...x}| | d4 5e 91 40 82 f7 30 ce ed 90 70 c9 62 76 41 c5 |.^.@..0...p.bvA.| | ff f7 b8 b9 be 80 f1 04 9a 76 1b 37 45 e8 23 40 |.........v.7E.#@| | 19 6f 36 20 85 51 48 14 47 a5 37 8e f7 e0 a6 08 |.o6 .QH.G.7.....| | af 1b 3d ee 1e 10 59 f5 70 44 b7 5e 67 fb 21 a9 |..=...Y.pD.^g.!.| | 8b 51 8a 33 a5 af 6b 07 18 b0 61 65 f7 6f 1e 36 |.Q.3..k...ae.o.6| | 5f 3b 45 aa 09 04 f8 51 27 ea 8c 27 9e b0 e4 dd |_;E....Q'..'....| | 6e 7a d7 31 68 72 40 98 da e6 50 5c 2f 01 18 fa |nz.1hr@...P\/...| | 7e 2a 66 01 09 c7 b4 e4 65 b9 46 b9 fd 1d 3d 3b |~*f.....e.F...=;| Plaintext[400]: | 00 22 89 ec f1 ff a6 17 c2 45 19 c2 ba 12 ed 66 |.".......E.....f| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:| | 31 31 3a 32 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:28 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 33 33 20 2d 20 44 48 45 2d 52 |x00,0x33 - DHE-R| | 53 41 2d 41 45 53 31 32 38 2d 53 48 41 20 20 20 |SA-AES128-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1..E.| | 97 9a 98 91 41 9c 2f 31 7c 54 f4 90 bb d9 ab a2 |....A./1|T......| | 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................| ssl_decrypt_record found padding 15 final len 384 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | e3 11 76 42 14 84 ab 07 2e 36 88 34 e6 50 6e a7 |..vB.....6.4.Pn.| | 41 c7 5e 57 |A.^W | ssl_decrypt_record: mac failed association_find: TCP port 4450 found 0x37351e0 dissect_ssl enter frame #177 (first time) conversation = 0x7fca71deddc0, ssl_session = 0x7fca45be0420 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 14 d3 a7 a2 3d 20 2c 40 8d ee d3 8c 03 c8 49 c6 |....= ,@......I.| | 86 f3 9a 97 3a a8 fe 8a 14 25 3e ae 34 b9 46 bf |....:....%>.4.F.| | 23 5a f3 d0 00 9b 3a a4 d4 8c 88 c4 2e ac c0 94 |#Z....:.........| Plaintext[48]: | f1 87 00 95 a1 ef 7a 30 6c 93 76 59 53 96 79 79 |......z0l.vYS.yy| | 01 00 c9 7d 56 6e b6 89 b8 55 f4 df 89 bd b6 59 |...}Vn...U.....Y| | 8a 9d 82 35 85 ca 09 09 09 09 09 09 09 09 09 09 |...5............| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | c9 7d 56 6e b6 89 b8 55 f4 df 89 bd b6 59 8a 9d |.}Vn...U.....Y..| | 82 35 85 ca |.5.. | ssl_decrypt_record: mac ok dissect_ssl enter frame #179 (first time) conversation = 0x7fca71deddc0, ssl_session = 0x7fca45be0420 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | c8 d9 a5 bd 0e 3d a2 ee 89 07 00 14 82 97 84 d9 |.....=..........| | 8e f3 c3 68 af 4b 0b b0 91 06 23 5a eb 1a e0 a8 |...h.K....#Z....| | 05 34 46 00 b8 14 76 50 75 fc 15 6b 24 f8 1c 86 |.4F...vPu..k$...| Plaintext[48]: | 43 1c b4 57 66 e4 d1 42 61 53 66 34 bd 34 34 50 |C..Wf..BaSf4.44P| | 01 00 31 fb 6f 51 66 33 c0 6d f0 66 0b 2b 2d 60 |..1.oQf3.m.f.+-`| | 1e 1d 21 08 e1 71 09 09 09 09 09 09 09 09 09 09 |..!..q..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 31 fb 6f 51 66 33 c0 6d f0 66 0b 2b 2d 60 1e 1d |1.oQf3.m.f.+-`..| | 21 08 e1 71 |!..q | ssl_decrypt_record: mac ok dissect_ssl enter frame #184 (first time) ssl_session_init: initializing ptr 0x7fca45be2960 size 688 conversation = 0x7fca71dee068, ssl_session = 0x7fca45be2960 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 46076 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4451 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #186 (first time) conversation = 0x7fca71dee068, ssl_session = 0x7fca45be2960 record: offset = 0, reported_length_remaining = 884 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0035 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | db bb bf 65 08 47 e1 5a f8 07 fb 9d 25 e6 45 89 |...e.G.Z....%.E.| | 85 1a 41 ad 12 ac b5 f6 75 e1 db aa 92 5c 56 ed |..A.....u....\V.| | 2b 8a e8 0d cc 52 e5 ef d9 44 d0 64 78 8b 8d 87 |+....R...D.dx...| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f0 cf 09 17 1a 90 bd 15 7c 66 3c 3e f3 d0 26 92 |........|f<>..&.| | 7e 96 74 e0 ad c2 07 d0 ac 8c 6f 9e 66 52 34 c2 |~.t.......o.fR4.| | f0 8d ec 81 a8 99 83 2a 03 c5 b0 97 33 82 53 f7 |.......*....3.S.| | d9 01 56 6c 70 be cc 8a 24 31 71 72 73 |..Vlp...$1qrs | hash out[136]: | db e6 04 4a 46 c3 18 d6 8a 54 11 87 ee f1 e7 e4 |...JF....T......| | 0a 1b 71 69 b3 06 79 e5 df de 9f ab d7 2d 71 90 |..qi..y......-q.| | 98 5e 7a 3e dc f0 fd 7c b9 f5 19 14 10 95 69 10 |.^z>...|......i.| | 6a dc 4c aa d1 f8 4a 69 81 98 98 df bb 6b df 0a |j.L...Ji.....k..| | a6 5d 9c 63 b5 a3 03 99 45 55 24 98 3d 40 1a 94 |.].c....EU$.=@..| | 93 99 85 66 ae 49 13 9b f0 b4 78 ab b2 95 7e c0 |...f.I....x...~.| | d6 f1 9e ff a7 76 d7 cf 97 f1 ca 2d 26 59 10 fc |.....v.....-&Y..| | 31 73 d5 9e 92 32 70 82 a6 f8 fd d2 84 3b 8e 9f |1s...2p......;..| | b5 1a 54 1d 71 76 9e cb |..T.qv.. | PRF out[136]: | db e6 04 4a 46 c3 18 d6 8a 54 11 87 ee f1 e7 e4 |...JF....T......| | 0a 1b 71 69 b3 06 79 e5 df de 9f ab d7 2d 71 90 |..qi..y......-q.| | 98 5e 7a 3e dc f0 fd 7c b9 f5 19 14 10 95 69 10 |.^z>...|......i.| | 6a dc 4c aa d1 f8 4a 69 81 98 98 df bb 6b df 0a |j.L...Ji.....k..| | a6 5d 9c 63 b5 a3 03 99 45 55 24 98 3d 40 1a 94 |.].c....EU$.=@..| | 93 99 85 66 ae 49 13 9b f0 b4 78 ab b2 95 7e c0 |...f.I....x...~.| | d6 f1 9e ff a7 76 d7 cf 97 f1 ca 2d 26 59 10 fc |.....v.....-&Y..| | 31 73 d5 9e 92 32 70 82 a6 f8 fd d2 84 3b 8e 9f |1s...2p......;..| | b5 1a 54 1d 71 76 9e cb |..T.qv.. | key expansion[136]: | db e6 04 4a 46 c3 18 d6 8a 54 11 87 ee f1 e7 e4 |...JF....T......| | 0a 1b 71 69 b3 06 79 e5 df de 9f ab d7 2d 71 90 |..qi..y......-q.| | 98 5e 7a 3e dc f0 fd 7c b9 f5 19 14 10 95 69 10 |.^z>...|......i.| | 6a dc 4c aa d1 f8 4a 69 81 98 98 df bb 6b df 0a |j.L...Ji.....k..| | a6 5d 9c 63 b5 a3 03 99 45 55 24 98 3d 40 1a 94 |.].c....EU$.=@..| | 93 99 85 66 ae 49 13 9b f0 b4 78 ab b2 95 7e c0 |...f.I....x...~.| | d6 f1 9e ff a7 76 d7 cf 97 f1 ca 2d 26 59 10 fc |.....v.....-&Y..| | 31 73 d5 9e 92 32 70 82 a6 f8 fd d2 84 3b 8e 9f |1s...2p......;..| | b5 1a 54 1d 71 76 9e cb |..T.qv.. | Client MAC key[20]: | db e6 04 4a 46 c3 18 d6 8a 54 11 87 ee f1 e7 e4 |...JF....T......| | 0a 1b 71 69 |..qi | Server MAC key[20]: | b3 06 79 e5 df de 9f ab d7 2d 71 90 98 5e 7a 3e |..y......-q..^z>| | dc f0 fd 7c |...| | Client Write key[32]: | b9 f5 19 14 10 95 69 10 6a dc 4c aa d1 f8 4a 69 |......i.j.L...Ji| | 81 98 98 df bb 6b df 0a a6 5d 9c 63 b5 a3 03 99 |.....k...].c....| Server Write key[32]: | 45 55 24 98 3d 40 1a 94 93 99 85 66 ae 49 13 9b |EU$.=@.....f.I..| | f0 b4 78 ab b2 95 7e c0 d6 f1 9e ff a7 76 d7 cf |..x...~......v..| Client Write IV[16]: | 97 f1 ca 2d 26 59 10 fc 31 73 d5 9e 92 32 70 82 |...-&Y..1s...2p.| Server Write IV[16]: | a6 f8 fd d2 84 3b 8e 9f b5 1a 54 1d 71 76 9e cb |.....;....T.qv..| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 821 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884 dissect_ssl enter frame #188 (first time) conversation = 0x7fca71dee068, ssl_session = 0x7fca45be2960 record: offset = 0, reported_length_remaining = 342 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 262, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70... looking for RSA pre-mastera3909729d90d64d1a54d9ea0d4a24023a60c44da755d2899... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 14 bb dd 69 e9 d2 df ca ae 2c 79 78 36 1c 62 43 |...i.....,yx6.bC| | f2 63 cd 89 31 55 7f ec 4a e6 fd 36 58 d4 0c c0 |.c..1U..J..6X...| | 58 0a 09 15 ce 27 8d f4 ff 0e 72 96 d0 56 a4 b5 |X....'....r..V..| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f0 cf 09 17 1a 90 bd 15 7c 66 3c 3e f3 d0 26 92 |........|f<>..&.| | 7e 96 74 e0 ad c2 07 d0 ac 8c 6f 9e 66 52 34 c2 |~.t.......o.fR4.| | f0 8d ec 81 a8 99 83 2a 03 c5 b0 97 33 82 53 f7 |.......*....3.S.| | d9 01 56 6c 70 be cc 8a 24 31 71 72 73 |..Vlp...$1qrs | hash out[136]: | 91 75 e8 cf 3f ea ce bc a8 7b 54 83 2d 66 80 36 |.u..?....{T.-f.6| | d2 db 85 17 e2 6a 87 9b c6 ed 12 b7 27 02 c6 e9 |.....j......'...| | 9e 7c ce 67 f9 cb b2 9c 37 a3 cf 03 33 e4 0c 82 |.|.g....7...3...| | 7c d2 0c 86 fc 35 62 3d 9c b7 28 e9 ea a4 72 68 ||....5b=..(...rh| | 74 e8 04 da 70 59 d9 a1 e9 b8 08 7b eb 81 53 6b |t...pY.....{..Sk| | 5d 50 f0 eb be 00 1d c5 e3 60 a1 36 f9 fd 5f c6 |]P.......`.6.._.| | 7d 5a b7 52 4d b1 d8 fe 42 27 e3 cf a6 74 71 a4 |}Z.RM...B'...tq.| | 32 45 b6 4a 50 09 2b 01 26 45 79 46 07 cb 3e 85 |2E.JP.+.&EyF..>.| | 73 5f cf d5 df e8 54 16 |s_....T. | PRF out[136]: | 91 75 e8 cf 3f ea ce bc a8 7b 54 83 2d 66 80 36 |.u..?....{T.-f.6| | d2 db 85 17 e2 6a 87 9b c6 ed 12 b7 27 02 c6 e9 |.....j......'...| | 9e 7c ce 67 f9 cb b2 9c 37 a3 cf 03 33 e4 0c 82 |.|.g....7...3...| | 7c d2 0c 86 fc 35 62 3d 9c b7 28 e9 ea a4 72 68 ||....5b=..(...rh| | 74 e8 04 da 70 59 d9 a1 e9 b8 08 7b eb 81 53 6b |t...pY.....{..Sk| | 5d 50 f0 eb be 00 1d c5 e3 60 a1 36 f9 fd 5f c6 |]P.......`.6.._.| | 7d 5a b7 52 4d b1 d8 fe 42 27 e3 cf a6 74 71 a4 |}Z.RM...B'...tq.| | 32 45 b6 4a 50 09 2b 01 26 45 79 46 07 cb 3e 85 |2E.JP.+.&EyF..>.| | 73 5f cf d5 df e8 54 16 |s_....T. | key expansion[136]: | 91 75 e8 cf 3f ea ce bc a8 7b 54 83 2d 66 80 36 |.u..?....{T.-f.6| | d2 db 85 17 e2 6a 87 9b c6 ed 12 b7 27 02 c6 e9 |.....j......'...| | 9e 7c ce 67 f9 cb b2 9c 37 a3 cf 03 33 e4 0c 82 |.|.g....7...3...| | 7c d2 0c 86 fc 35 62 3d 9c b7 28 e9 ea a4 72 68 ||....5b=..(...rh| | 74 e8 04 da 70 59 d9 a1 e9 b8 08 7b eb 81 53 6b |t...pY.....{..Sk| | 5d 50 f0 eb be 00 1d c5 e3 60 a1 36 f9 fd 5f c6 |]P.......`.6.._.| | 7d 5a b7 52 4d b1 d8 fe 42 27 e3 cf a6 74 71 a4 |}Z.RM...B'...tq.| | 32 45 b6 4a 50 09 2b 01 26 45 79 46 07 cb 3e 85 |2E.JP.+.&EyF..>.| | 73 5f cf d5 df e8 54 16 |s_....T. | Client MAC key[20]: | 91 75 e8 cf 3f ea ce bc a8 7b 54 83 2d 66 80 36 |.u..?....{T.-f.6| | d2 db 85 17 |.... | Server MAC key[20]: | e2 6a 87 9b c6 ed 12 b7 27 02 c6 e9 9e 7c ce 67 |.j......'....|.g| | f9 cb b2 9c |.... | Client Write key[32]: | 37 a3 cf 03 33 e4 0c 82 7c d2 0c 86 fc 35 62 3d |7...3...|....5b=| | 9c b7 28 e9 ea a4 72 68 74 e8 04 da 70 59 d9 a1 |..(...rht...pY..| Server Write key[32]: | e9 b8 08 7b eb 81 53 6b 5d 50 f0 eb be 00 1d c5 |...{..Sk]P......| | e3 60 a1 36 f9 fd 5f c6 7d 5a b7 52 4d b1 d8 fe |.`.6.._.}Z.RM...| Client Write IV[16]: | 42 27 e3 cf a6 74 71 a4 32 45 b6 4a 50 09 2b 01 |B'...tq.2E.JP.+.| Server Write IV[16]: | 26 45 79 46 07 cb 3e 85 73 5f cf d5 df e8 54 16 |&EyF..>.s_....T.| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 14 bb dd 69 e9 d2 df ca ae 2c 79 78 36 1c 62 43 |...i.....,yx6.bC| | f2 63 cd 89 31 55 7f ec 4a e6 fd 36 58 d4 0c c0 |.c..1U..J..6X...| | 58 0a 09 15 ce 27 8d f4 ff 0e 72 96 d0 56 a4 b5 |X....'....r..V..| dissect_ssl3_handshake session keys successfully generated record: offset = 267, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 273, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 67 a0 a9 5d 58 5e e0 b3 98 cd 72 bd c0 6f 5a 15 |g..]X^....r..oZ.| | 7d 1a 94 72 ea 3a 28 5c 5d ad 94 de e7 28 87 ec |}..r.:(\]....(..| | 74 56 19 80 ac c1 cc 76 83 35 41 66 ea fc 5f 5d |tV.....v.5Af.._]| | a2 f6 dd e2 41 b2 22 a9 8e 10 78 30 5b 74 78 c8 |....A."...x0[tx.| Plaintext[64]: | e7 da 72 44 36 11 fb 0c b1 fd d5 5f 9c e2 67 5c |..rD6......_..g\| | 14 00 00 0c 6e b2 03 07 8d 9a 6a 6a b1 91 1f 51 |....n.....jj...Q| | ee 15 cb b7 a9 78 e6 85 0e 37 47 03 cc 5b a1 4f |.....x...7G..[.O| | 66 c7 71 e0 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |f.q.............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | ee 15 cb b7 a9 78 e6 85 0e 37 47 03 cc 5b a1 4f |.....x...7G..[.O| | 66 c7 71 e0 |f.q. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #189 (first time) conversation = 0x7fca71dee068, ssl_session = 0x7fca45be2960 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 85 2e 72 52 ff fa 92 2d c3 df 38 8b e0 38 61 4b |..rR...-..8..8aK| | a7 e4 fb ad 13 b1 33 d2 a0 2e 6f f0 f1 30 4f b1 |......3...o..0O.| | 18 79 d9 5a a4 48 be c7 cb b2 22 96 5a 6c 52 e5 |.y.Z.H....".ZlR.| | fd 37 37 1a b3 60 12 f3 1f 3a a2 b9 a2 13 b0 32 |.77..`...:.....2| Plaintext[64]: | 80 a6 2b 8c 9a 2c 85 25 53 69 d2 57 82 e7 a3 a2 |..+..,.%Si.W....| | 14 00 00 0c f5 0e 11 58 99 e8 af b6 8a 05 d5 03 |.......X........| | 02 31 9e 7d 02 07 1b c4 08 29 05 cd 5c 3e cc 07 |.1.}.....)..\>..| | 7b e3 4d 64 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |{.Md............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 02 31 9e 7d 02 07 1b c4 08 29 05 cd 5c 3e cc 07 |.1.}.....)..\>..| | 7b e3 4d 64 |{.Md | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #190 (first time) conversation = 0x7fca71dee068, ssl_session = 0x7fca45be2960 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | 98 8e 76 0a 94 5f 9d 7d fe 73 dd 80 e0 eb 64 63 |..v.._.}.s....dc| | 31 b4 dd af 03 b9 20 e4 a2 dc 04 d9 94 9f 99 eb |1..... .........| | 66 4e a5 2b c6 10 01 e2 df fd 65 ff 2e 44 0a 40 |fN.+......e..D.@| | 86 d6 b8 b8 b9 71 b3 43 bf 5b fb 3e d8 37 89 69 |.....q.C.[.>.7.i| | 33 9f 02 32 e2 bb 25 a1 2a 0d 29 56 db d2 e6 e1 |3..2..%.*.)V....| | ac a5 6d 1d 2b 72 b2 f2 21 a5 d1 4d 6c 3f 95 4f |..m.+r..!..Ml?.O| | b7 83 ce f4 76 99 9a 1d 0d 79 60 4f 6b fb 0e 2c |....v....y`Ok..,| Plaintext[112]: | 6a 13 3c 6d 03 49 af 0b 4f 6d ab 94 ac b3 3e 7c |j.|| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 61 65 73 32 35 36 2d 73 68 61 |Host: aes256-sha| | 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 |.local.al.lekens| | 74 65 79 6e 2e 6e 6c 3a 34 34 35 31 0d 0a 0d 0a |teyn.nl:4451....| | 96 22 6c cb f9 cf 36 1f 8e ee d4 34 9f 89 42 ff |."l...6....4..B.| | e9 cd 4a 31 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..J1............| ssl_decrypt_record found padding 11 final len 100 checking mac (len 64, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 38 1f 37 54 51 ba b6 e0 17 94 d2 f9 24 c3 da af |8.7TQ.......$...| | b0 89 84 cf |.... | ssl_decrypt_record: mac failed association_find: TCP port 46076 found (nil) association_find: TCP port 4451 found 0x372ca60 dissect_ssl enter frame #191 (first time) conversation = 0x7fca71dee068, ssl_session = 0x7fca45be2960 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | 35 04 8a 13 44 cc 63 86 8b 6b 2f f1 1d ee 6f 5e |5...D.c..k/...o^| | 51 84 57 93 df 68 8a 3b b1 9a 1d 8b 3a 26 2d 27 |Q.W..h.;....:&-'| | 36 7d b0 a3 e2 fc 1d 95 70 a6 e4 d9 1a 4d 0f 8c |6}......p....M..| | 54 36 ac 9f 66 4b 1a bc cb 5b 3e 93 3d 74 e3 1b |T6..fK...[>.=t..| | 70 ea 48 6d 88 73 39 38 a1 35 f4 5e f4 db fb 05 |p.Hm.s98.5.^....| | a4 f4 77 d6 9e 76 e9 72 9f 13 c2 5f 64 48 ff 01 |..w..v.r..._dH..| | 34 fa 7d 88 50 be a5 0b 5d 22 d6 ca f7 ba 01 54 |4.}.P...]".....T| | 86 d1 3c 9f 50 91 77 27 47 a8 a1 41 13 cd 24 ef |..<.P.w'G..A..$.| | da d1 1f 2e 2f 9c 0c f1 4c f3 3b 52 df cf 86 93 |..../...L.;R....| | 99 9b da 67 c1 30 9d ac 57 58 72 11 74 20 1d fc |...g.0..WXr.t ..| | 73 a0 34 9d d9 b4 6e 94 69 20 48 77 fd a9 38 15 |s.4...n.i Hw..8.| | 58 94 f8 02 17 72 c6 d5 df d9 61 d6 84 9e d4 9f |X....r....a.....| | b7 b1 78 1d 51 8a 7c 1e 0f 90 2b 98 f6 5f e8 ef |..x.Q.|...+.._..| | 38 27 9e bd 1b 56 7f 6e a6 44 10 bf ad 82 65 58 |8'...V.n.D....eX| | 48 fa 18 b9 a0 7d 2d a9 0e 63 06 c8 33 f8 b4 68 |H....}-..c..3..h| | 9d 8f a8 16 52 e8 1b 20 5b f3 78 8e 6a 96 3e 5e |....R.. [.x.j.>^| | 3c f6 2b 57 b8 ac 31 1d 9c 52 38 0a 6e 1a a9 7c |<.+W..1..R8.n..|| | e9 a6 96 34 d7 39 6a dd 7a 37 35 5e a3 e5 7d 3a |...4.9j.z75^..}:| | 5b 81 d6 79 e7 50 ed 84 5b 0a 0c 39 a8 dd fb 78 |[..y.P..[..9...x| | f8 cd 8d 6c 19 28 18 e0 f3 bf 10 38 2f ce ee bb |...l.(.....8/...| | 88 a9 d1 29 25 59 e2 36 ae 44 5b d9 c6 ea e0 e7 |...)%Y.6.D[.....| | c1 a3 8b a3 48 21 4d f7 52 dc bb cc 4a ca 99 b5 |....H!M.R...J...| | 76 a4 48 a2 6b c1 31 31 7a e9 e9 0b 58 b6 7c 46 |v.H.k.11z...X.|F| | a3 13 91 c8 56 28 29 c6 a1 4f 1a ec 14 54 0d e2 |....V()..O...T..| | d8 28 ed 14 b0 2b 1b 5f 63 47 f6 1c a9 f8 2c 42 |.(...+._cG....,B| Plaintext[400]: | 75 e8 77 a0 b0 85 88 04 73 cf 32 da 8a 45 59 6e |u.w.....s.2..EYn| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:| | 31 31 3a 32 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:28 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 33 35 20 2d 20 41 45 53 32 35 |x00,0x35 - AES25| | 36 2d 53 48 41 20 20 20 20 20 20 20 20 20 20 20 |6-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1...d| | 89 98 cb 2b ed a1 9f b7 83 d7 f9 7d b2 1a b4 c0 |...+.......}....| | 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................| ssl_decrypt_record found padding 15 final len 384 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | bb 30 c9 62 0b 3b 25 5e 7f c0 51 26 d9 35 b7 e8 |.0.b.;%^..Q&.5..| | b7 b6 83 04 |.... | ssl_decrypt_record: mac failed association_find: TCP port 4451 found 0x372ca60 dissect_ssl enter frame #192 (first time) conversation = 0x7fca71dee068, ssl_session = 0x7fca45be2960 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 28 9a 27 19 27 cb 98 39 7a 52 2d bd 35 18 23 c1 |(.'.'..9zR-.5.#.| | 6a 8c 86 d5 c7 16 80 f1 bc b1 f9 0a d8 f3 96 1f |j...............| | a2 b5 62 9f 5d 7d a6 84 68 c1 7e a2 b3 2a 51 95 |..b.]}..h.~..*Q.| Plaintext[48]: | cd 96 95 ec ae 66 1a f2 5a 3c d2 59 c3 0a 2d 7b |.....f..Z<.Y..-{| | 01 00 5d 32 31 1f 3b 54 52 0f a1 77 67 12 ea e3 |..]21.;TR..wg...| | 90 31 45 27 61 3b 09 09 09 09 09 09 09 09 09 09 |.1E'a;..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 5d 32 31 1f 3b 54 52 0f a1 77 67 12 ea e3 90 31 |]21.;TR..wg....1| | 45 27 61 3b |E'a; | ssl_decrypt_record: mac ok dissect_ssl enter frame #194 (first time) conversation = 0x7fca71dee068, ssl_session = 0x7fca45be2960 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 5e 12 3b 07 56 32 7c 9f 81 18 67 23 d6 71 59 92 |^.;.V2|...g#.qY.| | a1 8e 3c 84 ed 1f 95 0e 30 f5 a1 2c ca c9 41 8e |..<.....0..,..A.| | 54 e1 a8 97 91 28 64 72 c7 3d ee 4f 8a 87 ca 7e |T....(dr.=.O...~| Plaintext[48]: | e9 e3 84 94 b9 e3 1c fc 46 c0 0b 06 9d 4a 74 ef |........F....Jt.| | 01 00 ec b0 ce 0e 32 25 97 8f 23 13 7e a3 20 85 |......2%..#.~. .| | 07 3c 8f 86 b7 36 09 09 09 09 09 09 09 09 09 09 |.<...6..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | ec b0 ce 0e 32 25 97 8f 23 13 7e a3 20 85 07 3c |....2%..#.~. ..<| | 8f 86 b7 36 |...6 | ssl_decrypt_record: mac ok dissect_ssl enter frame #199 (first time) ssl_session_init: initializing ptr 0x7fca45be4f20 size 688 conversation = 0x7fca71dee310, ssl_session = 0x7fca45be4f20 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 45020 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4452 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #201 (first time) conversation = 0x7fca71dee310, ssl_session = 0x7fca45be4f20 record: offset = 0, reported_length_remaining = 1134 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0038 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 14 bb dd 69 e9 d2 df ca ae 2c 79 78 36 1c 62 43 |...i.....,yx6.bC| | f2 63 cd 89 31 55 7f ec 4a e6 fd 36 58 d4 0c c0 |.c..1U..J..6X...| | 58 0a 09 15 ce 27 8d f4 ff 0e 72 96 d0 56 a4 b5 |X....'....r..V..| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f0 48 ff 58 ca 7c 79 fe 2c 01 92 0a c6 9b b1 26 |.H.X.|y.,......&| | b9 51 58 90 1d 16 7d 7f ef 06 a5 28 da 52 34 c2 |.QX...}....(.R4.| | f0 d8 87 58 c9 e9 b8 c6 07 25 ce ea b9 15 98 71 |...X.....%.....q| | 5e 86 a9 fc 5b 2e a5 65 da 3b 56 12 6f |^...[..e.;V.o | hash out[136]: | 0b 1c 9c 9e a6 4d b8 99 33 aa 83 63 33 47 48 2e |.....M..3..c3GH.| | 4e dd 19 36 7c 3e c5 c4 b5 6d e0 e2 b9 05 30 77 |N..6|>...m....0w| | 44 a5 6f 2b 7b 61 15 a3 d6 c8 a4 ed 38 3f 2c 36 |D.o+{a......8?,6| | 46 6a 89 0f 88 a1 65 e4 7f 21 8e cc 3e 33 5e 24 |Fj....e..!..>3^$| | 6f 97 f7 6d dc 08 0e 72 ae e8 58 2a b7 4e 7b 74 |o..m...r..X*.N{t| | 2e 26 b4 ae 56 72 0b e0 c7 6c 5d 3c a1 1b e9 d7 |.&..Vr...l]<....| | 1a 8d f8 d6 81 5a ab 56 92 57 c2 56 2e d6 72 13 |.....Z.V.W.V..r.| | 47 fe 5a 5d 4c 36 28 2a 45 70 60 56 93 b7 08 86 |G.Z]L6(*Ep`V....| | d3 42 64 8c d2 2b ad aa |.Bd..+.. | PRF out[136]: | 0b 1c 9c 9e a6 4d b8 99 33 aa 83 63 33 47 48 2e |.....M..3..c3GH.| | 4e dd 19 36 7c 3e c5 c4 b5 6d e0 e2 b9 05 30 77 |N..6|>...m....0w| | 44 a5 6f 2b 7b 61 15 a3 d6 c8 a4 ed 38 3f 2c 36 |D.o+{a......8?,6| | 46 6a 89 0f 88 a1 65 e4 7f 21 8e cc 3e 33 5e 24 |Fj....e..!..>3^$| | 6f 97 f7 6d dc 08 0e 72 ae e8 58 2a b7 4e 7b 74 |o..m...r..X*.N{t| | 2e 26 b4 ae 56 72 0b e0 c7 6c 5d 3c a1 1b e9 d7 |.&..Vr...l]<....| | 1a 8d f8 d6 81 5a ab 56 92 57 c2 56 2e d6 72 13 |.....Z.V.W.V..r.| | 47 fe 5a 5d 4c 36 28 2a 45 70 60 56 93 b7 08 86 |G.Z]L6(*Ep`V....| | d3 42 64 8c d2 2b ad aa |.Bd..+.. | key expansion[136]: | 0b 1c 9c 9e a6 4d b8 99 33 aa 83 63 33 47 48 2e |.....M..3..c3GH.| | 4e dd 19 36 7c 3e c5 c4 b5 6d e0 e2 b9 05 30 77 |N..6|>...m....0w| | 44 a5 6f 2b 7b 61 15 a3 d6 c8 a4 ed 38 3f 2c 36 |D.o+{a......8?,6| | 46 6a 89 0f 88 a1 65 e4 7f 21 8e cc 3e 33 5e 24 |Fj....e..!..>3^$| | 6f 97 f7 6d dc 08 0e 72 ae e8 58 2a b7 4e 7b 74 |o..m...r..X*.N{t| | 2e 26 b4 ae 56 72 0b e0 c7 6c 5d 3c a1 1b e9 d7 |.&..Vr...l]<....| | 1a 8d f8 d6 81 5a ab 56 92 57 c2 56 2e d6 72 13 |.....Z.V.W.V..r.| | 47 fe 5a 5d 4c 36 28 2a 45 70 60 56 93 b7 08 86 |G.Z]L6(*Ep`V....| | d3 42 64 8c d2 2b ad aa |.Bd..+.. | Client MAC key[20]: | 0b 1c 9c 9e a6 4d b8 99 33 aa 83 63 33 47 48 2e |.....M..3..c3GH.| | 4e dd 19 36 |N..6 | Server MAC key[20]: | 7c 3e c5 c4 b5 6d e0 e2 b9 05 30 77 44 a5 6f 2b ||>...m....0wD.o+| | 7b 61 15 a3 |{a.. | Client Write key[32]: | d6 c8 a4 ed 38 3f 2c 36 46 6a 89 0f 88 a1 65 e4 |....8?,6Fj....e.| | 7f 21 8e cc 3e 33 5e 24 6f 97 f7 6d dc 08 0e 72 |.!..>3^$o..m...r| Server Write key[32]: | ae e8 58 2a b7 4e 7b 74 2e 26 b4 ae 56 72 0b e0 |..X*.N{t.&..Vr..| | c7 6c 5d 3c a1 1b e9 d7 1a 8d f8 d6 81 5a ab 56 |.l]<.........Z.V| Client Write IV[16]: | 92 57 c2 56 2e d6 72 13 47 fe 5a 5d 4c 36 28 2a |.W.V..r.G.Z]L6(*| Server Write IV[16]: | 45 70 60 56 93 b7 08 86 d3 42 64 8c d2 2b ad aa |Ep`V.....Bd..+..| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 1071 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 735, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803 record: offset = 803, reported_length_remaining = 331 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 808 length 313 bytes, remaining 1125 record: offset = 1125, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1130 length 0 bytes, remaining 1134 dissect_ssl enter frame #203 (first time) conversation = 0x7fca71dee310, ssl_session = 0x7fca45be4f20 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b... looking for RSA pre-master00809642d847c3b2d14fd5633cd5e3781e6875fd448033a8... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | af f5 8f 23 60 51 73 d7 b9 31 24 69 2a 27 9d ee |...#`Qs..1$i*'..| | b0 ad 9e 41 a7 97 c3 f4 a1 04 64 70 e1 37 99 e8 |...A......dp.7..| | ef 5c e6 b2 03 be 70 66 05 36 4f 23 4b cd 23 c0 |.\....pf.6O#K.#.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f0 48 ff 58 ca 7c 79 fe 2c 01 92 0a c6 9b b1 26 |.H.X.|y.,......&| | b9 51 58 90 1d 16 7d 7f ef 06 a5 28 da 52 34 c2 |.QX...}....(.R4.| | f0 d8 87 58 c9 e9 b8 c6 07 25 ce ea b9 15 98 71 |...X.....%.....q| | 5e 86 a9 fc 5b 2e a5 65 da 3b 56 12 6f |^...[..e.;V.o | hash out[136]: | 9b 82 cf 17 79 d8 ec 9a 12 6d 6d 13 83 df b6 55 |....y....mm....U| | b3 a3 45 25 3b ef ad c0 98 dc d4 a2 a4 a2 70 c1 |..E%;.........p.| | dc a7 f5 e8 d6 18 55 ba a2 bb c0 63 8a 08 7b fe |......U....c..{.| | a0 1c 8a 49 69 ea af 84 3e dd 20 c8 f5 78 fa a3 |...Ii...>. ..x..| | 08 1d 9f 63 5e 50 d0 7f 00 79 52 f7 16 93 92 cd |...c^P...yR.....| | 7e 6c bf ba 6c 21 a8 7b b2 11 1f 28 b2 f3 27 5d |~l..l!.{...(..']| | a8 1f 51 82 01 2e 61 1d 13 af 32 2a 55 68 64 02 |..Q...a...2*Uhd.| | 19 74 53 ad cd e5 09 58 10 1e a6 5b 13 5c 68 f1 |.tS....X...[.\h.| | 24 ce 48 cc df a7 da 62 |$.H....b | PRF out[136]: | 9b 82 cf 17 79 d8 ec 9a 12 6d 6d 13 83 df b6 55 |....y....mm....U| | b3 a3 45 25 3b ef ad c0 98 dc d4 a2 a4 a2 70 c1 |..E%;.........p.| | dc a7 f5 e8 d6 18 55 ba a2 bb c0 63 8a 08 7b fe |......U....c..{.| | a0 1c 8a 49 69 ea af 84 3e dd 20 c8 f5 78 fa a3 |...Ii...>. ..x..| | 08 1d 9f 63 5e 50 d0 7f 00 79 52 f7 16 93 92 cd |...c^P...yR.....| | 7e 6c bf ba 6c 21 a8 7b b2 11 1f 28 b2 f3 27 5d |~l..l!.{...(..']| | a8 1f 51 82 01 2e 61 1d 13 af 32 2a 55 68 64 02 |..Q...a...2*Uhd.| | 19 74 53 ad cd e5 09 58 10 1e a6 5b 13 5c 68 f1 |.tS....X...[.\h.| | 24 ce 48 cc df a7 da 62 |$.H....b | key expansion[136]: | 9b 82 cf 17 79 d8 ec 9a 12 6d 6d 13 83 df b6 55 |....y....mm....U| | b3 a3 45 25 3b ef ad c0 98 dc d4 a2 a4 a2 70 c1 |..E%;.........p.| | dc a7 f5 e8 d6 18 55 ba a2 bb c0 63 8a 08 7b fe |......U....c..{.| | a0 1c 8a 49 69 ea af 84 3e dd 20 c8 f5 78 fa a3 |...Ii...>. ..x..| | 08 1d 9f 63 5e 50 d0 7f 00 79 52 f7 16 93 92 cd |...c^P...yR.....| | 7e 6c bf ba 6c 21 a8 7b b2 11 1f 28 b2 f3 27 5d |~l..l!.{...(..']| | a8 1f 51 82 01 2e 61 1d 13 af 32 2a 55 68 64 02 |..Q...a...2*Uhd.| | 19 74 53 ad cd e5 09 58 10 1e a6 5b 13 5c 68 f1 |.tS....X...[.\h.| | 24 ce 48 cc df a7 da 62 |$.H....b | Client MAC key[20]: | 9b 82 cf 17 79 d8 ec 9a 12 6d 6d 13 83 df b6 55 |....y....mm....U| | b3 a3 45 25 |..E% | Server MAC key[20]: | 3b ef ad c0 98 dc d4 a2 a4 a2 70 c1 dc a7 f5 e8 |;.........p.....| | d6 18 55 ba |..U. | Client Write key[32]: | a2 bb c0 63 8a 08 7b fe a0 1c 8a 49 69 ea af 84 |...c..{....Ii...| | 3e dd 20 c8 f5 78 fa a3 08 1d 9f 63 5e 50 d0 7f |>. ..x.....c^P..| Server Write key[32]: | 00 79 52 f7 16 93 92 cd 7e 6c bf ba 6c 21 a8 7b |.yR.....~l..l!.{| | b2 11 1f 28 b2 f3 27 5d a8 1f 51 82 01 2e 61 1d |...(..']..Q...a.| Client Write IV[16]: | 13 af 32 2a 55 68 64 02 19 74 53 ad cd e5 09 58 |..2*Uhd..tS....X| Server Write IV[16]: | 10 1e a6 5b 13 5c 68 f1 24 ce 48 cc df a7 da 62 |...[.\h.$.H....b| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | af f5 8f 23 60 51 73 d7 b9 31 24 69 2a 27 9d ee |...#`Qs..1$i*'..| | b0 ad 9e 41 a7 97 c3 f4 a1 04 64 70 e1 37 99 e8 |...A......dp.7..| | ef 5c e6 b2 03 be 70 66 05 36 4f 23 4b cd 23 c0 |.\....pf.6O#K.#.| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | fb 86 82 ea df 4f 26 3a e6 70 78 5a 78 03 8f 7e |.....O&:.pxZx..~| | bf e3 b8 33 ad c8 71 2b aa bd 07 4e 0a b1 98 3f |...3..q+...N...?| | 62 fc d8 05 2b c7 2e d4 27 e3 49 e5 8b 91 9e 3c |b...+...'.I....<| | 3c 57 a6 38 d4 e1 7a 65 90 c0 8b 70 05 75 f7 98 |docum| | 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca| | 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.| | 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 25 75 3c ac |nl'%u<.| | 33 0d 12 b8 c8 e5 d3 c3 ac 59 18 d2 e9 58 10 65 |3........Y...X.e| | 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................| ssl_decrypt_record found padding 15 final len 384 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 86 7a fa 50 78 0a df fb d3 e2 f3 83 f2 3b a0 1b |.z.Px........;..| | a6 60 6f fc |.`o. | ssl_decrypt_record: mac failed association_find: TCP port 4452 found 0x37006d0 dissect_ssl enter frame #207 (first time) conversation = 0x7fca71dee310, ssl_session = 0x7fca45be4f20 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 5c e2 4d 5f 85 eb 33 12 25 0e f5 83 f5 08 97 fc |\.M_..3.%.......| | 07 62 fa 28 a3 e2 b0 48 bc 5d 28 a5 9a 24 18 86 |.b.(...H.](..$..| | e3 e5 09 ea b8 06 53 35 18 a4 16 44 96 65 a5 e4 |......S5...D.e..| Plaintext[48]: | 04 d5 a9 5b 71 cb 91 da 72 d0 9e 8a 11 3b b2 9e |...[q...r....;..| | 01 00 72 ef cf a9 5f 5b c6 53 b8 9d 77 10 2d f9 |..r..._[.S..w.-.| | 24 53 89 41 3f 89 09 09 09 09 09 09 09 09 09 09 |$S.A?...........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 72 ef cf a9 5f 5b c6 53 b8 9d 77 10 2d f9 24 53 |r..._[.S..w.-.$S| | 89 41 3f 89 |.A?. | ssl_decrypt_record: mac ok dissect_ssl enter frame #209 (first time) conversation = 0x7fca71dee310, ssl_session = 0x7fca45be4f20 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 15 13 0a 7f 3d cd d8 6e 93 4a 4d bf b2 de b1 7a |....=..n.JM....z| | 53 85 97 97 5b 93 2f 5c 55 1d e5 5b d1 bd c8 64 |S...[./\U..[...d| | bb 6d 39 c4 6a 85 6c fe ca 3d 1d d1 c0 5d 56 3c |.m9.j.l..=...]V<| Plaintext[48]: | 6a 27 bc 4d 0b 53 4e 4f 1a f1 d0 01 e0 6d dc 63 |j'.M.SNO.....m.c| | 01 00 4e 5d 6e 8c 50 7a 5c d1 80 0e 42 89 60 62 |..N]n.Pz\...B.`b| | ae 74 70 a2 cc b7 09 09 09 09 09 09 09 09 09 09 |.tp.............| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 4e 5d 6e 8c 50 7a 5c d1 80 0e 42 89 60 62 ae 74 |N]n.Pz\...B.`b.t| | 70 a2 cc b7 |p... | ssl_decrypt_record: mac ok dissect_ssl enter frame #214 (first time) ssl_session_init: initializing ptr 0x7fca45be7420 size 688 conversation = 0x7fca71dee5b8, ssl_session = 0x7fca45be7420 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 52902 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4453 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #216 (first time) conversation = 0x7fca71dee5b8, ssl_session = 0x7fca45be7420 record: offset = 0, reported_length_remaining = 1416 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0039 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | af f5 8f 23 60 51 73 d7 b9 31 24 69 2a 27 9d ee |...#`Qs..1$i*'..| | b0 ad 9e 41 a7 97 c3 f4 a1 04 64 70 e1 37 99 e8 |...A......dp.7..| | ef 5c e6 b2 03 be 70 66 05 36 4f 23 4b cd 23 c0 |.\....pf.6O#K.#.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f1 ab 05 91 79 95 d3 36 41 09 de 0e 9c 4f ba a5 |....y..6A....O..| | 7b a3 13 99 9b cb fd 62 30 b4 30 da da 52 34 c2 |{......b0.0..R4.| | f1 89 1a d7 f3 82 ca b1 4a 6f e1 b6 9e ff 5f 43 |........Jo...._C| | b8 61 23 bd 29 6b 35 35 33 01 b5 fe 0e |.a#.)k553.... | hash out[136]: | 36 d3 2e 84 40 cd b2 3c fd 94 70 6e 26 50 f0 43 |6...@..<..pn&P.C| | 5e ba 4f 9f 93 be 83 f9 89 16 f3 4c 8d 4d 34 d3 |^.O........L.M4.| | fd 73 d0 45 56 d2 63 b3 92 92 9e fb d1 fb e9 80 |.s.EV.c.........| | 9b 9d f8 d5 ba f6 81 75 c5 35 3d 2c 65 28 f9 63 |.......u.5=,e(.c| | 73 1b d5 fe f9 7b 44 58 c1 45 6c 13 63 51 43 96 |s....{DX.El.cQC.| | 87 67 0a cc a5 ea be 2f 10 0f e6 aa b1 6b 72 ed |.g...../.....kr.| | ff 69 bb 9f 7e 4a 9b 49 26 bb 82 e1 95 14 b2 49 |.i..~J.I&......I| | 67 27 8f 0e 1d d5 b6 4e 3e 1e 62 95 a1 ac b0 9d |g'.....N>.b.....| | 6e 4c 5a 08 88 4f 3e eb |nLZ..O>. | PRF out[136]: | 36 d3 2e 84 40 cd b2 3c fd 94 70 6e 26 50 f0 43 |6...@..<..pn&P.C| | 5e ba 4f 9f 93 be 83 f9 89 16 f3 4c 8d 4d 34 d3 |^.O........L.M4.| | fd 73 d0 45 56 d2 63 b3 92 92 9e fb d1 fb e9 80 |.s.EV.c.........| | 9b 9d f8 d5 ba f6 81 75 c5 35 3d 2c 65 28 f9 63 |.......u.5=,e(.c| | 73 1b d5 fe f9 7b 44 58 c1 45 6c 13 63 51 43 96 |s....{DX.El.cQC.| | 87 67 0a cc a5 ea be 2f 10 0f e6 aa b1 6b 72 ed |.g...../.....kr.| | ff 69 bb 9f 7e 4a 9b 49 26 bb 82 e1 95 14 b2 49 |.i..~J.I&......I| | 67 27 8f 0e 1d d5 b6 4e 3e 1e 62 95 a1 ac b0 9d |g'.....N>.b.....| | 6e 4c 5a 08 88 4f 3e eb |nLZ..O>. | key expansion[136]: | 36 d3 2e 84 40 cd b2 3c fd 94 70 6e 26 50 f0 43 |6...@..<..pn&P.C| | 5e ba 4f 9f 93 be 83 f9 89 16 f3 4c 8d 4d 34 d3 |^.O........L.M4.| | fd 73 d0 45 56 d2 63 b3 92 92 9e fb d1 fb e9 80 |.s.EV.c.........| | 9b 9d f8 d5 ba f6 81 75 c5 35 3d 2c 65 28 f9 63 |.......u.5=,e(.c| | 73 1b d5 fe f9 7b 44 58 c1 45 6c 13 63 51 43 96 |s....{DX.El.cQC.| | 87 67 0a cc a5 ea be 2f 10 0f e6 aa b1 6b 72 ed |.g...../.....kr.| | ff 69 bb 9f 7e 4a 9b 49 26 bb 82 e1 95 14 b2 49 |.i..~J.I&......I| | 67 27 8f 0e 1d d5 b6 4e 3e 1e 62 95 a1 ac b0 9d |g'.....N>.b.....| | 6e 4c 5a 08 88 4f 3e eb |nLZ..O>. | Client MAC key[20]: | 36 d3 2e 84 40 cd b2 3c fd 94 70 6e 26 50 f0 43 |6...@..<..pn&P.C| | 5e ba 4f 9f |^.O. | Server MAC key[20]: | 93 be 83 f9 89 16 f3 4c 8d 4d 34 d3 fd 73 d0 45 |.......L.M4..s.E| | 56 d2 63 b3 |V.c. | Client Write key[32]: | 92 92 9e fb d1 fb e9 80 9b 9d f8 d5 ba f6 81 75 |...............u| | c5 35 3d 2c 65 28 f9 63 73 1b d5 fe f9 7b 44 58 |.5=,e(.cs....{DX| Server Write key[32]: | c1 45 6c 13 63 51 43 96 87 67 0a cc a5 ea be 2f |.El.cQC..g...../| | 10 0f e6 aa b1 6b 72 ed ff 69 bb 9f 7e 4a 9b 49 |.....kr..i..~J.I| Client Write IV[16]: | 26 bb 82 e1 95 14 b2 49 67 27 8f 0e 1d d5 b6 4e |&......Ig'.....N| Server Write IV[16]: | 3e 1e 62 95 a1 ac b0 9d 6e 4c 5a 08 88 4f 3e eb |>.b.....nLZ..O>.| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 1353 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 541 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 527, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407 record: offset = 1407, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416 dissect_ssl enter frame #218 (first time) conversation = 0x7fca71dee5b8, ssl_session = 0x7fca45be7420 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd29... looking for RSA pre-master00802f670d44d9546728ec7ccce395c6f8531f36eaf1a564... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | d6 b0 54 28 1c 63 19 12 3a c6 9d ea a6 19 84 9c |..T(.c..:.......| | 6c 41 3e 7d 03 e8 13 c0 da 48 ae 4a dd 46 f5 f6 |lA>}.....H.J.F..| | 3a 58 2e 2b 16 87 b8 74 8b e2 82 9c e9 f9 28 5f |:X.+...t......(_| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f1 ab 05 91 79 95 d3 36 41 09 de 0e 9c 4f ba a5 |....y..6A....O..| | 7b a3 13 99 9b cb fd 62 30 b4 30 da da 52 34 c2 |{......b0.0..R4.| | f1 89 1a d7 f3 82 ca b1 4a 6f e1 b6 9e ff 5f 43 |........Jo...._C| | b8 61 23 bd 29 6b 35 35 33 01 b5 fe 0e |.a#.)k553.... | hash out[136]: | 39 c2 78 0b a8 23 39 ca 75 6d d3 0b c2 3d 63 2f |9.x..#9.um...=c/| | 33 52 ab c7 c4 df 69 09 b1 8d 52 80 1c 3f 74 7c |3R....i...R..?t|| | d9 34 54 c9 e3 58 f2 14 56 11 71 1a f2 e9 b8 4f |.4T..X..V.q....O| | 75 6f ac 73 45 f5 b8 f6 5b 3a ec dc 7c 72 b9 32 |uo.sE...[:..|r.2| | 39 04 de f0 8a 20 a7 8a 82 84 80 e6 fb 56 34 04 |9.... .......V4.| | 34 e5 2c 7f 2f ca ae 11 cf ef 42 b3 c7 01 20 cf |4.,./.....B... .| | c0 84 f3 92 56 60 82 a2 57 b2 47 af fb 92 93 f1 |....V`..W.G.....| | 40 f3 73 f3 bb e3 55 fd 07 f0 29 4f 77 50 53 50 |@.s...U...)OwPSP| | 6d 81 21 f5 14 c7 cf c9 |m.!..... | PRF out[136]: | 39 c2 78 0b a8 23 39 ca 75 6d d3 0b c2 3d 63 2f |9.x..#9.um...=c/| | 33 52 ab c7 c4 df 69 09 b1 8d 52 80 1c 3f 74 7c |3R....i...R..?t|| | d9 34 54 c9 e3 58 f2 14 56 11 71 1a f2 e9 b8 4f |.4T..X..V.q....O| | 75 6f ac 73 45 f5 b8 f6 5b 3a ec dc 7c 72 b9 32 |uo.sE...[:..|r.2| | 39 04 de f0 8a 20 a7 8a 82 84 80 e6 fb 56 34 04 |9.... .......V4.| | 34 e5 2c 7f 2f ca ae 11 cf ef 42 b3 c7 01 20 cf |4.,./.....B... .| | c0 84 f3 92 56 60 82 a2 57 b2 47 af fb 92 93 f1 |....V`..W.G.....| | 40 f3 73 f3 bb e3 55 fd 07 f0 29 4f 77 50 53 50 |@.s...U...)OwPSP| | 6d 81 21 f5 14 c7 cf c9 |m.!..... | key expansion[136]: | 39 c2 78 0b a8 23 39 ca 75 6d d3 0b c2 3d 63 2f |9.x..#9.um...=c/| | 33 52 ab c7 c4 df 69 09 b1 8d 52 80 1c 3f 74 7c |3R....i...R..?t|| | d9 34 54 c9 e3 58 f2 14 56 11 71 1a f2 e9 b8 4f |.4T..X..V.q....O| | 75 6f ac 73 45 f5 b8 f6 5b 3a ec dc 7c 72 b9 32 |uo.sE...[:..|r.2| | 39 04 de f0 8a 20 a7 8a 82 84 80 e6 fb 56 34 04 |9.... .......V4.| | 34 e5 2c 7f 2f ca ae 11 cf ef 42 b3 c7 01 20 cf |4.,./.....B... .| | c0 84 f3 92 56 60 82 a2 57 b2 47 af fb 92 93 f1 |....V`..W.G.....| | 40 f3 73 f3 bb e3 55 fd 07 f0 29 4f 77 50 53 50 |@.s...U...)OwPSP| | 6d 81 21 f5 14 c7 cf c9 |m.!..... | Client MAC key[20]: | 39 c2 78 0b a8 23 39 ca 75 6d d3 0b c2 3d 63 2f |9.x..#9.um...=c/| | 33 52 ab c7 |3R.. | Server MAC key[20]: | c4 df 69 09 b1 8d 52 80 1c 3f 74 7c d9 34 54 c9 |..i...R..?t|.4T.| | e3 58 f2 14 |.X.. | Client Write key[32]: | 56 11 71 1a f2 e9 b8 4f 75 6f ac 73 45 f5 b8 f6 |V.q....Ouo.sE...| | 5b 3a ec dc 7c 72 b9 32 39 04 de f0 8a 20 a7 8a |[:..|r.29.... ..| Server Write key[32]: | 82 84 80 e6 fb 56 34 04 34 e5 2c 7f 2f ca ae 11 |.....V4.4.,./...| | cf ef 42 b3 c7 01 20 cf c0 84 f3 92 56 60 82 a2 |..B... .....V`..| Client Write IV[16]: | 57 b2 47 af fb 92 93 f1 40 f3 73 f3 bb e3 55 fd |W.G.....@.s...U.| Server Write IV[16]: | 07 f0 29 4f 77 50 53 50 6d 81 21 f5 14 c7 cf c9 |..)OwPSPm.!.....| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | d6 b0 54 28 1c 63 19 12 3a c6 9d ea a6 19 84 9c |..T(.c..:.......| | 6c 41 3e 7d 03 e8 13 c0 da 48 ae 4a dd 46 f5 f6 |lA>}.....H.J.F..| | 3a 58 2e 2b 16 87 b8 74 8b e2 82 9c e9 f9 28 5f |:X.+...t......(_| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 33 76 1c 9f 54 ed c6 46 30 05 fd f5 61 7e 8a ec |3v..T..F0...a~..| | c1 07 05 96 f8 62 aa ab 2c 8c 82 6e 4b 1b fa 81 |.....b..,..nK...| | 6e 21 52 79 a3 19 7c 55 ed 39 a1 5d 99 2c 9e a3 |n!Ry..|U.9.].,..| | 1b f9 5c 0e a5 95 aa 99 e9 7c 0b 97 fa 7e 6e a7 |..\......|...~n.| Plaintext[64]: | a0 00 69 d7 cf 98 0d a7 63 cf 75 91 89 12 bd e3 |..i.....c.u.....| | 14 00 00 0c ef 6f 7c 34 b9 aa ce 7a 43 83 e1 93 |.....o|4...zC...| | ff bd 4d 23 a4 c9 0b 2b 85 4b c6 5f 61 ef 07 3a |..M#...+.K._a..:| | 2e d6 5f 37 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.._7............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | ff bd 4d 23 a4 c9 0b 2b 85 4b c6 5f 61 ef 07 3a |..M#...+.K._a..:| | 2e d6 5f 37 |.._7 | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #219 (first time) conversation = 0x7fca71dee5b8, ssl_session = 0x7fca45be7420 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | a3 e4 69 91 f0 2a fe 4c 8a 92 22 06 ba 92 64 2e |..i..*.L.."...d.| | d4 e5 4b 94 af 0b bd bc c7 41 cb 79 bb 50 8d 10 |..K......A.y.P..| | 5a 12 ed 1f 06 42 e3 40 16 21 4c 27 0e bd 01 3a |Z....B.@.!L'...:| | dd 77 da e9 c0 b6 bd 32 8a 86 7e 5d b8 a5 26 49 |.w.....2..~]..&I| Plaintext[64]: | 2b 50 de 96 ba d2 a8 d6 92 d3 ce df f4 38 14 0e |+P...........8..| | 14 00 00 0c 7a 7e 50 96 14 70 c4 c5 b0 cf 39 bd |....z~P..p....9.| | b0 c8 0e 95 47 fd 0c 18 96 cd 02 f7 97 90 13 0c |....G...........| | 04 bd 98 43 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |...C............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | b0 c8 0e 95 47 fd 0c 18 96 cd 02 f7 97 90 13 0c |....G...........| | 04 bd 98 43 |...C | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #220 (first time) conversation = 0x7fca71dee5b8, ssl_session = 0x7fca45be7420 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | 95 b6 63 f7 01 ca f8 3d 4a e1 8e 11 48 12 9d 16 |..c....=J...H...| | 24 d4 a5 bb 81 e7 2a 04 ac 3a 2b 33 74 e1 ff 36 |$.....*..:+3t..6| | 7b 9b 94 8a b3 f8 67 9e 2e e2 e6 99 5b d7 15 3c |{.....g.....[..<| | 90 03 a8 10 79 07 0f a6 cc 94 37 9d af ea 02 55 |....y.....7....U| | 91 b6 dd a8 2a 42 c1 fd 4c 0f 0a 8c 3c 0e a4 82 |....*B..L...<...| | 8d 09 47 95 60 2b 09 96 6c 30 06 5d bf ba 9e b1 |..G.`+..l0.]....| | 22 52 7f 26 8a 5f 91 91 3c 2b f8 1f 27 88 af 44 |"R.&._..<+..'..D| Plaintext[112]: | 3c 74 52 56 78 89 9a a1 bc 23 d2 5b d2 0b fa c5 |.#.| | a1 16 83 d3 a3 16 a1 04 db 9b ac d7 e3 e0 e8 3a |...............:| | 0e 81 eb 30 7b 1e 52 63 94 e5 c0 33 57 46 49 35 |...0{.Rc...3WFI5| | 3b d5 a7 c1 38 5b 0f ae e4 e5 a8 ed 52 8c c1 01 |;...8[......R...| | b2 2e 46 d2 f2 8b 3c 2d 77 25 5e 3c f9 bd fe 93 |..F...<-w%^<....| | 85 0f 18 08 09 74 c3 67 2d 83 77 e2 6c 65 d3 3f |.....t.g-.w.le.?| | dc 2b b2 4e 10 7d b5 3b dd 2e 27 b1 b1 0c c9 a2 |.+.N.}.;..'.....| | d6 b0 73 9e b5 c6 a6 d8 0e 5a 5f c2 75 1b e8 7f |..s......Z_.u...| | 12 5e 64 12 e7 4e 49 50 e6 11 ee 29 58 5a 88 64 |.^d..NIP...)XZ.d| Plaintext[400]: | 37 13 02 57 db df 7c fb d0 f8 4a fb fc 75 4a d3 |7..W..|...J..uJ.| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:| | 31 31 3a 32 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:29 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 33 39 20 2d 20 44 48 45 2d 52 |x00,0x39 - DHE-R| | 53 41 2d 41 45 53 32 35 36 2d 53 48 41 20 20 20 |SA-AES256-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1....| | f3 63 3c 01 a9 a5 df 74 fb 01 82 43 fc 18 2c a8 |.c<....t...C..,.| | 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................| ssl_decrypt_record found padding 15 final len 384 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | cb 87 cd ec 7c c0 af b9 50 6c 19 03 aa 61 23 a5 |....|...Pl...a#.| | bb d5 7d 13 |..}. | ssl_decrypt_record: mac failed association_find: TCP port 4453 found 0x27eec50 dissect_ssl enter frame #222 (first time) conversation = 0x7fca71dee5b8, ssl_session = 0x7fca45be7420 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 55 7d 22 af 8f a7 fc b2 ad 2a bc 1f 60 92 51 3e |U}"......*..`.Q>| | 43 a6 d0 e5 42 4c 40 d6 ae ab b5 53 bb 0d d0 92 |C...BL@....S....| | 25 6e f7 ec 5f fd f0 55 b1 c4 75 16 f1 86 a3 4a |%n.._..U..u....J| Plaintext[48]: | 40 e4 bf 34 94 24 10 8d e5 d0 9b c5 9a 14 85 28 |@..4.$.........(| | 01 00 07 09 c1 b1 a5 a6 54 41 8d ee 75 e0 4e 79 |........TA..u.Ny| | 57 c9 dc e9 e0 77 09 09 09 09 09 09 09 09 09 09 |W....w..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 07 09 c1 b1 a5 a6 54 41 8d ee 75 e0 4e 79 57 c9 |......TA..u.NyW.| | dc e9 e0 77 |...w | ssl_decrypt_record: mac ok dissect_ssl enter frame #224 (first time) conversation = 0x7fca71dee5b8, ssl_session = 0x7fca45be7420 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 95 8b fa 12 0a b2 30 82 17 41 7c 1e 58 5e e6 9c |......0..A|.X^..| | 2a 18 31 91 41 f0 c1 21 a1 1f b2 b7 d6 f9 6a a4 |*.1.A..!......j.| | eb 0e 27 af d1 96 68 d4 f4 06 d8 c5 5d e2 a3 45 |..'...h.....]..E| Plaintext[48]: | d5 62 4f ee 8d 44 90 f8 c8 bb b0 e4 bc 0e a3 09 |.bO..D..........| | 01 00 74 9e a0 4a cf 56 6e 6d f9 67 d8 da 4d 75 |..t..J.Vnm.g..Mu| | 61 c8 a2 ec 0b 1f 09 09 09 09 09 09 09 09 09 09 |a...............| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 74 9e a0 4a cf 56 6e 6d f9 67 d8 da 4d 75 61 c8 |t..J.Vnm.g..Mua.| | a2 ec 0b 1f |.... | ssl_decrypt_record: mac ok dissect_ssl enter frame #229 (first time) ssl_session_init: initializing ptr 0x7fca45be9960 size 688 conversation = 0x7fca71dee860, ssl_session = 0x7fca45be9960 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 50418 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4457 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #231 (first time) conversation = 0x7fca71dee860, ssl_session = 0x7fca45be9960 record: offset = 0, reported_length_remaining = 884 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0041 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | d6 b0 54 28 1c 63 19 12 3a c6 9d ea a6 19 84 9c |..T(.c..:.......| | 6c 41 3e 7d 03 e8 13 c0 da 48 ae 4a dd 46 f5 f6 |lA>}.....H.J.F..| | 3a 58 2e 2b 16 87 b8 74 8b e2 82 9c e9 f9 28 5f |:X.+...t......(_| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f1 92 61 7e a8 7f ca 24 7d 17 34 2b 23 ad 77 d8 |..a~...$}.4+#.w.| | 9c 3c 66 7b 26 aa 7b 15 ab 59 99 64 d4 52 34 c2 |.Q... .E.=......| | 14 06 67 03 60 fb d1 dc 5c b4 60 97 cf 1f 66 e6 |..g.`...\.`...f.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f1 92 61 7e a8 7f ca 24 7d 17 34 2b 23 ad 77 d8 |..a~...$}.4+#.w.| | 9c 3c 66 7b 26 aa 7b 15 ab 59 99 64 d4 52 34 c2 |.Q... .E.=......| | 14 06 67 03 60 fb d1 dc 5c b4 60 97 cf 1f 66 e6 |..g.`...\.`...f.| dissect_ssl3_handshake session keys successfully generated record: offset = 267, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 273, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 4c 52 62 cc f5 43 03 9b 63 64 91 ee 29 a7 2e 9d |LRb..C..cd..)...| | 8f 9c 44 0e 3d 88 02 6b 8d c5 4c 0f 73 55 3f 86 |..D.=..k..L.sU?.| | 55 c2 d4 7b 91 7d 4f 81 8f 54 ed 83 8a c3 bb 5a |U..{.}O..T.....Z| | 08 25 de 3a 45 74 1b 81 5b 42 71 59 8b 87 c9 e0 |.%.:Et..[BqY....| Plaintext[64]: | 47 e1 f7 1f f2 f2 8c 7a a7 ee fd 91 ce f3 16 25 |G......z.......%| | 14 00 00 0c f7 73 9c d2 47 e7 0b e5 99 a5 36 20 |.....s..G.....6 | | 01 e0 1b 9e a6 f0 4a d9 48 6f ce fe 98 68 86 a9 |......J.Ho...h..| | 9d 3e 0f ff 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.>..............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 01 e0 1b 9e a6 f0 4a d9 48 6f ce fe 98 68 86 a9 |......J.Ho...h..| | 9d 3e 0f ff |.>.. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #234 (first time) conversation = 0x7fca71dee860, ssl_session = 0x7fca45be9960 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 21 84 91 76 36 39 e8 f5 58 29 24 a4 78 7b 7d ae |!..v69..X)$.x{}.| | be b6 62 28 c5 e0 07 2b c2 75 b4 c9 18 84 af b1 |..b(...+.u......| | 93 43 4c 26 b8 72 5f fb 0f f2 52 15 fd b5 b9 a0 |.CL&.r_...R.....| | f4 54 e8 dd 01 b8 83 43 a2 b4 43 bf 52 08 c4 2b |.T.....C..C.R..+| Plaintext[64]: | 4c ba 74 4b 8b a3 e5 d0 3c b5 ed fa 54 e3 d1 d7 |L.tK....<...T...| | 14 00 00 0c 12 fe f4 ad c6 d7 6e 99 9c bb 85 5b |..........n....[| | 0f 15 1c 3c 37 4e b8 f0 c7 f4 86 6b 7e 49 f2 75 |...<7N.....k~I.u| | 48 07 c0 59 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |H..Y............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 0f 15 1c 3c 37 4e b8 f0 c7 f4 86 6b 7e 49 f2 75 |...<7N.....k~I.u| | 48 07 c0 59 |H..Y | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #235 (first time) conversation = 0x7fca71dee860, ssl_session = 0x7fca45be9960 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | b3 af ce 00 71 67 a3 2e 0c a4 c3 34 c5 fe 5a 24 |....qg.....4..Z$| | bb a0 76 0e 1d 44 28 d1 7a 05 27 1d 30 df 87 5e |..v..D(.z.'.0..^| | 0f 70 fe db f3 9a b1 82 98 e6 c6 34 f9 81 4a 69 |.p.........4..Ji| | 57 f9 b1 22 e8 b8 da 80 e0 a8 86 e5 b7 89 86 4a |W.."...........J| | ce 0b ea 26 51 74 80 77 a9 a0 b1 ee 30 8e 52 42 |...&Qt.w....0.RB| | c2 2a 19 f5 1d 57 6c 87 da 18 00 49 3e e4 13 b5 |.*...Wl....I>...| | c1 c9 53 24 9c 61 f3 a7 8e e9 7b b4 14 3a 86 4f |..S$.a....{..:.O| Plaintext[112]: | 5e 15 3b 1b 0e ae cb 39 29 46 d4 af 1f a5 5d 13 |^.;....9)F....].| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 63 61 6d 65 6c 6c 69 61 31 32 |Host: camellia12| | 38 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c |8-sha.local.al.l| | 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 35 |ekensteyn.nl:445| | 37 0d 0a 0d 0a 1d b9 f8 3c b2 25 8b f3 f1 e1 09 |7.......<.%.....| | 50 45 72 fa 30 0e 8e 67 23 06 06 06 06 06 06 06 |PEr.0..g#.......| ssl_decrypt_record found padding 6 final len 105 checking mac (len 69, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 93 72 a1 b8 94 41 e3 ad 22 f5 23 98 d2 0d 6d c0 |.r...A..".#...m.| | 50 c5 12 cf |P... | ssl_decrypt_record: mac failed association_find: TCP port 50418 found (nil) association_find: TCP port 4457 found 0x3734c50 dissect_ssl enter frame #236 (first time) conversation = 0x7fca71dee860, ssl_session = 0x7fca45be9960 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | 91 7d b3 4a d4 1c a5 3c 34 86 de 58 55 32 85 b1 |.}.J...<4..XU2..| | b3 b6 a5 f3 06 24 fe 56 93 2b 3c df 74 9a aa ef |.....$.V.+<.t...| | 03 b2 57 e8 f2 59 c8 de 27 13 8f c5 d6 2f 48 1d |..W..Y..'..../H.| | ce 86 a2 79 c2 7d 06 40 42 d9 4b a1 7e 2c 26 9d |...y.}.@B.K.~,&.| | cd a8 1e 44 2b a7 be cf 15 71 95 bb e6 c5 52 5d |...D+....q....R]| | 9b 9a 97 fa fd 4f cd 03 ac ba bd fe db c8 82 70 |.....O.........p| | df 0a 67 34 05 8c 3d 0e 05 de e7 b7 43 6f 87 d4 |..g4..=.....Co..| | 07 cc c8 b6 d2 4f 7c ba 51 b7 da d1 0c 66 10 f7 |.....O|.Q....f..| | 70 ea 6d db bf f5 78 47 9b 9b e5 67 20 01 2f 08 |p.m...xG...g ./.| | 6e 6b 86 ef 7d d8 15 76 c0 14 18 f1 f0 da 1f 00 |nk..}..v........| | 1f 44 62 21 ba a5 a5 c5 6b fb df 4c 89 f4 e3 89 |.Db!....k..L....| | 75 74 04 d6 8a 62 72 0a 06 03 97 c3 0c 6b e6 f7 |ut...br......k..| | b5 fb 0e d0 cf 9f c9 a2 89 29 7d f2 5d b7 30 f7 |.........)}.].0.| | e3 ee 05 3d 5d c7 a9 44 1e 59 bf 64 27 95 10 fb |...=]..D.Y.d'...| | ce e3 e4 1f df a5 84 7e c0 93 80 95 08 51 e5 9f |.......~.....Q..| | 4e fe af 9f 8a a2 3a 7a 97 3e 40 82 fc 49 d5 1d |N.....:z.>@..I..| | 07 3f f9 bc c0 dc a3 19 05 33 c3 4f 96 dc 9f 53 |.?.......3.O...S| | f8 44 fc 68 35 aa 2e f5 4a 1c 70 66 51 40 57 85 |.D.h5...J.pfQ@W.| | 2a 6b 7f 70 db ec 8a de b2 f7 a8 4f 76 d0 27 ec |*k.p.......Ov.'.| | ce 1b 1b 45 ac 30 5c 21 93 47 db bc 2f 11 20 ae |...E.0\!.G../. .| | 20 d2 35 6c df 3f 86 b2 0f 35 76 19 b7 5c f0 e3 | .5l.?...5v..\..| | 25 78 1c 08 18 ac d1 b4 01 3c 9f f6 0b f6 dc 42 |%x.......<.....B| | 61 0b 9b 1c f4 32 73 3d 5c 32 05 fb 76 45 b4 0a |a....2s=\2..vE..| | ed ad 6a 5d e4 c2 24 e1 d4 55 f2 32 af 5e aa 18 |..j]..$..U.2.^..| | 1c 5e 7e 5e 04 31 13 7b ec 80 8e 2b 17 30 70 40 |.^~^.1.{...+.0p@| Plaintext[400]: | f6 84 48 3c b6 d0 a7 9c d9 53 2a 5f 11 5b b0 26 |..H<.....S*_.[.&| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:| | 31 31 3a 32 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:29 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 34 31 20 2d 20 43 41 4d 45 4c |x00,0x41 - CAMEL| | 4c 49 41 31 32 38 2d 53 48 41 20 20 20 20 20 20 |LIA128-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 43 61 6d 65 6c 6c 69 61 28 31 32 38 29 20 4d |=Camellia(128) M| | 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1| | c7 d8 31 39 a7 3e 12 d8 32 94 ff 04 fa a7 b7 be |..19.>..2.......| | 17 c4 d5 1c 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................| ssl_decrypt_record found padding 11 final len 388 checking mac (len 352, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | e7 62 c6 c4 da 66 91 8e 90 cc f7 12 f2 be 15 0f |.b...f..........| | 72 8e ab 42 |r..B | ssl_decrypt_record: mac failed association_find: TCP port 4457 found 0x3734c50 dissect_ssl enter frame #237 (first time) conversation = 0x7fca71dee860, ssl_session = 0x7fca45be9960 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 38 12 e6 31 8a 8e a3 93 84 af 5e 48 8c ac fe ca |8..1......^H....| | ae 52 4f 40 c5 6c 5d bc f3 42 ae 1e e3 3a f3 eb |.RO@.l]..B...:..| | 9d 8d 96 7c 74 07 b8 ab d6 4a b6 10 04 1c 83 47 |...|t....J.....G| Plaintext[48]: | 7e e4 86 0a 30 a5 05 09 1b d7 3b f2 50 7c a3 14 |~...0.....;.P|..| | 01 00 9c e5 7c 9e 4a 68 88 d7 60 9f e9 bb f2 b2 |....|.Jh..`.....| | 1e 90 bd ee dd d2 09 09 09 09 09 09 09 09 09 09 |................| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 9c e5 7c 9e 4a 68 88 d7 60 9f e9 bb f2 b2 1e 90 |..|.Jh..`.......| | bd ee dd d2 |.... | ssl_decrypt_record: mac ok dissect_ssl enter frame #239 (first time) conversation = 0x7fca71dee860, ssl_session = 0x7fca45be9960 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 35 0a 96 e3 90 69 29 d2 19 dc fd 0f 4b f1 de 23 |5....i).....K..#| | ca c4 fb 34 07 3d ca cb 37 89 d5 3b b4 46 61 9d |...4.=..7..;.Fa.| | c2 b1 df 0b 08 76 20 3b 96 d0 f9 63 6e 33 75 65 |.....v ;...cn3ue| Plaintext[48]: | eb 38 8c 26 0c 48 fe 13 51 a0 23 59 39 69 b4 35 |.8.&.H..Q.#Y9i.5| | 01 00 33 dd ce 87 23 35 f9 1e f4 e0 d1 21 dc 6b |..3...#5.....!.k| | af 63 dc 34 cd 99 09 09 09 09 09 09 09 09 09 09 |.c.4............| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 33 dd ce 87 23 35 f9 1e f4 e0 d1 21 dc 6b af 63 |3...#5.....!.k.c| | dc 34 cd 99 |.4.. | ssl_decrypt_record: mac ok dissect_ssl enter frame #244 (first time) ssl_session_init: initializing ptr 0x7fca45bebee0 size 688 conversation = 0x7fca71deeb08, ssl_session = 0x7fca45bebee0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 44831 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4458 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #246 (first time) conversation = 0x7fca71deeb08, ssl_session = 0x7fca45bebee0 record: offset = 0, reported_length_remaining = 1135 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0044 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | e1 1c 3c fc 6f 8b a7 fe 2d f3 ad 7f 47 b8 e0 db |..<.o...-...G...| | 3e 51 a8 9a eb 20 8c 45 c0 3d ce e3 b7 9d c8 dc |>Q... .E.=......| | 14 06 67 03 60 fb d1 dc 5c b4 60 97 cf 1f 66 e6 |..g.`...\.`...f.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f1 4d 90 9b 21 34 3d 9c ab 54 85 19 3f a1 67 bd |.M..!4=..T..?.g.| | 3a f8 05 12 cc 1b ac 16 6f db ea 96 84 52 34 c2 |:.......o....R4.| | f1 86 8c db ab aa 51 7f 0b 47 0c 34 81 34 05 e8 |......Q..G.4.4..| | 92 08 38 77 ef 52 1a 6d 1f 6b f2 01 8c |..8w.R.m.k... | hash out[104]: | 1c ed 7f 25 5f cb 21 dd f9 f9 96 72 b1 90 c9 d6 |...%_.!....r....| | ad 72 80 84 af 6c 7c 76 b4 6d da d3 46 8c c1 3c |.r...l|v.m..F..<| | bd d2 84 2a f4 c7 0e 00 d7 72 fc 3b 26 6e 79 56 |...*.....r.;&nyV| | 95 2e 57 b1 74 6c 83 9a 68 c7 d1 da 89 0c 59 54 |..W.tl..h.....YT| | 66 95 36 ce b8 5a f0 e1 24 36 be 0a b4 56 af e4 |f.6..Z..$6...V..| | d5 f8 c4 03 1c d9 fb b1 a5 62 45 17 02 d4 28 d1 |.........bE...(.| | 9a 60 fe 15 19 8b 60 ae |.`....`. | PRF out[104]: | 1c ed 7f 25 5f cb 21 dd f9 f9 96 72 b1 90 c9 d6 |...%_.!....r....| | ad 72 80 84 af 6c 7c 76 b4 6d da d3 46 8c c1 3c |.r...l|v.m..F..<| | bd d2 84 2a f4 c7 0e 00 d7 72 fc 3b 26 6e 79 56 |...*.....r.;&nyV| | 95 2e 57 b1 74 6c 83 9a 68 c7 d1 da 89 0c 59 54 |..W.tl..h.....YT| | 66 95 36 ce b8 5a f0 e1 24 36 be 0a b4 56 af e4 |f.6..Z..$6...V..| | d5 f8 c4 03 1c d9 fb b1 a5 62 45 17 02 d4 28 d1 |.........bE...(.| | 9a 60 fe 15 19 8b 60 ae |.`....`. | key expansion[104]: | 1c ed 7f 25 5f cb 21 dd f9 f9 96 72 b1 90 c9 d6 |...%_.!....r....| | ad 72 80 84 af 6c 7c 76 b4 6d da d3 46 8c c1 3c |.r...l|v.m..F..<| | bd d2 84 2a f4 c7 0e 00 d7 72 fc 3b 26 6e 79 56 |...*.....r.;&nyV| | 95 2e 57 b1 74 6c 83 9a 68 c7 d1 da 89 0c 59 54 |..W.tl..h.....YT| | 66 95 36 ce b8 5a f0 e1 24 36 be 0a b4 56 af e4 |f.6..Z..$6...V..| | d5 f8 c4 03 1c d9 fb b1 a5 62 45 17 02 d4 28 d1 |.........bE...(.| | 9a 60 fe 15 19 8b 60 ae |.`....`. | Client MAC key[20]: | 1c ed 7f 25 5f cb 21 dd f9 f9 96 72 b1 90 c9 d6 |...%_.!....r....| | ad 72 80 84 |.r.. | Server MAC key[20]: | af 6c 7c 76 b4 6d da d3 46 8c c1 3c bd d2 84 2a |.l|v.m..F..<...*| | f4 c7 0e 00 |.... | Client Write key[16]: | d7 72 fc 3b 26 6e 79 56 95 2e 57 b1 74 6c 83 9a |.r.;&nyV..W.tl..| Server Write key[16]: | 68 c7 d1 da 89 0c 59 54 66 95 36 ce b8 5a f0 e1 |h.....YTf.6..Z..| Client Write IV[16]: | 24 36 be 0a b4 56 af e4 d5 f8 c4 03 1c d9 fb b1 |$6...V..........| Server Write IV[16]: | a5 62 45 17 02 d4 28 d1 9a 60 fe 15 19 8b 60 ae |.bE...(..`....`.| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: CAMELLIA128 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: CAMELLIA128 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 1072 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 735, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803 record: offset = 803, reported_length_remaining = 332 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 318, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 808 length 314 bytes, remaining 1126 record: offset = 1126, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1131 length 0 bytes, remaining 1135 dissect_ssl enter frame #248 (first time) conversation = 0x7fca71deeb08, ssl_session = 0x7fca45bebee0 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef... looking for RSA pre-master0080017403ec9beab40874d420b636c528a422d3f5a04f90... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | bf b3 a6 e2 2a 71 ee 4a 90 54 a4 55 87 d9 a1 f9 |....*q.J.T.U....| | 9b 7c 7c 10 7b f0 49 1e 55 1c 67 6d c3 d4 6b a1 |.||.{.I.U.gm..k.| | ac 86 b4 de 39 47 58 4c ad 09 d1 5f b2 4f bb 91 |....9GXL..._.O..| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f1 4d 90 9b 21 34 3d 9c ab 54 85 19 3f a1 67 bd |.M..!4=..T..?.g.| | 3a f8 05 12 cc 1b ac 16 6f db ea 96 84 52 34 c2 |:.......o....R4.| | f1 86 8c db ab aa 51 7f 0b 47 0c 34 81 34 05 e8 |......Q..G.4.4..| | 92 08 38 77 ef 52 1a 6d 1f 6b f2 01 8c |..8w.R.m.k... | hash out[104]: | 1c 36 64 11 71 0c 77 0b 2c 6c e0 47 69 ba 9e 0b |.6d.q.w.,l.Gi...| | 96 28 6d 6f 96 c6 29 f6 03 bd 7a 09 81 b0 87 bc |.(mo..)...z.....| | 35 f1 84 83 d7 bd 3e 95 02 c7 a8 2e c8 8c d8 4c |5.....>........L| | 96 76 ed 03 ae 66 11 66 3d 30 31 dc 10 08 ec 72 |.v...f.f=01....r| | 0c 7a 8c ea dc 03 d1 bc a2 47 f7 dc b6 5c 61 3a |.z.......G...\a:| | 52 6e b9 55 f0 f9 0d 95 1f 98 e6 a4 b5 7a 1b 00 |Rn.U.........z..| | ff 9a 24 3d 66 b8 8e 3c |..$=f..< | PRF out[104]: | 1c 36 64 11 71 0c 77 0b 2c 6c e0 47 69 ba 9e 0b |.6d.q.w.,l.Gi...| | 96 28 6d 6f 96 c6 29 f6 03 bd 7a 09 81 b0 87 bc |.(mo..)...z.....| | 35 f1 84 83 d7 bd 3e 95 02 c7 a8 2e c8 8c d8 4c |5.....>........L| | 96 76 ed 03 ae 66 11 66 3d 30 31 dc 10 08 ec 72 |.v...f.f=01....r| | 0c 7a 8c ea dc 03 d1 bc a2 47 f7 dc b6 5c 61 3a |.z.......G...\a:| | 52 6e b9 55 f0 f9 0d 95 1f 98 e6 a4 b5 7a 1b 00 |Rn.U.........z..| | ff 9a 24 3d 66 b8 8e 3c |..$=f..< | key expansion[104]: | 1c 36 64 11 71 0c 77 0b 2c 6c e0 47 69 ba 9e 0b |.6d.q.w.,l.Gi...| | 96 28 6d 6f 96 c6 29 f6 03 bd 7a 09 81 b0 87 bc |.(mo..)...z.....| | 35 f1 84 83 d7 bd 3e 95 02 c7 a8 2e c8 8c d8 4c |5.....>........L| | 96 76 ed 03 ae 66 11 66 3d 30 31 dc 10 08 ec 72 |.v...f.f=01....r| | 0c 7a 8c ea dc 03 d1 bc a2 47 f7 dc b6 5c 61 3a |.z.......G...\a:| | 52 6e b9 55 f0 f9 0d 95 1f 98 e6 a4 b5 7a 1b 00 |Rn.U.........z..| | ff 9a 24 3d 66 b8 8e 3c |..$=f..< | Client MAC key[20]: | 1c 36 64 11 71 0c 77 0b 2c 6c e0 47 69 ba 9e 0b |.6d.q.w.,l.Gi...| | 96 28 6d 6f |.(mo | Server MAC key[20]: | 96 c6 29 f6 03 bd 7a 09 81 b0 87 bc 35 f1 84 83 |..)...z.....5...| | d7 bd 3e 95 |..>. | Client Write key[16]: | 02 c7 a8 2e c8 8c d8 4c 96 76 ed 03 ae 66 11 66 |.......L.v...f.f| Server Write key[16]: | 3d 30 31 dc 10 08 ec 72 0c 7a 8c ea dc 03 d1 bc |=01....r.z......| Client Write IV[16]: | a2 47 f7 dc b6 5c 61 3a 52 6e b9 55 f0 f9 0d 95 |.G...\a:Rn.U....| Server Write IV[16]: | 1f 98 e6 a4 b5 7a 1b 00 ff 9a 24 3d 66 b8 8e 3c |.....z....$=f..<| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: CAMELLIA128 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: CAMELLIA128 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | bf b3 a6 e2 2a 71 ee 4a 90 54 a4 55 87 d9 a1 f9 |....*q.J.T.U....| | 9b 7c 7c 10 7b f0 49 1e 55 1c 67 6d c3 d4 6b a1 |.||.{.I.U.gm..k.| | ac 86 b4 de 39 47 58 4c ad 09 d1 5f b2 4f bb 91 |....9GXL..._.O..| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | dc d3 ed 83 82 a6 c9 e9 ad 4f 65 a6 00 d3 09 f6 |.........Oe.....| | 8f 51 8a d6 eb 33 3a fd 21 99 ab 6d 67 3d 5e 1b |.Q...3:.!..mg=^.| | c7 63 f4 d7 eb ff 82 86 f4 b9 5b 31 d0 20 bf bf |.c........[1. ..| | da a0 4f 65 5f 3b 89 e7 0c 41 2f 42 eb 10 30 3d |..Oe_;...A/B..0=| Plaintext[64]: | 71 28 e6 92 85 a4 ae d3 8f cf 3b fa f2 7f fd c9 |q(........;.....| | 14 00 00 0c 98 24 e4 05 59 5d 00 af b9 c5 b6 2c |.....$..Y].....,| | 34 1f ec c4 43 2d ed c1 21 08 69 85 98 67 b9 ce |4...C-..!.i..g..| | 5b 20 24 ca 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |[ $.............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 34 1f ec c4 43 2d ed c1 21 08 69 85 98 67 b9 ce |4...C-..!.i..g..| | 5b 20 24 ca |[ $. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #249 (first time) conversation = 0x7fca71deeb08, ssl_session = 0x7fca45bebee0 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 96 bd 0b b3 e1 58 b5 37 39 bc ae d4 57 0c 58 cf |.....X.79...W.X.| | 71 6c 96 7d a3 2b fe 0b 63 1a 8a a0 e2 61 8b b4 |ql.}.+..c....a..| | 39 6d 77 71 8c 79 d1 24 1d 2b d4 0e bf 64 de d4 |9mwq.y.$.+...d..| | 04 af f5 d6 26 7a 1c ad bb 47 2b 6d a5 44 6e 62 |....&z...G+m.Dnb| Plaintext[64]: | 3f 16 43 c8 78 70 e3 98 69 a3 a0 bd 22 42 73 43 |?.C.xp..i..."BsC| | 14 00 00 0c 19 c9 85 4a f2 f0 37 57 af f1 ef 1e |.......J..7W....| | 59 60 4c b7 51 89 3c 0b 8a 48 d6 f1 50 8f f6 a3 |Y`L.Q.<..H..P...| | 71 eb 2f 6e 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |q./n............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 59 60 4c b7 51 89 3c 0b 8a 48 d6 f1 50 8f f6 a3 |Y`L.Q.<..H..P...| | 71 eb 2f 6e |q./n | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #250 (first time) conversation = 0x7fca71deeb08, ssl_session = 0x7fca45bebee0 record: offset = 0, reported_length_remaining = 133 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 128, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 128 Ciphertext[128]: | 48 0e cc b0 d1 df 8a fe ac 57 f8 c0 0f 12 03 43 |H........W.....C| | 22 c9 42 a8 d6 ab c9 57 7c bb 50 18 3a 9e 74 71 |".B....W|.P.:.tq| | 22 f3 5a a5 4c f8 b3 15 0d 02 fa 25 0b 1e 09 e3 |".Z.L......%....| | 02 7e d1 4d 40 98 54 8a 73 d8 a4 85 d6 56 d4 50 |.~.M@.T.s....V.P| | cf 47 48 c2 11 5f 48 52 70 26 0a e5 e2 85 c5 c8 |.GH.._HRp&......| | ba 05 2f 49 91 d1 fa 69 25 04 9a 95 f4 4e e1 84 |../I...i%....N..| | 7e cb 4c 5c 05 2b ac 7f 00 48 8b e5 6e df 08 64 |~.L\.+...H..n..d| | 36 0d d9 a6 88 41 bd 93 ca 4a e3 99 1f 36 32 5e |6....A...J...62^| Plaintext[128]: | 5e 3b e9 1d 88 7d e4 89 2e 21 ce 05 ff 14 4b fd |^;...}...!....K.| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 63 61 |Host: dhe-dss-ca| | 6d 65 6c 6c 69 61 31 32 38 2d 73 68 61 2e 6c 6f |mellia128-sha.lo| | 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey| | 6e 2e 6e 6c 3a 34 34 35 38 0d 0a 0d 0a c4 06 71 |n.nl:4458......q| | b1 f1 b4 c9 f5 08 d1 54 fb 5c fa a1 d1 91 d4 05 |.......T.\......| | 7d 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |}...............| ssl_decrypt_record found padding 14 final len 113 checking mac (len 77, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 27 6d d3 9c 0b 26 10 b1 77 77 a9 66 9e 9b 04 31 |'m...&..ww.f...1| | cc b8 e6 e3 |.... | ssl_decrypt_record: mac failed association_find: TCP port 44831 found (nil) association_find: TCP port 4458 found 0x362fa20 dissect_ssl enter frame #251 (first time) conversation = 0x7fca71deeb08, ssl_session = 0x7fca45bebee0 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | 86 d2 0b e0 3d e7 99 7a bc 93 71 f7 5c 83 15 11 |....=..z..q.\...| | 7e fd d9 79 5c ca 16 a0 07 1e 77 eb b5 ec ab 1b |~..y\.....w.....| | 0b 3a 90 16 3b 79 98 14 d4 c8 68 9b 90 b6 c4 e3 |.:..;y....h.....| | 82 a5 f5 3a 7d f8 d3 75 4a 50 02 71 f0 98 47 93 |...:}..uJP.q..G.| | b3 12 c1 7f 03 c7 47 eb 19 f7 84 09 bb 34 24 0e |......G......4$.| | c8 d4 f3 5d f6 f5 9c 9c 9e 80 b3 f4 c5 e6 5c 06 |...]..........\.| | a1 7a 9d 88 5f f1 b1 9c 99 32 af 3a 10 d1 56 73 |.z.._....2.:..Vs| | 61 7b 81 c7 db d1 29 00 d0 c3 e6 1e bf f8 90 14 |a{....).........| | 5a 91 06 cf a9 ac 0c 09 71 0b 30 2e 8a dc fb 26 |Z.......q.0....&| | 4f 15 46 67 b8 3a d7 35 3b c1 e5 b1 69 ee 97 b3 |O.Fg.:.5;...i...| | ab a1 75 35 e1 cd db de 77 8e a0 fa 50 c7 db 49 |..u5....w...P..I| | 65 63 55 d2 ba 63 7a e1 7b 0f 08 0e 36 e3 5c 70 |ecU..cz.{...6.\p| | f3 96 ac ad bf c6 20 0b 50 7e 62 b7 32 4a 7e 48 |...... .P~b.2J~H| | 2c 75 04 9d ce 24 ce 89 cc 40 df 07 56 f3 29 f7 |,u...$...@..V.).| | fe 55 c8 02 2b a5 29 33 ca d1 b9 5d 88 41 41 f8 |.U..+.)3...].AA.| | c0 ee 24 ee 8a de 61 81 a9 f4 da a1 72 7d 9a 64 |..$...a.....r}.d| | 11 07 16 df 18 3b fa e8 5a 82 24 03 d6 fa 43 17 |.....;..Z.$...C.| | fe 57 6a 65 b4 f8 86 de ed d1 85 74 15 99 65 bf |.Wje.......t..e.| | ad e4 c2 96 10 68 c8 0d ed 9a 05 09 87 4a 18 7d |.....h.......J.}| | 76 44 5b 31 b4 8d f0 1e 09 5b 3b ce e8 f1 71 03 |vD[1.....[;...q.| | d5 bc 3e 04 e1 f2 d6 af ab 0b d5 b3 27 ab 48 db |..>.........'.H.| | 7d 96 57 99 c9 8d 49 e9 78 bb a4 38 ae 91 98 9d |}.W...I.x..8....| | cc a5 86 0a 87 b0 66 d9 44 62 e8 51 ed 94 56 d8 |......f.Db.Q..V.| | d2 10 7d 50 e8 26 9f 3a c3 d8 f3 02 fc 94 14 ee |..}P.&.:........| | 26 b5 2a 74 64 a8 0b 0c 13 be 80 53 c8 fc ef c4 |&.*td......S....| Plaintext[400]: | 5d c6 b4 1d 6e 5d 83 ee cf 69 dc 3c 02 ae 36 c6 |]...n]...i.<..6.| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:| | 31 31 3a 32 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:29 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 34 34 20 2d 20 44 48 45 2d 44 |x00,0x44 - DHE-D| | 53 53 2d 43 41 4d 45 4c 4c 49 41 31 32 38 2d 53 |SS-CAMELLIA128-S| | 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc| | 3d 43 61 6d 65 6c 6c 69 61 28 31 32 38 29 20 4d |=Camellia(128) M| | 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1| | a2 ef cc 42 a1 f6 43 09 3c f4 c8 dd 4b 5e 69 fa |...B..C.<...K^i.| | 73 82 c6 7c 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |s..|............| ssl_decrypt_record found padding 11 final len 388 checking mac (len 352, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | b3 9e 08 3f f0 b2 ea 60 4c 4c 70 a6 07 43 f6 ba |...?...`LLp..C..| | f2 c6 a9 be |.... | ssl_decrypt_record: mac failed association_find: TCP port 4458 found 0x362fa20 dissect_ssl enter frame #252 (first time) conversation = 0x7fca71deeb08, ssl_session = 0x7fca45bebee0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 85 61 af 2e 35 b0 66 ed 75 41 12 69 36 11 37 53 |.a..5.f.uA.i6.7S| | d2 77 62 4c e7 4d a3 e6 88 57 5c 2b e1 4f 7b 21 |.wbL.M...W\+.O{!| | 37 b2 dd 00 f3 f6 c6 27 c0 50 d1 6d 72 50 c2 c3 |7......'.P.mrP..| Plaintext[48]: | 28 b7 c2 cd da 2c 4b 1d 44 d5 3f e8 77 cb 2f f8 |(....,K.D.?.w./.| | 01 00 2d 42 b8 bd 1d ba 6e c5 d3 7f bf 06 b9 50 |..-B....n......P| | 33 ed 25 ab 90 63 09 09 09 09 09 09 09 09 09 09 |3.%..c..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 2d 42 b8 bd 1d ba 6e c5 d3 7f bf 06 b9 50 33 ed |-B....n......P3.| | 25 ab 90 63 |%..c | ssl_decrypt_record: mac ok dissect_ssl enter frame #254 (first time) conversation = 0x7fca71deeb08, ssl_session = 0x7fca45bebee0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 86 a6 03 cb ed 97 4c 24 f5 bb cc 86 36 09 ed 9d |......L$....6...| | 79 30 61 51 30 a7 da 2a 01 4a 90 1b f7 89 34 c0 |y0aQ0..*.J....4.| | 5d 47 1a 92 a8 12 f6 d7 ba 1b 3d 78 6c 01 ee f9 |]G........=xl...| Plaintext[48]: | 7b 64 d5 e7 67 61 0d 46 4d aa 72 7b 5c 93 6a a7 |{d..ga.FM.r{\.j.| | 01 00 47 6d ec b5 f4 31 c1 42 b5 44 47 bf 07 68 |..Gm...1.B.DG..h| | 0d fb ff 39 ad 76 09 09 09 09 09 09 09 09 09 09 |...9.v..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 47 6d ec b5 f4 31 c1 42 b5 44 47 bf 07 68 0d fb |Gm...1.B.DG..h..| | ff 39 ad 76 |.9.v | ssl_decrypt_record: mac ok dissect_ssl enter frame #259 (first time) ssl_session_init: initializing ptr 0x7fca45bee3e0 size 688 conversation = 0x7fca71deedb0, ssl_session = 0x7fca45bee3e0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 45712 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4459 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #261 (first time) conversation = 0x7fca71deedb0, ssl_session = 0x7fca45bee3e0 record: offset = 0, reported_length_remaining = 1416 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0045 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | bf b3 a6 e2 2a 71 ee 4a 90 54 a4 55 87 d9 a1 f9 |....*q.J.T.U....| | 9b 7c 7c 10 7b f0 49 1e 55 1c 67 6d c3 d4 6b a1 |.||.{.I.U.gm..k.| | ac 86 b4 de 39 47 58 4c ad 09 d1 5f b2 4f bb 91 |....9GXL..._.O..| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f1 85 16 cd f3 be 95 44 a5 55 9d 3e fa dd 76 0a |.......D.U.>..v.| | d8 8a de 23 61 a1 fb cb 35 45 4e af 70 52 34 c2 |...#a...5EN.pR4.| | f1 63 7d e3 79 73 f0 f7 cb 4c 9c a2 ee bc 55 9c |.c}.ys...L....U.| | b6 27 17 60 79 f2 72 62 6f 72 fc 48 ab |.'.`y.rbor.H. | hash out[104]: | 31 20 61 29 5c 30 e4 af d2 c4 41 de 48 14 e8 0d |1 a)\0....A.H...| | 2c 5a e8 b7 b3 a3 2f 97 a0 ae 8e e9 68 ed 45 97 |,Z..../.....h.E.| | f8 6b b2 2a c8 e2 52 8d dd de d8 85 a0 df d3 df |.k.*..R.........| | 53 96 ed 86 7d ec 51 eb d5 1f 47 2b 80 e8 d9 84 |S...}.Q...G+....| | 91 ed f4 71 27 3d 1e e3 43 06 1a 32 a6 4e 29 9c |...q'=..C..2.N).| | c8 fd 46 12 60 96 68 fc 84 5a 59 d1 cd 62 92 a4 |..F.`.h..ZY..b..| | a1 0d d6 b3 3b bf b2 4f |....;..O | PRF out[104]: | 31 20 61 29 5c 30 e4 af d2 c4 41 de 48 14 e8 0d |1 a)\0....A.H...| | 2c 5a e8 b7 b3 a3 2f 97 a0 ae 8e e9 68 ed 45 97 |,Z..../.....h.E.| | f8 6b b2 2a c8 e2 52 8d dd de d8 85 a0 df d3 df |.k.*..R.........| | 53 96 ed 86 7d ec 51 eb d5 1f 47 2b 80 e8 d9 84 |S...}.Q...G+....| | 91 ed f4 71 27 3d 1e e3 43 06 1a 32 a6 4e 29 9c |...q'=..C..2.N).| | c8 fd 46 12 60 96 68 fc 84 5a 59 d1 cd 62 92 a4 |..F.`.h..ZY..b..| | a1 0d d6 b3 3b bf b2 4f |....;..O | key expansion[104]: | 31 20 61 29 5c 30 e4 af d2 c4 41 de 48 14 e8 0d |1 a)\0....A.H...| | 2c 5a e8 b7 b3 a3 2f 97 a0 ae 8e e9 68 ed 45 97 |,Z..../.....h.E.| | f8 6b b2 2a c8 e2 52 8d dd de d8 85 a0 df d3 df |.k.*..R.........| | 53 96 ed 86 7d ec 51 eb d5 1f 47 2b 80 e8 d9 84 |S...}.Q...G+....| | 91 ed f4 71 27 3d 1e e3 43 06 1a 32 a6 4e 29 9c |...q'=..C..2.N).| | c8 fd 46 12 60 96 68 fc 84 5a 59 d1 cd 62 92 a4 |..F.`.h..ZY..b..| | a1 0d d6 b3 3b bf b2 4f |....;..O | Client MAC key[20]: | 31 20 61 29 5c 30 e4 af d2 c4 41 de 48 14 e8 0d |1 a)\0....A.H...| | 2c 5a e8 b7 |,Z.. | Server MAC key[20]: | b3 a3 2f 97 a0 ae 8e e9 68 ed 45 97 f8 6b b2 2a |../.....h.E..k.*| | c8 e2 52 8d |..R. | Client Write key[16]: | dd de d8 85 a0 df d3 df 53 96 ed 86 7d ec 51 eb |........S...}.Q.| Server Write key[16]: | d5 1f 47 2b 80 e8 d9 84 91 ed f4 71 27 3d 1e e3 |..G+.......q'=..| Client Write IV[16]: | 43 06 1a 32 a6 4e 29 9c c8 fd 46 12 60 96 68 fc |C..2.N)...F.`.h.| Server Write IV[16]: | 84 5a 59 d1 cd 62 92 a4 a1 0d d6 b3 3b bf b2 4f |.ZY..b......;..O| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: CAMELLIA128 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: CAMELLIA128 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 1353 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 541 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 527, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407 record: offset = 1407, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416 dissect_ssl enter frame #263 (first time) conversation = 0x7fca71deedb0, ssl_session = 0x7fca45bee3e0 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079... looking for RSA pre-master008026623446ce90bc7960ea641d4009a018c4c1f458d7b3... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | e0 ac 82 c7 35 69 c5 18 cd 00 8c 8c 27 47 dd da |....5i......'G..| | 2d c7 f7 b0 31 b7 41 b0 c1 96 34 f2 75 1d e5 7c |-...1.A...4.u..|| | 06 4b a8 c3 22 ed 95 be 54 19 6a 47 cc d9 89 7b |.K.."...T.jG...{| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f1 85 16 cd f3 be 95 44 a5 55 9d 3e fa dd 76 0a |.......D.U.>..v.| | d8 8a de 23 61 a1 fb cb 35 45 4e af 70 52 34 c2 |...#a...5EN.pR4.| | f1 63 7d e3 79 73 f0 f7 cb 4c 9c a2 ee bc 55 9c |.c}.ys...L....U.| | b6 27 17 60 79 f2 72 62 6f 72 fc 48 ab |.'.`y.rbor.H. | hash out[104]: | 4f 9d 44 89 f1 70 21 76 f9 14 bf 74 9b 09 e9 ef |O.D..p!v...t....| | b6 52 a6 6e b2 03 4a f7 c1 36 e2 3e 08 d1 41 44 |.R.n..J..6.>..AD| | 04 a3 6e 51 74 5d 21 a4 8e 6a 1a f8 35 00 94 e9 |..nQt]!..j..5...| | 0c 6b d3 f5 b3 98 75 65 a3 19 d3 d3 75 88 65 d8 |.k....ue....u.e.| | e2 b5 c7 d5 d3 7e 9c 7d e4 73 98 6f 03 11 c2 e8 |.....~.}.s.o....| | e0 9a 3b e3 3a 28 06 f7 dc 0d bc 03 9d d7 a7 6d |..;.:(.........m| | 02 37 aa 70 45 ca 5c 18 |.7.pE.\. | PRF out[104]: | 4f 9d 44 89 f1 70 21 76 f9 14 bf 74 9b 09 e9 ef |O.D..p!v...t....| | b6 52 a6 6e b2 03 4a f7 c1 36 e2 3e 08 d1 41 44 |.R.n..J..6.>..AD| | 04 a3 6e 51 74 5d 21 a4 8e 6a 1a f8 35 00 94 e9 |..nQt]!..j..5...| | 0c 6b d3 f5 b3 98 75 65 a3 19 d3 d3 75 88 65 d8 |.k....ue....u.e.| | e2 b5 c7 d5 d3 7e 9c 7d e4 73 98 6f 03 11 c2 e8 |.....~.}.s.o....| | e0 9a 3b e3 3a 28 06 f7 dc 0d bc 03 9d d7 a7 6d |..;.:(.........m| | 02 37 aa 70 45 ca 5c 18 |.7.pE.\. | key expansion[104]: | 4f 9d 44 89 f1 70 21 76 f9 14 bf 74 9b 09 e9 ef |O.D..p!v...t....| | b6 52 a6 6e b2 03 4a f7 c1 36 e2 3e 08 d1 41 44 |.R.n..J..6.>..AD| | 04 a3 6e 51 74 5d 21 a4 8e 6a 1a f8 35 00 94 e9 |..nQt]!..j..5...| | 0c 6b d3 f5 b3 98 75 65 a3 19 d3 d3 75 88 65 d8 |.k....ue....u.e.| | e2 b5 c7 d5 d3 7e 9c 7d e4 73 98 6f 03 11 c2 e8 |.....~.}.s.o....| | e0 9a 3b e3 3a 28 06 f7 dc 0d bc 03 9d d7 a7 6d |..;.:(.........m| | 02 37 aa 70 45 ca 5c 18 |.7.pE.\. | Client MAC key[20]: | 4f 9d 44 89 f1 70 21 76 f9 14 bf 74 9b 09 e9 ef |O.D..p!v...t....| | b6 52 a6 6e |.R.n | Server MAC key[20]: | b2 03 4a f7 c1 36 e2 3e 08 d1 41 44 04 a3 6e 51 |..J..6.>..AD..nQ| | 74 5d 21 a4 |t]!. | Client Write key[16]: | 8e 6a 1a f8 35 00 94 e9 0c 6b d3 f5 b3 98 75 65 |.j..5....k....ue| Server Write key[16]: | a3 19 d3 d3 75 88 65 d8 e2 b5 c7 d5 d3 7e 9c 7d |....u.e......~.}| Client Write IV[16]: | e4 73 98 6f 03 11 c2 e8 e0 9a 3b e3 3a 28 06 f7 |.s.o......;.:(..| Server Write IV[16]: | dc 0d bc 03 9d d7 a7 6d 02 37 aa 70 45 ca 5c 18 |.......m.7.pE.\.| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: CAMELLIA128 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: CAMELLIA128 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | e0 ac 82 c7 35 69 c5 18 cd 00 8c 8c 27 47 dd da |....5i......'G..| | 2d c7 f7 b0 31 b7 41 b0 c1 96 34 f2 75 1d e5 7c |-...1.A...4.u..|| | 06 4b a8 c3 22 ed 95 be 54 19 6a 47 cc d9 89 7b |.K.."...T.jG...{| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | b4 3f c3 25 7f 4e 49 55 76 e2 30 ac 75 64 31 6a |.?.%.NIUv.0.ud1j| | 61 27 98 d3 57 93 f2 76 a3 03 00 bf 58 a3 b3 e9 |a'..W..v....X...| | 82 73 01 61 9e 53 88 cd 3f f3 eb df 8e 6b d3 19 |.s.a.S..?....k..| | 6b e2 9a 85 a8 ac d1 85 f7 0e 8d 36 36 1f 7b f2 |k..........66.{.| Plaintext[64]: | 6d 60 32 fe fc 34 c2 30 06 2a af 14 ee 83 7f 9b |m`2..4.0.*......| | 14 00 00 0c 59 81 33 28 63 4c 25 de 29 5c 98 65 |....Y.3(cL%.)\.e| | f1 83 ce 4d ad 6b e1 7c 31 0f ec 2d 62 b9 a8 67 |...M.k.|1..-b..g| | 68 aa d8 c3 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |h...............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | f1 83 ce 4d ad 6b e1 7c 31 0f ec 2d 62 b9 a8 67 |...M.k.|1..-b..g| | 68 aa d8 c3 |h... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #264 (first time) conversation = 0x7fca71deedb0, ssl_session = 0x7fca45bee3e0 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | aa 8a 46 75 bb 2d 08 c2 9e 86 47 1e 5d b5 55 2b |..Fu.-....G.].U+| | 63 d8 c0 37 64 76 31 eb 78 07 fb 40 f1 a0 8b 70 |c..7dv1.x..@...p| | 89 db 48 e7 d0 47 ee e5 a7 0e 3a c7 91 51 94 74 |..H..G....:..Q.t| | a1 43 c7 5f 52 d3 d1 de 99 60 54 92 74 82 ca 5e |.C._R....`T.t..^| Plaintext[64]: | db e7 58 bf eb 38 bf c3 c4 08 9c 5b ae f2 20 2b |..X..8.....[.. +| | 14 00 00 0c 91 26 db ed cb de 01 b6 d3 8a f9 a2 |.....&..........| | 21 9f 0e d7 22 eb 2a 99 f0 ea d2 45 84 aa 99 20 |!...".*....E... | | 9e a3 10 d7 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 21 9f 0e d7 22 eb 2a 99 f0 ea d2 45 84 aa 99 20 |!...".*....E... | | 9e a3 10 d7 |.... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #265 (first time) conversation = 0x7fca71deedb0, ssl_session = 0x7fca45bee3e0 record: offset = 0, reported_length_remaining = 133 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 128, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 128 Ciphertext[128]: | f9 9e ac 46 9e f6 d8 55 4f 59 58 0c ac 46 d9 1e |...F...UOYX..F..| | 1a f2 34 a9 27 df fe 4d e3 0b f6 89 93 40 db 07 |..4.'..M.....@..| | e3 03 90 0c ec a8 31 05 9f ad b9 b5 f0 63 99 bf |......1......c..| | d5 01 51 1b aa 5c 0f 56 9e b8 0e 14 5c 6b e3 99 |..Q..\.V....\k..| | cd 0a e6 02 d7 d4 da 5c 4e b9 ad 92 af a7 4b a0 |.......\N.....K.| | ca de 98 98 e5 a0 42 f4 6e 66 c2 a4 eb af 84 bb |......B.nf......| | 49 97 ac 85 6f ef 28 ea c1 65 aa c5 62 f4 da 7c |I...o.(..e..b..|| | 25 d0 57 8a 1b 13 7a 4e 3d 52 65 bc fb a1 4f 2b |%.W...zN=Re...O+| Plaintext[128]: | 7b ef cb a1 a5 fb ad 04 9c 17 99 30 7d c5 eb 3f |{..........0}..?| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 63 61 |Host: dhe-rsa-ca| | 6d 65 6c 6c 69 61 31 32 38 2d 73 68 61 2e 6c 6f |mellia128-sha.lo| | 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey| | 6e 2e 6e 6c 3a 34 34 35 39 0d 0a 0d 0a 54 bd f4 |n.nl:4459....T..| | 97 57 83 e7 b3 aa 68 3f 83 e2 aa d3 f3 31 3e 56 |.W....h?.....1>V| | 8d 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |................| ssl_decrypt_record found padding 14 final len 113 checking mac (len 77, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 1c e7 01 99 53 17 71 36 cc 95 e9 49 fd 8e ae 14 |....S.q6...I....| | 7b 4d 05 75 |{M.u | ssl_decrypt_record: mac failed association_find: TCP port 45712 found (nil) association_find: TCP port 4459 found 0x362fab0 dissect_ssl enter frame #266 (first time) conversation = 0x7fca71deedb0, ssl_session = 0x7fca45bee3e0 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | d8 e9 22 02 b1 ba 1f 41 10 1f f5 17 7a b7 33 5c |.."....A....z.3\| | 09 34 11 5e bc 53 1a a9 78 24 59 79 7b 2a cd c7 |.4.^.S..x$Yy{*..| | 9f d4 4d 8d 0d 1f f3 e3 de 53 92 55 de d8 b7 fd |..M......S.U....| | b6 5c d2 14 d6 13 1a cb 77 6f 27 0a 3a 41 5f 57 |.\......wo'.:A_W| | 7a 5c 2d 98 3b 2e 3c 48 37 c5 ed ca be 50 b0 f8 |z\-.;..Mx.| | 1a 9f 32 6e 70 a9 e2 d1 81 ae 53 8f f2 43 df 00 |..2np.....S..C..| | 65 65 ea e0 b6 77 87 2b 1f b3 69 ac f0 c4 06 f2 |ee...w.+..i.....| | d3 33 b3 09 b6 c1 fa 3d 98 b6 ba 12 64 b5 61 81 |.3.....=....d.a.| | b2 f6 eb 22 04 b4 2e 2e 90 57 3a 4a 9c 77 6c 4b |...".....W:J.wlK| | b9 63 05 aa 6c a0 5a 47 10 b6 5d f1 ff 49 a8 6e |.c..l.ZG..]..I.n| | 30 b3 53 07 96 40 14 ad 0e 29 d5 d7 a9 81 ce 3f |0.S..@...).....?| | b9 ff 03 53 62 db dd f0 2f de 2a e1 14 b2 70 9e |...Sb.../.*...p.| | fb 4c 63 8b fb 7f 85 22 92 3d e2 cc a8 de bd 9a |.Lc....".=......| | 56 ab f9 f0 db 95 35 21 82 ec 30 9c f8 38 81 fc |V.....5!..0..8..| | 08 41 c8 f2 e3 a8 0e a5 e4 d2 1e dc e8 4f 37 b1 |.A...........O7.| | 37 d2 d5 1f 41 e9 a7 4f 5e 7b b2 dc cc 53 cd 7e |7...A..O^{...S.~| | 75 18 80 0c d2 93 9e 20 90 1a 8b 4b 57 24 24 fb |u...... ...KW$$.| | be 58 b6 9f e4 2f 0a db c1 19 42 b6 d6 16 36 08 |.X.../....B...6.| | 0b 25 d1 30 13 86 6d 1f 86 26 fd 65 f1 f0 b9 9b |.%.0..m..&.e....| | 78 72 48 88 dd 60 91 4c 14 33 e0 98 17 2a fe 79 |xrH..`.L.3...*.y| | 3a 9c 2b ef 7b 7f 42 7f b2 76 5c f7 59 e4 18 fc |:.+.{.B..v\.Y...| | e0 16 d6 26 0e 44 ca 46 4d 1f 72 20 3b c4 61 4f |...&.D.FM.r ;.aO| Plaintext[400]: | 47 ff 55 29 c7 65 f9 25 27 e9 77 22 01 9d 13 0a |G.U).e.%'.w"....| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:| | 31 31 3a 32 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:29 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 34 35 20 2d 20 44 48 45 2d 52 |x00,0x45 - DHE-R| | 53 41 2d 43 41 4d 45 4c 4c 49 41 31 32 38 2d 53 |SA-CAMELLIA128-S| | 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 43 61 6d 65 6c 6c 69 61 28 31 32 38 29 20 4d |=Camellia(128) M| | 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1| | 3a 19 6a 82 a3 80 c0 3b 65 3c fb bb dc 0c d2 8b |:.j....;e<......| | fb 0b 0d 1d 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................| ssl_decrypt_record found padding 11 final len 388 checking mac (len 352, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | e5 29 3d f8 74 22 96 1d 9e 02 fe a8 e0 d8 22 e1 |.)=.t"........".| | db 9f ef 01 |.... | ssl_decrypt_record: mac failed association_find: TCP port 4459 found 0x362fab0 dissect_ssl enter frame #267 (first time) conversation = 0x7fca71deedb0, ssl_session = 0x7fca45bee3e0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 5e 19 19 6d c8 ce bf db 7d 42 06 04 f6 a0 86 c6 |^..m....}B......| | c4 b5 6b af 34 17 aa 8c 48 76 2b ea b9 a6 a9 10 |..k.4...Hv+.....| | 1d ff 0b 2e 14 c0 2f 92 ff b1 ef 73 e7 f0 ff e4 |....../....s....| Plaintext[48]: | 96 26 11 11 d3 83 b1 be d6 af 09 a1 42 f0 7b d7 |.&..........B.{.| | 01 00 f8 c5 b1 76 ed cb 2f c1 0e 36 01 00 d8 2e |.....v../..6....| | 79 94 62 2f e5 2c 09 09 09 09 09 09 09 09 09 09 |y.b/.,..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | f8 c5 b1 76 ed cb 2f c1 0e 36 01 00 d8 2e 79 94 |...v../..6....y.| | 62 2f e5 2c |b/., | ssl_decrypt_record: mac ok dissect_ssl enter frame #269 (first time) conversation = 0x7fca71deedb0, ssl_session = 0x7fca45bee3e0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 0d 63 7a 9b 73 b3 3f 2f 3d a4 74 4c a0 de 84 e8 |.cz.s.?/=.tL....| | b2 3b e8 69 89 bc 6a 9a 34 11 0d 3d 98 19 e4 95 |.;.i..j.4..=....| | 3c c5 95 c4 96 4f 4e 66 f4 87 13 aa bb 35 7b 68 |<....ONf.....5{h| Plaintext[48]: | 24 67 80 63 95 68 97 66 18 96 3c 42 bc e8 9f 93 |$g.c.h.f.. state 0x01 dissect_ssl enter frame #276 (first time) conversation = 0x7fca71def058, ssl_session = 0x7fca45bf0920 record: offset = 0, reported_length_remaining = 884 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0084 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | e0 ac 82 c7 35 69 c5 18 cd 00 8c 8c 27 47 dd da |....5i......'G..| | 2d c7 f7 b0 31 b7 41 b0 c1 96 34 f2 75 1d e5 7c |-...1.A...4.u..|| | 06 4b a8 c3 22 ed 95 be 54 19 6a 47 cc d9 89 7b |.K.."...T.jG...{| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f1 84 ee f3 da c8 b4 22 c8 9d a5 e0 ea fb b7 46 |.......".......F| | d0 11 12 66 ec cf 45 34 48 89 51 8b ec 52 34 c2 |...f..E4H.Q..R4.| | f1 0f 5a c6 3a 3a 3a b8 77 01 37 24 4c 56 27 b3 |..Z.:::.w.7$LV'.| | 34 6a 4f 34 a2 e7 b5 36 5a da 9a b8 c0 |4jO4...6Z.... | hash out[136]: | b8 0f f4 78 2b 4a 26 1b 2d 54 a2 d5 f1 ee 9b df |...x+J&.-T......| | 3c 2e d1 11 9a cc 26 12 ae 29 27 2c 47 aa 6c 23 |<.....&..)',G.l#| | 25 7f e7 f7 1c 44 2b b2 67 5c 27 91 af 19 b9 16 |%....D+.g\'.....| | d0 10 5e 1b f2 cb 1e 95 90 90 6d b2 ca 74 73 97 |..^.......m..ts.| | d5 93 ed 4a 2c b7 df 28 42 4c 82 c4 a1 11 35 11 |...J,..(BL....5.| | dc c8 86 71 a7 63 03 2a 16 c1 50 f6 9c b0 03 bf |...q.c.*..P.....| | 02 2e 41 08 d8 51 f0 9b d6 81 ce 54 7f 26 48 18 |..A..Q.....T.&H.| | dc 4b a3 95 91 6f f4 e0 f4 3d 6d 27 a5 ec 51 40 |.K...o...=m'..Q@| | 42 f6 99 c9 a9 28 c2 7c |B....(.| | PRF out[136]: | b8 0f f4 78 2b 4a 26 1b 2d 54 a2 d5 f1 ee 9b df |...x+J&.-T......| | 3c 2e d1 11 9a cc 26 12 ae 29 27 2c 47 aa 6c 23 |<.....&..)',G.l#| | 25 7f e7 f7 1c 44 2b b2 67 5c 27 91 af 19 b9 16 |%....D+.g\'.....| | d0 10 5e 1b f2 cb 1e 95 90 90 6d b2 ca 74 73 97 |..^.......m..ts.| | d5 93 ed 4a 2c b7 df 28 42 4c 82 c4 a1 11 35 11 |...J,..(BL....5.| | dc c8 86 71 a7 63 03 2a 16 c1 50 f6 9c b0 03 bf |...q.c.*..P.....| | 02 2e 41 08 d8 51 f0 9b d6 81 ce 54 7f 26 48 18 |..A..Q.....T.&H.| | dc 4b a3 95 91 6f f4 e0 f4 3d 6d 27 a5 ec 51 40 |.K...o...=m'..Q@| | 42 f6 99 c9 a9 28 c2 7c |B....(.| | key expansion[136]: | b8 0f f4 78 2b 4a 26 1b 2d 54 a2 d5 f1 ee 9b df |...x+J&.-T......| | 3c 2e d1 11 9a cc 26 12 ae 29 27 2c 47 aa 6c 23 |<.....&..)',G.l#| | 25 7f e7 f7 1c 44 2b b2 67 5c 27 91 af 19 b9 16 |%....D+.g\'.....| | d0 10 5e 1b f2 cb 1e 95 90 90 6d b2 ca 74 73 97 |..^.......m..ts.| | d5 93 ed 4a 2c b7 df 28 42 4c 82 c4 a1 11 35 11 |...J,..(BL....5.| | dc c8 86 71 a7 63 03 2a 16 c1 50 f6 9c b0 03 bf |...q.c.*..P.....| | 02 2e 41 08 d8 51 f0 9b d6 81 ce 54 7f 26 48 18 |..A..Q.....T.&H.| | dc 4b a3 95 91 6f f4 e0 f4 3d 6d 27 a5 ec 51 40 |.K...o...=m'..Q@| | 42 f6 99 c9 a9 28 c2 7c |B....(.| | Client MAC key[20]: | b8 0f f4 78 2b 4a 26 1b 2d 54 a2 d5 f1 ee 9b df |...x+J&.-T......| | 3c 2e d1 11 |<... | Server MAC key[20]: | 9a cc 26 12 ae 29 27 2c 47 aa 6c 23 25 7f e7 f7 |..&..)',G.l#%...| | 1c 44 2b b2 |.D+. | Client Write key[32]: | 67 5c 27 91 af 19 b9 16 d0 10 5e 1b f2 cb 1e 95 |g\'.......^.....| | 90 90 6d b2 ca 74 73 97 d5 93 ed 4a 2c b7 df 28 |..m..ts....J,..(| Server Write key[32]: | 42 4c 82 c4 a1 11 35 11 dc c8 86 71 a7 63 03 2a |BL....5....q.c.*| | 16 c1 50 f6 9c b0 03 bf 02 2e 41 08 d8 51 f0 9b |..P.......A..Q..| Client Write IV[16]: | d6 81 ce 54 7f 26 48 18 dc 4b a3 95 91 6f f4 e0 |...T.&H..K...o..| Server Write IV[16]: | f4 3d 6d 27 a5 ec 51 40 42 f6 99 c9 a9 28 c2 7c |.=m'..Q@B....(.|| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: CAMELLIA256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: CAMELLIA256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 821 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884 dissect_ssl enter frame #278 (first time) conversation = 0x7fca71def058, ssl_session = 0x7fca45bf0920 record: offset = 0, reported_length_remaining = 342 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 262, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2... looking for RSA pre-masterb2e73e29db1e25760dde23be4a9ca0f8d0fdd0c2ddce5aff... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 33 e5 c3 73 96 41 ea 8b 00 3e 5c 42 69 95 5f c9 |3..s.A...>\Bi._.| | b5 70 41 12 23 32 36 1b 15 12 46 11 c4 3b c3 8d |.pA.#26...F..;..| | 98 db 5b fd e3 75 23 ec 09 55 de 3c 3c 8c d0 11 |..[..u#..U.<<...| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f1 84 ee f3 da c8 b4 22 c8 9d a5 e0 ea fb b7 46 |.......".......F| | d0 11 12 66 ec cf 45 34 48 89 51 8b ec 52 34 c2 |...f..E4H.Q..R4.| | f1 0f 5a c6 3a 3a 3a b8 77 01 37 24 4c 56 27 b3 |..Z.:::.w.7$LV'.| | 34 6a 4f 34 a2 e7 b5 36 5a da 9a b8 c0 |4jO4...6Z.... | hash out[136]: | b0 29 0e 1c 52 58 18 4a 61 5a c1 bd 32 eb 72 99 |.)..RX.JaZ..2.r.| | 9d f9 86 93 43 ac 4a 6b 1f 7b 98 63 01 ff 96 72 |....C.Jk.{.c...r| | 74 47 6a 25 ba 76 13 c9 59 c9 cf 69 d3 a7 74 0e |tGj%.v..Y..i..t.| | f6 52 87 2c 33 47 7a af b1 fd d6 78 c7 c2 fb de |.R.,3Gz....x....| | a2 6f 0c cc 17 92 2f 61 83 68 3d 7f c3 57 3d ad |.o..../a.h=..W=.| | a8 4f d1 a0 64 5d 87 b7 81 66 12 73 a1 7b 9a f0 |.O..d]...f.s.{..| | 18 98 65 f4 8e be 51 b7 fe 32 ce 4b 17 96 88 da |..e...Q..2.K....| | fa 0d 1a 65 b7 bd 22 d8 b0 c7 4c 0b 67 06 2c 36 |...e.."...L.g.,6| | 11 48 85 e8 38 75 e8 03 |.H..8u.. | PRF out[136]: | b0 29 0e 1c 52 58 18 4a 61 5a c1 bd 32 eb 72 99 |.)..RX.JaZ..2.r.| | 9d f9 86 93 43 ac 4a 6b 1f 7b 98 63 01 ff 96 72 |....C.Jk.{.c...r| | 74 47 6a 25 ba 76 13 c9 59 c9 cf 69 d3 a7 74 0e |tGj%.v..Y..i..t.| | f6 52 87 2c 33 47 7a af b1 fd d6 78 c7 c2 fb de |.R.,3Gz....x....| | a2 6f 0c cc 17 92 2f 61 83 68 3d 7f c3 57 3d ad |.o..../a.h=..W=.| | a8 4f d1 a0 64 5d 87 b7 81 66 12 73 a1 7b 9a f0 |.O..d]...f.s.{..| | 18 98 65 f4 8e be 51 b7 fe 32 ce 4b 17 96 88 da |..e...Q..2.K....| | fa 0d 1a 65 b7 bd 22 d8 b0 c7 4c 0b 67 06 2c 36 |...e.."...L.g.,6| | 11 48 85 e8 38 75 e8 03 |.H..8u.. | key expansion[136]: | b0 29 0e 1c 52 58 18 4a 61 5a c1 bd 32 eb 72 99 |.)..RX.JaZ..2.r.| | 9d f9 86 93 43 ac 4a 6b 1f 7b 98 63 01 ff 96 72 |....C.Jk.{.c...r| | 74 47 6a 25 ba 76 13 c9 59 c9 cf 69 d3 a7 74 0e |tGj%.v..Y..i..t.| | f6 52 87 2c 33 47 7a af b1 fd d6 78 c7 c2 fb de |.R.,3Gz....x....| | a2 6f 0c cc 17 92 2f 61 83 68 3d 7f c3 57 3d ad |.o..../a.h=..W=.| | a8 4f d1 a0 64 5d 87 b7 81 66 12 73 a1 7b 9a f0 |.O..d]...f.s.{..| | 18 98 65 f4 8e be 51 b7 fe 32 ce 4b 17 96 88 da |..e...Q..2.K....| | fa 0d 1a 65 b7 bd 22 d8 b0 c7 4c 0b 67 06 2c 36 |...e.."...L.g.,6| | 11 48 85 e8 38 75 e8 03 |.H..8u.. | Client MAC key[20]: | b0 29 0e 1c 52 58 18 4a 61 5a c1 bd 32 eb 72 99 |.)..RX.JaZ..2.r.| | 9d f9 86 93 |.... | Server MAC key[20]: | 43 ac 4a 6b 1f 7b 98 63 01 ff 96 72 74 47 6a 25 |C.Jk.{.c...rtGj%| | ba 76 13 c9 |.v.. | Client Write key[32]: | 59 c9 cf 69 d3 a7 74 0e f6 52 87 2c 33 47 7a af |Y..i..t..R.,3Gz.| | b1 fd d6 78 c7 c2 fb de a2 6f 0c cc 17 92 2f 61 |...x.....o..../a| Server Write key[32]: | 83 68 3d 7f c3 57 3d ad a8 4f d1 a0 64 5d 87 b7 |.h=..W=..O..d]..| | 81 66 12 73 a1 7b 9a f0 18 98 65 f4 8e be 51 b7 |.f.s.{....e...Q.| Client Write IV[16]: | fe 32 ce 4b 17 96 88 da fa 0d 1a 65 b7 bd 22 d8 |.2.K.......e..".| Server Write IV[16]: | b0 c7 4c 0b 67 06 2c 36 11 48 85 e8 38 75 e8 03 |..L.g.,6.H..8u..| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: CAMELLIA256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: CAMELLIA256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 33 e5 c3 73 96 41 ea 8b 00 3e 5c 42 69 95 5f c9 |3..s.A...>\Bi._.| | b5 70 41 12 23 32 36 1b 15 12 46 11 c4 3b c3 8d |.pA.#26...F..;..| | 98 db 5b fd e3 75 23 ec 09 55 de 3c 3c 8c d0 11 |..[..u#..U.<<...| dissect_ssl3_handshake session keys successfully generated record: offset = 267, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 273, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | e2 78 48 13 68 2b ed 47 b2 fd 71 95 aa ea 49 ee |.xH.h+.G..q...I.| | c3 92 79 e2 8b d0 bb c6 2d 2d 0f 73 0d c1 18 b1 |..y.....--.s....| | 90 dd 47 fe ed 2a b1 ea 32 e8 07 88 b7 b2 54 c7 |..G..*..2.....T.| | 5e 88 ec fe 22 e7 a2 25 c7 e2 cd 59 13 fa b3 3c |^..."..%...Y...<| Plaintext[64]: | 55 f0 62 0a c6 7c 89 9d 05 ff 82 e2 15 46 63 ee |U.b..|.......Fc.| | 14 00 00 0c 3c cd 8e 07 86 ab 12 17 d1 83 b5 16 |....<...........| | 4d 5d 22 e4 f0 41 82 7e 30 10 7e 3d 59 42 66 30 |M]"..A.~0.~=YBf0| | a9 6a 7c 63 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.j|c............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 4d 5d 22 e4 f0 41 82 7e 30 10 7e 3d 59 42 66 30 |M]"..A.~0.~=YBf0| | a9 6a 7c 63 |.j|c | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #279 (first time) conversation = 0x7fca71def058, ssl_session = 0x7fca45bf0920 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 20 4a a9 e5 2e e8 c0 7f d2 a8 26 b4 1e c7 4d a3 | J........&...M.| | 10 e2 e4 f4 32 ce 49 87 ef 66 fe 36 98 53 d6 da |....2.I..f.6.S..| | 03 d5 84 84 ae 55 3d d7 e7 bd d2 d2 85 2f 21 10 |.....U=....../!.| | 33 4f 8b ce dd 65 64 93 f8 df 3a 28 54 eb f6 27 |3O...ed...:(T..'| Plaintext[64]: | a2 59 23 34 12 8a 36 b0 81 6e 0f 67 e1 1c 3e 11 |.Y#4..6..n.g..>.| | 14 00 00 0c 9f 9b 48 4d ac 5a 28 c3 8b 03 16 8e |......HM.Z(.....| | b4 e7 98 05 00 71 2d 72 13 98 94 3b b4 f7 cc ca |.....q-r...;....| | 0f 65 91 e9 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.e..............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | b4 e7 98 05 00 71 2d 72 13 98 94 3b b4 f7 cc ca |.....q-r...;....| | 0f 65 91 e9 |.e.. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #280 (first time) conversation = 0x7fca71def058, ssl_session = 0x7fca45bf0920 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | 22 f3 a2 2c 25 fc 11 54 60 f0 b9 73 e2 22 6b 61 |"..,%..T`..s."ka| | 51 25 52 76 12 08 83 9b 15 24 e0 94 af 20 3c 67 |Q%Rv.....$... .4.:...5| | 8b da e7 27 5e 0c d7 80 7a 07 b7 66 4e 7b 9d dc |...'^...z..fN{..| | 4f 01 fe c9 76 74 b3 dc 7c 2f ac 4d 3c ff cd d0 |O...vt..|/.M<...| | 54 d3 21 16 9f 24 50 8c a9 ca d8 b0 36 74 20 3b |T.!..$P.....6t ;| | 2a a3 01 1d 06 95 d1 12 62 c7 fc 9b 06 6b 9e d2 |*.......b....k..| | 04 3e 91 b8 a9 1b 6d d2 0b dd 4d c8 82 9d 27 bd |.>....m...M...'.| Plaintext[400]: | a6 23 8e 39 4b fb b1 13 4e 3a ab db c0 de 26 aa |.#.9K...N:....&.| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:| | 31 31 3a 32 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:29 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 38 34 20 2d 20 43 41 4d 45 4c |x00,0x84 - CAMEL| | 4c 49 41 32 35 36 2d 53 48 41 20 20 20 20 20 20 |LIA256-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 43 61 6d 65 6c 6c 69 61 28 32 35 36 29 20 4d |=Camellia(256) M| | 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1| | df 29 e8 5b d5 ad c2 85 4d cb 79 c9 c9 f8 53 c0 |.).[....M.y...S.| | 85 6b 36 af 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.k6.............| ssl_decrypt_record found padding 11 final len 388 checking mac (len 352, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 94 93 ca 0c 29 55 c7 c0 53 b7 0d f5 6c 30 93 f6 |....)U..S...l0..| | 94 75 b1 e8 |.u.. | ssl_decrypt_record: mac failed association_find: TCP port 4463 found 0x3630510 dissect_ssl enter frame #282 (first time) conversation = 0x7fca71def058, ssl_session = 0x7fca45bf0920 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 52 d9 7e 4c 37 b5 2b 9c 4a e7 c9 39 6c e5 05 27 |R.~L7.+.J..9l..'| | 62 ce e8 35 2f 4a 70 77 a5 c3 ec a2 21 53 50 0f |b..5/Jpw....!SP.| | 3f 46 30 b3 9c a4 1b 1e 4c 41 93 0a c2 b1 f5 f0 |?F0.....LA......| Plaintext[48]: | 85 22 a7 0d 85 53 37 23 e4 2e 91 e4 73 d9 69 be |."...S7#....s.i.| | 01 00 aa 55 3e 1d 7e 14 8e b9 c5 78 34 3f f3 bb |...U>.~....x4?..| | 41 68 52 e1 54 b5 09 09 09 09 09 09 09 09 09 09 |AhR.T...........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | aa 55 3e 1d 7e 14 8e b9 c5 78 34 3f f3 bb 41 68 |.U>.~....x4?..Ah| | 52 e1 54 b5 |R.T. | ssl_decrypt_record: mac ok dissect_ssl enter frame #284 (first time) conversation = 0x7fca71def058, ssl_session = 0x7fca45bf0920 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | f0 f1 93 67 ed 0e f9 2a 52 98 c4 24 12 a5 50 95 |...g...*R..$..P.| | 89 cb 96 fc 07 73 d5 af fe 66 3a 10 18 1c 5f 58 |.....s...f:..._X| | ef 07 b2 ec ec 2a 80 6e d5 53 00 1a 4c e2 ba ee |.....*.n.S..L...| Plaintext[48]: | f5 40 60 ee ae 6f bc 7b a7 65 5f e2 9f 96 47 6b |.@`..o.{.e_...Gk| | 01 00 9c 31 02 a3 11 95 d4 6e e3 9a 8e 78 75 b7 |...1.....n...xu.| | 8f e0 b0 dd d8 86 09 09 09 09 09 09 09 09 09 09 |................| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 9c 31 02 a3 11 95 d4 6e e3 9a 8e 78 75 b7 8f e0 |.1.....n...xu...| | b0 dd d8 86 |.... | ssl_decrypt_record: mac ok dissect_ssl enter frame #289 (first time) ssl_session_init: initializing ptr 0x7fca45bf2ea0 size 688 conversation = 0x7fca71def300, ssl_session = 0x7fca45bf2ea0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 46579 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4464 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #291 (first time) conversation = 0x7fca71def300, ssl_session = 0x7fca45bf2ea0 record: offset = 0, reported_length_remaining = 1134 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0087 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 33 e5 c3 73 96 41 ea 8b 00 3e 5c 42 69 95 5f c9 |3..s.A...>\Bi._.| | b5 70 41 12 23 32 36 1b 15 12 46 11 c4 3b c3 8d |.pA.#26...F..;..| | 98 db 5b fd e3 75 23 ec 09 55 de 3c 3c 8c d0 11 |..[..u#..U.<<...| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f2 ed 46 99 77 1f ee fd 3c 96 9e 60 a3 a0 51 97 |..F.w...<..`..Q.| | 77 84 c4 58 1a 0c 41 42 11 a9 7a ad 6e 52 34 c2 |w..X..AB..z.nR4.| | f2 b4 b6 1b 5a 11 c9 69 e9 d6 dc 80 15 ac 90 dd |....Z..i........| | 21 df f0 0a 7a 88 b3 72 34 05 ec 9f 6d |!...z..r4...m | hash out[136]: | 87 59 16 84 5d c1 01 37 5a 73 c5 76 55 a3 af 7d |.Y..]..7Zs.vU..}| | 74 96 a1 b6 89 4b c8 7d 2e 2a c7 fe f1 e2 aa f7 |t....K.}.*......| | 83 37 54 25 18 bc 84 76 39 c3 12 52 a7 6f 1f fd |.7T%...v9..R.o..| | ab 78 e9 4e 1b ee a0 83 da 32 62 40 99 2d 10 6b |.x.N.....2b@.-.k| | 47 b9 ef 3a 09 ba 87 2e 47 90 2f 9a d9 09 c3 88 |G..:....G./.....| | 62 e1 0d 91 5a 4a b3 c7 78 73 74 49 45 5d fb 1d |b...ZJ..xstIE]..| | 4e 5c 34 d1 a1 8c 3d 36 3f b9 dd f1 af 80 fe eb |N\4...=6?.......| | aa e9 eb 76 9b 56 96 05 3d 85 41 87 db f4 7c ec |...v.V..=.A...|.| | c0 42 29 28 21 37 27 8b |.B)(!7'. | PRF out[136]: | 87 59 16 84 5d c1 01 37 5a 73 c5 76 55 a3 af 7d |.Y..]..7Zs.vU..}| | 74 96 a1 b6 89 4b c8 7d 2e 2a c7 fe f1 e2 aa f7 |t....K.}.*......| | 83 37 54 25 18 bc 84 76 39 c3 12 52 a7 6f 1f fd |.7T%...v9..R.o..| | ab 78 e9 4e 1b ee a0 83 da 32 62 40 99 2d 10 6b |.x.N.....2b@.-.k| | 47 b9 ef 3a 09 ba 87 2e 47 90 2f 9a d9 09 c3 88 |G..:....G./.....| | 62 e1 0d 91 5a 4a b3 c7 78 73 74 49 45 5d fb 1d |b...ZJ..xstIE]..| | 4e 5c 34 d1 a1 8c 3d 36 3f b9 dd f1 af 80 fe eb |N\4...=6?.......| | aa e9 eb 76 9b 56 96 05 3d 85 41 87 db f4 7c ec |...v.V..=.A...|.| | c0 42 29 28 21 37 27 8b |.B)(!7'. | key expansion[136]: | 87 59 16 84 5d c1 01 37 5a 73 c5 76 55 a3 af 7d |.Y..]..7Zs.vU..}| | 74 96 a1 b6 89 4b c8 7d 2e 2a c7 fe f1 e2 aa f7 |t....K.}.*......| | 83 37 54 25 18 bc 84 76 39 c3 12 52 a7 6f 1f fd |.7T%...v9..R.o..| | ab 78 e9 4e 1b ee a0 83 da 32 62 40 99 2d 10 6b |.x.N.....2b@.-.k| | 47 b9 ef 3a 09 ba 87 2e 47 90 2f 9a d9 09 c3 88 |G..:....G./.....| | 62 e1 0d 91 5a 4a b3 c7 78 73 74 49 45 5d fb 1d |b...ZJ..xstIE]..| | 4e 5c 34 d1 a1 8c 3d 36 3f b9 dd f1 af 80 fe eb |N\4...=6?.......| | aa e9 eb 76 9b 56 96 05 3d 85 41 87 db f4 7c ec |...v.V..=.A...|.| | c0 42 29 28 21 37 27 8b |.B)(!7'. | Client MAC key[20]: | 87 59 16 84 5d c1 01 37 5a 73 c5 76 55 a3 af 7d |.Y..]..7Zs.vU..}| | 74 96 a1 b6 |t... | Server MAC key[20]: | 89 4b c8 7d 2e 2a c7 fe f1 e2 aa f7 83 37 54 25 |.K.}.*.......7T%| | 18 bc 84 76 |...v | Client Write key[32]: | 39 c3 12 52 a7 6f 1f fd ab 78 e9 4e 1b ee a0 83 |9..R.o...x.N....| | da 32 62 40 99 2d 10 6b 47 b9 ef 3a 09 ba 87 2e |.2b@.-.kG..:....| Server Write key[32]: | 47 90 2f 9a d9 09 c3 88 62 e1 0d 91 5a 4a b3 c7 |G./.....b...ZJ..| | 78 73 74 49 45 5d fb 1d 4e 5c 34 d1 a1 8c 3d 36 |xstIE]..N\4...=6| Client Write IV[16]: | 3f b9 dd f1 af 80 fe eb aa e9 eb 76 9b 56 96 05 |?..........v.V..| Server Write IV[16]: | 3d 85 41 87 db f4 7c ec c0 42 29 28 21 37 27 8b |=.A...|..B)(!7'.| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: CAMELLIA256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: CAMELLIA256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 1071 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 735, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803 record: offset = 803, reported_length_remaining = 331 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 808 length 313 bytes, remaining 1125 record: offset = 1125, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1130 length 0 bytes, remaining 1134 dissect_ssl enter frame #293 (first time) conversation = 0x7fca71def300, ssl_session = 0x7fca45bf2ea0 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a... looking for RSA pre-master00807038a4c79396c04e7dea4cd446b1ed5f41ae4121d02d... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a88b3723405ec9f6d 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 1b 03 13 ae fd a9 dc 38 b1 68 f2 fd d5 f7 08 48 |.......8.h.....H| | b6 97 f8 f5 5b 7d f8 db b8 63 37 cd b0 0b 4e 4f |....[}...c7...NO| | f2 59 77 af dc 1c 4b d8 0d 15 84 a7 ea 8b e0 4d |.Yw...K........M| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f2 ed 46 99 77 1f ee fd 3c 96 9e 60 a3 a0 51 97 |..F.w...<..`..Q.| | 77 84 c4 58 1a 0c 41 42 11 a9 7a ad 6e 52 34 c2 |w..X..AB..z.nR4.| | f2 b4 b6 1b 5a 11 c9 69 e9 d6 dc 80 15 ac 90 dd |....Z..i........| | 21 df f0 0a 7a 88 b3 72 34 05 ec 9f 6d |!...z..r4...m | hash out[136]: | 7e 66 a0 bc 57 60 aa 05 d5 a0 25 d5 07 99 fb ba |~f..W`....%.....| | 88 bd 55 a5 5d 85 6b b1 ad 30 c2 ac 87 55 25 ef |..U.].k..0...U%.| | f1 8d 49 52 eb 66 0c a4 be c2 63 bd 95 28 20 b0 |..IR.f....c..( .| | 76 c1 ce d0 a6 3d a5 a8 88 96 89 60 0b f4 17 1c |v....=.....`....| | b3 e7 f0 af 09 bd b4 76 aa 6b c8 d7 13 d0 fb df |.......v.k......| | 50 45 5f af 5a 8d 79 ca b6 82 0d 94 84 75 0a a4 |PE_.Z.y......u..| | eb 06 07 b2 ec ec d1 80 22 18 90 b2 fa f4 3c 2c |........".....<,| | 8c a9 80 6a 04 45 3a 82 c3 6b 6f 6a 98 aa 77 ac |...j.E:..koj..w.| | 56 a3 a5 f8 69 f6 e7 82 |V...i... | PRF out[136]: | 7e 66 a0 bc 57 60 aa 05 d5 a0 25 d5 07 99 fb ba |~f..W`....%.....| | 88 bd 55 a5 5d 85 6b b1 ad 30 c2 ac 87 55 25 ef |..U.].k..0...U%.| | f1 8d 49 52 eb 66 0c a4 be c2 63 bd 95 28 20 b0 |..IR.f....c..( .| | 76 c1 ce d0 a6 3d a5 a8 88 96 89 60 0b f4 17 1c |v....=.....`....| | b3 e7 f0 af 09 bd b4 76 aa 6b c8 d7 13 d0 fb df |.......v.k......| | 50 45 5f af 5a 8d 79 ca b6 82 0d 94 84 75 0a a4 |PE_.Z.y......u..| | eb 06 07 b2 ec ec d1 80 22 18 90 b2 fa f4 3c 2c |........".....<,| | 8c a9 80 6a 04 45 3a 82 c3 6b 6f 6a 98 aa 77 ac |...j.E:..koj..w.| | 56 a3 a5 f8 69 f6 e7 82 |V...i... | key expansion[136]: | 7e 66 a0 bc 57 60 aa 05 d5 a0 25 d5 07 99 fb ba |~f..W`....%.....| | 88 bd 55 a5 5d 85 6b b1 ad 30 c2 ac 87 55 25 ef |..U.].k..0...U%.| | f1 8d 49 52 eb 66 0c a4 be c2 63 bd 95 28 20 b0 |..IR.f....c..( .| | 76 c1 ce d0 a6 3d a5 a8 88 96 89 60 0b f4 17 1c |v....=.....`....| | b3 e7 f0 af 09 bd b4 76 aa 6b c8 d7 13 d0 fb df |.......v.k......| | 50 45 5f af 5a 8d 79 ca b6 82 0d 94 84 75 0a a4 |PE_.Z.y......u..| | eb 06 07 b2 ec ec d1 80 22 18 90 b2 fa f4 3c 2c |........".....<,| | 8c a9 80 6a 04 45 3a 82 c3 6b 6f 6a 98 aa 77 ac |...j.E:..koj..w.| | 56 a3 a5 f8 69 f6 e7 82 |V...i... | Client MAC key[20]: | 7e 66 a0 bc 57 60 aa 05 d5 a0 25 d5 07 99 fb ba |~f..W`....%.....| | 88 bd 55 a5 |..U. | Server MAC key[20]: | 5d 85 6b b1 ad 30 c2 ac 87 55 25 ef f1 8d 49 52 |].k..0...U%...IR| | eb 66 0c a4 |.f.. | Client Write key[32]: | be c2 63 bd 95 28 20 b0 76 c1 ce d0 a6 3d a5 a8 |..c..( .v....=..| | 88 96 89 60 0b f4 17 1c b3 e7 f0 af 09 bd b4 76 |...`...........v| Server Write key[32]: | aa 6b c8 d7 13 d0 fb df 50 45 5f af 5a 8d 79 ca |.k......PE_.Z.y.| | b6 82 0d 94 84 75 0a a4 eb 06 07 b2 ec ec d1 80 |.....u..........| Client Write IV[16]: | 22 18 90 b2 fa f4 3c 2c 8c a9 80 6a 04 45 3a 82 |".....<,...j.E:.| Server Write IV[16]: | c3 6b 6f 6a 98 aa 77 ac 56 a3 a5 f8 69 f6 e7 82 |.koj..w.V...i...| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: CAMELLIA256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: CAMELLIA256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 1b 03 13 ae fd a9 dc 38 b1 68 f2 fd d5 f7 08 48 |.......8.h.....H| | b6 97 f8 f5 5b 7d f8 db b8 63 37 cd b0 0b 4e 4f |....[}...c7...NO| | f2 59 77 af dc 1c 4b d8 0d 15 84 a7 ea 8b e0 4d |.Yw...K........M| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 0b 96 24 62 95 91 94 90 ec a0 3b 01 47 4b 99 51 |..$b......;.GK.Q| | 1f e3 13 78 56 81 e1 58 40 96 36 72 a3 f8 3b 94 |...xV..X@.6r..;.| | c7 6a 45 61 3f 31 d2 70 aa 2c 72 99 2c 65 a0 57 |.jEa?1.p.,r.,e.W| | 3c 10 7f e7 10 cf c3 af a6 c2 94 eb 6f ba b6 37 |<...........o..7| Plaintext[64]: | e0 8a 9c ba e0 b3 32 46 c8 c6 76 a9 56 a5 a1 b3 |......2F..v.V...| | 14 00 00 0c e3 15 e1 f4 44 37 52 ea 1c bb ff 8c |........D7R.....| | cb c7 c6 59 c4 53 60 8f e3 2c fe b6 35 7b c7 72 |...Y.S`..,..5{.r| | 78 9e e2 d4 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |x...............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | cb c7 c6 59 c4 53 60 8f e3 2c fe b6 35 7b c7 72 |...Y.S`..,..5{.r| | 78 9e e2 d4 |x... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #294 (first time) conversation = 0x7fca71def300, ssl_session = 0x7fca45bf2ea0 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 75 fd 12 94 c8 ca b7 fb 94 da 62 c9 fb 9f 43 ba |u.........b...C.| | 35 26 aa bd 4d 7f 22 24 6b 60 a5 8b 0f 7c ef 65 |5&..M."$k`...|.e| | 22 e3 89 96 cc fc 39 fe c6 4a a2 57 44 95 f0 4f |".....9..J.WD..O| | 76 1f 37 e6 6d 41 52 55 39 84 85 45 17 2f 24 ed |v.7.mARU9..E./$.| Plaintext[64]: | 19 9a c9 7d f7 0a 82 5f 36 6f 19 ba 64 fe ed 30 |...}..._6o..d..0| | 14 00 00 0c 2f ce 55 50 a4 89 5e 27 5e 2f 77 e5 |..../.UP..^'^/w.| | 88 b1 d6 31 2f 44 99 eb 3f c5 6c 7b 76 94 8d 55 |...1/D..?.l{v..U| | ed 2c 84 bb 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.,..............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 88 b1 d6 31 2f 44 99 eb 3f c5 6c 7b 76 94 8d 55 |...1/D..?.l{v..U| | ed 2c 84 bb |.,.. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #295 (first time) conversation = 0x7fca71def300, ssl_session = 0x7fca45bf2ea0 record: offset = 0, reported_length_remaining = 133 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 128, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 128 Ciphertext[128]: | 9a 43 84 16 63 40 06 c2 64 11 ff f6 09 88 99 d4 |.C..c@..d.......| | ec 48 b2 20 f7 b5 1e e1 08 b3 30 35 fd f0 b4 6d |.H. ......05...m| | c1 e1 91 b4 c8 b9 fb 37 f7 60 29 f7 45 19 9e 86 |.......7.`).E...| | 1d 3e 1e 99 a8 a4 1c 53 4f df 7c 83 49 bc af 8c |.>.....SO.|.I...| | a2 f4 e4 fa e9 b0 b9 22 a5 bc f1 ac f5 6e 25 09 |.......".....n%.| | c7 7b 5a d2 9f e5 fe 2c 5b 49 19 f7 bc 72 8d 64 |.{Z....,[I...r.d| | 80 79 81 4d 3a 78 cc 1d 0e cd e7 22 60 eb 69 4c |.y.M:x....."`.iL| | 21 90 0a e0 d3 54 9e 33 70 68 30 8e 0d 0e ef 1b |!....T.3ph0.....| Plaintext[128]: | 81 0f c6 55 32 f3 5a 6c b2 f5 a8 04 46 f1 eb 17 |...U2.Zl....F...| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 63 61 |Host: dhe-dss-ca| | 6d 65 6c 6c 69 61 32 35 36 2d 73 68 61 2e 6c 6f |mellia256-sha.lo| | 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey| | 6e 2e 6e 6c 3a 34 34 36 34 0d 0a 0d 0a be 24 31 |n.nl:4464.....$1| | 35 1f 16 ef c8 09 81 ae 8e 89 a7 11 2c c2 db a6 |5...........,...| | fc 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |................| ssl_decrypt_record found padding 14 final len 113 checking mac (len 77, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 40 46 b2 bd 08 3d 2d 35 ef 97 f0 50 a0 4b 7b 5e |@F...=-5...P.K{^| | 1a 47 61 96 |.Ga. | ssl_decrypt_record: mac failed association_find: TCP port 46579 found (nil) association_find: TCP port 4464 found 0x36305a0 dissect_ssl enter frame #296 (first time) conversation = 0x7fca71def300, ssl_session = 0x7fca45bf2ea0 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | 6b e8 82 e5 c2 7a 56 76 a5 fb f4 73 12 15 89 31 |k....zVv...s...1| | 64 95 48 68 e6 c2 e8 8b 4f 82 45 59 d4 b9 7d 6b |d.Hh....O.EY..}k| | d7 af 4d b4 f7 0e c1 3c 3a ac ab a9 67 b2 04 ba |..M....<:...g...| | 28 93 3a 52 85 8f b5 fe 5c cb 41 38 78 2b 1e f2 |(.:R....\.A8x+..| | 01 12 ca bb b9 5a 19 52 1d e5 1f ab 61 94 c9 ef |.....Z.R....a...| | ad 31 87 f4 f0 3c f4 f3 9c 3f 45 47 b0 48 c7 a0 |.1...<...?EG.H..| | 28 b7 6f 9a 92 c2 69 58 9c 56 8e a7 16 9f d5 cf |(.o...iX.V......| | 7a a8 63 70 d0 75 67 84 ce d2 73 be f5 7e 63 d3 |z.cp.ug...s..~c.| | 8f 42 1a f1 8b 92 0c 5a 04 68 79 49 4f cc 7a e7 |.B.....Z.hyIO.z.| | 52 49 5a a4 c7 99 65 fe a5 d0 c9 8c e1 56 76 2e |RIZ...e......Vv.| | 13 77 91 42 d6 77 ce 6f 4c a3 db 06 9e cd 53 17 |.w.B.w.oL.....S.| | 4a 72 ea a5 0a 26 c7 e7 e6 b3 6f 6a 8b c8 88 e2 |Jr...&....oj....| | d6 ef 98 a0 bf 9a df 28 55 ea 38 95 36 30 49 e4 |.......(U.8.60I.| | 65 03 61 cf 8a d5 dd d4 e1 ad 1f 1e 36 24 c4 e3 |e.a.........6$..| | 8d 0d f9 e1 8c e8 40 98 44 56 0a f8 88 49 31 2b |......@.DV...I1+| | c5 15 1f 4e 58 54 21 5f 20 65 06 88 e4 4e f3 05 |...NXT!_ e...N..| | 42 83 94 9b e3 94 ea d2 63 9e c3 1b 73 15 58 61 |B.......c...s.Xa| | f0 5a a9 49 e5 10 e0 af 22 49 8b 6c e2 f5 8e 5c |.Z.I...."I.l...\| | 62 73 a3 ad 76 ee f3 5a 52 92 0d 68 f8 ec 72 62 |bs..v..ZR..h..rb| | 0e 6e 88 42 84 66 72 32 31 a0 eb 36 f6 33 94 18 |.n.B.fr21..6.3..| | 49 94 3e d2 dd 5a 17 c6 54 c9 66 b0 01 62 76 eb |I.>..Z..T.f..bv.| | 82 eb d6 d0 f1 f3 85 0d c5 87 f0 1c 49 59 25 fa |............IY%.| | 8d 43 6a a5 6f 5a 4a 0a 2a 3d cf 4f 1a 31 0d c8 |.Cj.oZJ.*=.O.1..| | 7d 9d 2b ec f3 39 2b 04 9e 91 e3 5e c7 b5 9c 35 |}.+..9+....^...5| | 8a 4f a1 6e 0c 91 e7 98 d2 73 fa 3a 73 f2 3c 99 |.O.n.....s.:s.<.| Plaintext[400]: | ff 2c a7 66 a5 c7 df e2 a0 ad 8f 9d 24 1e 0d 5f |.,.f........$.._| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:| | 31 31 3a 33 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:30 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 38 37 20 2d 20 44 48 45 2d 44 |x00,0x87 - DHE-D| | 53 53 2d 43 41 4d 45 4c 4c 49 41 32 35 36 2d 53 |SS-CAMELLIA256-S| | 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc| | 3d 43 61 6d 65 6c 6c 69 61 28 32 35 36 29 20 4d |=Camellia(256) M| | 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1| | 84 20 dd 1a 5d aa 4c f5 f8 3b bd fc f5 b9 6a 25 |. ..].L..;....j%| | 93 e6 5f c8 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.._.............| ssl_decrypt_record found padding 11 final len 388 checking mac (len 352, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | ae 29 50 a8 b9 8b 36 97 e7 3b d4 5f d8 e0 8a a5 |.)P...6..;._....| | 30 e5 c5 e6 |0... | ssl_decrypt_record: mac failed association_find: TCP port 4464 found 0x36305a0 dissect_ssl enter frame #297 (first time) conversation = 0x7fca71def300, ssl_session = 0x7fca45bf2ea0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | ec e9 5a 96 6b 6c d5 d9 7f c1 fc 9c 3a a1 91 76 |..Z.kl......:..v| | d0 2f 62 4f ac ab 1d a7 a0 9d 42 8e 09 91 81 01 |./bO......B.....| | 66 8e e6 e5 07 43 6a f8 4d cf b8 9d 8e 38 5b c9 |f....Cj.M....8[.| Plaintext[48]: | aa ce 7e 1a 9d bd be 52 d0 0c ee ff c0 5a df 12 |..~....R.....Z..| | 01 00 ab dc c8 a6 da 20 4c ce 51 25 d3 44 86 59 |....... L.Q%.D.Y| | da 55 da 52 c7 be 09 09 09 09 09 09 09 09 09 09 |.U.R............| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | ab dc c8 a6 da 20 4c ce 51 25 d3 44 86 59 da 55 |..... L.Q%.D.Y.U| | da 52 c7 be |.R.. | ssl_decrypt_record: mac ok dissect_ssl enter frame #299 (first time) conversation = 0x7fca71def300, ssl_session = 0x7fca45bf2ea0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 81 79 78 6a 19 33 37 a7 10 2f f5 57 3f ee 41 02 |.yxj.37../.W?.A.| | 1f 0d 52 c0 aa 93 f2 48 6a 54 4d 48 78 59 c8 bc |..R....HjTMHxY..| | 30 aa 2d e3 ed a0 d7 5f 4b 94 ea e6 2f a9 1a 03 |0.-...._K.../...| Plaintext[48]: | 75 0c 52 4c 5d a6 a7 e0 fa 75 00 bb 0d 3c c9 6d |u.RL]....u...<.m| | 01 00 8c b1 63 cb 89 ef 73 ca 3c 63 ab 79 a9 cc |....c...s. state 0x01 dissect_ssl enter frame #306 (first time) conversation = 0x7fca71def5a8, ssl_session = 0x7fca45bf53a0 record: offset = 0, reported_length_remaining = 1416 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0088 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 1b 03 13 ae fd a9 dc 38 b1 68 f2 fd d5 f7 08 48 |.......8.h.....H| | b6 97 f8 f5 5b 7d f8 db b8 63 37 cd b0 0b 4e 4f |....[}...c7...NO| | f2 59 77 af dc 1c 4b d8 0d 15 84 a7 ea 8b e0 4d |.Yw...K........M| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f2 33 0e a5 ed f6 5f 3f bf ec e5 9d 50 33 d2 91 |.3...._?....P3..| | 5b 04 62 5c a5 bb 93 40 34 ea a9 86 eb 52 34 c2 |[.b\...@4....R4.| | f2 8e 1f 7f 2a 7a ca 2e 9c 71 ff b4 7e d2 d8 46 |....*z...q..~..F| | d1 1d 72 3e 2b 9d 4a 44 e4 1c 19 ec d8 |..r>+.JD..... | hash out[136]: | ee 59 42 39 60 de 5d f6 c6 92 53 13 cb 02 a4 c4 |.YB9`.]...S.....| | 17 72 89 d5 c0 ef fd a6 27 93 bd 49 47 db b3 3d |.r......'..IG..=| | 9f 21 e4 a6 c1 8e 26 fd 5e fa 9e 87 d8 a7 81 5f |.!....&.^......_| | 8d 35 ab 15 3a 32 5a a4 74 62 76 88 14 e6 0e 4b |.5..:2Z.tbv....K| | d6 6a 86 8b f9 9e a0 0d aa 10 11 0e d2 31 bb 26 |.j...........1.&| | f5 ad d0 d1 87 b8 55 6d d3 a0 85 f1 48 22 fd f4 |......Um....H"..| | 24 77 58 67 8b 6c f7 75 62 85 63 c6 9c cf 2e 78 |$wXg.l.ub.c....x| | e7 c0 a2 9d 62 a9 1f 79 f1 3a e7 3f ea e2 8a 21 |....b..y.:.?...!| | 0b 1e 12 39 c1 55 5d a5 |...9.U]. | PRF out[136]: | ee 59 42 39 60 de 5d f6 c6 92 53 13 cb 02 a4 c4 |.YB9`.]...S.....| | 17 72 89 d5 c0 ef fd a6 27 93 bd 49 47 db b3 3d |.r......'..IG..=| | 9f 21 e4 a6 c1 8e 26 fd 5e fa 9e 87 d8 a7 81 5f |.!....&.^......_| | 8d 35 ab 15 3a 32 5a a4 74 62 76 88 14 e6 0e 4b |.5..:2Z.tbv....K| | d6 6a 86 8b f9 9e a0 0d aa 10 11 0e d2 31 bb 26 |.j...........1.&| | f5 ad d0 d1 87 b8 55 6d d3 a0 85 f1 48 22 fd f4 |......Um....H"..| | 24 77 58 67 8b 6c f7 75 62 85 63 c6 9c cf 2e 78 |$wXg.l.ub.c....x| | e7 c0 a2 9d 62 a9 1f 79 f1 3a e7 3f ea e2 8a 21 |....b..y.:.?...!| | 0b 1e 12 39 c1 55 5d a5 |...9.U]. | key expansion[136]: | ee 59 42 39 60 de 5d f6 c6 92 53 13 cb 02 a4 c4 |.YB9`.]...S.....| | 17 72 89 d5 c0 ef fd a6 27 93 bd 49 47 db b3 3d |.r......'..IG..=| | 9f 21 e4 a6 c1 8e 26 fd 5e fa 9e 87 d8 a7 81 5f |.!....&.^......_| | 8d 35 ab 15 3a 32 5a a4 74 62 76 88 14 e6 0e 4b |.5..:2Z.tbv....K| | d6 6a 86 8b f9 9e a0 0d aa 10 11 0e d2 31 bb 26 |.j...........1.&| | f5 ad d0 d1 87 b8 55 6d d3 a0 85 f1 48 22 fd f4 |......Um....H"..| | 24 77 58 67 8b 6c f7 75 62 85 63 c6 9c cf 2e 78 |$wXg.l.ub.c....x| | e7 c0 a2 9d 62 a9 1f 79 f1 3a e7 3f ea e2 8a 21 |....b..y.:.?...!| | 0b 1e 12 39 c1 55 5d a5 |...9.U]. | Client MAC key[20]: | ee 59 42 39 60 de 5d f6 c6 92 53 13 cb 02 a4 c4 |.YB9`.]...S.....| | 17 72 89 d5 |.r.. | Server MAC key[20]: | c0 ef fd a6 27 93 bd 49 47 db b3 3d 9f 21 e4 a6 |....'..IG..=.!..| | c1 8e 26 fd |..&. | Client Write key[32]: | 5e fa 9e 87 d8 a7 81 5f 8d 35 ab 15 3a 32 5a a4 |^......_.5..:2Z.| | 74 62 76 88 14 e6 0e 4b d6 6a 86 8b f9 9e a0 0d |tbv....K.j......| Server Write key[32]: | aa 10 11 0e d2 31 bb 26 f5 ad d0 d1 87 b8 55 6d |.....1.&......Um| | d3 a0 85 f1 48 22 fd f4 24 77 58 67 8b 6c f7 75 |....H"..$wXg.l.u| Client Write IV[16]: | 62 85 63 c6 9c cf 2e 78 e7 c0 a2 9d 62 a9 1f 79 |b.c....x....b..y| Server Write IV[16]: | f1 3a e7 3f ea e2 8a 21 0b 1e 12 39 c1 55 5d a5 |.:.?...!...9.U].| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: CAMELLIA256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: CAMELLIA256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 1353 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 541 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 527, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407 record: offset = 1407, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416 dissect_ssl enter frame #308 (first time) conversation = 0x7fca71def5a8, ssl_session = 0x7fca45bf53a0 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2f28e1f7f2a7aca2e9c71ffb47ed2d846d11d723e2b... looking for RSA pre-master00804d88cc113cda54ce368ddfcda4f342764a662dfa3a39... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a88b3723405ec9f6d 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2ed4699771feefd3c969e60a3a051977784c4581a0c414211a97aad6e 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f28e1f7f2a7aca2e9c71ffb47ed2d846d11d723e2b9d4a44e41c19ecd8 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 84 c3 e2 c9 72 70 90 8b 22 af 4a 2d 26 9f 7c 0a |....rp..".J-&.|.| | 63 75 b1 84 fe 4b 36 5d af c8 ba 92 57 78 72 7a |cu...K6]....Wxrz| | 6d 29 6f 11 e9 b9 4c b9 64 36 42 e6 5d c4 7e 56 |m)o...L.d6B.].~V| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f2 33 0e a5 ed f6 5f 3f bf ec e5 9d 50 33 d2 91 |.3...._?....P3..| | 5b 04 62 5c a5 bb 93 40 34 ea a9 86 eb 52 34 c2 |[.b\...@4....R4.| | f2 8e 1f 7f 2a 7a ca 2e 9c 71 ff b4 7e d2 d8 46 |....*z...q..~..F| | d1 1d 72 3e 2b 9d 4a 44 e4 1c 19 ec d8 |..r>+.JD..... | hash out[136]: | fc 4f 05 ba 05 a0 61 16 1f 61 4b 91 cd c1 05 3c |.O....a..aK....<| | f3 fb 29 20 d1 fd 81 df cb 96 f4 bf 4e da d1 d0 |..) ........N...| | 83 2f 6a 20 23 95 fe 65 63 e6 71 a4 33 05 33 0b |./j #..ec.q.3.3.| | 49 b9 0d 1e ac b2 b6 37 c5 e8 2b 8d 7c 81 67 27 |I......7..+.|.g'| | 9e e4 cd 8e ab b2 17 5a 94 b6 db 45 fa 10 2c 26 |.......Z...E..,&| | 84 e0 5c 29 fb d7 35 02 d2 fe 9b f0 92 08 67 e4 |..\)..5.......g.| | 1d 6e 0e 3f 3f cb a3 83 45 92 2c 04 7f 9f 69 e6 |.n.??...E.,...i.| | 38 d6 89 74 29 b6 15 5c b8 f4 26 a6 42 50 4f e5 |8..t)..\..&.BPO.| | cc b0 49 9e 3e 77 c9 bd |..I.>w.. | PRF out[136]: | fc 4f 05 ba 05 a0 61 16 1f 61 4b 91 cd c1 05 3c |.O....a..aK....<| | f3 fb 29 20 d1 fd 81 df cb 96 f4 bf 4e da d1 d0 |..) ........N...| | 83 2f 6a 20 23 95 fe 65 63 e6 71 a4 33 05 33 0b |./j #..ec.q.3.3.| | 49 b9 0d 1e ac b2 b6 37 c5 e8 2b 8d 7c 81 67 27 |I......7..+.|.g'| | 9e e4 cd 8e ab b2 17 5a 94 b6 db 45 fa 10 2c 26 |.......Z...E..,&| | 84 e0 5c 29 fb d7 35 02 d2 fe 9b f0 92 08 67 e4 |..\)..5.......g.| | 1d 6e 0e 3f 3f cb a3 83 45 92 2c 04 7f 9f 69 e6 |.n.??...E.,...i.| | 38 d6 89 74 29 b6 15 5c b8 f4 26 a6 42 50 4f e5 |8..t)..\..&.BPO.| | cc b0 49 9e 3e 77 c9 bd |..I.>w.. | key expansion[136]: | fc 4f 05 ba 05 a0 61 16 1f 61 4b 91 cd c1 05 3c |.O....a..aK....<| | f3 fb 29 20 d1 fd 81 df cb 96 f4 bf 4e da d1 d0 |..) ........N...| | 83 2f 6a 20 23 95 fe 65 63 e6 71 a4 33 05 33 0b |./j #..ec.q.3.3.| | 49 b9 0d 1e ac b2 b6 37 c5 e8 2b 8d 7c 81 67 27 |I......7..+.|.g'| | 9e e4 cd 8e ab b2 17 5a 94 b6 db 45 fa 10 2c 26 |.......Z...E..,&| | 84 e0 5c 29 fb d7 35 02 d2 fe 9b f0 92 08 67 e4 |..\)..5.......g.| | 1d 6e 0e 3f 3f cb a3 83 45 92 2c 04 7f 9f 69 e6 |.n.??...E.,...i.| | 38 d6 89 74 29 b6 15 5c b8 f4 26 a6 42 50 4f e5 |8..t)..\..&.BPO.| | cc b0 49 9e 3e 77 c9 bd |..I.>w.. | Client MAC key[20]: | fc 4f 05 ba 05 a0 61 16 1f 61 4b 91 cd c1 05 3c |.O....a..aK....<| | f3 fb 29 20 |..) | Server MAC key[20]: | d1 fd 81 df cb 96 f4 bf 4e da d1 d0 83 2f 6a 20 |........N..../j | | 23 95 fe 65 |#..e | Client Write key[32]: | 63 e6 71 a4 33 05 33 0b 49 b9 0d 1e ac b2 b6 37 |c.q.3.3.I......7| | c5 e8 2b 8d 7c 81 67 27 9e e4 cd 8e ab b2 17 5a |..+.|.g'.......Z| Server Write key[32]: | 94 b6 db 45 fa 10 2c 26 84 e0 5c 29 fb d7 35 02 |...E..,&..\)..5.| | d2 fe 9b f0 92 08 67 e4 1d 6e 0e 3f 3f cb a3 83 |......g..n.??...| Client Write IV[16]: | 45 92 2c 04 7f 9f 69 e6 38 d6 89 74 29 b6 15 5c |E.,...i.8..t)..\| Server Write IV[16]: | b8 f4 26 a6 42 50 4f e5 cc b0 49 9e 3e 77 c9 bd |..&.BPO...I.>w..| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: CAMELLIA256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: CAMELLIA256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 84 c3 e2 c9 72 70 90 8b 22 af 4a 2d 26 9f 7c 0a |....rp..".J-&.|.| | 63 75 b1 84 fe 4b 36 5d af c8 ba 92 57 78 72 7a |cu...K6]....Wxrz| | 6d 29 6f 11 e9 b9 4c b9 64 36 42 e6 5d c4 7e 56 |m)o...L.d6B.].~V| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 1a 55 88 c1 9f 0f d6 5e da 3c 73 ef c6 17 a1 3c |.U.....^.\.....vPY,.j| | 14 00 00 0c 4b f0 5f b7 32 41 3a 9d 41 51 4e cc |....K._.2A:.AQN.| | d4 a5 63 5b 3d 79 04 49 19 81 53 5d 7d ee 7c df |..c[=y.I..S]}.|.| | 6c 1a 8e 93 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |l...............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | d4 a5 63 5b 3d 79 04 49 19 81 53 5d 7d ee 7c df |..c[=y.I..S]}.|.| | 6c 1a 8e 93 |l... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #309 (first time) conversation = 0x7fca71def5a8, ssl_session = 0x7fca45bf53a0 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | b2 15 62 04 f5 45 46 d5 54 55 1c d5 d7 e0 97 93 |..b..EF.TU......| | 33 14 84 c4 cd 46 f8 99 80 d1 a3 89 b1 21 78 f2 |3....F.......!x.| | e5 0a a8 c7 9e aa be 85 cf bf 40 be a6 42 91 f5 |..........@..B..| | f8 47 bd 04 59 77 0c b9 ed 11 69 54 f9 de dc 96 |.G..Yw....iT....| Plaintext[64]: | 47 b1 37 89 df e1 0c 1c 7b 44 94 bd 72 45 c4 65 |G.7.....{D..rE.e| | 14 00 00 0c fa e6 ee 90 89 c9 c9 c9 0f e8 93 6d |...............m| | ac 18 89 13 3b 0b f7 20 17 f2 69 dd 4d eb 97 82 |....;.. ..i.M...| | e8 4f 23 6c 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.O#l............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | ac 18 89 13 3b 0b f7 20 17 f2 69 dd 4d eb 97 82 |....;.. ..i.M...| | e8 4f 23 6c |.O#l | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #310 (first time) conversation = 0x7fca71def5a8, ssl_session = 0x7fca45bf53a0 record: offset = 0, reported_length_remaining = 133 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 128, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 128 Ciphertext[128]: | 1a b9 46 1f 0a d9 7b ec 5d bf ee 9f da d4 33 17 |..F...{.].....3.| | 0e ed 40 db 88 94 87 02 c6 d2 1f 27 95 2d 4c 11 |..@........'.-L.| | 03 39 00 df 5d 23 6b 13 5e b4 9f ef 31 8c 70 30 |.9..]#k.^...1.p0| | 19 44 a4 6a 3f 33 a1 bd 9a a4 e3 fb 32 29 20 11 |.D.j?3......2) .| | 09 9f 57 86 f8 de 05 40 38 19 89 37 79 45 96 20 |..W....@8..7yE. | | a3 e9 92 71 7f 1b 15 51 c4 22 a5 71 6e e6 31 77 |...q...Q.".qn.1w| | 33 ac 7b 27 99 ec 67 9b 76 cf e9 2d 60 03 9a 53 |3.{'..g.v..-`..S| | a5 49 0b 8a da dc 9d aa 09 66 ab 60 86 6f 46 47 |.I.......f.`.oFG| Plaintext[128]: | e6 9c e9 51 f3 1e dc 4d 9e 79 0c 93 97 17 b7 c4 |...Q...M.y......| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 63 61 |Host: dhe-rsa-ca| | 6d 65 6c 6c 69 61 32 35 36 2d 73 68 61 2e 6c 6f |mellia256-sha.lo| | 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey| | 6e 2e 6e 6c 3a 34 34 36 35 0d 0a 0d 0a fa 96 cf |n.nl:4465.......| | 76 c7 99 a2 66 67 44 4e 35 14 14 76 14 c8 3c 1a |v...fgDN5..v..<.| | 07 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |................| ssl_decrypt_record found padding 14 final len 113 checking mac (len 77, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 80 b7 f4 87 73 1a 76 ba d9 2d cc db 86 2e 67 17 |....s.v..-....g.| | 3b 35 43 1f |;5C. | ssl_decrypt_record: mac failed association_find: TCP port 56921 found (nil) association_find: TCP port 4465 found 0x36d4d60 dissect_ssl enter frame #311 (first time) conversation = 0x7fca71def5a8, ssl_session = 0x7fca45bf53a0 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | 22 dd 8c 13 9e c8 ca 43 8d da cc 0f 19 70 ec 4d |"......C.....p.M| | 34 fe c2 32 a4 e7 f5 fd 12 ac dd 0e 98 e5 a8 c5 |4..2............| | 38 5a da ba e5 ac 6a 4b 15 69 e5 59 19 22 7e e3 |8Z....jK.i.Y."~.| | dd db b6 cf 27 f9 8a 6b 5c c6 18 a5 b6 23 d0 69 |....'..k\....#.i| | cc 91 0d ce d4 d0 a3 18 d8 7b c8 48 fb d5 c3 6d |.........{.H...m| | b4 0c fd 0a 1e c6 f6 95 56 42 7a ca 57 6e eb 88 |........VBz.Wn..| | 10 b7 13 8b a8 50 c4 73 0e b7 e2 8d 17 a7 21 86 |.....P.s......!.| | de 32 1e 70 90 21 4c 7c 25 cc 52 d5 ef 82 8d 22 |.2.p.!L|%.R...."| | 1c 83 0e a5 4b ba 09 0d 1f 9c d3 98 40 1f 78 63 |....K.......@.xc| | f3 80 0a 1c 8a 76 57 df 41 dc 12 b4 09 66 5e 4a |.....vW.A....f^J| | 0e 8e b6 67 ff 3f 89 9d da d3 0d 05 0b bf 42 8d |...g.?........B.| | c1 9f d0 fe f5 81 dd 99 7f 8b 32 4c 61 63 aa 53 |..........2Lac.S| | 54 fa b1 9b 74 b5 00 d1 64 12 22 e2 dd a6 34 9f |T...t...d."...4.| | b8 bb af 5d f1 d2 0a 82 7a db 78 c3 a0 58 d6 d7 |...]....z.x..X..| | 40 20 56 ce 24 5c 2f 7f a8 12 1a ed 90 72 b1 7a |@ V.$\/......r.z| | 00 97 89 31 0c a1 7e c3 30 7c 59 a1 64 8b e4 ca |...1..~.0|Y.d...| | 2c ea b8 db b8 2e cd 18 bf f0 9a 15 8e 05 20 99 |,............. .| | 95 a8 b0 04 e8 20 51 e4 6d 89 13 00 3d 73 7e 15 |..... Q.m...=s~.| | fa 1c 4b 82 c9 d1 fa 27 74 63 b7 a4 55 88 65 cb |..K....'tc..U.e.| | 90 fd ba 63 13 4f c2 40 21 22 b2 41 ad 38 c1 16 |...c.O.@!".A.8..| | 34 d8 63 a0 9a a6 47 ac 85 01 59 9d 04 f0 48 bf |4.c...G...Y...H.| | a4 26 93 2d 55 ed 5e f2 a0 27 dc 06 7a 47 ec 4f |.&.-U.^..'..zG.O| | de bf c8 2a b0 a0 74 48 73 88 a3 34 58 d4 0a b5 |...*..tHs..4X...| | 28 01 18 83 45 6d da 1b e3 31 f8 31 da 16 a0 0f |(...Em...1.1....| | c7 a8 46 65 29 f0 59 c2 8b 95 96 48 cc a8 4d ee |..Fe).Y....H..M.| Plaintext[400]: | 4c 82 27 c0 40 13 7f 8a 53 05 38 36 c2 2d 1b 1d |L.'.@...S.86.-..| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:| | 31 31 3a 33 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:30 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 38 38 20 2d 20 44 48 45 2d 52 |x00,0x88 - DHE-R| | 53 41 2d 43 41 4d 45 4c 4c 49 41 32 35 36 2d 53 |SA-CAMELLIA256-S| | 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 43 61 6d 65 6c 6c 69 61 28 32 35 36 29 20 4d |=Camellia(256) M| | 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1| | 44 50 90 5b 6a 0e 27 0e 1c 80 27 bc ce 00 01 e3 |DP.[j.'...'.....| | 7a 0f 53 6a 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |z.Sj............| ssl_decrypt_record found padding 11 final len 388 checking mac (len 352, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 77 be 30 bb e6 7c 2e c4 13 bf 69 ec de 97 50 3c |w.0..|....i...P<| | 19 9f 5c 05 |..\. | ssl_decrypt_record: mac failed association_find: TCP port 4465 found 0x36d4d60 dissect_ssl enter frame #312 (first time) conversation = 0x7fca71def5a8, ssl_session = 0x7fca45bf53a0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 3b 08 67 d6 c7 54 6e 2d d4 8b 0e 88 cf 90 a1 f8 |;.g..Tn-........| | c7 ab 6f 0b 4a 3b bd 98 33 58 b1 88 0f ce e9 7e |..o.J;..3X.....~| | 13 63 3f 70 b7 cb 4e e7 d5 df 69 8e 32 66 5c ac |.c?p..N...i.2f\.| Plaintext[48]: | 22 61 6e 6b 1b 54 86 db 38 b3 75 7b 8b 96 de 52 |"ank.T..8.u{...R| | 01 00 70 73 7e 89 f6 a6 ec c9 a1 1c 62 ce dc ee |..ps~.......b...| | b0 60 ee a4 59 d0 09 09 09 09 09 09 09 09 09 09 |.`..Y...........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 70 73 7e 89 f6 a6 ec c9 a1 1c 62 ce dc ee b0 60 |ps~.......b....`| | ee a4 59 d0 |..Y. | ssl_decrypt_record: mac ok dissect_ssl enter frame #314 (first time) conversation = 0x7fca71def5a8, ssl_session = 0x7fca45bf53a0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | ea b4 de 97 0c 0a 68 1c 8d bf ee 71 6f 17 dd 85 |......h....qo...| | ef 83 97 42 b5 4e 7a 2d 8e 05 ce c1 94 f9 6a 3c |...B.Nz-......j<| | bb 49 5b b2 0d 64 b5 a2 02 77 b9 eb 58 50 cf ac |.I[..d...w..XP..| Plaintext[48]: | a4 eb 12 db 0b 34 01 d4 d8 26 e0 17 c7 35 24 46 |.....4...&...5$F| | 01 00 90 e9 3f e7 a2 40 73 45 9d f4 fc 26 5e 6c |....?..@sE...&^l| | 9d 9a be 82 fd 5d 09 09 09 09 09 09 09 09 09 09 |.....]..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 90 e9 3f e7 a2 40 73 45 9d f4 fc 26 5e 6c 9d 9a |..?..@sE...&^l..| | be 82 fd 5d |...] | ssl_decrypt_record: mac ok dissect_ssl enter frame #319 (first time) ssl_session_init: initializing ptr 0x7fca45bf78a0 size 688 conversation = 0x7fca71def850, ssl_session = 0x7fca45bf78a0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 47266 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4470 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #321 (first time) conversation = 0x7fca71def850, ssl_session = 0x7fca45bf78a0 record: offset = 0, reported_length_remaining = 884 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0096 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 84 c3 e2 c9 72 70 90 8b 22 af 4a 2d 26 9f 7c 0a |....rp..".J-&.|.| | 63 75 b1 84 fe 4b 36 5d af c8 ba 92 57 78 72 7a |cu...K6]....Wxrz| | 6d 29 6f 11 e9 b9 4c b9 64 36 42 e6 5d c4 7e 56 |m)o...L.d6B.].~V| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f2 96 8a a5 1a 4e a2 8b ca b9 08 d2 a0 a5 01 1e |.....N..........| | b8 47 de 99 e3 8f 01 4d b5 35 71 e9 2d 52 34 c2 |.G.....M.5q.-R4.| | f2 3b b1 ff 6b 1a 56 7c ab 27 45 81 ce 4a e5 9f |.;..k.V|.'E..J..| | fe 8a 2e 43 ae 2d ef e2 af d7 88 66 33 |...C.-.....f3 | hash out[104]: | a6 d0 91 1e 36 3b fa 22 81 e1 e0 cc 1b cb f3 d7 |....6;."........| | 34 00 f3 7b 6b a1 95 e1 72 69 06 79 f7 4d 87 93 |4..{k...ri.y.M..| | b7 28 92 68 ef 09 93 ea 55 a3 ea 0a 9a 28 cc 32 |.(.h....U....(.2| | ed 05 0a ee 22 75 59 dd 91 a6 2d 95 96 6b 22 9f |...."uY...-..k".| | e4 7a 01 df f9 d2 20 a8 7a 73 50 a1 59 2a 18 1f |.z.... .zsP.Y*..| | 30 18 5e ea c0 6b 07 d4 95 92 2a 29 ab 1b 6c f8 |0.^..k....*)..l.| | 7a 8c 5b 75 df ee a8 4b |z.[u...K | PRF out[104]: | a6 d0 91 1e 36 3b fa 22 81 e1 e0 cc 1b cb f3 d7 |....6;."........| | 34 00 f3 7b 6b a1 95 e1 72 69 06 79 f7 4d 87 93 |4..{k...ri.y.M..| | b7 28 92 68 ef 09 93 ea 55 a3 ea 0a 9a 28 cc 32 |.(.h....U....(.2| | ed 05 0a ee 22 75 59 dd 91 a6 2d 95 96 6b 22 9f |...."uY...-..k".| | e4 7a 01 df f9 d2 20 a8 7a 73 50 a1 59 2a 18 1f |.z.... .zsP.Y*..| | 30 18 5e ea c0 6b 07 d4 95 92 2a 29 ab 1b 6c f8 |0.^..k....*)..l.| | 7a 8c 5b 75 df ee a8 4b |z.[u...K | key expansion[104]: | a6 d0 91 1e 36 3b fa 22 81 e1 e0 cc 1b cb f3 d7 |....6;."........| | 34 00 f3 7b 6b a1 95 e1 72 69 06 79 f7 4d 87 93 |4..{k...ri.y.M..| | b7 28 92 68 ef 09 93 ea 55 a3 ea 0a 9a 28 cc 32 |.(.h....U....(.2| | ed 05 0a ee 22 75 59 dd 91 a6 2d 95 96 6b 22 9f |...."uY...-..k".| | e4 7a 01 df f9 d2 20 a8 7a 73 50 a1 59 2a 18 1f |.z.... .zsP.Y*..| | 30 18 5e ea c0 6b 07 d4 95 92 2a 29 ab 1b 6c f8 |0.^..k....*)..l.| | 7a 8c 5b 75 df ee a8 4b |z.[u...K | Client MAC key[20]: | a6 d0 91 1e 36 3b fa 22 81 e1 e0 cc 1b cb f3 d7 |....6;."........| | 34 00 f3 7b |4..{ | Server MAC key[20]: | 6b a1 95 e1 72 69 06 79 f7 4d 87 93 b7 28 92 68 |k...ri.y.M...(.h| | ef 09 93 ea |.... | Client Write key[16]: | 55 a3 ea 0a 9a 28 cc 32 ed 05 0a ee 22 75 59 dd |U....(.2...."uY.| Server Write key[16]: | 91 a6 2d 95 96 6b 22 9f e4 7a 01 df f9 d2 20 a8 |..-..k"..z.... .| Client Write IV[16]: | 7a 73 50 a1 59 2a 18 1f 30 18 5e ea c0 6b 07 d4 |zsP.Y*..0.^..k..| Server Write IV[16]: | 95 92 2a 29 ab 1b 6c f8 7a 8c 5b 75 df ee a8 4b |..*)..l.z.[u...K| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: SEED decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: SEED decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 821 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884 dissect_ssl enter frame #323 (first time) conversation = 0x7fca71def850, ssl_session = 0x7fca45bf78a0 record: offset = 0, reported_length_remaining = 342 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 262, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2f23bb1ff6b1a567cab274581ce4ae59ffe8a2e43ae... looking for RSA pre-master3268780686b49c1ee5fe55a7ec53579d8d7d715a5c8b4d15... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a88b3723405ec9f6d 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2ed4699771feefd3c969e60a3a051977784c4581a0c414211a97aad6e 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f28e1f7f2a7aca2e9c71ffb47ed2d846d11d723e2b9d4a44e41c19ecd8 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2330ea5edf65f3fbfece59d5033d2915b04625ca5bb934034eaa986eb 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f23bb1ff6b1a567cab274581ce4ae59ffe8a2e43ae2defe2afd7886633 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 83 a3 38 e2 e5 74 ed de 13 cd 97 3b 3e 3b 53 ee |..8..t.....;>;S.| | 76 fa 23 ae 64 7c e6 07 b9 ed 3a 69 1e dd 60 fa |v.#.d|....:i..`.| | e4 00 b8 76 72 9b 99 e2 aa bc ec 18 8a 72 b9 60 |...vr........r.`| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f2 96 8a a5 1a 4e a2 8b ca b9 08 d2 a0 a5 01 1e |.....N..........| | b8 47 de 99 e3 8f 01 4d b5 35 71 e9 2d 52 34 c2 |.G.....M.5q.-R4.| | f2 3b b1 ff 6b 1a 56 7c ab 27 45 81 ce 4a e5 9f |.;..k.V|.'E..J..| | fe 8a 2e 43 ae 2d ef e2 af d7 88 66 33 |...C.-.....f3 | hash out[104]: | 33 66 f7 d0 f6 00 5a 02 6c b2 75 b4 a2 06 2c d7 |3f....Z.l.u...,.| | be 60 00 c8 ef 46 2b 75 39 8e 35 cc 75 3b c0 66 |.`...F+u9.5.u;.f| | 1a 04 07 67 5d 2f 88 63 aa 9e 5e e3 a2 52 b6 c9 |...g]/.c..^..R..| | ec 00 d5 2c a4 d6 96 7a 60 b6 ee e9 76 fc 5c 8b |...,...z`...v.\.| | 3a 92 81 47 7a db 36 ef a8 80 f0 8f a9 15 31 9c |:..Gz.6.......1.| | 53 7e 8d 7f 6f cb d5 ef c0 17 34 1e 35 84 9b 2b |S~..o.....4.5..+| | 5b ce 49 bc 39 37 22 bc |[.I.97". | PRF out[104]: | 33 66 f7 d0 f6 00 5a 02 6c b2 75 b4 a2 06 2c d7 |3f....Z.l.u...,.| | be 60 00 c8 ef 46 2b 75 39 8e 35 cc 75 3b c0 66 |.`...F+u9.5.u;.f| | 1a 04 07 67 5d 2f 88 63 aa 9e 5e e3 a2 52 b6 c9 |...g]/.c..^..R..| | ec 00 d5 2c a4 d6 96 7a 60 b6 ee e9 76 fc 5c 8b |...,...z`...v.\.| | 3a 92 81 47 7a db 36 ef a8 80 f0 8f a9 15 31 9c |:..Gz.6.......1.| | 53 7e 8d 7f 6f cb d5 ef c0 17 34 1e 35 84 9b 2b |S~..o.....4.5..+| | 5b ce 49 bc 39 37 22 bc |[.I.97". | key expansion[104]: | 33 66 f7 d0 f6 00 5a 02 6c b2 75 b4 a2 06 2c d7 |3f....Z.l.u...,.| | be 60 00 c8 ef 46 2b 75 39 8e 35 cc 75 3b c0 66 |.`...F+u9.5.u;.f| | 1a 04 07 67 5d 2f 88 63 aa 9e 5e e3 a2 52 b6 c9 |...g]/.c..^..R..| | ec 00 d5 2c a4 d6 96 7a 60 b6 ee e9 76 fc 5c 8b |...,...z`...v.\.| | 3a 92 81 47 7a db 36 ef a8 80 f0 8f a9 15 31 9c |:..Gz.6.......1.| | 53 7e 8d 7f 6f cb d5 ef c0 17 34 1e 35 84 9b 2b |S~..o.....4.5..+| | 5b ce 49 bc 39 37 22 bc |[.I.97". | Client MAC key[20]: | 33 66 f7 d0 f6 00 5a 02 6c b2 75 b4 a2 06 2c d7 |3f....Z.l.u...,.| | be 60 00 c8 |.`.. | Server MAC key[20]: | ef 46 2b 75 39 8e 35 cc 75 3b c0 66 1a 04 07 67 |.F+u9.5.u;.f...g| | 5d 2f 88 63 |]/.c | Client Write key[16]: | aa 9e 5e e3 a2 52 b6 c9 ec 00 d5 2c a4 d6 96 7a |..^..R.....,...z| Server Write key[16]: | 60 b6 ee e9 76 fc 5c 8b 3a 92 81 47 7a db 36 ef |`...v.\.:..Gz.6.| Client Write IV[16]: | a8 80 f0 8f a9 15 31 9c 53 7e 8d 7f 6f cb d5 ef |......1.S~..o...| Server Write IV[16]: | c0 17 34 1e 35 84 9b 2b 5b ce 49 bc 39 37 22 bc |..4.5..+[.I.97".| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: SEED decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: SEED decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 83 a3 38 e2 e5 74 ed de 13 cd 97 3b 3e 3b 53 ee |..8..t.....;>;S.| | 76 fa 23 ae 64 7c e6 07 b9 ed 3a 69 1e dd 60 fa |v.#.d|....:i..`.| | e4 00 b8 76 72 9b 99 e2 aa bc ec 18 8a 72 b9 60 |...vr........r.`| dissect_ssl3_handshake session keys successfully generated record: offset = 267, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 273, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 3a 51 6d ce 6b e8 15 c5 ce c1 ae 3a 60 8d ab e0 |:Qm.k......:`...| | 84 12 a7 c1 40 8e e8 10 55 c0 16 ec 09 e5 c9 e3 |....@...U.......| | 77 a6 f3 75 df fd 80 9d 74 56 6d 66 93 29 ad 97 |w..u....tVmf.)..| | e7 a0 81 dd 72 c8 a4 7f a3 37 19 9a 9e ea 07 af |....r....7......| Plaintext[64]: | e7 36 18 7a 55 9b f4 d5 9b 85 6d b5 58 5c 9d 71 |.6.zU.....m.X\.q| | 14 00 00 0c ca dd 7f 75 d6 6d ec 47 40 fc a4 20 |.......u.m.G@.. | | e1 3e 35 be 50 3d d1 fd 51 5d 69 b1 6f ac 7e e0 |.>5.P=..Q]i.o.~.| | 02 ed 63 d4 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..c.............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | e1 3e 35 be 50 3d d1 fd 51 5d 69 b1 6f ac 7e e0 |.>5.P=..Q]i.o.~.| | 02 ed 63 d4 |..c. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #324 (first time) conversation = 0x7fca71def850, ssl_session = 0x7fca45bf78a0 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 17 2e 30 29 0e 39 92 39 7c 4a e8 d6 67 94 6c af |..0).9.9|J..g.l.| | f7 89 65 78 20 25 d2 cf ba 3f bb aa 5a 4f 4e 30 |..ex %...?..ZON0| | 01 e3 e3 0b d3 3f e4 56 62 06 f2 7c 48 94 17 13 |.....?.Vb..|H...| | d1 42 6d 10 4c ed 49 0d 25 ff 9d 5d 09 c3 95 f6 |.Bm.L.I.%..]....| Plaintext[64]: | 4f bf 83 61 ab 37 6c e5 42 0a 64 0a 48 19 37 d0 |O..a.7l.B.d.H.7.| | 14 00 00 0c 51 5f d9 f7 72 31 c3 1d 90 65 ef 31 |....Q_..r1...e.1| | 44 33 7b 78 5b bd 49 78 bf 73 96 51 66 57 3a 4a |D3{x[.Ix.s.QfW:J| | a0 af 3f d4 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..?.............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 44 33 7b 78 5b bd 49 78 bf 73 96 51 66 57 3a 4a |D3{x[.Ix.s.QfW:J| | a0 af 3f d4 |..?. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #325 (first time) conversation = 0x7fca71def850, ssl_session = 0x7fca45bf78a0 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | 28 47 a5 7d 55 14 1d 44 b0 d8 8d 22 ab ba eb 1c |(G.}U..D..."....| | ee bf 38 e9 7a 0f 34 77 84 b4 99 34 c3 1d 05 63 |..8.z.4w...4...c| | a7 21 ed a4 e1 56 cd 3b cb 8c fb 2d d8 f1 b5 de |.!...V.;...-....| | 73 64 19 b1 5b ca 34 99 a9 ab 86 00 f3 23 cd a0 |sd..[.4......#..| | e4 45 a0 b8 8c b3 0e 7d 69 05 68 d8 d5 1b 64 d9 |.E.....}i.h...d.| | 63 c5 7d 54 51 53 bb 83 dd 36 bf f5 57 2e 85 61 |c.}TQS...6..W..a| | 99 ae e4 e1 2a a3 aa 09 65 25 7c 1f 50 23 18 90 |....*...e%|.P#..| Plaintext[112]: | d9 ee 12 35 a0 ad 73 90 9e 10 76 00 23 f4 aa df |...5..s...v.#...| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 73 65 65 64 2d 73 68 61 2e 6c |Host: seed-sha.l| | 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 |ocal.al.lekenste| | 79 6e 2e 6e 6c 3a 34 34 37 30 0d 0a 0d 0a ca ac |yn.nl:4470......| | 2c bd 84 d9 c2 3d be 01 a9 83 46 8a c6 31 31 82 |,....=....F..11.| | 50 5c 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d |P\..............| ssl_decrypt_record found padding 13 final len 98 checking mac (len 62, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 81 a7 d8 33 49 c1 fd 2a 37 9c 66 35 31 ad 82 bb |...3I..*7.f51...| | 32 f2 97 59 |2..Y | ssl_decrypt_record: mac failed association_find: TCP port 47266 found (nil) association_find: TCP port 4470 found 0x36d5030 dissect_ssl enter frame #326 (first time) conversation = 0x7fca71def850, ssl_session = 0x7fca45bf78a0 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | fe 9c e3 de e1 e1 2a e2 ed 88 79 26 37 c9 96 28 |......*...y&7..(| | 85 ba 03 85 1a b4 2d 0f a2 d1 11 43 c9 d8 85 12 |......-....C....| | d7 27 3a be 63 62 17 89 2b d6 50 9b 7b 8f 4b 38 |.':.cb..+.P.{.K8| | 05 7f 03 68 cf 27 81 e7 d7 4f 55 51 a4 87 e0 74 |...h.'...OUQ...t| | 98 d3 25 91 c0 be 99 dd 4c 73 b1 4f 29 8c 2d f1 |..%.....Ls.O).-.| | 17 b2 86 de d9 91 ce eb bd 17 ba 92 c6 b0 64 5e |..............d^| | 7b 51 84 31 ac c4 bd cb 4d 7a 20 50 1b 8e 43 56 |{Q.1....Mz P..CV| | 7c 31 eb 73 af a1 ae 55 94 65 20 d2 d5 5a cf 50 ||1.s...U.e ..Z.P| | f7 2f cf 5b fd 90 47 94 05 89 62 b2 92 3f 29 0a |./.[..G...b..?).| | f8 1d 2e fd a0 33 0e 52 91 b8 07 10 1f c9 79 16 |.....3.R......y.| | 3b e6 cc 86 2c 17 45 00 dc c0 ba 57 79 6c 1c 1b |;...,.E....Wyl..| | 4c a9 a4 8f 93 b5 9e 27 19 72 b9 e7 1d ce d2 22 |L......'.r....."| | df 19 07 90 f1 fc 1d dc 86 fb f1 5c 65 c8 9a cb |...........\e...| | 30 ab 04 ce 94 62 b0 cd 90 72 0c 5e 3c b3 d5 3c |0....b...r.^<..<| | 08 8e 31 7b 50 a0 d0 ba 01 b2 c4 dc 2e 59 db c5 |..1{P........Y..| | ed b4 e2 f2 71 a5 ad ef b2 96 d3 13 04 4e 4e c1 |....q........NN.| | 3a f5 4d 1c 1a 5c 90 6c 02 c5 c7 d8 b6 02 58 92 |:.M..\.l......X.| | 13 39 aa 5a d8 20 ce f7 3c 44 5c 37 a4 38 c8 2c |.9.Z. ..| | bf 88 45 47 62 88 46 2c 41 99 a6 40 10 76 b9 70 |..EGb.F,A..@.v.p| | 37 c7 c4 b9 3a 5c 66 22 e3 2a 30 1c 7d bb b6 e0 |7...:\f".*0.}...| Plaintext[400]: | 03 c2 ef 64 94 2b df 80 e6 b1 94 d9 a4 45 14 05 |...d.+.......E..| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:| | 31 31 3a 33 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:30 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 39 36 20 2d 20 53 45 45 44 2d |x00,0x96 - SEED-| | 53 48 41 20 20 20 20 20 20 20 20 20 20 20 20 20 |SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 53 45 45 44 28 31 32 38 29 20 4d 61 63 3d 53 |=SEED(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1..J"| | 46 99 bb 2d 6e 8b ff 3e 14 40 08 c1 96 e0 13 bc |F..-n..>.@......| | 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................| ssl_decrypt_record found padding 15 final len 384 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 79 07 f6 6d e0 75 b2 b0 29 a1 00 6b 05 82 44 82 |y..m.u..)..k..D.| | c6 ef 1a b4 |.... | ssl_decrypt_record: mac failed association_find: TCP port 4470 found 0x36d5030 dissect_ssl enter frame #327 (first time) conversation = 0x7fca71def850, ssl_session = 0x7fca45bf78a0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 08 8e 57 66 ec 81 3e 29 35 13 72 f0 3e 8c cb 23 |..Wf..>)5.r.>..#| | 05 67 15 60 45 70 df f4 1f af 15 62 07 39 b2 d1 |.g.`Ep.....b.9..| | d1 4c 1e 19 58 61 c1 a3 45 a4 6b 70 a0 d9 a3 cf |.L..Xa..E.kp....| Plaintext[48]: | fb 22 03 cb 07 46 47 4b 78 b7 53 7f de 5a 90 f6 |."...FGKx.S..Z..| | 01 00 1f 89 54 ef bc b7 41 de 4b 85 43 5a 9a 97 |....T...A.K.CZ..| | ee 4b d7 b4 5f 09 09 09 09 09 09 09 09 09 09 09 |.K.._...........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 1f 89 54 ef bc b7 41 de 4b 85 43 5a 9a 97 ee 4b |..T...A.K.CZ...K| | d7 b4 5f 09 |.._. | ssl_decrypt_record: mac ok dissect_ssl enter frame #329 (first time) conversation = 0x7fca71def850, ssl_session = 0x7fca45bf78a0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 0b 6d 3b f0 9c b0 ca 76 dc ce c5 66 ba 4c 68 72 |.m;....v...f.Lhr| | 9e 76 aa e7 1e b1 a7 58 38 79 46 88 42 5b a2 ad |.v.....X8yF.B[..| | 3d 5e b9 fd 7d 7e 5f f7 c4 f1 cf 15 ab 22 98 c1 |=^..}~_......"..| Plaintext[48]: | d1 d9 15 71 64 f8 c8 b6 5d eb 51 87 1a 59 25 94 |...qd...].Q..Y%.| | 01 00 56 7e 37 9a aa 5b dd 26 4c bf 6f 85 15 2c |..V~7..[.&L.o..,| | d4 4c 54 11 cf 72 09 09 09 09 09 09 09 09 09 09 |.LT..r..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 56 7e 37 9a aa 5b dd 26 4c bf 6f 85 15 2c d4 4c |V~7..[.&L.o..,.L| | 54 11 cf 72 |T..r | ssl_decrypt_record: mac ok dissect_ssl enter frame #334 (first time) ssl_session_init: initializing ptr 0x7fca45bf9e60 size 688 conversation = 0x7fca71defaf8, ssl_session = 0x7fca45bf9e60 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 60559 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4471 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #336 (first time) conversation = 0x7fca71defaf8, ssl_session = 0x7fca45bf9e60 record: offset = 0, reported_length_remaining = 1134 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x0099 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 83 a3 38 e2 e5 74 ed de 13 cd 97 3b 3e 3b 53 ee |..8..t.....;>;S.| | 76 fa 23 ae 64 7c e6 07 b9 ed 3a 69 1e dd 60 fa |v.#.d|....:i..`.| | e4 00 b8 76 72 9b 99 e2 aa bc ec 18 8a 72 b9 60 |...vr........r.`| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f2 1b 07 65 b7 ce 7a 5b d6 35 02 bc c7 9e 63 d2 |...e..z[.5....c.| | e5 3e 6c 7b a8 86 d2 a6 d6 21 b4 29 d3 52 34 c2 |.>l{.....!.).R4.| | f2 88 8c 7e 15 b7 d5 82 7f d7 5d b4 f7 b7 a1 c4 |...~......].....| | 50 be 4f 9f 14 45 76 07 e1 a2 6f ce 1a |P.O..Ev...o.. | hash out[104]: | db 82 39 11 da 56 e5 71 e5 ab aa 2d f0 94 90 29 |..9..V.q...-...)| | 35 06 0c 68 28 62 21 ca b3 f3 23 20 d4 30 9f 73 |5..h(b!...# .0.s| | 1e c4 f1 85 29 47 c6 1f 8a 4f 58 f6 9c 9a 7a 57 |....)G...OX...zW| | 84 98 22 64 fe 05 8f 55 f2 78 6b 99 94 7c ff 18 |.."d...U.xk..|..| | 27 6e 96 16 09 35 aa 01 98 c3 02 b4 63 b2 5f 02 |'n...5......c._.| | bd 8e 2f f1 ee b7 2c 5a 7a fd e8 a8 a5 75 d7 8a |../...,Zz....u..| | dc a5 70 03 33 ba 51 d0 |..p.3.Q. | PRF out[104]: | db 82 39 11 da 56 e5 71 e5 ab aa 2d f0 94 90 29 |..9..V.q...-...)| | 35 06 0c 68 28 62 21 ca b3 f3 23 20 d4 30 9f 73 |5..h(b!...# .0.s| | 1e c4 f1 85 29 47 c6 1f 8a 4f 58 f6 9c 9a 7a 57 |....)G...OX...zW| | 84 98 22 64 fe 05 8f 55 f2 78 6b 99 94 7c ff 18 |.."d...U.xk..|..| | 27 6e 96 16 09 35 aa 01 98 c3 02 b4 63 b2 5f 02 |'n...5......c._.| | bd 8e 2f f1 ee b7 2c 5a 7a fd e8 a8 a5 75 d7 8a |../...,Zz....u..| | dc a5 70 03 33 ba 51 d0 |..p.3.Q. | key expansion[104]: | db 82 39 11 da 56 e5 71 e5 ab aa 2d f0 94 90 29 |..9..V.q...-...)| | 35 06 0c 68 28 62 21 ca b3 f3 23 20 d4 30 9f 73 |5..h(b!...# .0.s| | 1e c4 f1 85 29 47 c6 1f 8a 4f 58 f6 9c 9a 7a 57 |....)G...OX...zW| | 84 98 22 64 fe 05 8f 55 f2 78 6b 99 94 7c ff 18 |.."d...U.xk..|..| | 27 6e 96 16 09 35 aa 01 98 c3 02 b4 63 b2 5f 02 |'n...5......c._.| | bd 8e 2f f1 ee b7 2c 5a 7a fd e8 a8 a5 75 d7 8a |../...,Zz....u..| | dc a5 70 03 33 ba 51 d0 |..p.3.Q. | Client MAC key[20]: | db 82 39 11 da 56 e5 71 e5 ab aa 2d f0 94 90 29 |..9..V.q...-...)| | 35 06 0c 68 |5..h | Server MAC key[20]: | 28 62 21 ca b3 f3 23 20 d4 30 9f 73 1e c4 f1 85 |(b!...# .0.s....| | 29 47 c6 1f |)G.. | Client Write key[16]: | 8a 4f 58 f6 9c 9a 7a 57 84 98 22 64 fe 05 8f 55 |.OX...zW.."d...U| Server Write key[16]: | f2 78 6b 99 94 7c ff 18 27 6e 96 16 09 35 aa 01 |.xk..|..'n...5..| Client Write IV[16]: | 98 c3 02 b4 63 b2 5f 02 bd 8e 2f f1 ee b7 2c 5a |....c._.../...,Z| Server Write IV[16]: | 7a fd e8 a8 a5 75 d7 8a dc a5 70 03 33 ba 51 d0 |z....u....p.3.Q.| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: SEED decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: SEED decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 1071 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 735, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803 record: offset = 803, reported_length_remaining = 331 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 808 length 313 bytes, remaining 1125 record: offset = 1125, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1130 length 0 bytes, remaining 1134 dissect_ssl enter frame #338 (first time) conversation = 0x7fca71defaf8, ssl_session = 0x7fca45bf9e60 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2f2888c7e15b7d5827fd75db4f7b7a1c450be4f9f14... looking for RSA pre-master008046a21c181ea8c86e56333a1c8bf54f34ccf9d6c666ba... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a88b3723405ec9f6d 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2ed4699771feefd3c969e60a3a051977784c4581a0c414211a97aad6e 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f28e1f7f2a7aca2e9c71ffb47ed2d846d11d723e2b9d4a44e41c19ecd8 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2330ea5edf65f3fbfece59d5033d2915b04625ca5bb934034eaa986eb 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f23bb1ff6b1a567cab274581ce4ae59ffe8a2e43ae2defe2afd7886633 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2968aa51a4ea28bcab908d2a0a5011eb847de99e38f014db53571e92d 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2888c7e15b7d5827fd75db4f7b7a1c450be4f9f14457607e1a26fce1a DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | de 2f 09 45 ce f2 8d 0d fe 5c 2d ea b3 42 55 c7 |./.E.....\-..BU.| | 49 cb c4 b1 1d 1a 22 4f 6f e6 8e 17 f3 e6 11 6d |I....."Oo......m| | 2a 63 62 12 af 71 53 26 ca 7a 7f 96 25 1d 29 d8 |*cb..qS&.z..%.).| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f2 1b 07 65 b7 ce 7a 5b d6 35 02 bc c7 9e 63 d2 |...e..z[.5....c.| | e5 3e 6c 7b a8 86 d2 a6 d6 21 b4 29 d3 52 34 c2 |.>l{.....!.).R4.| | f2 88 8c 7e 15 b7 d5 82 7f d7 5d b4 f7 b7 a1 c4 |...~......].....| | 50 be 4f 9f 14 45 76 07 e1 a2 6f ce 1a |P.O..Ev...o.. | hash out[104]: | 93 dd f8 3c a2 ec 16 3a 78 02 91 85 d6 39 d0 a4 |...<...:x....9..| | 18 c2 a3 64 c6 a8 ad 94 1b fb 54 c2 73 b4 2f 66 |...d......T.s./f| | dc 07 da a4 35 54 98 0f 12 b7 e5 a7 02 d7 92 c5 |....5T..........| | 4e 00 b7 07 f1 da 6a 21 d5 be d0 cb 0d 70 1f fb |N.....j!.....p..| | 77 d5 25 74 1f 37 f2 3a b3 88 d5 f8 60 1b fc a4 |w.%t.7.:....`...| | e1 48 8b db 94 3d c8 cb a9 d1 c7 dc ee 18 0c 95 |.H...=..........| | 8f 22 11 72 2e b0 23 51 |.".r..#Q | PRF out[104]: | 93 dd f8 3c a2 ec 16 3a 78 02 91 85 d6 39 d0 a4 |...<...:x....9..| | 18 c2 a3 64 c6 a8 ad 94 1b fb 54 c2 73 b4 2f 66 |...d......T.s./f| | dc 07 da a4 35 54 98 0f 12 b7 e5 a7 02 d7 92 c5 |....5T..........| | 4e 00 b7 07 f1 da 6a 21 d5 be d0 cb 0d 70 1f fb |N.....j!.....p..| | 77 d5 25 74 1f 37 f2 3a b3 88 d5 f8 60 1b fc a4 |w.%t.7.:....`...| | e1 48 8b db 94 3d c8 cb a9 d1 c7 dc ee 18 0c 95 |.H...=..........| | 8f 22 11 72 2e b0 23 51 |.".r..#Q | key expansion[104]: | 93 dd f8 3c a2 ec 16 3a 78 02 91 85 d6 39 d0 a4 |...<...:x....9..| | 18 c2 a3 64 c6 a8 ad 94 1b fb 54 c2 73 b4 2f 66 |...d......T.s./f| | dc 07 da a4 35 54 98 0f 12 b7 e5 a7 02 d7 92 c5 |....5T..........| | 4e 00 b7 07 f1 da 6a 21 d5 be d0 cb 0d 70 1f fb |N.....j!.....p..| | 77 d5 25 74 1f 37 f2 3a b3 88 d5 f8 60 1b fc a4 |w.%t.7.:....`...| | e1 48 8b db 94 3d c8 cb a9 d1 c7 dc ee 18 0c 95 |.H...=..........| | 8f 22 11 72 2e b0 23 51 |.".r..#Q | Client MAC key[20]: | 93 dd f8 3c a2 ec 16 3a 78 02 91 85 d6 39 d0 a4 |...<...:x....9..| | 18 c2 a3 64 |...d | Server MAC key[20]: | c6 a8 ad 94 1b fb 54 c2 73 b4 2f 66 dc 07 da a4 |......T.s./f....| | 35 54 98 0f |5T.. | Client Write key[16]: | 12 b7 e5 a7 02 d7 92 c5 4e 00 b7 07 f1 da 6a 21 |........N.....j!| Server Write key[16]: | d5 be d0 cb 0d 70 1f fb 77 d5 25 74 1f 37 f2 3a |.....p..w.%t.7.:| Client Write IV[16]: | b3 88 d5 f8 60 1b fc a4 e1 48 8b db 94 3d c8 cb |....`....H...=..| Server Write IV[16]: | a9 d1 c7 dc ee 18 0c 95 8f 22 11 72 2e b0 23 51 |.........".r..#Q| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: SEED decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: SEED decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | de 2f 09 45 ce f2 8d 0d fe 5c 2d ea b3 42 55 c7 |./.E.....\-..BU.| | 49 cb c4 b1 1d 1a 22 4f 6f e6 8e 17 f3 e6 11 6d |I....."Oo......m| | 2a 63 62 12 af 71 53 26 ca 7a 7f 96 25 1d 29 d8 |*cb..qS&.z..%.).| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 41 bd b8 88 a4 55 7b b8 d7 3d 0e 59 ff 76 db b9 |A....U{..=.Y.v..| | ee e6 3b 8f e0 04 f9 22 d9 d4 51 78 08 d7 6a 9f |..;...."..Qx..j.| | 05 89 04 2b 49 62 9b d1 4f 83 a8 29 6e 27 37 98 |...+Ib..O..)n'7.| | df 4e 5f 98 a6 a9 8f 44 0e 53 e3 11 3c ec 6f 93 |.N_....D.S..<.o.| Plaintext[64]: | 43 55 44 4a e3 d5 bc c6 9c 06 f7 19 c5 5f 57 b8 |CUDJ........._W.| | 14 00 00 0c 3e 6d ab 03 d5 ff ef a7 83 90 24 5f |....>m........$_| | d3 42 b5 01 7f ba ce 48 db 14 bb 29 6b 8b fd 51 |.B.....H...)k..Q| | cd f6 2d d0 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..-.............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | d3 42 b5 01 7f ba ce 48 db 14 bb 29 6b 8b fd 51 |.B.....H...)k..Q| | cd f6 2d d0 |..-. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #339 (first time) conversation = 0x7fca71defaf8, ssl_session = 0x7fca45bf9e60 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 80 4c 5a f0 49 79 18 61 de bb d6 fd 6e 0b 01 f4 |.LZ.Iy.a....n...| | 91 5a 4e ec c6 ef 6b 29 89 52 0c 34 3c d2 c8 ce |.ZN...k).R.4<...| | b7 6d ac d5 50 80 68 ab d8 28 f9 ce 4e 05 64 21 |.m..P.h..(..N.d!| | 22 52 6c 46 49 73 c2 2d 9c c7 77 0f 5a 4c e8 5f |"RlFIs.-..w.ZL._| Plaintext[64]: | c0 b6 c6 0f 96 da 17 a1 23 6f 86 47 81 66 2d 7e |........#o.G.f-~| | 14 00 00 0c cb 9d 89 4c 95 f1 e1 10 7f 87 90 7a |.......L.......z| | e4 5f bd d5 5b 97 a4 e6 81 21 c9 4d 23 b3 50 c5 |._..[....!.M#.P.| | ee 92 da a0 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | e4 5f bd d5 5b 97 a4 e6 81 21 c9 4d 23 b3 50 c5 |._..[....!.M#.P.| | ee 92 da a0 |.... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #340 (first time) conversation = 0x7fca71defaf8, ssl_session = 0x7fca45bf9e60 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | 61 fb 74 0e 71 31 c5 e5 6b 9f ae 99 9b 42 4f 1d |a.t.q1..k....BO.| | 5d d9 6b e3 5f 33 d0 ea 3b ff 47 30 fd f7 eb 5e |].k._3..;.G0...^| | 65 64 99 cf cf 11 71 e0 c8 99 7f 62 5a 1b 8b e9 |ed....q....bZ...| | fb e4 39 2b c7 51 b5 b4 62 1f 1f a9 c3 f6 dc 5f |..9+.Q..b......_| | 8a 58 0c 47 fd d5 6d 25 88 a1 48 28 55 97 c7 a1 |.X.G..m%..H(U...| | d2 72 af 3d 4c 1d 22 b7 7c 4a 06 0a b1 0a e2 1d |.r.=L.".|J......| | b2 9d 9a aa 05 11 33 4a a0 77 d9 ce 77 a5 8e 8d |......3J.w..w...| Plaintext[112]: | 90 1a 3a 2c 6c 02 d6 89 8d 13 06 4f e4 9d 79 08 |..:,l......O..y.| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 73 65 |Host: dhe-dss-se| | 65 64 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e |ed-sha.local.al.| | 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 |lekensteyn.nl:44| | 37 31 0d 0a 0d 0a c1 41 44 cc 60 bf 01 78 20 db |71.....AD.`..x .| | 65 6f 57 44 14 a3 aa 4a e3 6d 05 05 05 05 05 05 |eoWD...J.m......| ssl_decrypt_record found padding 5 final len 106 checking mac (len 70, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | a4 f2 a4 e9 c8 fd 8a a5 27 9c f0 56 16 26 31 67 |........'..V.&1g| | 72 bb 3e 5e |r.>^ | ssl_decrypt_record: mac failed association_find: TCP port 60559 found (nil) association_find: TCP port 4471 found 0x36d50c0 dissect_ssl enter frame #341 (first time) conversation = 0x7fca71defaf8, ssl_session = 0x7fca45bf9e60 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | 46 e2 1e b5 f4 d9 b9 d1 3e 25 05 68 f6 ec 0c 81 |F.......>%.h....| | 3f bc 19 4d b2 b7 38 d1 e7 ab b5 59 34 0d f3 35 |?..M..8....Y4..5| | 44 e0 d4 24 a6 dd c0 8e e7 81 6b c9 6a 5f d0 19 |D..$......k.j_..| | bd d8 91 33 fe 9f 11 f1 e7 df 5c 29 5f 14 93 e0 |...3......\)_...| | 7e 4b 3d c0 b1 0f 20 77 17 4b b1 c8 d0 90 38 33 |~K=... w.K....83| | 9c 7c 18 1a 18 c7 6d e7 f4 36 6c 92 98 d1 89 ed |.|....m..6l.....| | 9e e5 55 c8 01 04 06 76 c9 21 fb 48 3b 69 3c 32 |..U....v.!.H;i<2| | 13 b7 7e a9 90 20 25 72 a3 77 ba dc cc b8 80 db |..~.. %r.w......| | 56 1c c5 33 a8 98 fe 93 b7 48 9c ca ea 30 6f 62 |V..3.....H...0ob| | 21 a4 99 d3 29 dc 2b 32 0a 2e 3d c4 27 33 33 a3 |!...).+2..=.'33.| | 63 82 46 43 90 5e 4c 5d e0 69 9c 4a 57 22 a8 a3 |c.FC.^L].i.JW"..| | ab 48 c2 82 b6 33 17 f9 35 01 b7 a1 87 32 78 40 |.H...3..5....2x@| | 22 49 af c9 75 47 72 3c 9d 12 1b e9 6f a5 b1 92 |"I..uGr<....o...| | 4f 7a 6a 73 d9 9a 13 33 e0 57 48 b9 ec c8 a7 24 |Ozjs...3.WH....$| | 80 42 e3 f9 a2 6a 36 67 62 c9 eb 79 6d 2e 1e 51 |.B...j6gb..ym..Q| | cc f4 d9 3a e8 12 05 dd 4d 00 a8 b2 2c 81 fa bb |...:....M...,...| | 15 fd 88 c6 ae f4 65 7f b2 92 34 16 7a cb c9 e9 |......e...4.z...| | 27 e4 91 3b 0a 97 34 0c 2c f6 80 de 44 80 54 ab |'..;..4.,...D.T.| | 40 d5 1a 80 95 93 7e 69 4d 74 0a ba ec b8 c2 c6 |@.....~iMt......| | 2b cd bf 25 9b c8 8a 75 80 5e 90 cb 9a a1 8f 4f |+..%...u.^.....O| | 5e 29 80 40 b1 5c 52 37 41 ed 85 75 e9 77 db 42 |^).@.\R7A..u.w.B| | 69 2d a9 28 b5 ff 37 07 4b 46 77 24 b1 e5 9d 25 |i-.(..7.KFw$...%| | 06 0f 38 9d 7d 63 6e 9a a4 8d 32 02 7b 26 c3 5a |..8.}cn...2.{&.Z| | 26 08 5e 3e 0b d8 eb a8 b3 b9 ea ab 79 46 1d 13 |&.^>........yF..| | f4 40 70 8d c5 97 dd fc f7 c2 ce 47 31 01 bd d1 |.@p........G1...| Plaintext[400]: | 17 a8 63 57 41 2c 45 32 12 e5 da 02 12 32 b3 90 |..cWA,E2.....2..| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:| | 31 31 3a 33 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:30 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 39 39 20 2d 20 44 48 45 2d 44 |x00,0x99 - DHE-D| | 53 53 2d 53 45 45 44 2d 53 48 41 20 20 20 20 20 |SS-SEED-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc| | 3d 53 45 45 44 28 31 32 38 29 20 4d 61 63 3d 53 |=SEED(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1c.lw| | 2c 00 7a 6c 72 52 57 e5 3d db ef 45 11 ca 41 b6 |,.zlrRW.=..E..A.| | 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................| ssl_decrypt_record found padding 15 final len 384 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 5a 71 32 5c fd 30 c4 fa 96 33 88 15 6a d4 da 52 |Zq2\.0...3..j..R| | 08 37 45 81 |.7E. | ssl_decrypt_record: mac failed association_find: TCP port 4471 found 0x36d50c0 dissect_ssl enter frame #342 (first time) conversation = 0x7fca71defaf8, ssl_session = 0x7fca45bf9e60 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 65 05 15 b8 2e 1b cf 96 91 85 bd 89 68 4c fa e8 |e...........hL..| | ab cd 49 98 89 19 f4 37 c8 b5 2a a3 8e ca 2f e8 |..I....7..*.../.| | 34 e7 ee c9 d5 15 29 2c c6 c0 3e 44 b3 d8 12 2f |4.....),..>D.../| Plaintext[48]: | 47 4d 74 6a 8b d6 2c da b6 d4 26 5a ca 0e d1 e2 |GMtj..,...&Z....| | 01 00 30 7f 3f dd 2f 80 0c 3a 34 f2 f9 55 c2 8e |..0.?./..:4..U..| | bc 35 24 50 f1 0b 09 09 09 09 09 09 09 09 09 09 |.5$P............| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 30 7f 3f dd 2f 80 0c 3a 34 f2 f9 55 c2 8e bc 35 |0.?./..:4..U...5| | 24 50 f1 0b |$P.. | ssl_decrypt_record: mac ok dissect_ssl enter frame #344 (first time) conversation = 0x7fca71defaf8, ssl_session = 0x7fca45bf9e60 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | e7 53 f5 34 2b 53 20 2e bc ba 70 61 9c 77 b6 e0 |.S.4+S ...pa.w..| | 6d 8d ff 0d 76 38 c1 33 4a 6d b3 11 fa 95 68 96 |m...v8.3Jm....h.| | f9 80 fc e8 f6 cf 5b 03 6c f0 b6 a7 5b 97 bf 2b |......[.l...[..+| Plaintext[48]: | 74 fa be 02 92 93 12 80 3a bb 09 43 71 25 ca cd |t.......:..Cq%..| | 01 00 e8 7a 80 0e 44 60 5e 50 f5 8a d9 b7 51 5d |...z..D`^P....Q]| | 0b 50 05 a0 cd be 09 09 09 09 09 09 09 09 09 09 |.P..............| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | e8 7a 80 0e 44 60 5e 50 f5 8a d9 b7 51 5d 0b 50 |.z..D`^P....Q].P| | 05 a0 cd be |.... | ssl_decrypt_record: mac ok dissect_ssl enter frame #349 (first time) ssl_session_init: initializing ptr 0x7fca45bfc3a0 size 688 conversation = 0x7fca71defda0, ssl_session = 0x7fca45bfc3a0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 34738 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4472 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #351 (first time) conversation = 0x7fca71defda0, ssl_session = 0x7fca45bfc3a0 record: offset = 0, reported_length_remaining = 1416 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0x009A -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | de 2f 09 45 ce f2 8d 0d fe 5c 2d ea b3 42 55 c7 |./.E.....\-..BU.| | 49 cb c4 b1 1d 1a 22 4f 6f e6 8e 17 f3 e6 11 6d |I....."Oo......m| | 2a 63 62 12 af 71 53 26 ca 7a 7f 96 25 1d 29 d8 |*cb..qS&.z..%.).| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f2 2f 61 6d 5f 9a d8 f4 8c 36 41 0b 08 fc f8 72 |./am_....6A....r| | f0 c9 2f be 02 b4 c3 c8 6a 91 25 25 74 52 34 c2 |../.....j.%%tR4.| | f2 d9 89 53 4d e7 83 9f c5 46 1d fb 92 90 26 6a |...SM....F....&j| | 33 b0 f2 41 fa f9 3f 4c 98 4d 16 56 a8 |3..A..?L.M.V. | hash out[104]: | 9c 0a e6 9c 86 22 7d 6f 77 ce 70 80 20 33 5b c9 |....."}ow.p. 3[.| | a5 be 04 f0 8a 3f 4b 90 af c8 78 27 af 07 9a 04 |.....?K...x'....| | 70 f7 b3 f3 d1 ca 12 a9 d0 74 7e db 74 8a 2c 2b |p........t~.t.,+| | 44 be 18 51 a8 ec f8 1c d6 21 f1 03 b5 9b 3f 7e |D..Q.....!....?~| | 80 38 77 f9 22 96 1a ef a4 04 a5 e5 e7 1e 4b 8f |.8w.".........K.| | 5d 60 6a 5a b3 89 94 98 ba d2 21 a0 6c c3 d4 fa |]`jZ......!.l...| | 06 c3 5b d3 02 40 ab f0 |..[..@.. | PRF out[104]: | 9c 0a e6 9c 86 22 7d 6f 77 ce 70 80 20 33 5b c9 |....."}ow.p. 3[.| | a5 be 04 f0 8a 3f 4b 90 af c8 78 27 af 07 9a 04 |.....?K...x'....| | 70 f7 b3 f3 d1 ca 12 a9 d0 74 7e db 74 8a 2c 2b |p........t~.t.,+| | 44 be 18 51 a8 ec f8 1c d6 21 f1 03 b5 9b 3f 7e |D..Q.....!....?~| | 80 38 77 f9 22 96 1a ef a4 04 a5 e5 e7 1e 4b 8f |.8w.".........K.| | 5d 60 6a 5a b3 89 94 98 ba d2 21 a0 6c c3 d4 fa |]`jZ......!.l...| | 06 c3 5b d3 02 40 ab f0 |..[..@.. | key expansion[104]: | 9c 0a e6 9c 86 22 7d 6f 77 ce 70 80 20 33 5b c9 |....."}ow.p. 3[.| | a5 be 04 f0 8a 3f 4b 90 af c8 78 27 af 07 9a 04 |.....?K...x'....| | 70 f7 b3 f3 d1 ca 12 a9 d0 74 7e db 74 8a 2c 2b |p........t~.t.,+| | 44 be 18 51 a8 ec f8 1c d6 21 f1 03 b5 9b 3f 7e |D..Q.....!....?~| | 80 38 77 f9 22 96 1a ef a4 04 a5 e5 e7 1e 4b 8f |.8w.".........K.| | 5d 60 6a 5a b3 89 94 98 ba d2 21 a0 6c c3 d4 fa |]`jZ......!.l...| | 06 c3 5b d3 02 40 ab f0 |..[..@.. | Client MAC key[20]: | 9c 0a e6 9c 86 22 7d 6f 77 ce 70 80 20 33 5b c9 |....."}ow.p. 3[.| | a5 be 04 f0 |.... | Server MAC key[20]: | 8a 3f 4b 90 af c8 78 27 af 07 9a 04 70 f7 b3 f3 |.?K...x'....p...| | d1 ca 12 a9 |.... | Client Write key[16]: | d0 74 7e db 74 8a 2c 2b 44 be 18 51 a8 ec f8 1c |.t~.t.,+D..Q....| Server Write key[16]: | d6 21 f1 03 b5 9b 3f 7e 80 38 77 f9 22 96 1a ef |.!....?~.8w."...| Client Write IV[16]: | a4 04 a5 e5 e7 1e 4b 8f 5d 60 6a 5a b3 89 94 98 |......K.]`jZ....| Server Write IV[16]: | ba d2 21 a0 6c c3 d4 fa 06 c3 5b d3 02 40 ab f0 |..!.l.....[..@..| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: SEED decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: SEED decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 63, reported_length_remaining = 1353 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 541 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 527, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407 record: offset = 1407, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416 dissect_ssl enter frame #353 (first time) conversation = 0x7fca71defda0, ssl_session = 0x7fca45bfc3a0 record: offset = 0, reported_length_remaining = 214 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 134, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2f2d989534de7839fc5461dfb9290266a33b0f241fa... looking for RSA pre-master00809bc16b22c1a46bc3992feb94dc811ba939653b734155... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a88b3723405ec9f6d 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2ed4699771feefd3c969e60a3a051977784c4581a0c414211a97aad6e 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f28e1f7f2a7aca2e9c71ffb47ed2d846d11d723e2b9d4a44e41c19ecd8 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2330ea5edf65f3fbfece59d5033d2915b04625ca5bb934034eaa986eb 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f23bb1ff6b1a567cab274581ce4ae59ffe8a2e43ae2defe2afd7886633 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2968aa51a4ea28bcab908d2a0a5011eb847de99e38f014db53571e92d 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2888c7e15b7d5827fd75db4f7b7a1c450be4f9f14457607e1a26fce1a DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f21b0765b7ce7a5bd63502bcc79e63d2e53e6c7ba886d2a6d621b429d3 DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f22f616d5f9ad8f48c36410b08fcf872f0c92fbe02b4c3c86a91252574 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2d989534de7839fc5461dfb9290266a33b0f241faf93f4c984d1656a8 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | db e5 52 01 d3 1d 01 f8 98 61 38 43 43 fd 02 1c |..R......a8CC...| | 8e c9 79 ec 9b 6c 78 c1 d9 79 83 06 01 40 04 e4 |..y..lx..y...@..| | 8b d9 84 66 6e 2b 4b 4d 26 a8 9d cc 79 31 f1 64 |...fn+KM&...y1.d| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f2 2f 61 6d 5f 9a d8 f4 8c 36 41 0b 08 fc f8 72 |./am_....6A....r| | f0 c9 2f be 02 b4 c3 c8 6a 91 25 25 74 52 34 c2 |../.....j.%%tR4.| | f2 d9 89 53 4d e7 83 9f c5 46 1d fb 92 90 26 6a |...SM....F....&j| | 33 b0 f2 41 fa f9 3f 4c 98 4d 16 56 a8 |3..A..?L.M.V. | hash out[104]: | e6 62 10 a2 e3 41 e7 27 fe 9e 93 1b 6e bf a2 ea |.b...A.'....n...| | bf b3 28 27 71 5a 6e d2 13 ff 31 bb 9b c3 69 1f |..('qZn...1...i.| | 3d e9 1a f5 f7 67 e8 1e 8a 91 e2 d3 e8 4b 5c c7 |=....g.......K\.| | f9 c7 95 d4 4d 11 18 b6 1e ba 87 66 19 38 72 d1 |....M......f.8r.| | 74 14 e5 8e 12 0b 79 d8 d3 6a a5 ee ec 04 de 19 |t.....y..j......| | 29 cd 9d a4 4c 7f d1 58 81 49 c9 77 53 25 61 64 |)...L..X.I.wS%ad| | 4e 79 09 d0 f1 c1 aa bc |Ny...... | PRF out[104]: | e6 62 10 a2 e3 41 e7 27 fe 9e 93 1b 6e bf a2 ea |.b...A.'....n...| | bf b3 28 27 71 5a 6e d2 13 ff 31 bb 9b c3 69 1f |..('qZn...1...i.| | 3d e9 1a f5 f7 67 e8 1e 8a 91 e2 d3 e8 4b 5c c7 |=....g.......K\.| | f9 c7 95 d4 4d 11 18 b6 1e ba 87 66 19 38 72 d1 |....M......f.8r.| | 74 14 e5 8e 12 0b 79 d8 d3 6a a5 ee ec 04 de 19 |t.....y..j......| | 29 cd 9d a4 4c 7f d1 58 81 49 c9 77 53 25 61 64 |)...L..X.I.wS%ad| | 4e 79 09 d0 f1 c1 aa bc |Ny...... | key expansion[104]: | e6 62 10 a2 e3 41 e7 27 fe 9e 93 1b 6e bf a2 ea |.b...A.'....n...| | bf b3 28 27 71 5a 6e d2 13 ff 31 bb 9b c3 69 1f |..('qZn...1...i.| | 3d e9 1a f5 f7 67 e8 1e 8a 91 e2 d3 e8 4b 5c c7 |=....g.......K\.| | f9 c7 95 d4 4d 11 18 b6 1e ba 87 66 19 38 72 d1 |....M......f.8r.| | 74 14 e5 8e 12 0b 79 d8 d3 6a a5 ee ec 04 de 19 |t.....y..j......| | 29 cd 9d a4 4c 7f d1 58 81 49 c9 77 53 25 61 64 |)...L..X.I.wS%ad| | 4e 79 09 d0 f1 c1 aa bc |Ny...... | Client MAC key[20]: | e6 62 10 a2 e3 41 e7 27 fe 9e 93 1b 6e bf a2 ea |.b...A.'....n...| | bf b3 28 27 |..(' | Server MAC key[20]: | 71 5a 6e d2 13 ff 31 bb 9b c3 69 1f 3d e9 1a f5 |qZn...1...i.=...| | f7 67 e8 1e |.g.. | Client Write key[16]: | 8a 91 e2 d3 e8 4b 5c c7 f9 c7 95 d4 4d 11 18 b6 |.....K\.....M...| Server Write key[16]: | 1e ba 87 66 19 38 72 d1 74 14 e5 8e 12 0b 79 d8 |...f.8r.t.....y.| Client Write IV[16]: | d3 6a a5 ee ec 04 de 19 29 cd 9d a4 4c 7f d1 58 |.j......)...L..X| Server Write IV[16]: | 81 49 c9 77 53 25 61 64 4e 79 09 d0 f1 c1 aa bc |.I.wS%adNy......| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: SEED decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: SEED decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | db e5 52 01 d3 1d 01 f8 98 61 38 43 43 fd 02 1c |..R......a8CC...| | 8e c9 79 ec 9b 6c 78 c1 d9 79 83 06 01 40 04 e4 |..y..lx..y...@..| | 8b d9 84 66 6e 2b 4b 4d 26 a8 9d cc 79 31 f1 64 |...fn+KM&...y1.d| dissect_ssl3_handshake session keys successfully generated record: offset = 139, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 145, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 1e 3a 7f 8a 2b 9c 50 da 9b bd b2 57 49 f2 69 5b |.:..+.P....WI.i[| | a5 48 0b 7d 79 07 7f c9 44 7d b9 4b 18 ec d5 d7 |.H.}y...D}.K....| | 74 64 54 a4 b2 ee 5f 9b 18 88 77 6a 11 41 fa 14 |tdT..._...wj.A..| | d2 05 30 45 1d 07 dd 8b a1 7e 06 c5 84 8c ed 8c |..0E.....~......| Plaintext[64]: | 1e 51 95 94 b8 61 e0 52 41 d4 bf e8 ae 29 8a 98 |.Q...a.RA....)..| | 14 00 00 0c f6 ba 5c 76 4b 7b 4f 08 8e 35 9a 4a |......\vK{O..5.J| | 0c ca 2d ef d6 f6 1f 8c 0c fd 90 78 e0 8e a1 8b |..-........x....| | 83 3c e9 54 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.<.T............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 0c ca 2d ef d6 f6 1f 8c 0c fd 90 78 e0 8e a1 8b |..-........x....| | 83 3c e9 54 |.<.T | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #354 (first time) conversation = 0x7fca71defda0, ssl_session = 0x7fca45bfc3a0 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 68 16 16 28 af 99 24 4f 78 fe 45 f3 8f d4 07 8d |h..(..$Ox.E.....| | 78 c1 99 0f ae 9c 03 bc 32 e7 f1 6d 63 8c 48 1b |x.......2..mc.H.| | ca 4e c1 15 ef 9e c6 c4 17 86 b7 a9 bc 34 7d 63 |.N...........4}c| | 31 d8 d5 47 56 97 b8 15 e1 f8 d6 2a 81 23 e9 ed |1..GV......*.#..| Plaintext[64]: | b4 a6 76 0c de 27 16 58 11 f1 9f 38 74 3b 00 0f |..v..'.X...8t;..| | 14 00 00 0c e4 78 a3 2c f8 a9 4b d0 36 7f 01 79 |.....x.,..K.6..y| | fc 42 53 58 7e 12 17 9a 9e 73 17 f1 4a cc 85 09 |.BSX~....s..J...| | 90 92 50 73 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..Ps............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | fc 42 53 58 7e 12 17 9a 9e 73 17 f1 4a cc 85 09 |.BSX~....s..J...| | 90 92 50 73 |..Ps | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #355 (first time) conversation = 0x7fca71defda0, ssl_session = 0x7fca45bfc3a0 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | a3 9d 3d 2b a0 c1 bb bf 08 c2 cc 14 9b fe 9b 0e |..=+............| | 1e 85 0a f1 5b 69 5e da 36 b8 b6 c7 18 34 cb 7f |....[i^.6....4..| | 45 e5 18 64 4e d4 b2 85 b9 fa d5 1b 68 d4 37 91 |E..dN.......h.7.| | 50 6a f5 f4 7b fb 52 dc da 3e a0 eb 35 1e 15 16 |Pj..{.R..>..5...| | 2c 05 39 b5 84 13 86 f0 ed 17 ce b6 b3 70 f0 6f |,.9..........p.o| | 04 05 bc 2f 82 31 67 fe cb d4 2f 42 f1 32 75 09 |.../.1g.../B.2u.| | dc ac eb 5c bd 3c 59 4e 7e 5e b9 d1 7e 20 d9 f2 |...\....w ..{...0.| | 3c be 17 2e 32 b8 17 42 ee 01 d9 8e fc 39 42 41 |<...2..B.....9BA| | a3 0c 6b 08 bd 4d 1b f6 04 80 3c 2d 12 f4 f3 50 |..k..M....<-...P| | 3a 82 6d d0 1c 16 c7 6c 3b cd 73 dd 91 be 50 00 |:.m....l;.s...P.| | a9 27 39 83 59 aa d6 70 a3 13 8c be 4e ce 98 f2 |.'9.Y..p....N...| | 8c b6 00 4e d7 68 9a 32 2a 1d 15 85 73 c5 ae bc |...N.h.2*...s...| | b9 6d 6c 09 63 8a 4d cb 15 2a 82 a7 d1 0c 90 8d |.ml.c.M..*......| | 2f 1f 75 19 d0 78 7f 60 38 7e 94 53 68 38 6e cd |/.u..x.`8~.Sh8n.| | 23 72 59 68 ac 01 3d f7 2a 07 57 74 75 fc 9b 61 |#rYh..=.*.Wtu..a| | 98 75 f1 39 01 15 d5 ca db 16 e1 8e a3 76 00 8c |.u.9.........v..| | 64 f5 57 79 70 1c 58 e3 72 a8 d9 08 35 3a 1a a9 |d.Wyp.X.r...5:..| | 6a f9 0b 46 e6 65 1d 93 41 f7 69 77 59 ce 39 f5 |j..F.e..A.iwY.9.| | 7f 87 27 3b 2d 4c 60 56 bb 6c 9e 59 ea c5 d1 a3 |..';-L`V.l.Y....| | 98 b6 ab 41 e2 9a 85 1f 68 25 6d 8f 36 ae bc 34 |...A....h%m.6..4| | a7 5e 87 96 64 26 64 d9 37 e2 b4 5c 71 47 6f 94 |.^..d&d.7..\qGo.| | 9e 86 c4 db 12 21 c8 18 c6 56 45 0d 9a 68 ec 97 |.....!...VE..h..| | 6a 55 8e 1c 4c c9 71 52 fe 69 38 27 2f 74 e3 9b |jU..L.qR.i8'/t..| Plaintext[400]: | d6 8b b6 04 4c 26 95 02 7c 94 dc aa f5 78 c0 50 |....L&..|....x.P| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:| | 31 31 3a 33 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:30 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 30 30 2c 30 78 39 41 20 2d 20 44 48 45 2d 52 |x00,0x9A - DHE-R| | 53 41 2d 53 45 45 44 2d 53 48 41 20 20 20 20 20 |SA-SEED-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH | | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 53 45 45 44 28 31 32 38 29 20 4d 61 63 3d 53 |=SEED(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1%...| | c2 30 30 03 29 9f 8e 5c f0 f3 1c 00 02 2d f4 cb |.00.)..\.....-..| | 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................| ssl_decrypt_record found padding 15 final len 384 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 44 5a 8b c8 1d 1b a2 6c e5 17 48 85 de 6f 0e 1b |DZ.....l..H..o..| | b0 23 88 e1 |.#.. | ssl_decrypt_record: mac failed association_find: TCP port 4472 found 0x36d5150 dissect_ssl enter frame #357 (first time) conversation = 0x7fca71defda0, ssl_session = 0x7fca45bfc3a0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 84 53 b8 3b 44 f3 5b 2e cc 01 e0 2f 89 7c 0c 97 |.S.;D.[..../.|..| | 2c 37 4e cb 03 38 01 9c f3 60 f4 a2 12 18 5c c5 |,7N..8...`....\.| | 22 56 43 f7 79 a1 ed 25 42 5c a6 dc 86 28 48 dd |"VC.y..%B\...(H.| Plaintext[48]: | 63 c2 be 6e 7e a8 67 17 6b 79 be 51 29 a6 fb cc |c..n~.g.ky.Q)...| | 01 00 b0 29 6b 84 bb e1 e7 d9 29 bf a1 5b 5b d5 |...)k.....)..[[.| | 84 b8 c5 d7 3a 1a 09 09 09 09 09 09 09 09 09 09 |....:...........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | b0 29 6b 84 bb e1 e7 d9 29 bf a1 5b 5b d5 84 b8 |.)k.....)..[[...| | c5 d7 3a 1a |..:. | ssl_decrypt_record: mac ok dissect_ssl enter frame #359 (first time) conversation = 0x7fca71defda0, ssl_session = 0x7fca45bfc3a0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 50 95 a7 d4 94 b4 fa a6 ea 1e 3b d8 cc 91 a9 fb |P.........;.....| | 10 50 24 e9 02 4c a6 e0 cb 20 74 2e 7d 00 91 db |.P$..L... t.}...| | 5b 87 4d c1 32 a1 96 5c c4 ba db 14 48 ed c8 62 |[.M.2..\....H..b| Plaintext[48]: | c6 57 b1 66 75 06 89 de d7 cf f5 87 fa 9e 14 81 |.W.fu...........| | 01 00 fa a7 9c 29 9d af 9b 22 30 1a 42 6a d1 8b |.....)..."0.Bj..| | eb 81 76 03 d1 f1 09 09 09 09 09 09 09 09 09 09 |..v.............| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | fa a7 9c 29 9d af 9b 22 30 1a 42 6a d1 8b eb 81 |...)..."0.Bj....| | 76 03 d1 f1 |v... | ssl_decrypt_record: mac ok dissect_ssl enter frame #364 (first time) ssl_session_init: initializing ptr 0x7fca45bfe8e0 size 688 conversation = 0x7fca71df0048, ssl_session = 0x7fca45bfe8e0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 45655 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4480 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #366 (first time) conversation = 0x7fca71df0048, ssl_session = 0x7fca45bfe8e0 record: offset = 0, reported_length_remaining = 565 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 66, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0xC003 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | db e5 52 01 d3 1d 01 f8 98 61 38 43 43 fd 02 1c |..R......a8CC...| | 8e c9 79 ec 9b 6c 78 c1 d9 79 83 06 01 40 04 e4 |..y..lx..y...@..| | 8b d9 84 66 6e 2b 4b 4d 26 a8 9d cc 79 31 f1 64 |...fn+KM&...y1.d| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f3 67 56 c6 2e e6 4b 45 cf 17 ca ef d0 cd 10 5e |.gV...KE.......^| | be 82 52 75 be c2 7a eb 52 0d 72 94 c9 52 34 c2 |..Ru..z.R.r..R4.| | f3 6a 2e 00 da ce d9 50 61 0a 27 8d f5 d5 cb cd |.j.....Pa.'.....| | 23 24 69 fe e9 bc 7a 06 51 1d a6 5e 98 |#$i...z.Q..^. | hash out[104]: | 76 fe 62 40 96 10 a2 6b dd 81 c3 8f 5a f0 b8 cc |v.b@...k....Z...| | 60 7b 90 de c2 4d 34 ed bc a7 4c 41 d5 89 1f 07 |`{...M4...LA....| | 75 97 fb 60 d7 60 36 ba 02 a1 10 b3 36 20 12 8e |u..`.`6.....6 ..| | 9b c4 90 be c7 bc d2 49 40 87 52 c8 ca 8f af 8e |.......I@.R.....| | c3 16 04 4f 6d 28 59 ba 22 b9 00 06 60 d5 a6 a8 |...Om(Y."...`...| | f2 fd cf e8 7e eb 76 2e 8f 9c 5d bd 06 16 49 88 |....~.v...]...I.| | 8a db a3 26 90 9a 99 20 |...&... | PRF out[104]: | 76 fe 62 40 96 10 a2 6b dd 81 c3 8f 5a f0 b8 cc |v.b@...k....Z...| | 60 7b 90 de c2 4d 34 ed bc a7 4c 41 d5 89 1f 07 |`{...M4...LA....| | 75 97 fb 60 d7 60 36 ba 02 a1 10 b3 36 20 12 8e |u..`.`6.....6 ..| | 9b c4 90 be c7 bc d2 49 40 87 52 c8 ca 8f af 8e |.......I@.R.....| | c3 16 04 4f 6d 28 59 ba 22 b9 00 06 60 d5 a6 a8 |...Om(Y."...`...| | f2 fd cf e8 7e eb 76 2e 8f 9c 5d bd 06 16 49 88 |....~.v...]...I.| | 8a db a3 26 90 9a 99 20 |...&... | key expansion[104]: | 76 fe 62 40 96 10 a2 6b dd 81 c3 8f 5a f0 b8 cc |v.b@...k....Z...| | 60 7b 90 de c2 4d 34 ed bc a7 4c 41 d5 89 1f 07 |`{...M4...LA....| | 75 97 fb 60 d7 60 36 ba 02 a1 10 b3 36 20 12 8e |u..`.`6.....6 ..| | 9b c4 90 be c7 bc d2 49 40 87 52 c8 ca 8f af 8e |.......I@.R.....| | c3 16 04 4f 6d 28 59 ba 22 b9 00 06 60 d5 a6 a8 |...Om(Y."...`...| | f2 fd cf e8 7e eb 76 2e 8f 9c 5d bd 06 16 49 88 |....~.v...]...I.| | 8a db a3 26 90 9a 99 20 |...&... | Client MAC key[20]: | 76 fe 62 40 96 10 a2 6b dd 81 c3 8f 5a f0 b8 cc |v.b@...k....Z...| | 60 7b 90 de |`{.. | Server MAC key[20]: | c2 4d 34 ed bc a7 4c 41 d5 89 1f 07 75 97 fb 60 |.M4...LA....u..`| | d7 60 36 ba |.`6. | Client Write key[24]: | 02 a1 10 b3 36 20 12 8e 9b c4 90 be c7 bc d2 49 |....6 .........I| | 40 87 52 c8 ca 8f af 8e |@.R..... | Server Write key[24]: | c3 16 04 4f 6d 28 59 ba 22 b9 00 06 60 d5 a6 a8 |...Om(Y."...`...| | f2 fd cf e8 7e eb 76 2e |....~.v. | Client Write IV[8]: | 8f 9c 5d bd 06 16 49 88 |..]...I. | Server Write IV[8]: | 8a db a3 26 90 9a 99 20 |...&... | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 71, reported_length_remaining = 494 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 480, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556 record: offset = 556, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 561 length 0 bytes, remaining 565 dissect_ssl enter frame #368 (first time) conversation = 0x7fca71df0048, ssl_session = 0x7fca45bfe8e0 record: offset = 0, reported_length_remaining = 166 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 102, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 98 bytes, remaining 107 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2f36a2e00daced950610a278df5d5cbcd232469fee9... looking for RSA pre-master6104636ee7ffcd33a0605110afc63fa7dcd80ce6929394cb... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a88b3723405ec9f6d 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2ed4699771feefd3c969e60a3a051977784c4581a0c414211a97aad6e 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f28e1f7f2a7aca2e9c71ffb47ed2d846d11d723e2b9d4a44e41c19ecd8 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2330ea5edf65f3fbfece59d5033d2915b04625ca5bb934034eaa986eb 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f23bb1ff6b1a567cab274581ce4ae59ffe8a2e43ae2defe2afd7886633 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2968aa51a4ea28bcab908d2a0a5011eb847de99e38f014db53571e92d 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2888c7e15b7d5827fd75db4f7b7a1c450be4f9f14457607e1a26fce1a DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f21b0765b7ce7a5bd63502bcc79e63d2e53e6c7ba886d2a6d621b429d3 DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f22f616d5f9ad8f48c36410b08fcf872f0c92fbe02b4c3c86a91252574 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2d989534de7839fc5461dfb9290266a33b0f241faf93f4c984d1656a8 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f36756c62ee64b45cf17caefd0cd105ebe825275bec27aeb520d7294c9 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f36a2e00daced950610a278df5d5cbcd232469fee9bc7a06511da65e98 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 93 8d c6 6d a6 6e f1 ec ed ed 64 95 e3 cb dd 99 |...m.n....d.....| | 63 ba 87 8c 80 c4 a3 63 27 b5 2f 4d 81 10 d9 4c |c......c'./M...L| | 6b 41 4c 75 6c ab 14 92 59 8a f0 71 48 77 18 8f |kALul...Y..qHw..| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f3 67 56 c6 2e e6 4b 45 cf 17 ca ef d0 cd 10 5e |.gV...KE.......^| | be 82 52 75 be c2 7a eb 52 0d 72 94 c9 52 34 c2 |..Ru..z.R.r..R4.| | f3 6a 2e 00 da ce d9 50 61 0a 27 8d f5 d5 cb cd |.j.....Pa.'.....| | 23 24 69 fe e9 bc 7a 06 51 1d a6 5e 98 |#$i...z.Q..^. | hash out[104]: | 8d f9 25 3a 0b 47 2a 54 29 2f a3 66 34 3a 76 46 |..%:.G*T)/.f4:vF| | 95 6b a7 37 71 8c 87 e3 94 7d b0 29 e9 39 f7 6a |.k.7q....}.).9.j| | 9a aa 2e 40 0b 30 67 88 aa 22 06 30 82 86 86 f5 |...@.0g..".0....| | 72 a8 8a 3a 77 71 40 63 c8 94 3f a7 d1 20 e4 1a |r..:wq@c..?.. ..| | a1 4d b4 94 ed d3 5f c8 85 a7 1a 4b 82 b7 fd 79 |.M...._....K...y| | 70 fc ac 1e 8c 18 bc c4 54 a1 90 88 16 4e 6d b2 |p.......T....Nm.| | d0 d9 69 c0 07 f7 b9 e5 |..i..... | PRF out[104]: | 8d f9 25 3a 0b 47 2a 54 29 2f a3 66 34 3a 76 46 |..%:.G*T)/.f4:vF| | 95 6b a7 37 71 8c 87 e3 94 7d b0 29 e9 39 f7 6a |.k.7q....}.).9.j| | 9a aa 2e 40 0b 30 67 88 aa 22 06 30 82 86 86 f5 |...@.0g..".0....| | 72 a8 8a 3a 77 71 40 63 c8 94 3f a7 d1 20 e4 1a |r..:wq@c..?.. ..| | a1 4d b4 94 ed d3 5f c8 85 a7 1a 4b 82 b7 fd 79 |.M...._....K...y| | 70 fc ac 1e 8c 18 bc c4 54 a1 90 88 16 4e 6d b2 |p.......T....Nm.| | d0 d9 69 c0 07 f7 b9 e5 |..i..... | key expansion[104]: | 8d f9 25 3a 0b 47 2a 54 29 2f a3 66 34 3a 76 46 |..%:.G*T)/.f4:vF| | 95 6b a7 37 71 8c 87 e3 94 7d b0 29 e9 39 f7 6a |.k.7q....}.).9.j| | 9a aa 2e 40 0b 30 67 88 aa 22 06 30 82 86 86 f5 |...@.0g..".0....| | 72 a8 8a 3a 77 71 40 63 c8 94 3f a7 d1 20 e4 1a |r..:wq@c..?.. ..| | a1 4d b4 94 ed d3 5f c8 85 a7 1a 4b 82 b7 fd 79 |.M...._....K...y| | 70 fc ac 1e 8c 18 bc c4 54 a1 90 88 16 4e 6d b2 |p.......T....Nm.| | d0 d9 69 c0 07 f7 b9 e5 |..i..... | Client MAC key[20]: | 8d f9 25 3a 0b 47 2a 54 29 2f a3 66 34 3a 76 46 |..%:.G*T)/.f4:vF| | 95 6b a7 37 |.k.7 | Server MAC key[20]: | 71 8c 87 e3 94 7d b0 29 e9 39 f7 6a 9a aa 2e 40 |q....}.).9.j...@| | 0b 30 67 88 |.0g. | Client Write key[24]: | aa 22 06 30 82 86 86 f5 72 a8 8a 3a 77 71 40 63 |.".0....r..:wq@c| | c8 94 3f a7 d1 20 e4 1a |..?.. .. | Server Write key[24]: | a1 4d b4 94 ed d3 5f c8 85 a7 1a 4b 82 b7 fd 79 |.M...._....K...y| | 70 fc ac 1e 8c 18 bc c4 |p....... | Client Write IV[8]: | 54 a1 90 88 16 4e 6d b2 |T....Nm. | Server Write IV[8]: | d0 d9 69 c0 07 f7 b9 e5 |..i..... | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 93 8d c6 6d a6 6e f1 ec ed ed 64 95 e3 cb dd 99 |...m.n....d.....| | 63 ba 87 8c 80 c4 a3 63 27 b5 2f 4d 81 10 d9 4c |c......c'./M...L| | 6b 41 4c 75 6c ab 14 92 59 8a f0 71 48 77 18 8f |kALul...Y..qHw..| dissect_ssl3_handshake session keys successfully generated record: offset = 107, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 113, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | a3 93 b8 8a cf 6b e4 d9 33 0f 1c d3 1d 81 32 a6 |.....k..3.....2.| | 54 08 df 6d 00 30 76 60 fe f7 af 5c 9d 17 a9 ff |T..m.0v`...\....| | 19 a2 05 4c f3 54 da 64 c5 6b a9 e3 52 c7 7d e7 |...L.T.d.k..R.}.| Plaintext[48]: | fb 59 9c 9d 32 7e 8f bf 14 00 00 0c c2 43 98 64 |.Y..2~.......C.d| | 90 40 7c 77 81 0d d5 cd f2 90 7e 64 1e 54 a6 c2 |.@|w......~d.T..| | ea c8 44 d8 f0 6d 9e 3f 15 25 4f b2 03 03 03 03 |..D..m.?.%O.....| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | f2 90 7e 64 1e 54 a6 c2 ea c8 44 d8 f0 6d 9e 3f |..~d.T....D..m.?| | 15 25 4f b2 |.%O. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #369 (first time) conversation = 0x7fca71df0048, ssl_session = 0x7fca45bfe8e0 record: offset = 0, reported_length_remaining = 234 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | f7 7d fb 97 0d 6a c0 91 a1 ff 30 7c 78 0d 92 e3 |.}...j....0|x...| | 9a 10 73 38 a1 e3 16 45 81 25 9d 40 25 f5 29 ef |..s8...E.%.@%.).| | 17 1f 36 74 ce 16 6c 93 de 38 6d 8d 7e c0 c6 3e |..6t..l..8m.~..>| Plaintext[48]: | 83 ab fa fb ec 69 9f 89 14 00 00 0c f1 d6 e1 58 |.....i.........X| | af 90 99 de 8a 17 38 3b e2 f2 8c 3c 1a 40 60 49 |......8;...<.@`I| | cf 2d ad 62 f8 1d c5 a1 29 3a 13 5b 03 03 03 03 |.-.b....):.[....| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | e2 f2 8c 3c 1a 40 60 49 cf 2d ad 62 f8 1d c5 a1 |...<.@`I.-.b....| | 29 3a 13 5b |):.[ | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #370 (first time) conversation = 0x7fca71df0048, ssl_session = 0x7fca45bfe8e0 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | b6 61 93 c3 0e 9d 91 10 6a 81 70 e0 16 85 87 dd |.a......j.p.....| | be 81 c9 07 3c 68 d9 b6 8b 63 53 ae 5d 7f a8 cb |......!f...GET / HT| | 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 63 |TP/1.1..Host: ec| | 64 68 2d 65 63 64 73 61 2d 64 65 73 2d 63 62 63 |dh-ecdsa-des-cbc| | 33 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c |3-sha.local.al.l| | 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 38 |ekensteyn.nl:448| | 30 0d 0a 0d 0a a1 69 4a 2a 11 81 e8 55 39 a3 da |0.....iJ*...U9..| | db fb 37 aa 4f ec 4a 1c 00 06 06 06 06 06 06 06 |..7.O.J.........| ssl_decrypt_record found padding 6 final len 105 checking mac (len 77, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | d3 7b 38 78 54 ad c4 33 70 1f 04 33 b2 18 2d d2 |.{8xT..3p..3..-.| | b0 5e 12 de |.^.. | ssl_decrypt_record: mac failed association_find: TCP port 45655 found (nil) association_find: TCP port 4480 found 0x3737fd0 dissect_ssl enter frame #371 (first time) conversation = 0x7fca71df0048, ssl_session = 0x7fca45bfe8e0 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | fb c6 bf 07 05 1a 7f 3f ab b6 7e cf c1 b3 15 b5 |.......?..~.....| | dc 10 be d3 89 e4 60 c7 4b c6 9a 6b 46 cc 60 c9 |......`.K..kF.`.| | 65 6f 87 61 3a 0a b5 42 95 a9 d2 b3 de e3 b3 ff |eo.a:..B........| | 3a cd f7 bd 9a 03 84 95 f5 01 4b 45 38 54 8b 88 |:.........KE8T..| | 39 8e 90 3d fc f2 0e 44 12 42 71 7b c0 0f ff 62 |9..=...D.Bq{...b| | 70 0d e2 5d 96 c9 28 68 06 d1 c1 0a 9a e1 89 a6 |p..]..(h........| | 9f 8c 74 70 0c 6d e3 b4 ff 24 cf 10 8b bf cd f7 |..tp.m...$......| | 5f f0 18 36 a2 7f c7 61 d3 48 ce dc e5 06 c3 c6 |_..6...a.H......| | 2d f8 f9 7b 68 30 7b bc f5 4d 8f e2 3a f2 ff f6 |-..{h0{..M..:...| | 74 5c 37 16 fe b2 bc cb 0b ef 59 57 83 0d ab 06 |t\7.......YW....| | 56 e6 58 60 a2 23 85 80 b4 b5 72 a2 11 7e bf 62 |V.X`.#....r..~.b| | 1c 62 01 25 b2 f9 fa e7 1b 77 f5 86 48 b1 c1 f6 |.b.%.....w..H...| | a6 bc 04 9f a8 3b d0 6b 87 07 72 0e d4 91 4f d0 |.....;.k..r...O.| | f8 c8 33 08 c1 cc 8c e7 c8 48 03 6b 99 d4 ed 7a |..3......H.k...z| | 72 71 59 c6 63 f2 0f a9 40 6d 56 b8 64 81 77 60 |rqY.c...@mV.d.w`| | 2d 87 ca b7 26 da d1 c2 f5 63 ff fa f2 70 ec 4d |-...&....c...p.M| | c8 9d 3e 0e fc c3 90 a9 b5 c3 ce 32 39 ba 42 dc |..>........29.B.| | 7b 06 62 a2 7c c2 07 85 32 0a 74 24 83 15 77 89 |{.b.|...2.t$..w.| | 73 42 54 80 d2 61 5f 68 7f 24 69 f8 a2 9a 1d dd |sBT..a_h.$i.....| | 15 13 d1 86 65 bb 0b f5 6b 74 d4 59 b2 fd 5c 85 |....e...kt.Y..\.| | 07 ca 19 8c 97 77 2a d3 ec 3f 42 39 46 f5 49 a6 |.....w*..?B9F.I.| | 72 c6 65 c7 4b a1 bd 1c df b4 11 4f c9 62 d7 68 |r.e.K......O.b.h| | 61 cd 15 57 cf 49 79 35 db 62 12 72 5d a0 a2 b2 |a..W.Iy5.b.r]...| | 0c 0d 53 5b 2e d2 c7 ab 2e ec 00 22 fb 41 a1 36 |..S[.......".A.6| Plaintext[384]: | d0 57 7b 32 c1 22 2b c7 48 54 54 50 2f 31 2e 31 |.W{2."+.HTTP/1.1| | 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:| | 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da| | 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep | | 32 30 31 33 20 32 30 3a 31 31 3a 33 31 20 47 4d |2013 20:11:31 GM| | 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:| | 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont| | 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 33 0d |ent-Length: 143.| | 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo| | 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu| | 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00| | 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach| | 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca| | 63 68 65 0d 0a 0d 0a 30 78 43 30 2c 30 78 30 33 |che....0xC0,0x03| | 20 2d 20 45 43 44 48 2d 45 43 44 53 41 2d 44 45 | - ECDH-ECDSA-DE| | 53 2d 43 42 43 33 2d 53 48 41 20 53 53 4c 76 33 |S-CBC3-SHA SSLv3| | 20 4b 78 3d 45 43 44 48 2f 45 43 44 53 41 20 41 | Kx=ECDH/ECDSA A| | 75 3d 45 43 44 48 20 45 6e 63 3d 33 44 45 53 28 |u=ECDH Enc=3DES(| | 31 36 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 |168) Mac=SHA1document.do| | 6d 61 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c |main='local.al.l| | 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 |ekensteyn.nl'.M...I...)| | 9c aa c3 71 b8 80 26 c3 de 5f 05 05 05 05 05 05 |...q..&.._......| ssl_decrypt_record found padding 5 final len 378 checking mac (len 350, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 21 8a 5d 30 a9 f4 80 8e 4d b8 04 44 d2 d6 7f 1e |!.]0....M..D....| | 7b 56 0f 22 |{V." | ssl_decrypt_record: mac failed association_find: TCP port 4480 found 0x3737fd0 dissect_ssl enter frame #372 (first time) conversation = 0x7fca71df0048, ssl_session = 0x7fca45bfe8e0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 27 4f 65 81 1a 6f 96 29 c3 c6 67 db 17 ea f4 b0 |'Oe..o.)..g.....| | ec cb ef 68 1e a2 ee 81 62 28 f9 68 3b 19 b9 89 |...h....b(.h;...| Plaintext[32]: | 4a 96 5d a6 d5 f1 e5 18 01 00 9e a6 22 54 7a d4 |J.]........."Tz.| | b9 06 c7 2e 9a 7a 83 6b ae 06 fa 19 dc 76 01 01 |.....z.k.....v..| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 9e a6 22 54 7a d4 b9 06 c7 2e 9a 7a 83 6b ae 06 |.."Tz......z.k..| | fa 19 dc 76 |...v | ssl_decrypt_record: mac ok dissect_ssl enter frame #374 (first time) conversation = 0x7fca71df0048, ssl_session = 0x7fca45bfe8e0 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 87 ab 98 10 ab f0 42 08 66 46 80 19 45 6d bc 31 |......B.fF..Em.1| | fa 65 23 e5 7b 84 00 df 0e d4 5c c3 38 0b 22 1f |.e#.{.....\.8.".| Plaintext[32]: | e6 d5 ae b8 3d 19 ae be 01 00 f2 8b 0b 10 44 4f |....=.........DO| | 87 02 7c 3a 76 18 6e 1d f9 9f e6 02 fc 99 01 01 |..|:v.n.........| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | f2 8b 0b 10 44 4f 87 02 7c 3a 76 18 6e 1d f9 9f |....DO..|:v.n...| | e6 02 fc 99 |.... | ssl_decrypt_record: mac ok dissect_ssl enter frame #379 (first time) ssl_session_init: initializing ptr 0x7fca45c00e00 size 688 conversation = 0x7fca71df02f0, ssl_session = 0x7fca45c00e00 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 35376 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4481 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #381 (first time) conversation = 0x7fca71df02f0, ssl_session = 0x7fca45c00e00 record: offset = 0, reported_length_remaining = 565 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 66, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0xC004 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 93 8d c6 6d a6 6e f1 ec ed ed 64 95 e3 cb dd 99 |...m.n....d.....| | 63 ba 87 8c 80 c4 a3 63 27 b5 2f 4d 81 10 d9 4c |c......c'./M...L| | 6b 41 4c 75 6c ab 14 92 59 8a f0 71 48 77 18 8f |kALul...Y..qHw..| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f3 6a 0b 87 04 21 3d 2d 34 b6 6f 11 93 45 cc 1d |.j...!=-4.o..E..| | 4b 0b 4c 95 a8 88 34 08 7a 19 cd 83 c1 52 34 c2 |K.L...4.z....R4.| | f3 7b 6b 51 87 ff b0 77 f0 15 a5 58 da 43 d7 22 |.{kQ...w...X.C."| | e1 56 02 ae 47 a7 fe 15 f0 5c f5 45 0c |.V..G....\.E. | hash out[104]: | 16 bc e3 a7 09 71 eb d5 f1 8c d7 af 6d e1 39 e0 |.....q......m.9.| | 26 52 e3 db 3d 81 4a 96 11 ca 7e 64 ce 87 56 fe |&R..=.J...~d..V.| | 60 88 1f bd 61 46 a7 8b a9 76 19 ce 01 11 59 1a |`...aF...v....Y.| | 2d d0 5b 77 38 08 bf fc 17 46 e0 a4 ba 5d 46 72 |-.[w8....F...]Fr| | 55 94 20 cb 41 75 ee de e5 8e 71 7d 67 f4 6d 21 |U. .Au....q}g.m!| | 43 d7 58 f5 04 57 c6 f7 d7 a8 01 49 1f 8e 83 f6 |C.X..W.....I....| | fb c6 02 c5 20 80 6b 32 |.... .k2 | PRF out[104]: | 16 bc e3 a7 09 71 eb d5 f1 8c d7 af 6d e1 39 e0 |.....q......m.9.| | 26 52 e3 db 3d 81 4a 96 11 ca 7e 64 ce 87 56 fe |&R..=.J...~d..V.| | 60 88 1f bd 61 46 a7 8b a9 76 19 ce 01 11 59 1a |`...aF...v....Y.| | 2d d0 5b 77 38 08 bf fc 17 46 e0 a4 ba 5d 46 72 |-.[w8....F...]Fr| | 55 94 20 cb 41 75 ee de e5 8e 71 7d 67 f4 6d 21 |U. .Au....q}g.m!| | 43 d7 58 f5 04 57 c6 f7 d7 a8 01 49 1f 8e 83 f6 |C.X..W.....I....| | fb c6 02 c5 20 80 6b 32 |.... .k2 | key expansion[104]: | 16 bc e3 a7 09 71 eb d5 f1 8c d7 af 6d e1 39 e0 |.....q......m.9.| | 26 52 e3 db 3d 81 4a 96 11 ca 7e 64 ce 87 56 fe |&R..=.J...~d..V.| | 60 88 1f bd 61 46 a7 8b a9 76 19 ce 01 11 59 1a |`...aF...v....Y.| | 2d d0 5b 77 38 08 bf fc 17 46 e0 a4 ba 5d 46 72 |-.[w8....F...]Fr| | 55 94 20 cb 41 75 ee de e5 8e 71 7d 67 f4 6d 21 |U. .Au....q}g.m!| | 43 d7 58 f5 04 57 c6 f7 d7 a8 01 49 1f 8e 83 f6 |C.X..W.....I....| | fb c6 02 c5 20 80 6b 32 |.... .k2 | Client MAC key[20]: | 16 bc e3 a7 09 71 eb d5 f1 8c d7 af 6d e1 39 e0 |.....q......m.9.| | 26 52 e3 db |&R.. | Server MAC key[20]: | 3d 81 4a 96 11 ca 7e 64 ce 87 56 fe 60 88 1f bd |=.J...~d..V.`...| | 61 46 a7 8b |aF.. | Client Write key[16]: | a9 76 19 ce 01 11 59 1a 2d d0 5b 77 38 08 bf fc |.v....Y.-.[w8...| Server Write key[16]: | 17 46 e0 a4 ba 5d 46 72 55 94 20 cb 41 75 ee de |.F...]FrU. .Au..| Client Write IV[16]: | e5 8e 71 7d 67 f4 6d 21 43 d7 58 f5 04 57 c6 f7 |..q}g.m!C.X..W..| Server Write IV[16]: | d7 a8 01 49 1f 8e 83 f6 fb c6 02 c5 20 80 6b 32 |...I........ .k2| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 71, reported_length_remaining = 494 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 480, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556 record: offset = 556, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 561 length 0 bytes, remaining 565 dissect_ssl enter frame #383 (first time) conversation = 0x7fca71df02f0, ssl_session = 0x7fca45c00e00 record: offset = 0, reported_length_remaining = 182 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 102, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 98 bytes, remaining 107 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2f37b6b5187ffb077f015a558da43d722e15602ae47... looking for RSA pre-master6104d4432640947655d2c1d09f94b58e44f58544c34d38e5... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a88b3723405ec9f6d 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2ed4699771feefd3c969e60a3a051977784c4581a0c414211a97aad6e 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f28e1f7f2a7aca2e9c71ffb47ed2d846d11d723e2b9d4a44e41c19ecd8 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2330ea5edf65f3fbfece59d5033d2915b04625ca5bb934034eaa986eb 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f23bb1ff6b1a567cab274581ce4ae59ffe8a2e43ae2defe2afd7886633 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2968aa51a4ea28bcab908d2a0a5011eb847de99e38f014db53571e92d 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2888c7e15b7d5827fd75db4f7b7a1c450be4f9f14457607e1a26fce1a DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f21b0765b7ce7a5bd63502bcc79e63d2e53e6c7ba886d2a6d621b429d3 DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f22f616d5f9ad8f48c36410b08fcf872f0c92fbe02b4c3c86a91252574 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2d989534de7839fc5461dfb9290266a33b0f241faf93f4c984d1656a8 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f36756c62ee64b45cf17caefd0cd105ebe825275bec27aeb520d7294c9 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f36a2e00daced950610a278df5d5cbcd232469fee9bc7a06511da65e98 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f36a0b8704213d2d34b66f119345cc1d4b0b4c95a88834087a19cd83c1 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f37b6b5187ffb077f015a558da43d722e15602ae47a7fe15f05cf5450c 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 86 c4 12 44 4e 5f 67 a3 a8 d9 78 e6 98 0b 1e 5c |...DN_g...x....\| | 4a 22 d5 34 dd fd 05 04 7b ee e3 6b 27 a9 37 64 |J".4....{..k'.7d| | 23 33 26 11 a5 a7 f9 f6 09 eb 75 1b ee d8 0c 7f |#3&.......u.....| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f3 6a 0b 87 04 21 3d 2d 34 b6 6f 11 93 45 cc 1d |.j...!=-4.o..E..| | 4b 0b 4c 95 a8 88 34 08 7a 19 cd 83 c1 52 34 c2 |K.L...4.z....R4.| | f3 7b 6b 51 87 ff b0 77 f0 15 a5 58 da 43 d7 22 |.{kQ...w...X.C."| | e1 56 02 ae 47 a7 fe 15 f0 5c f5 45 0c |.V..G....\.E. | hash out[104]: | e6 00 b0 fc 3b 4b d1 39 f4 13 70 aa fd 43 c8 e1 |....;K.9..p..C..| | 09 e9 9c bb 35 34 7d 77 eb 01 da 5d ac 66 fa 8e |....54}w...].f..| | b0 28 d9 1b 2e 55 0a ea 28 86 2c 89 f1 f7 56 57 |.(...U..(.,...VW| | 49 35 17 ec a5 f2 51 71 e2 f3 58 2e fc fb 7c 72 |I5....Qq..X...|r| | 97 ae 6c d2 2e 73 6d 53 70 4c 5a f4 a4 57 8c 28 |..l..smSpLZ..W.(| | 46 f4 44 1e 87 e7 73 05 e9 c3 a1 11 ea 79 15 f7 |F.D...s......y..| | af ed 9e ca 01 65 04 90 |.....e.. | PRF out[104]: | e6 00 b0 fc 3b 4b d1 39 f4 13 70 aa fd 43 c8 e1 |....;K.9..p..C..| | 09 e9 9c bb 35 34 7d 77 eb 01 da 5d ac 66 fa 8e |....54}w...].f..| | b0 28 d9 1b 2e 55 0a ea 28 86 2c 89 f1 f7 56 57 |.(...U..(.,...VW| | 49 35 17 ec a5 f2 51 71 e2 f3 58 2e fc fb 7c 72 |I5....Qq..X...|r| | 97 ae 6c d2 2e 73 6d 53 70 4c 5a f4 a4 57 8c 28 |..l..smSpLZ..W.(| | 46 f4 44 1e 87 e7 73 05 e9 c3 a1 11 ea 79 15 f7 |F.D...s......y..| | af ed 9e ca 01 65 04 90 |.....e.. | key expansion[104]: | e6 00 b0 fc 3b 4b d1 39 f4 13 70 aa fd 43 c8 e1 |....;K.9..p..C..| | 09 e9 9c bb 35 34 7d 77 eb 01 da 5d ac 66 fa 8e |....54}w...].f..| | b0 28 d9 1b 2e 55 0a ea 28 86 2c 89 f1 f7 56 57 |.(...U..(.,...VW| | 49 35 17 ec a5 f2 51 71 e2 f3 58 2e fc fb 7c 72 |I5....Qq..X...|r| | 97 ae 6c d2 2e 73 6d 53 70 4c 5a f4 a4 57 8c 28 |..l..smSpLZ..W.(| | 46 f4 44 1e 87 e7 73 05 e9 c3 a1 11 ea 79 15 f7 |F.D...s......y..| | af ed 9e ca 01 65 04 90 |.....e.. | Client MAC key[20]: | e6 00 b0 fc 3b 4b d1 39 f4 13 70 aa fd 43 c8 e1 |....;K.9..p..C..| | 09 e9 9c bb |.... | Server MAC key[20]: | 35 34 7d 77 eb 01 da 5d ac 66 fa 8e b0 28 d9 1b |54}w...].f...(..| | 2e 55 0a ea |.U.. | Client Write key[16]: | 28 86 2c 89 f1 f7 56 57 49 35 17 ec a5 f2 51 71 |(.,...VWI5....Qq| Server Write key[16]: | e2 f3 58 2e fc fb 7c 72 97 ae 6c d2 2e 73 6d 53 |..X...|r..l..smS| Client Write IV[16]: | 70 4c 5a f4 a4 57 8c 28 46 f4 44 1e 87 e7 73 05 |pLZ..W.(F.D...s.| Server Write IV[16]: | e9 c3 a1 11 ea 79 15 f7 af ed 9e ca 01 65 04 90 |.....y.......e..| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 86 c4 12 44 4e 5f 67 a3 a8 d9 78 e6 98 0b 1e 5c |...DN_g...x....\| | 4a 22 d5 34 dd fd 05 04 7b ee e3 6b 27 a9 37 64 |J".4....{..k'.7d| | 23 33 26 11 a5 a7 f9 f6 09 eb 75 1b ee d8 0c 7f |#3&.......u.....| dissect_ssl3_handshake session keys successfully generated record: offset = 107, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 113, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 8e c1 1d 78 27 84 0b f6 5d 80 62 31 d6 62 9a 2a |...x'...].b1.b.*| | 6a a9 7f 40 d6 60 0e 0f 2e 83 2e 6f 96 9c a3 b4 |j..@.`.....o....| | ec 25 d2 8f ad cd 22 b8 bd 8f c1 68 79 6c 94 21 |.%...."....hyl.!| | 1b 38 8c 15 13 9d 53 3c 26 67 6c 5a df 1a b3 a4 |.8....S<&glZ....| Plaintext[64]: | e2 e2 96 8f 86 7f 78 38 02 f5 7e 71 6c 3b 29 1a |......x8..~ql;).| | 14 00 00 0c 49 9a ba 47 9e 4d 41 73 df a7 63 b5 |....I..G.MAs..c.| | 4a 04 df 73 37 b8 57 8d 4a dc d4 90 9d 55 58 65 |J..s7.W.J....UXe| | 3b 94 d8 43 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |;..C............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 4a 04 df 73 37 b8 57 8d 4a dc d4 90 9d 55 58 65 |J..s7.W.J....UXe| | 3b 94 d8 43 |;..C | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #384 (first time) conversation = 0x7fca71df02f0, ssl_session = 0x7fca45c00e00 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | b7 bb 14 07 86 e1 cf 41 38 77 8c 9d 15 87 35 63 |.......A8w....5c| | be ca 8b e4 1a 77 82 8b b6 d3 1a ac 44 6e 1c 35 |.....w......Dn.5| | 04 78 7c be ff 17 09 06 4d d1 5e db cd 06 11 d7 |.x|.....M.^.....| | f5 ac d2 99 33 8e d1 3e da e6 fe ec d1 7e 01 32 |....3..>.....~.2| Plaintext[64]: | 33 11 31 38 99 ba dc 0f 20 20 03 ef 8e e8 50 1f |3.18.... ....P.| | 14 00 00 0c 02 ea ce 9b 82 32 06 0e 2d fa 0f d3 |.........2..-...| | c4 d5 3f bc f2 82 fd 92 2b 9d df ad c4 bc c0 e7 |..?.....+.......| | e5 10 96 e7 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | c4 d5 3f bc f2 82 fd 92 2b 9d df ad c4 bc c0 e7 |..?.....+.......| | e5 10 96 e7 |.... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #385 (first time) conversation = 0x7fca71df02f0, ssl_session = 0x7fca45c00e00 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | 49 84 2c e5 0b 47 70 0e 79 4e 52 4d 15 cb 7f 1c |I.,..Gp.yNRM....| | cc ee bc 16 58 a3 13 d7 5e f1 3d 80 2f 68 7c 7c |....X...^.=./h||| | 7b 03 28 cf a3 d4 a4 29 6c f4 a0 5a e0 34 db 49 |{.(....)l..Z.4.I| | 74 90 c8 26 b4 10 6f f1 76 b6 ae fc 85 49 c8 e4 |t..&..o.v....I..| | c5 c8 d2 83 bf b6 30 35 16 4e e5 bf c8 dd c2 06 |......05.N......| | d5 05 e4 66 84 74 1b 4e 59 9c a3 23 9e e2 91 48 |...f.t.NY..#...H| | 92 69 ec 53 82 c9 e2 0e 97 e5 85 0f 95 33 8d 43 |.i.S.........3.C| Plaintext[112]: | c5 b3 8a f2 9c 25 1e 08 bc 0b 4b 39 16 58 d4 22 |.....%....K9.X."| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa| | 2d 61 65 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 |-aes128-sha.loca| | 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.| | 6e 6c 3a 34 34 38 31 0d 0a 0d 0a 4c 7f b6 69 61 |nl:4481....L..ia| | 85 94 bf 79 92 3b 16 49 56 52 c3 1b 62 1c 17 00 |...y.;.IVR..b...| ssl_decrypt_record found padding 0 final len 111 checking mac (len 75, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 8e 12 da 40 70 a1 ed a3 d9 04 28 4e bf 75 aa 03 |...@p.....(N.u..| | d2 46 73 18 |.Fs. | ssl_decrypt_record: mac failed association_find: TCP port 35376 found (nil) association_find: TCP port 4481 found 0x3738060 dissect_ssl enter frame #386 (first time) conversation = 0x7fca71df02f0, ssl_session = 0x7fca45c00e00 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | 32 38 64 3e 3f ae cb 08 79 f3 5a cf e7 2f 24 aa |28d>?...y.Z../$.| | 75 bf 8d 9b 5d db bc 95 6f a3 dd d6 66 e8 f0 f5 |u...]...o...f...| | 04 19 bf 0f 15 b5 e3 a7 99 d4 68 84 c1 53 9b 1f |..........h..S..| | 8e b6 92 8f da 62 e1 e3 9f b5 0c e9 40 04 43 b6 |.....b......@.C.| | ec 87 ae 61 d9 71 f7 63 1d 30 f3 9d 37 3d 0d 2c |...a.q.c.0..7=.,| | b9 13 de 02 50 d3 23 8d ca 83 ad 12 a9 d9 fb a9 |....P.#.........| | 3b c4 9d 6e 15 fe b2 fd da 7c b4 dd be 45 e2 a5 |;..n.....|...E..| | 05 05 19 f6 04 25 39 db 0b f1 ff 06 e3 a3 75 69 |.....%9.......ui| | 67 f1 a5 1b 7a 2a 26 43 f5 0d d5 ec 09 cf 24 a7 |g...z*&C......$.| | 93 d4 42 b7 bd 31 f5 38 77 bb 61 7f 7a 25 79 0b |..B..1.8w.a.z%y.| | e3 ca 78 4f 02 d2 61 39 5d e7 70 89 f3 76 42 d2 |..xO..a9].p..vB.| | cf 48 60 a4 0b d0 6a 9e 5a a5 38 11 2a 59 07 bb |.H`...j.Z.8.*Y..| | ca 85 e7 f7 73 9c dd 43 24 03 a2 a4 7a 71 08 c9 |....s..C$...zq..| | 14 55 34 f7 33 92 56 93 ed 55 5e b8 42 d9 7f 31 |.U4.3.V..U^.B..1| | dd c4 b0 c7 ae b2 6b 62 74 07 4e 3b 9f 3a d7 29 |......kbt.N;.:.)| | 33 77 71 2a bd 66 83 45 34 6f 87 a7 25 59 72 8b |3wq*.f.E4o..%Yr.| | c0 c2 a3 c4 5f 2e ae 9a 7b f3 13 7b 14 1b dd 14 |...._...{..{....| | 2f 51 1a d9 4b e9 0a f4 c5 fe 2d 85 a6 0d d6 7a |/Q..K.....-....z| | a7 08 40 3f 22 25 3c 67 b0 69 ed ac 35 e9 59 e1 |..@?"%doc| | 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f |ument.domain='lo| | 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey| | 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 5f 4c |n.nl'_L| | 2c 20 4d 6f 6e a5 41 15 d8 99 26 2f 0e a7 b6 b4 |, Mon.A...&/....| | 46 cc 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d |F...............| ssl_decrypt_record found padding 13 final len 386 checking mac (len 350, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | c1 a4 d6 5a 22 35 98 c2 c2 92 e7 15 56 51 50 30 |...Z"5......VQP0| | bc ef d0 01 |.... | ssl_decrypt_record: mac failed association_find: TCP port 4481 found 0x3738060 dissect_ssl enter frame #387 (first time) conversation = 0x7fca71df02f0, ssl_session = 0x7fca45c00e00 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | a2 24 0e 4b e4 fb e3 91 66 67 8c ba 9a fc 55 e8 |.$.K....fg....U.| | 58 9c 5a 35 5c dc 59 47 46 36 bf 77 62 6a bc b7 |X.Z5\.YGF6.wbj..| | 4a 72 f4 e8 b3 30 61 83 a1 f0 2a b9 2e 19 53 32 |Jr...0a...*...S2| Plaintext[48]: | 50 f2 d8 3f e8 11 ac cf 61 d0 98 1b 17 cd 66 3f |P..?....a.....f?| | 01 00 3f 75 d5 15 f1 b4 79 eb d4 1a de 21 f6 ff |..?u....y....!..| | d3 02 5f 2d 42 0c 09 09 09 09 09 09 09 09 09 09 |.._-B...........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 3f 75 d5 15 f1 b4 79 eb d4 1a de 21 f6 ff d3 02 |?u....y....!....| | 5f 2d 42 0c |_-B. | ssl_decrypt_record: mac ok dissect_ssl enter frame #389 (first time) conversation = 0x7fca71df02f0, ssl_session = 0x7fca45c00e00 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | b8 8e c2 4f d4 7e 3a 16 94 9b 45 89 c1 69 e3 2c |...O.~:...E..i.,| | 59 8d ac 11 16 c9 6b d8 b1 9c 21 88 8f ff ad 33 |Y.....k...!....3| | 03 e5 0a df 48 77 e1 b4 d3 2e b4 c8 1d bd 66 d4 |....Hw........f.| Plaintext[48]: | 4c d5 85 20 1c f9 39 03 1d 2e b0 32 7e 3f a0 3f |L.. ..9....2~?.?| | 01 00 d4 64 1d 91 b0 ac b7 fb a4 18 b8 4e ce ae |...d.........N..| | 06 5b 60 4a 16 50 09 09 09 09 09 09 09 09 09 09 |.[`J.P..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | d4 64 1d 91 b0 ac b7 fb a4 18 b8 4e ce ae 06 5b |.d.........N...[| | 60 4a 16 50 |`J.P | ssl_decrypt_record: mac ok dissect_ssl enter frame #394 (first time) ssl_session_init: initializing ptr 0x7fca45c03320 size 688 conversation = 0x7fca71df0598, ssl_session = 0x7fca45c03320 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 60960 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4482 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #396 (first time) conversation = 0x7fca71df0598, ssl_session = 0x7fca45c03320 record: offset = 0, reported_length_remaining = 565 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 66, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0xC005 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 86 c4 12 44 4e 5f 67 a3 a8 d9 78 e6 98 0b 1e 5c |...DN_g...x....\| | 4a 22 d5 34 dd fd 05 04 7b ee e3 6b 27 a9 37 64 |J".4....{..k'.7d| | 23 33 26 11 a5 a7 f9 f6 09 eb 75 1b ee d8 0c 7f |#3&.......u.....| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f3 ea 5c eb 07 10 77 49 af 52 62 4d 67 4e 47 e9 |..\...wI.RbMgNG.| | 64 ae 7e 84 ab b1 40 90 90 0d 9a 93 40 52 34 c2 |d.~...@.....@R4.| | f3 53 f5 a9 55 b8 e7 e9 6e 59 30 58 aa 1b 26 90 |.S..U...nY0X..&.| | 5a 5c e8 ff 6c 36 77 0e b2 18 88 35 39 |Z\..l6w....59 | hash out[136]: | e0 8d 3d 85 ed 12 d3 26 87 7a c9 13 76 fe f2 84 |..=....&.z..v...| | 26 41 de 71 13 82 1b 2d 80 68 32 14 c2 4e 24 d3 |&A.q...-.h2..N$.| | 36 7b 3f e9 0e a9 ac c2 a3 82 08 b2 c4 e9 67 73 |6{?...........gs| | 6b 25 cd ba 56 06 13 62 a3 85 2d a4 f7 f1 09 ff |k%..V..b..-.....| | 02 53 2b a7 ea 9b 49 ee c8 4e 96 b6 23 63 66 91 |.S+...I..N..#cf.| | 58 72 b9 10 43 3c 81 f0 11 93 c0 00 1b 36 29 41 |Xr..C<.......6)A| | 25 46 8d 4d a1 96 30 14 ba 5c 0b fb 2d 5d cd 48 |%F.M..0..\..-].H| | 3d dc c0 fb 21 ba 79 0d d3 5d ab 20 de 69 4b 60 |=...!.y..]. .iK`| | 55 f6 6d f1 66 57 28 8e |U.m.fW(. | PRF out[136]: | e0 8d 3d 85 ed 12 d3 26 87 7a c9 13 76 fe f2 84 |..=....&.z..v...| | 26 41 de 71 13 82 1b 2d 80 68 32 14 c2 4e 24 d3 |&A.q...-.h2..N$.| | 36 7b 3f e9 0e a9 ac c2 a3 82 08 b2 c4 e9 67 73 |6{?...........gs| | 6b 25 cd ba 56 06 13 62 a3 85 2d a4 f7 f1 09 ff |k%..V..b..-.....| | 02 53 2b a7 ea 9b 49 ee c8 4e 96 b6 23 63 66 91 |.S+...I..N..#cf.| | 58 72 b9 10 43 3c 81 f0 11 93 c0 00 1b 36 29 41 |Xr..C<.......6)A| | 25 46 8d 4d a1 96 30 14 ba 5c 0b fb 2d 5d cd 48 |%F.M..0..\..-].H| | 3d dc c0 fb 21 ba 79 0d d3 5d ab 20 de 69 4b 60 |=...!.y..]. .iK`| | 55 f6 6d f1 66 57 28 8e |U.m.fW(. | key expansion[136]: | e0 8d 3d 85 ed 12 d3 26 87 7a c9 13 76 fe f2 84 |..=....&.z..v...| | 26 41 de 71 13 82 1b 2d 80 68 32 14 c2 4e 24 d3 |&A.q...-.h2..N$.| | 36 7b 3f e9 0e a9 ac c2 a3 82 08 b2 c4 e9 67 73 |6{?...........gs| | 6b 25 cd ba 56 06 13 62 a3 85 2d a4 f7 f1 09 ff |k%..V..b..-.....| | 02 53 2b a7 ea 9b 49 ee c8 4e 96 b6 23 63 66 91 |.S+...I..N..#cf.| | 58 72 b9 10 43 3c 81 f0 11 93 c0 00 1b 36 29 41 |Xr..C<.......6)A| | 25 46 8d 4d a1 96 30 14 ba 5c 0b fb 2d 5d cd 48 |%F.M..0..\..-].H| | 3d dc c0 fb 21 ba 79 0d d3 5d ab 20 de 69 4b 60 |=...!.y..]. .iK`| | 55 f6 6d f1 66 57 28 8e |U.m.fW(. | Client MAC key[20]: | e0 8d 3d 85 ed 12 d3 26 87 7a c9 13 76 fe f2 84 |..=....&.z..v...| | 26 41 de 71 |&A.q | Server MAC key[20]: | 13 82 1b 2d 80 68 32 14 c2 4e 24 d3 36 7b 3f e9 |...-.h2..N$.6{?.| | 0e a9 ac c2 |.... | Client Write key[32]: | a3 82 08 b2 c4 e9 67 73 6b 25 cd ba 56 06 13 62 |......gsk%..V..b| | a3 85 2d a4 f7 f1 09 ff 02 53 2b a7 ea 9b 49 ee |..-......S+...I.| Server Write key[32]: | c8 4e 96 b6 23 63 66 91 58 72 b9 10 43 3c 81 f0 |.N..#cf.Xr..C<..| | 11 93 c0 00 1b 36 29 41 25 46 8d 4d a1 96 30 14 |.....6)A%F.M..0.| Client Write IV[16]: | ba 5c 0b fb 2d 5d cd 48 3d dc c0 fb 21 ba 79 0d |.\..-].H=...!.y.| Server Write IV[16]: | d3 5d ab 20 de 69 4b 60 55 f6 6d f1 66 57 28 8e |.]. .iK`U.m.fW(.| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 71, reported_length_remaining = 494 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 480, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556 record: offset = 556, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 561 length 0 bytes, remaining 565 dissect_ssl enter frame #398 (first time) conversation = 0x7fca71df0598, ssl_session = 0x7fca45c03320 record: offset = 0, reported_length_remaining = 182 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 102, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 98 bytes, remaining 107 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2f353f5a955b8e7e96e593058aa1b26905a5ce8ff6c... looking for RSA pre-master6104567b4cafa042e28b0ffd04e4d44a7e1fb88466c1b61b... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a88b3723405ec9f6d 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2ed4699771feefd3c969e60a3a051977784c4581a0c414211a97aad6e 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f28e1f7f2a7aca2e9c71ffb47ed2d846d11d723e2b9d4a44e41c19ecd8 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2330ea5edf65f3fbfece59d5033d2915b04625ca5bb934034eaa986eb 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f23bb1ff6b1a567cab274581ce4ae59ffe8a2e43ae2defe2afd7886633 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2968aa51a4ea28bcab908d2a0a5011eb847de99e38f014db53571e92d 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2888c7e15b7d5827fd75db4f7b7a1c450be4f9f14457607e1a26fce1a DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f21b0765b7ce7a5bd63502bcc79e63d2e53e6c7ba886d2a6d621b429d3 DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f22f616d5f9ad8f48c36410b08fcf872f0c92fbe02b4c3c86a91252574 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2d989534de7839fc5461dfb9290266a33b0f241faf93f4c984d1656a8 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f36756c62ee64b45cf17caefd0cd105ebe825275bec27aeb520d7294c9 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f36a2e00daced950610a278df5d5cbcd232469fee9bc7a06511da65e98 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f36a0b8704213d2d34b66f119345cc1d4b0b4c95a88834087a19cd83c1 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f37b6b5187ffb077f015a558da43d722e15602ae47a7fe15f05cf5450c 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f353f5a955b8e7e96e593058aa1b26905a5ce8ff6c36770eb218883539 49E10327AD96808A76FC339CFF686DB7C51DE85DD3CC81E6D9571FA3949162CADFF2FD4286473D0BB3A4CA0E3A1BDBCC found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 49 e1 03 27 ad 96 80 8a 76 fc 33 9c ff 68 6d b7 |I..'....v.3..hm.| | c5 1d e8 5d d3 cc 81 e6 d9 57 1f a3 94 91 62 ca |...].....W....b.| | df f2 fd 42 86 47 3d 0b b3 a4 ca 0e 3a 1b db cc |...B.G=.....:...| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f3 ea 5c eb 07 10 77 49 af 52 62 4d 67 4e 47 e9 |..\...wI.RbMgNG.| | 64 ae 7e 84 ab b1 40 90 90 0d 9a 93 40 52 34 c2 |d.~...@.....@R4.| | f3 53 f5 a9 55 b8 e7 e9 6e 59 30 58 aa 1b 26 90 |.S..U...nY0X..&.| | 5a 5c e8 ff 6c 36 77 0e b2 18 88 35 39 |Z\..l6w....59 | hash out[136]: | 04 db 53 b4 b1 41 76 79 dc 7e b3 7d b7 92 29 ad |..S..Avy.~.}..).| | 27 c4 ea 34 d0 78 f2 3f 66 f6 17 fc 57 a8 28 5d |'..4.x.?f...W.(]| | dc c5 68 9a ea 0f 4e 6e 4a 0e cc 9b 33 e9 3a 8d |..h...NnJ...3.:.| | e3 ed f6 03 f8 1c 87 a9 c0 16 72 ff e8 9f fb d7 |..........r.....| | b8 fc 1c 21 89 b3 84 83 55 80 a8 51 51 25 c4 9a |...!....U..QQ%..| | ca 94 08 e1 a3 e7 56 5e c8 d2 0f 60 a1 63 7c 18 |......V^...`.c|.| | 83 72 52 c9 70 80 93 13 6a 15 e1 f3 5d 0e e8 26 |.rR.p...j...]..&| | 48 5a 14 c5 31 15 05 9a 05 06 5f 95 44 3f 7b 0a |HZ..1....._.D?{.| | e5 ec df fa f0 98 95 5b |.......[ | PRF out[136]: | 04 db 53 b4 b1 41 76 79 dc 7e b3 7d b7 92 29 ad |..S..Avy.~.}..).| | 27 c4 ea 34 d0 78 f2 3f 66 f6 17 fc 57 a8 28 5d |'..4.x.?f...W.(]| | dc c5 68 9a ea 0f 4e 6e 4a 0e cc 9b 33 e9 3a 8d |..h...NnJ...3.:.| | e3 ed f6 03 f8 1c 87 a9 c0 16 72 ff e8 9f fb d7 |..........r.....| | b8 fc 1c 21 89 b3 84 83 55 80 a8 51 51 25 c4 9a |...!....U..QQ%..| | ca 94 08 e1 a3 e7 56 5e c8 d2 0f 60 a1 63 7c 18 |......V^...`.c|.| | 83 72 52 c9 70 80 93 13 6a 15 e1 f3 5d 0e e8 26 |.rR.p...j...]..&| | 48 5a 14 c5 31 15 05 9a 05 06 5f 95 44 3f 7b 0a |HZ..1....._.D?{.| | e5 ec df fa f0 98 95 5b |.......[ | key expansion[136]: | 04 db 53 b4 b1 41 76 79 dc 7e b3 7d b7 92 29 ad |..S..Avy.~.}..).| | 27 c4 ea 34 d0 78 f2 3f 66 f6 17 fc 57 a8 28 5d |'..4.x.?f...W.(]| | dc c5 68 9a ea 0f 4e 6e 4a 0e cc 9b 33 e9 3a 8d |..h...NnJ...3.:.| | e3 ed f6 03 f8 1c 87 a9 c0 16 72 ff e8 9f fb d7 |..........r.....| | b8 fc 1c 21 89 b3 84 83 55 80 a8 51 51 25 c4 9a |...!....U..QQ%..| | ca 94 08 e1 a3 e7 56 5e c8 d2 0f 60 a1 63 7c 18 |......V^...`.c|.| | 83 72 52 c9 70 80 93 13 6a 15 e1 f3 5d 0e e8 26 |.rR.p...j...]..&| | 48 5a 14 c5 31 15 05 9a 05 06 5f 95 44 3f 7b 0a |HZ..1....._.D?{.| | e5 ec df fa f0 98 95 5b |.......[ | Client MAC key[20]: | 04 db 53 b4 b1 41 76 79 dc 7e b3 7d b7 92 29 ad |..S..Avy.~.}..).| | 27 c4 ea 34 |'..4 | Server MAC key[20]: | d0 78 f2 3f 66 f6 17 fc 57 a8 28 5d dc c5 68 9a |.x.?f...W.(]..h.| | ea 0f 4e 6e |..Nn | Client Write key[32]: | 4a 0e cc 9b 33 e9 3a 8d e3 ed f6 03 f8 1c 87 a9 |J...3.:.........| | c0 16 72 ff e8 9f fb d7 b8 fc 1c 21 89 b3 84 83 |..r........!....| Server Write key[32]: | 55 80 a8 51 51 25 c4 9a ca 94 08 e1 a3 e7 56 5e |U..QQ%........V^| | c8 d2 0f 60 a1 63 7c 18 83 72 52 c9 70 80 93 13 |...`.c|..rR.p...| Client Write IV[16]: | 6a 15 e1 f3 5d 0e e8 26 48 5a 14 c5 31 15 05 9a |j...]..&HZ..1...| Server Write IV[16]: | 05 06 5f 95 44 3f 7b 0a e5 ec df fa f0 98 95 5b |.._.D?{........[| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 49 e1 03 27 ad 96 80 8a 76 fc 33 9c ff 68 6d b7 |I..'....v.3..hm.| | c5 1d e8 5d d3 cc 81 e6 d9 57 1f a3 94 91 62 ca |...].....W....b.| | df f2 fd 42 86 47 3d 0b b3 a4 ca 0e 3a 1b db cc |...B.G=.....:...| dissect_ssl3_handshake session keys successfully generated record: offset = 107, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 113, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | bb 79 6b a1 ec a1 98 ed ef 7d 5d b0 6e a5 a3 82 |.yk......}].n...| | db 76 70 9f 0a 50 9e 7e 72 de b1 a9 f3 b3 31 c2 |.vp..P.~r.....1.| | fe 5e 32 57 ac 45 c9 49 69 52 1d fd fd 50 77 e4 |.^2W.E.IiR...Pw.| | 53 28 40 7f c9 2a fa 46 02 a1 6b b1 20 2c 94 f3 |S(@..*.F..k. ,..| Plaintext[64]: | 78 12 f6 0f a3 20 48 8a 0b a7 10 4b ef 71 e5 2c |x.... H....K.q.,| | 14 00 00 0c 0e 27 c5 25 9e 5e 51 e8 55 75 53 92 |.....'.%.^Q.UuS.| | 8f 02 a0 b4 00 ce ac eb 80 2e b0 e7 69 1f 6a 8f |............i.j.| | ac c0 33 21 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..3!............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 8f 02 a0 b4 00 ce ac eb 80 2e b0 e7 69 1f 6a 8f |............i.j.| | ac c0 33 21 |..3! | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #399 (first time) conversation = 0x7fca71df0598, ssl_session = 0x7fca45c03320 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 98 77 5d d3 c7 44 00 e3 53 5d 61 fd 2c 03 89 19 |.w]..D..S]a.,...| | 14 8a 10 14 4d 44 62 26 2a a0 1b 31 fe 23 33 0e |....MDb&*..1.#3.| | ab 6b 6b 73 d9 fb 1c 05 45 32 85 17 b2 d4 cb 73 |.kks....E2.....s| | 55 16 7e 6a fc 67 1f 40 bb 71 12 ce 2f 78 f8 e6 |U.~j.g.@.q../x..| Plaintext[64]: | dc 7c dd ee 49 3e f9 07 d3 08 c3 62 28 46 34 c1 |.|..I>.....b(F4.| | 14 00 00 0c bb 5e a4 b5 4f 62 bd 7c e1 3d 41 9b |.....^..Ob.|.=A.| | 30 d6 85 81 1c d8 23 cf d4 78 69 9d 7d 4c d7 51 |0.....#..xi.}L.Q| | 0f 69 03 12 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.i..............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 30 d6 85 81 1c d8 23 cf d4 78 69 9d 7d 4c d7 51 |0.....#..xi.}L.Q| | 0f 69 03 12 |.i.. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #400 (first time) conversation = 0x7fca71df0598, ssl_session = 0x7fca45c03320 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | 4b 8e 42 fa 9e e7 6d 30 f8 a4 d5 4c 07 7f 91 c6 |K.B...m0...L....| | d7 e0 fc 0d 56 c4 bb 3c 9c c2 b7 23 7f 02 7a d7 |....V..<...#..z.| | 49 2a 76 d3 17 c9 4a 45 74 1d 9c f3 0e f0 cb 5b |I*v...JEt......[| | 6a ad 6f b4 ea 0d d7 f3 e2 1c 25 d2 b7 e3 1b dc |j.o.......%.....| | 9c 90 be 15 82 ac a9 7b 6e 38 30 d8 50 89 66 d6 |.......{n80.P.f.| | 62 6c cf ba f9 0d a4 82 26 55 22 90 d3 f8 02 72 |bl......&U"....r| | 50 fd ad 79 85 0a 70 04 ce 21 83 16 6f 40 fe 99 |P..y..p..!..o@..| Plaintext[112]: | 87 7c ff 3a 1d a1 b0 a2 79 85 27 4d d6 df 14 65 |.|.:....y.'M...e| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 2d 65 63 64 73 61 |Host: ecdh-ecdsa| | 2d 61 65 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 |-aes256-sha.loca| | 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.| | 6e 6c 3a 34 34 38 32 0d 0a 0d 0a ce e2 4b 0d f0 |nl:4482......K..| | 9a 7a aa de a7 f3 f5 8f d6 a3 9b 0a f1 38 cb 00 |.z...........8..| ssl_decrypt_record found padding 0 final len 111 checking mac (len 75, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 04 bd 33 a9 f1 b9 57 2c d0 d7 76 86 8f 86 f6 2a |..3...W,..v....*| | ee bf 95 2a |...* | ssl_decrypt_record: mac failed association_find: TCP port 60960 found (nil) association_find: TCP port 4482 found 0x37380f0 dissect_ssl enter frame #401 (first time) conversation = 0x7fca71df0598, ssl_session = 0x7fca45c03320 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | fa bf dd 7f 6c c3 1d d9 e9 b4 43 ba 7c 13 94 80 |....l.....C.|...| | b1 51 a5 08 14 40 af 5b 18 b6 4e 0c 49 bb f1 4d |.Q...@.[..N.I..M| | 38 6e 13 9d 86 7e 6f f8 9f 8e 07 e8 f6 bb b1 d0 |8n...~o.........| | f5 0f 10 73 1b 2c 9c f5 8c 38 00 a0 2b 7a 83 58 |...s.,...8..+z.X| | ee a5 c4 3f 4a a0 43 e6 f5 1e b4 f5 d8 f7 14 03 |...?J.C.........| | bb d2 68 fe 69 7c d6 70 b5 b7 3e 07 08 b7 26 05 |..h.i|.p..>...&.| | e9 e2 f7 58 ff a0 38 ad cd d3 d3 a4 0b e9 b7 dc |...X..8.........| | c8 90 c4 f6 36 db 7d 15 24 4d 6f 75 0b 1f 36 c2 |....6.}.$Mou..6.| | 63 4d ee d1 88 c1 be 12 cd e7 e5 99 f8 b4 1d 58 |cM.............X| | 26 10 ed ab c4 da 08 e2 f8 7d 8c a6 df 44 92 91 |&........}...D..| | 68 e1 fd 1d 15 7a d5 50 98 ff 2e f2 9b c3 2a fb |h....z.P......*.| | 49 c9 52 a9 4a 23 5c 98 eb 0b f5 fe 2c c5 48 4e |I.R.J#\.....,.HN| | 4c f8 ec c1 22 41 05 36 5a 4c e0 40 50 fc 43 8a |L..."A.6ZL.@P.C.| | 75 e3 62 58 46 58 6c ff 4a 9d 3b 32 75 a9 d4 a0 |u.bXFXl.J.;2u...| | 13 5d 6e 6b 04 11 f2 ea 05 2b 81 3a 2e 3d 71 7c |.]nk.....+.:.=q|| | 4f 6f 24 52 29 c4 02 3f 01 f3 4d e1 ba 50 83 b9 |Oo$R)..?..M..P..| | 37 1d 61 b6 93 29 75 d1 64 37 17 ba a9 a3 06 d3 |7.a..)u.d7......| | ca ea 87 c3 b6 20 bd b6 26 30 71 39 ff 46 41 83 |..... ..&0q9.FA.| | 1a ae 60 57 94 9f 2a 0f 05 86 34 67 52 0d 9b 2c |..`W..*...4gR..,| | 12 d9 ae 05 63 80 d9 ac 65 e0 cf 63 65 b3 69 f4 |....c...e..ce.i.| | 38 c5 dc 28 fa 54 91 5e 73 14 13 3f eb 51 3f 88 |8..(.T.^s..?.Q?.| | 3c aa af c1 7f 18 34 0f c3 22 29 cb a2 b3 cd d6 |<.....4..").....| | 1f ae a0 77 09 14 91 3e 4f 40 1d ab b8 c6 bc ce |...w...>O@......| | b3 55 21 ac 65 5a 8c 9f 0d 56 45 36 90 23 40 58 |.U!.eZ...VE6.#@X| | 29 75 e8 ce 86 0f 1d 83 f1 4b 8f 32 91 c5 41 2c |)u.......K.2..A,| Plaintext[400]: | 77 27 ad e0 ab 36 11 b5 c5 a4 82 19 f8 cc 9d d3 |w'...6..........| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:| | 31 31 3a 33 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:31 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 33 0d 0a 43 6f 6e 6e 65 63 74 |th: 143..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 30 35 20 2d 20 45 43 44 48 2d |xC0,0x05 - ECDH-| | 45 43 44 53 41 2d 41 45 53 32 35 36 2d 53 48 41 |ECDSA-AES256-SHA| | 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH| | 2f 45 43 44 53 41 20 41 75 3d 45 43 44 48 20 45 |/ECDSA Au=ECDH E| | 6e 63 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 |nc=AES(256) Mac| | 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 |=SHA1v.| | 98 67 5f 6b 1f 37 17 c3 a4 b2 e9 f4 cf 2f 9b 5b |.g_k.7......./.[| | 07 fd 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d |................| ssl_decrypt_record found padding 13 final len 386 checking mac (len 350, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | ac 7a 1e 70 39 6f 28 c5 58 c6 8c 4c 8c 68 2e 87 |.z.p9o(.X..L.h..| | b0 b0 55 42 |..UB | ssl_decrypt_record: mac failed association_find: TCP port 4482 found 0x37380f0 dissect_ssl enter frame #402 (first time) conversation = 0x7fca71df0598, ssl_session = 0x7fca45c03320 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 43 9d 1d ec 16 db 4b 21 92 33 44 21 bf 64 ea 0e |C.....K!.3D!.d..| | a3 ff d7 79 58 85 12 28 88 28 d8 c4 de 0d b4 66 |...yX..(.(.....f| | 44 9e 72 63 da 8c 54 30 54 96 23 ab 38 c2 65 38 |D.rc..T0T.#.8.e8| Plaintext[48]: | 5b 00 32 f8 16 cb 6c 49 0a c3 83 80 0d fd 66 24 |[.2...lI......f$| | 01 00 b7 90 df c8 cb 98 41 b4 d7 cd b6 6f 82 53 |........A....o.S| | 55 00 b1 40 53 25 09 09 09 09 09 09 09 09 09 09 |U..@S%..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | b7 90 df c8 cb 98 41 b4 d7 cd b6 6f 82 53 55 00 |......A....o.SU.| | b1 40 53 25 |.@S% | ssl_decrypt_record: mac ok dissect_ssl enter frame #404 (first time) conversation = 0x7fca71df0598, ssl_session = 0x7fca45c03320 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | bd 28 67 88 30 d4 72 a1 4c 34 7a 6a 5d 13 0a 2b |.(g.0.r.L4zj]..+| | fb 2f 4e 82 5c 7c 0f b1 08 07 6e 1f e3 81 a9 a7 |./N.\|....n.....| | d4 be bb e3 b7 9d 27 aa 01 b0 20 a5 59 09 3d a5 |......'... .Y.=.| Plaintext[48]: | 2f ed 46 41 3a 22 a4 bf 7f 2e a1 40 99 14 a4 7d |/.FA:".....@...}| | 01 00 64 1e 8e 0d 0d 98 0b d2 f3 dd e2 b4 ba 87 |..d.............| | ed d8 ae 37 8b e0 09 09 09 09 09 09 09 09 09 09 |...7............| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 64 1e 8e 0d 0d 98 0b d2 f3 dd e2 b4 ba 87 ed d8 |d...............| | ae 37 8b e0 |.7.. | ssl_decrypt_record: mac ok dissect_ssl enter frame #409 (first time) ssl_session_init: initializing ptr 0x7fca45c05800 size 688 conversation = 0x7fca71df0840, ssl_session = 0x7fca45c05800 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 36616 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4484 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #411 (first time) conversation = 0x7fca71df0840, ssl_session = 0x7fca45c05800 record: offset = 0, reported_length_remaining = 750 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 66, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0xC008 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 49 e1 03 27 ad 96 80 8a 76 fc 33 9c ff 68 6d b7 |I..'....v.3..hm.| | c5 1d e8 5d d3 cc 81 e6 d9 57 1f a3 94 91 62 ca |...].....W....b.| | df f2 fd 42 86 47 3d 0b b3 a4 ca 0e 3a 1b db cc |...B.G=.....:...| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f3 76 7d 57 c7 3b 3b 64 df 63 69 82 c2 a5 db 19 |.v}W.;;d.ci.....| | 7f 7e a7 3c 02 7e b4 4a e4 05 cb 7c 2e 52 34 c2 |.~.<.~.J...|.R4.| | f3 3d 02 71 3b e9 4b 00 5a 27 e8 ad 85 4d b7 e2 |.=.q;.K.Z'...M..| | 65 e0 4b f4 90 64 b2 d3 3f 46 f7 03 d2 |e.K..d..?F... | hash out[104]: | 3a 27 41 d8 e9 83 8b 1c 10 4a d0 bd 40 86 ef d5 |:'A......J..@...| | df ea 29 93 63 a1 d3 08 0e 8d fe 7c 17 c6 12 78 |..).c......|...x| | d8 c7 39 77 da 1d ab fa fc 07 24 5e cb c9 d2 e3 |..9w......$^....| | 0d bf 8d c2 83 6e 91 50 a4 6a 34 da 04 3b 66 d7 |.....n.P.j4..;f.| | b7 ed 5b 47 f9 c6 d4 bb c3 cc 69 4a 63 73 54 ef |..[G......iJcsT.| | d0 50 32 47 49 66 0e 88 39 56 83 17 9f c3 53 c4 |.P2GIf..9V....S.| | 0e 32 ec 22 0d 4b 17 da |.2.".K.. | PRF out[104]: | 3a 27 41 d8 e9 83 8b 1c 10 4a d0 bd 40 86 ef d5 |:'A......J..@...| | df ea 29 93 63 a1 d3 08 0e 8d fe 7c 17 c6 12 78 |..).c......|...x| | d8 c7 39 77 da 1d ab fa fc 07 24 5e cb c9 d2 e3 |..9w......$^....| | 0d bf 8d c2 83 6e 91 50 a4 6a 34 da 04 3b 66 d7 |.....n.P.j4..;f.| | b7 ed 5b 47 f9 c6 d4 bb c3 cc 69 4a 63 73 54 ef |..[G......iJcsT.| | d0 50 32 47 49 66 0e 88 39 56 83 17 9f c3 53 c4 |.P2GIf..9V....S.| | 0e 32 ec 22 0d 4b 17 da |.2.".K.. | key expansion[104]: | 3a 27 41 d8 e9 83 8b 1c 10 4a d0 bd 40 86 ef d5 |:'A......J..@...| | df ea 29 93 63 a1 d3 08 0e 8d fe 7c 17 c6 12 78 |..).c......|...x| | d8 c7 39 77 da 1d ab fa fc 07 24 5e cb c9 d2 e3 |..9w......$^....| | 0d bf 8d c2 83 6e 91 50 a4 6a 34 da 04 3b 66 d7 |.....n.P.j4..;f.| | b7 ed 5b 47 f9 c6 d4 bb c3 cc 69 4a 63 73 54 ef |..[G......iJcsT.| | d0 50 32 47 49 66 0e 88 39 56 83 17 9f c3 53 c4 |.P2GIf..9V....S.| | 0e 32 ec 22 0d 4b 17 da |.2.".K.. | Client MAC key[20]: | 3a 27 41 d8 e9 83 8b 1c 10 4a d0 bd 40 86 ef d5 |:'A......J..@...| | df ea 29 93 |..). | Server MAC key[20]: | 63 a1 d3 08 0e 8d fe 7c 17 c6 12 78 d8 c7 39 77 |c......|...x..9w| | da 1d ab fa |.... | Client Write key[24]: | fc 07 24 5e cb c9 d2 e3 0d bf 8d c2 83 6e 91 50 |..$^.........n.P| | a4 6a 34 da 04 3b 66 d7 |.j4..;f. | Server Write key[24]: | b7 ed 5b 47 f9 c6 d4 bb c3 cc 69 4a 63 73 54 ef |..[G......iJcsT.| | d0 50 32 47 49 66 0e 88 |.P2GIf.. | Client Write IV[8]: | 39 56 83 17 9f c3 53 c4 |9V....S. | Server Write IV[8]: | 0e 32 ec 22 0d 4b 17 da |.2.".K.. | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 71, reported_length_remaining = 679 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 480, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556 record: offset = 556, reported_length_remaining = 194 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 180, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 561 length 176 bytes, remaining 741 record: offset = 741, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 746 length 0 bytes, remaining 750 dissect_ssl enter frame #413 (first time) conversation = 0x7fca71df0840, ssl_session = 0x7fca45c05800 record: offset = 0, reported_length_remaining = 134 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 70, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2f33d02713be94b005a27e8ad854db7e265e04bf490... looking for RSA pre-master4104458e6a57e4b7b005ce280dd331641c7d463ab55640b6... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a88b3723405ec9f6d 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2ed4699771feefd3c969e60a3a051977784c4581a0c414211a97aad6e 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f28e1f7f2a7aca2e9c71ffb47ed2d846d11d723e2b9d4a44e41c19ecd8 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2330ea5edf65f3fbfece59d5033d2915b04625ca5bb934034eaa986eb 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f23bb1ff6b1a567cab274581ce4ae59ffe8a2e43ae2defe2afd7886633 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2968aa51a4ea28bcab908d2a0a5011eb847de99e38f014db53571e92d 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2888c7e15b7d5827fd75db4f7b7a1c450be4f9f14457607e1a26fce1a DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f21b0765b7ce7a5bd63502bcc79e63d2e53e6c7ba886d2a6d621b429d3 DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f22f616d5f9ad8f48c36410b08fcf872f0c92fbe02b4c3c86a91252574 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2d989534de7839fc5461dfb9290266a33b0f241faf93f4c984d1656a8 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f36756c62ee64b45cf17caefd0cd105ebe825275bec27aeb520d7294c9 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f36a2e00daced950610a278df5d5cbcd232469fee9bc7a06511da65e98 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f36a0b8704213d2d34b66f119345cc1d4b0b4c95a88834087a19cd83c1 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f37b6b5187ffb077f015a558da43d722e15602ae47a7fe15f05cf5450c 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f353f5a955b8e7e96e593058aa1b26905a5ce8ff6c36770eb218883539 49E10327AD96808A76FC339CFF686DB7C51DE85DD3CC81E6D9571FA3949162CADFF2FD4286473D0BB3A4CA0E3A1BDBCC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f3ea5ceb07107749af52624d674e47e964ae7e84abb14090900d9a9340 49E10327AD96808A76FC339CFF686DB7C51DE85DD3CC81E6D9571FA3949162CADFF2FD4286473D0BB3A4CA0E3A1BDBCC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f3767d57c73b3b64df636982c2a5db197f7ea73c027eb44ae405cb7c2e 50787B46430A893B2355D92AEF474B50067D8252EC544E904DCC0375DABE46AC7597C4ECB62A877B39D5C046BCCFF5D7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f33d02713be94b005a27e8ad854db7e265e04bf49064b2d33f46f703d2 50787B46430A893B2355D92AEF474B50067D8252EC544E904DCC0375DABE46AC7597C4ECB62A877B39D5C046BCCFF5D7 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 50 78 7b 46 43 0a 89 3b 23 55 d9 2a ef 47 4b 50 |Px{FC..;#U.*.GKP| | 06 7d 82 52 ec 54 4e 90 4d cc 03 75 da be 46 ac |.}.R.TN.M..u..F.| | 75 97 c4 ec b6 2a 87 7b 39 d5 c0 46 bc cf f5 d7 |u....*.{9..F....| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f3 76 7d 57 c7 3b 3b 64 df 63 69 82 c2 a5 db 19 |.v}W.;;d.ci.....| | 7f 7e a7 3c 02 7e b4 4a e4 05 cb 7c 2e 52 34 c2 |.~.<.~.J...|.R4.| | f3 3d 02 71 3b e9 4b 00 5a 27 e8 ad 85 4d b7 e2 |.=.q;.K.Z'...M..| | 65 e0 4b f4 90 64 b2 d3 3f 46 f7 03 d2 |e.K..d..?F... | hash out[104]: | 98 cc f4 f3 ee 79 8e 8c 36 3c a1 13 6a 84 4c 2b |.....y..6<..j.L+| | 69 69 6a cf e9 d4 62 d8 8d 32 40 84 99 17 45 1e |iij...b..2@...E.| | 9c 7b 37 46 bf cf 32 98 64 2d 40 ce 2b b7 19 26 |.{7F..2.d-@.+..&| | 78 1e 19 c4 e3 2c d4 e5 b0 56 69 76 c1 f4 14 ee |x....,...Viv....| | a4 d5 ca 3b 18 60 5e 6b 4f 09 23 1f d1 2a ed 7c |...;.`^kO.#..*.|| | 55 22 2d 90 ea 17 e1 5b d2 cf 6b b7 03 1d 22 35 |U"-....[..k..."5| | 0c 9a 04 f6 d8 9a 3d 1b |......=. | PRF out[104]: | 98 cc f4 f3 ee 79 8e 8c 36 3c a1 13 6a 84 4c 2b |.....y..6<..j.L+| | 69 69 6a cf e9 d4 62 d8 8d 32 40 84 99 17 45 1e |iij...b..2@...E.| | 9c 7b 37 46 bf cf 32 98 64 2d 40 ce 2b b7 19 26 |.{7F..2.d-@.+..&| | 78 1e 19 c4 e3 2c d4 e5 b0 56 69 76 c1 f4 14 ee |x....,...Viv....| | a4 d5 ca 3b 18 60 5e 6b 4f 09 23 1f d1 2a ed 7c |...;.`^kO.#..*.|| | 55 22 2d 90 ea 17 e1 5b d2 cf 6b b7 03 1d 22 35 |U"-....[..k..."5| | 0c 9a 04 f6 d8 9a 3d 1b |......=. | key expansion[104]: | 98 cc f4 f3 ee 79 8e 8c 36 3c a1 13 6a 84 4c 2b |.....y..6<..j.L+| | 69 69 6a cf e9 d4 62 d8 8d 32 40 84 99 17 45 1e |iij...b..2@...E.| | 9c 7b 37 46 bf cf 32 98 64 2d 40 ce 2b b7 19 26 |.{7F..2.d-@.+..&| | 78 1e 19 c4 e3 2c d4 e5 b0 56 69 76 c1 f4 14 ee |x....,...Viv....| | a4 d5 ca 3b 18 60 5e 6b 4f 09 23 1f d1 2a ed 7c |...;.`^kO.#..*.|| | 55 22 2d 90 ea 17 e1 5b d2 cf 6b b7 03 1d 22 35 |U"-....[..k..."5| | 0c 9a 04 f6 d8 9a 3d 1b |......=. | Client MAC key[20]: | 98 cc f4 f3 ee 79 8e 8c 36 3c a1 13 6a 84 4c 2b |.....y..6<..j.L+| | 69 69 6a cf |iij. | Server MAC key[20]: | e9 d4 62 d8 8d 32 40 84 99 17 45 1e 9c 7b 37 46 |..b..2@...E..{7F| | bf cf 32 98 |..2. | Client Write key[24]: | 64 2d 40 ce 2b b7 19 26 78 1e 19 c4 e3 2c d4 e5 |d-@.+..&x....,..| | b0 56 69 76 c1 f4 14 ee |.Viv.... | Server Write key[24]: | a4 d5 ca 3b 18 60 5e 6b 4f 09 23 1f d1 2a ed 7c |...;.`^kO.#..*.|| | 55 22 2d 90 ea 17 e1 5b |U"-....[ | Client Write IV[8]: | d2 cf 6b b7 03 1d 22 35 |..k..."5 | Server Write IV[8]: | 0c 9a 04 f6 d8 9a 3d 1b |......=. | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 50 78 7b 46 43 0a 89 3b 23 55 d9 2a ef 47 4b 50 |Px{FC..;#U.*.GKP| | 06 7d 82 52 ec 54 4e 90 4d cc 03 75 da be 46 ac |.}.R.TN.M..u..F.| | 75 97 c4 ec b6 2a 87 7b 39 d5 c0 46 bc cf f5 d7 |u....*.{9..F....| dissect_ssl3_handshake session keys successfully generated record: offset = 75, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 81, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 73 4b f1 fc 7d 3e 75 4a 16 a7 c6 0a 6d 4d 45 bb |sK..}>uJ....mME.| | b8 bd 31 57 36 a4 59 70 d4 fd 6c e3 32 26 ce c7 |..1W6.Yp..l.2&..| | 58 1a c0 90 ea bc 3e 3f 9d 7e a4 75 fd 5f a1 8e |X.....>?.~.u._..| Plaintext[48]: | 36 11 39 5d 12 d1 d5 32 14 00 00 0c ef 69 a0 25 |6.9]...2.....i.%| | ac 05 9f 3a 45 c7 cc 59 cd 74 5c 55 c6 38 45 c2 |...:E..Y.t\U.8E.| | 6c b6 61 93 2d 93 af 0d 18 2f 08 c9 03 03 03 03 |l.a.-..../......| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | cd 74 5c 55 c6 38 45 c2 6c b6 61 93 2d 93 af 0d |.t\U.8E.l.a.-...| | 18 2f 08 c9 |./.. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #414 (first time) conversation = 0x7fca71df0840, ssl_session = 0x7fca45c05800 record: offset = 0, reported_length_remaining = 234 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 96 32 03 84 ba 08 ca 89 3d 63 37 f9 75 3a aa 0b |.2......=c7.u:..| | 64 6d 4a 6d 58 b8 b1 60 d5 e9 4b 30 a9 40 3d 1a |dmJmX..`..K0.@=.| | 0c 63 29 61 e0 d4 97 c0 b4 90 62 3e a4 71 8f 56 |.c)a......b>.q.V| Plaintext[48]: | 44 cf b6 c5 04 2d b8 7b 14 00 00 0c 7f 48 91 e0 |D....-.{.....H..| | 4b 61 ae fd 66 36 d7 0f 89 4d 0d 11 2d 69 ca 78 |Ka..f6...M..-i.x| | d3 45 0b 79 3e 9b b0 0a ef 72 03 83 03 03 03 03 |.E.y>....r......| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 89 4d 0d 11 2d 69 ca 78 d3 45 0b 79 3e 9b b0 0a |.M..-i.x.E.y>...| | ef 72 03 83 |.r.. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #415 (first time) conversation = 0x7fca71df0840, ssl_session = 0x7fca45c05800 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | 8d 21 cf 4f 44 65 57 8d a6 74 17 51 35 d7 db 31 |.!.ODeW..t.Q5..1| | 0a ff 82 c1 fa 8d 92 a7 fc 83 55 b1 46 39 8e ba |..........U.F9..| | 00 29 f3 9d 93 af e7 4a f3 0d 94 90 2e bc 8f a2 |.).....J........| | 0b 87 58 f3 ab 0a 80 ac 25 18 cc 4e 6a 29 e1 e9 |..X.....%..Nj)..| | 22 44 95 16 8f 82 2a 48 9a d0 e9 fa 37 86 cc 07 |"D....*H....7...| | 5b 0f dc c9 ff ca e5 1b 2e 97 33 83 0a 9a 08 30 |[.........3....0| | 4d 76 19 07 61 13 32 bc 4b 72 53 df e2 d2 93 f8 |Mv..a.2.KrS.....| Plaintext[112]: | 8c a3 dd 3f 07 3c ea 28 47 45 54 20 2f 20 48 54 |...?.<.(GET / HT| | 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 63 |TP/1.1..Host: ec| | 64 68 65 2d 65 63 64 73 61 2d 64 65 73 2d 63 62 |dhe-ecdsa-des-cb| | 63 33 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e |c3-sha.local.al.| | 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 |lekensteyn.nl:44| | 38 34 0d 0a 0d 0a 1b 95 14 86 23 fc f1 7a 07 c7 |84........#..z..| | d0 a2 4b bc b2 02 1b e6 60 a2 05 05 05 05 05 05 |..K.....`.......| ssl_decrypt_record found padding 5 final len 106 checking mac (len 78, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 57 be ff 9d 6a f8 10 5a 9c 88 6f ba 05 b0 28 17 |W...j..Z..o...(.| | b5 d5 2f ad |../. | ssl_decrypt_record: mac failed association_find: TCP port 36616 found (nil) association_find: TCP port 4484 found 0x3738210 dissect_ssl enter frame #416 (first time) conversation = 0x7fca71df0840, ssl_session = 0x7fca45c05800 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | a6 27 0c 4d 4b d1 f9 a9 6e 0c 7c 18 98 5e 7e ba |.'.MK...n.|..^~.| | 38 95 5d e4 e7 d1 33 e6 0e de e9 c7 53 52 a1 3c |8.]...3.....SR.<| | 9d ea 5a 08 29 cc 7f 7e d6 f3 d5 e7 bd 13 26 d6 |..Z.)..~......&.| | 8a 8c f4 ad c7 89 5e 5b 63 16 96 dd a5 c4 3d f4 |......^[c.....=.| | a4 7c ba 3a 6c f6 48 e8 cd a3 f0 52 db 80 cb c7 |.|.:l.H....R....| | b4 3f c7 5c 1a c1 7c e5 c4 2a 5d f4 a6 65 a7 d0 |.?.\..|..*]..e..| | 9e e8 82 ee 7f d7 bc 31 39 98 c9 23 b6 2a 92 96 |.......19..#.*..| | a7 36 60 97 f8 a5 0b 6a 49 75 b4 b9 8c c8 e0 5f |.6`....jIu....._| | 7c 2e 11 9d 2f 4c 68 84 d6 72 0f 6d bd 94 9f 04 ||.../Lh..r.m....| | cd 16 2f 17 7e c2 69 e6 c8 95 6a bc 8b 84 c4 b9 |../.~.i...j.....| | ff ac 79 62 e6 f0 e1 b1 87 82 ae 36 d7 be a2 34 |..yb.......6...4| | 41 5b 28 8c 81 1e 2b f4 82 1a 8d 34 ce 18 ff f9 |A[(...+....4....| | 79 48 51 65 f4 7c d7 63 1f 18 e4 0e a4 e8 1a 02 |yHQe.|.c........| | c1 b3 e9 09 b6 0c c6 24 65 4e 63 e4 76 0e 68 61 |.......$eNc.v.ha| | e7 cb 51 0c d0 2e 83 1f 0e 3b 9a 9d ff c0 b4 8e |..Q......;......| | 42 83 cc 93 bb d7 ec b3 f7 e7 f6 2b 0a 4a e5 4f |B..........+.J.O| | 88 60 24 2f 42 95 97 a0 2a 8d be d9 6e c0 01 5e |.`$/B...*...n..^| | 48 73 3b eb 86 8b 4e 71 e2 b0 e2 78 d8 9a 49 ae |Hs;...Nq...x..I.| | 7d 17 69 3d ed e1 ff 1e 37 08 d9 e2 af 14 30 42 |}.i=....7.....0B| | 1d 9c af 1e 79 f0 80 be 47 b0 82 9d 20 dc b7 9e |....y...G... ...| | 82 f7 35 4d 68 b2 25 3b c7 b3 b2 69 5a 89 87 66 |..5Mh.%;...iZ..f| | ba 81 e8 e1 ec 47 df 49 1b 7f df 5d 10 09 d6 51 |.....G.I...]...Q| | 5d ca 46 45 20 9b 97 da 37 a7 03 e4 39 1f 6a 87 |].FE ...7...9.j.| | 37 ef b3 7a 0b 8e 98 93 41 48 68 b3 69 84 de e3 |7..z....AHh.i...| Plaintext[384]: | 53 33 d2 1c d0 e6 7d a9 48 54 54 50 2f 31 2e 31 |S3....}.HTTP/1.1| | 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:| | 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da| | 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep | | 32 30 31 33 20 32 30 3a 31 31 3a 33 31 20 47 4d |2013 20:11:31 GM| | 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:| | 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont| | 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 33 0d |ent-Length: 143.| | 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo| | 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu| | 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00| | 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach| | 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca| | 63 68 65 0d 0a 0d 0a 30 78 43 30 2c 30 78 30 38 |che....0xC0,0x08| | 20 2d 20 45 43 44 48 45 2d 45 43 44 53 41 2d 44 | - ECDHE-ECDSA-D| | 45 53 2d 43 42 43 33 2d 53 48 41 20 53 53 4c 76 |ES-CBC3-SHA SSLv| | 33 20 4b 78 3d 45 43 44 48 20 20 20 20 20 41 75 |3 Kx=ECDH Au| | 3d 45 43 44 53 41 20 45 6e 63 3d 33 44 45 53 28 |=ECDSA Enc=3DES(| | 31 36 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 |168) Mac=SHA1document.do| | 6d 61 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c |main='local.al.l| | 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 |ekensteyn.nl'.K..v.J..Z| | e1 86 2a 24 ee 0f 6f 36 be 87 05 05 05 05 05 05 |..*$..o6........| ssl_decrypt_record found padding 5 final len 378 checking mac (len 350, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 38 2d 7f 46 7e 2a 25 9c ab 68 5f 5f e8 1c a1 d2 |8-.F~*%..h__....| | d7 11 ad dd |.... | ssl_decrypt_record: mac failed association_find: TCP port 4484 found 0x3738210 dissect_ssl enter frame #417 (first time) conversation = 0x7fca71df0840, ssl_session = 0x7fca45c05800 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 33 e8 6d 3d 0d 2d c8 07 76 fa bb 56 76 17 d8 d0 |3.m=.-..v..Vv...| | 39 52 be 92 1f e7 a1 fa 4d 5d 89 ac c6 ea c7 a6 |9R......M]......| Plaintext[32]: | 6c c1 03 87 c6 89 2e 47 01 00 66 e8 82 84 37 1f |l......G..f...7.| | 12 bb ee 1f 57 0b 37 c3 05 13 80 6c 1c 75 01 01 |....W.7....l.u..| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 66 e8 82 84 37 1f 12 bb ee 1f 57 0b 37 c3 05 13 |f...7.....W.7...| | 80 6c 1c 75 |.l.u | ssl_decrypt_record: mac ok dissect_ssl enter frame #419 (first time) conversation = 0x7fca71df0840, ssl_session = 0x7fca45c05800 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | 8f 0f 00 82 03 2f 39 46 a1 bd 7c f6 59 ed 74 05 |...../9F..|.Y.t.| | 74 45 86 c4 80 5b 79 7c 35 90 3a 9e 0d c2 d2 a5 |tE...[y|5.:.....| Plaintext[32]: | 6c 9c 35 14 01 43 7a e8 01 00 12 c0 f8 f7 00 97 |l.5..Cz.........| | 56 1f 8f 1b 29 62 af eb b9 95 0a 85 aa c8 01 01 |V...)b..........| ssl_decrypt_record found padding 1 final len 30 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 12 c0 f8 f7 00 97 56 1f 8f 1b 29 62 af eb b9 95 |......V...)b....| | 0a 85 aa c8 |.... | ssl_decrypt_record: mac ok dissect_ssl enter frame #424 (first time) ssl_session_init: initializing ptr 0x7fca45c07d00 size 688 conversation = 0x7fca71df0ae8, ssl_session = 0x7fca45c07d00 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 39714 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4485 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #426 (first time) conversation = 0x7fca71df0ae8, ssl_session = 0x7fca45c07d00 record: offset = 0, reported_length_remaining = 751 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 66, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0xC009 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 50 78 7b 46 43 0a 89 3b 23 55 d9 2a ef 47 4b 50 |Px{FC..;#U.*.GKP| | 06 7d 82 52 ec 54 4e 90 4d cc 03 75 da be 46 ac |.}.R.TN.M..u..F.| | 75 97 c4 ec b6 2a 87 7b 39 d5 c0 46 bc cf f5 d7 |u....*.{9..F....| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f3 f8 5e 50 3f 39 bb b6 0e 91 46 5b 12 62 2d 25 |..^P?9....F[.b-%| | ae 6d 94 a0 09 83 23 9d 3f 3d 13 34 e5 52 34 c2 |.m....#.?=.4.R4.| | f3 5b c3 b6 25 01 5f 9e 96 5f 41 c8 85 c3 eb b8 |.[..%._.._A.....| | fb 55 9d f8 e2 43 bc 09 6a de 43 7e eb |.U...C..j.C~. | hash out[104]: | 10 78 e9 b5 db 79 ff 9a e8 76 6a 9e 33 66 85 34 |.x...y...vj.3f.4| | 18 cc c3 5b fd e4 3e 9e 5b c7 da fd 6b fb 8b 80 |...[..>.[...k...| | e8 77 fb 21 72 cf 29 f9 02 f5 84 7f ac ac e4 6d |.w.!r.)........m| | e2 46 8c 2a f8 f0 be da 97 7f f7 90 55 ee 44 34 |.F.*........U.D4| | ba 01 e3 c5 73 33 4d b8 b6 37 b5 a7 f3 3e ad 69 |....s3M..7...>.i| | e9 9f 5d 32 d9 d7 02 2b 29 26 46 6f 70 87 c3 d2 |..]2...+)&Fop...| | d3 96 09 aa 04 c6 12 3a |.......: | PRF out[104]: | 10 78 e9 b5 db 79 ff 9a e8 76 6a 9e 33 66 85 34 |.x...y...vj.3f.4| | 18 cc c3 5b fd e4 3e 9e 5b c7 da fd 6b fb 8b 80 |...[..>.[...k...| | e8 77 fb 21 72 cf 29 f9 02 f5 84 7f ac ac e4 6d |.w.!r.)........m| | e2 46 8c 2a f8 f0 be da 97 7f f7 90 55 ee 44 34 |.F.*........U.D4| | ba 01 e3 c5 73 33 4d b8 b6 37 b5 a7 f3 3e ad 69 |....s3M..7...>.i| | e9 9f 5d 32 d9 d7 02 2b 29 26 46 6f 70 87 c3 d2 |..]2...+)&Fop...| | d3 96 09 aa 04 c6 12 3a |.......: | key expansion[104]: | 10 78 e9 b5 db 79 ff 9a e8 76 6a 9e 33 66 85 34 |.x...y...vj.3f.4| | 18 cc c3 5b fd e4 3e 9e 5b c7 da fd 6b fb 8b 80 |...[..>.[...k...| | e8 77 fb 21 72 cf 29 f9 02 f5 84 7f ac ac e4 6d |.w.!r.)........m| | e2 46 8c 2a f8 f0 be da 97 7f f7 90 55 ee 44 34 |.F.*........U.D4| | ba 01 e3 c5 73 33 4d b8 b6 37 b5 a7 f3 3e ad 69 |....s3M..7...>.i| | e9 9f 5d 32 d9 d7 02 2b 29 26 46 6f 70 87 c3 d2 |..]2...+)&Fop...| | d3 96 09 aa 04 c6 12 3a |.......: | Client MAC key[20]: | 10 78 e9 b5 db 79 ff 9a e8 76 6a 9e 33 66 85 34 |.x...y...vj.3f.4| | 18 cc c3 5b |...[ | Server MAC key[20]: | fd e4 3e 9e 5b c7 da fd 6b fb 8b 80 e8 77 fb 21 |..>.[...k....w.!| | 72 cf 29 f9 |r.). | Client Write key[16]: | 02 f5 84 7f ac ac e4 6d e2 46 8c 2a f8 f0 be da |.......m.F.*....| Server Write key[16]: | 97 7f f7 90 55 ee 44 34 ba 01 e3 c5 73 33 4d b8 |....U.D4....s3M.| Client Write IV[16]: | b6 37 b5 a7 f3 3e ad 69 e9 9f 5d 32 d9 d7 02 2b |.7...>.i..]2...+| Server Write IV[16]: | 29 26 46 6f 70 87 c3 d2 d3 96 09 aa 04 c6 12 3a |)&Fop..........:| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 71, reported_length_remaining = 680 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 480, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556 record: offset = 556, reported_length_remaining = 195 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 181, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 561 length 177 bytes, remaining 742 record: offset = 742, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 747 length 0 bytes, remaining 751 dissect_ssl enter frame #428 (first time) conversation = 0x7fca71df0ae8, ssl_session = 0x7fca45c07d00 record: offset = 0, reported_length_remaining = 150 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 70, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2f35bc3b625015f9e965f41c885c3ebb8fb559df8e2... looking for RSA pre-master41049356dc02ea9daa883eb1e070e91a3c9acef8fe2ab4e8... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a88b3723405ec9f6d 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2ed4699771feefd3c969e60a3a051977784c4581a0c414211a97aad6e 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f28e1f7f2a7aca2e9c71ffb47ed2d846d11d723e2b9d4a44e41c19ecd8 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2330ea5edf65f3fbfece59d5033d2915b04625ca5bb934034eaa986eb 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f23bb1ff6b1a567cab274581ce4ae59ffe8a2e43ae2defe2afd7886633 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2968aa51a4ea28bcab908d2a0a5011eb847de99e38f014db53571e92d 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2888c7e15b7d5827fd75db4f7b7a1c450be4f9f14457607e1a26fce1a DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f21b0765b7ce7a5bd63502bcc79e63d2e53e6c7ba886d2a6d621b429d3 DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f22f616d5f9ad8f48c36410b08fcf872f0c92fbe02b4c3c86a91252574 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2d989534de7839fc5461dfb9290266a33b0f241faf93f4c984d1656a8 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f36756c62ee64b45cf17caefd0cd105ebe825275bec27aeb520d7294c9 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f36a2e00daced950610a278df5d5cbcd232469fee9bc7a06511da65e98 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f36a0b8704213d2d34b66f119345cc1d4b0b4c95a88834087a19cd83c1 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f37b6b5187ffb077f015a558da43d722e15602ae47a7fe15f05cf5450c 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f353f5a955b8e7e96e593058aa1b26905a5ce8ff6c36770eb218883539 49E10327AD96808A76FC339CFF686DB7C51DE85DD3CC81E6D9571FA3949162CADFF2FD4286473D0BB3A4CA0E3A1BDBCC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f3ea5ceb07107749af52624d674e47e964ae7e84abb14090900d9a9340 49E10327AD96808A76FC339CFF686DB7C51DE85DD3CC81E6D9571FA3949162CADFF2FD4286473D0BB3A4CA0E3A1BDBCC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f3767d57c73b3b64df636982c2a5db197f7ea73c027eb44ae405cb7c2e 50787B46430A893B2355D92AEF474B50067D8252EC544E904DCC0375DABE46AC7597C4ECB62A877B39D5C046BCCFF5D7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f33d02713be94b005a27e8ad854db7e265e04bf49064b2d33f46f703d2 50787B46430A893B2355D92AEF474B50067D8252EC544E904DCC0375DABE46AC7597C4ECB62A877B39D5C046BCCFF5D7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f3f85e503f39bbb60e91465b12622d25ae6d94a00983239d3f3d1334e5 230ECC7B6E87B5763BABAAF128C0BD1AA265687B7D84506D2F5F4A2BEFD4F8A085018691C9F508BD0E1AAF63685AD504 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f35bc3b625015f9e965f41c885c3ebb8fb559df8e243bc096ade437eeb 230ECC7B6E87B5763BABAAF128C0BD1AA265687B7D84506D2F5F4A2BEFD4F8A085018691C9F508BD0E1AAF63685AD504 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 23 0e cc 7b 6e 87 b5 76 3b ab aa f1 28 c0 bd 1a |#..{n..v;...(...| | a2 65 68 7b 7d 84 50 6d 2f 5f 4a 2b ef d4 f8 a0 |.eh{}.Pm/_J+....| | 85 01 86 91 c9 f5 08 bd 0e 1a af 63 68 5a d5 04 |...........chZ..| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f3 f8 5e 50 3f 39 bb b6 0e 91 46 5b 12 62 2d 25 |..^P?9....F[.b-%| | ae 6d 94 a0 09 83 23 9d 3f 3d 13 34 e5 52 34 c2 |.m....#.?=.4.R4.| | f3 5b c3 b6 25 01 5f 9e 96 5f 41 c8 85 c3 eb b8 |.[..%._.._A.....| | fb 55 9d f8 e2 43 bc 09 6a de 43 7e eb |.U...C..j.C~. | hash out[104]: | 21 e1 34 1e 4d d7 05 14 bf c5 82 8d 23 14 60 db |!.4.M.......#.`.| | 67 56 b9 21 78 d5 ff 24 c4 97 8e cf 11 d8 8a 66 |gV.!x..$.......f| | cb bd 67 e1 30 7b 83 e5 95 f7 f7 fb 87 6a af d2 |..g.0{.......j..| | 50 f6 79 04 85 57 75 d1 7d 7a 6d c8 db b2 a0 f3 |P.y..Wu.}zm.....| | ae 6e 1a 83 c8 01 2c 1e 5f 85 d4 54 2c a9 92 6b |.n....,._..T,..k| | a0 f5 69 85 bc 4c 40 70 ed 3c 1b 79 4c 13 47 e5 |..i..L@p.<.yL.G.| | cc 03 67 d7 7f 05 cc 9e |..g..... | PRF out[104]: | 21 e1 34 1e 4d d7 05 14 bf c5 82 8d 23 14 60 db |!.4.M.......#.`.| | 67 56 b9 21 78 d5 ff 24 c4 97 8e cf 11 d8 8a 66 |gV.!x..$.......f| | cb bd 67 e1 30 7b 83 e5 95 f7 f7 fb 87 6a af d2 |..g.0{.......j..| | 50 f6 79 04 85 57 75 d1 7d 7a 6d c8 db b2 a0 f3 |P.y..Wu.}zm.....| | ae 6e 1a 83 c8 01 2c 1e 5f 85 d4 54 2c a9 92 6b |.n....,._..T,..k| | a0 f5 69 85 bc 4c 40 70 ed 3c 1b 79 4c 13 47 e5 |..i..L@p.<.yL.G.| | cc 03 67 d7 7f 05 cc 9e |..g..... | key expansion[104]: | 21 e1 34 1e 4d d7 05 14 bf c5 82 8d 23 14 60 db |!.4.M.......#.`.| | 67 56 b9 21 78 d5 ff 24 c4 97 8e cf 11 d8 8a 66 |gV.!x..$.......f| | cb bd 67 e1 30 7b 83 e5 95 f7 f7 fb 87 6a af d2 |..g.0{.......j..| | 50 f6 79 04 85 57 75 d1 7d 7a 6d c8 db b2 a0 f3 |P.y..Wu.}zm.....| | ae 6e 1a 83 c8 01 2c 1e 5f 85 d4 54 2c a9 92 6b |.n....,._..T,..k| | a0 f5 69 85 bc 4c 40 70 ed 3c 1b 79 4c 13 47 e5 |..i..L@p.<.yL.G.| | cc 03 67 d7 7f 05 cc 9e |..g..... | Client MAC key[20]: | 21 e1 34 1e 4d d7 05 14 bf c5 82 8d 23 14 60 db |!.4.M.......#.`.| | 67 56 b9 21 |gV.! | Server MAC key[20]: | 78 d5 ff 24 c4 97 8e cf 11 d8 8a 66 cb bd 67 e1 |x..$.......f..g.| | 30 7b 83 e5 |0{.. | Client Write key[16]: | 95 f7 f7 fb 87 6a af d2 50 f6 79 04 85 57 75 d1 |.....j..P.y..Wu.| Server Write key[16]: | 7d 7a 6d c8 db b2 a0 f3 ae 6e 1a 83 c8 01 2c 1e |}zm......n....,.| Client Write IV[16]: | 5f 85 d4 54 2c a9 92 6b a0 f5 69 85 bc 4c 40 70 |_..T,..k..i..L@p| Server Write IV[16]: | ed 3c 1b 79 4c 13 47 e5 cc 03 67 d7 7f 05 cc 9e |.<.yL.G...g.....| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 23 0e cc 7b 6e 87 b5 76 3b ab aa f1 28 c0 bd 1a |#..{n..v;...(...| | a2 65 68 7b 7d 84 50 6d 2f 5f 4a 2b ef d4 f8 a0 |.eh{}.Pm/_J+....| | 85 01 86 91 c9 f5 08 bd 0e 1a af 63 68 5a d5 04 |...........chZ..| dissect_ssl3_handshake session keys successfully generated record: offset = 75, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 81, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | b3 df 48 57 a7 b1 2b 05 44 62 c0 70 59 d8 20 63 |..HW..+.Db.pY. c| | 6c 61 9b b3 e9 dc 3e 4c d0 81 4b 0c e3 2f 5a 02 |la....>L..K../Z.| | ed 0b 73 f4 72 fe 1b f7 02 df ab 72 b0 a7 70 b0 |..s.r......r..p.| | dc 5f 67 10 88 97 a9 b1 15 1c cb ad 4a 04 9f a5 |._g.........J...| Plaintext[64]: | 2b dc a7 d7 d2 4f fc cb 1a ea 46 f1 73 22 cc 20 |+....O....F.s". | | 14 00 00 0c e4 0b 1f c5 ee 8c 34 ed ef d6 72 c0 |..........4...r.| | 34 65 bd 3a 3a 2e 7c c9 b5 12 a7 c8 27 7b 69 5f |4e.::.|.....'{i_| | 31 91 ac c2 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |1...............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 34 65 bd 3a 3a 2e 7c c9 b5 12 a7 c8 27 7b 69 5f |4e.::.|.....'{i_| | 31 91 ac c2 |1... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #429 (first time) conversation = 0x7fca71df0ae8, ssl_session = 0x7fca45c07d00 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | a3 a1 1a 86 92 3a 62 d3 f7 d5 b6 97 69 c9 87 c3 |.....:b.....i...| | 81 e6 df 4d 6a f4 fc ef b9 b2 b0 34 c7 0c e6 cc |...Mj......4....| | 0e 34 48 74 12 b9 a8 d2 4f 26 63 63 15 04 c8 be |.4Ht....O&cc....| | a8 f4 5e c3 ef a8 7a 91 7f 2d 25 e1 b8 33 b0 5d |..^...z..-%..3.]| Plaintext[64]: | 74 a1 d0 84 57 46 d5 15 06 08 c6 c4 9d e5 cd f4 |t...WF..........| | 14 00 00 0c b0 97 31 68 da 44 50 21 ad 97 71 c0 |......1h.DP!..q.| | 28 c8 12 6f b6 18 2d 5b a6 25 5a 88 da 12 ad 61 |(..o..-[.%Z....a| | d1 8a 10 e2 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 28 c8 12 6f b6 18 2d 5b a6 25 5a 88 da 12 ad 61 |(..o..-[.%Z....a| | d1 8a 10 e2 |.... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #430 (first time) conversation = 0x7fca71df0ae8, ssl_session = 0x7fca45c07d00 record: offset = 0, reported_length_remaining = 133 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 128, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 128 Ciphertext[128]: | 00 d9 1f ae ed ee 14 33 67 ce b4 c1 03 50 c2 5d |.......3g....P.]| | 0b 23 1e ac 1b fc a2 10 27 4d f3 bf 6b ab 97 4e |.#......'M..k..N| | 19 3e 88 08 bb e7 24 40 a1 06 16 86 fa 69 b3 68 |.>....$@.....i.h| | 38 61 e9 51 90 a3 e3 d1 5c bd 74 0d a3 f2 e0 ef |8a.Q....\.t.....| | e9 4a eb 52 e9 c9 bf d6 a7 06 f3 8f 47 20 19 28 |.J.R........G .(| | 59 91 36 60 ff 72 fb 09 c5 34 2a 51 0e 11 f9 a9 |Y.6`.r...4*Q....| | f2 96 5c af 43 94 8a 2f bb a8 cf 07 90 12 f2 39 |..\.C../.......9| | 40 ce 9c 41 e7 b1 52 35 46 4d 0d d4 a5 7d 4e 94 |@..A..R5FM...}N.| Plaintext[128]: | c3 0c 6a 2e 6e 5e 03 02 2a d4 28 64 f6 63 3a 53 |..j.n^..*.(d.c:S| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds| | 61 2d 61 65 73 31 32 38 2d 73 68 61 2e 6c 6f 63 |a-aes128-sha.loc| | 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn| | 2e 6e 6c 3a 34 34 38 35 0d 0a 0d 0a b0 b2 70 a6 |.nl:4485......p.| | 3d 3a cd 4f 8f c8 b4 c0 25 53 01 bb 46 b5 78 79 |=:.O....%S..F.xy| | 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................| ssl_decrypt_record found padding 15 final len 112 checking mac (len 76, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 81 40 3d 40 04 66 3f 8b 8f cc 60 d4 c7 4a 12 fe |.@=@.f?...`..J..| | 6d 54 3a 72 |mT:r | ssl_decrypt_record: mac failed association_find: TCP port 39714 found (nil) association_find: TCP port 4485 found 0x37382a0 dissect_ssl enter frame #431 (first time) conversation = 0x7fca71df0ae8, ssl_session = 0x7fca45c07d00 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | 10 a3 0c 90 b6 a0 9e d2 2d 7d c2 d4 6a be 21 a9 |........-}..j.!.| | 98 f4 93 1d e5 44 b5 7c 32 1b c5 9a 1a e8 f9 85 |.....D.|2.......| | dd 1d 69 f9 98 c2 1b 53 15 6c c2 7f 37 5b fa be |..i....S.l..7[..| | d3 84 5f 1b 91 4c da 8b cd 62 c6 7e a5 8b 67 4e |.._..L...b.~..gN| | 47 64 4f 59 f8 4b 40 92 98 68 c1 60 23 e6 e6 a9 |GdOY.K@..h.`#...| | 5c 3a 46 64 55 df 66 48 4b 5c c2 9a 0e 49 a7 1f |\:FdU.fHK\...I..| | b6 b4 e8 53 72 31 1c b3 8a f5 ac 9f 55 05 21 0e |...Sr1......U.!.| | e2 84 9a e3 39 09 7c a6 b8 1a e6 60 28 bf 10 cd |....9.|....`(...| | 9a 14 2b 10 ed 2c 05 42 ae 80 cf 31 b7 de 32 0a |..+..,.B...1..2.| | f4 03 d7 37 05 3f cb 06 79 cb 22 f1 cc 17 da 28 |...7.?..y."....(| | 36 bc 0f 2a 6a 74 cc 0b 8a ae 5d 49 92 e4 ae 1f |6..*jt....]I....| | a2 7a 4a d4 a6 05 9d d1 2f 00 64 ab a2 bd 02 fe |.zJ...../.d.....| | c7 27 8b fd 86 42 04 4d e2 4f 2c 98 8f a2 10 46 |.'...B.M.O,....F| | a3 e9 3d c1 81 9e 00 b2 4e 2a 75 88 9f 38 5e 46 |..=.....N*u..8^F| | 52 ea ae 0d c7 b4 92 69 d5 ed 60 d9 a4 3e 87 db |R......i..`..>..| | 38 99 59 51 f6 01 95 fa 30 d1 aa 84 31 e5 25 5d |8.YQ....0...1.%]| | 3d fd 69 44 32 65 ee 8e db 14 f9 21 95 b0 17 5b |=.iD2e.....!...[| | da bd a0 73 c4 d3 84 b3 56 f1 37 e9 30 77 dd d5 |...s....V.7.0w..| | 17 6a f8 2b ff c5 ca e8 e5 f3 24 87 a3 58 1e b4 |.j.+......$..X..| | 3f f3 74 93 f4 f0 d7 28 91 13 43 d9 a5 a1 70 ba |?.t....(..C...p.| | 05 16 f9 9b 87 ca 9b 41 bb 67 fd 23 3b 33 6f d4 |.......A.g.#;3o.| | a5 86 76 d5 0f fc 38 bb 32 d7 2c de 2e 10 f7 a7 |..v...8.2.,.....| | a6 ea 4d fa 83 fd 56 ad 61 86 82 fe 56 91 b9 ea |..M...V.a...V...| | 50 1c 32 20 f3 f3 eb 73 54 fd e3 5f 26 f6 74 3b |P.2 ...sT.._&.t;| | f7 36 10 c0 72 10 c9 55 0d 0a 38 e2 f1 be 52 ec |.6..r..U..8...R.| Plaintext[400]: | fb 7d cd 3a d1 29 53 63 c9 70 4e fe 0d eb 48 80 |.}.:.)Sc.pN...H.| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:| | 31 31 3a 33 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:31 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 32 0d 0a 43 6f 6e 6e 65 63 74 |th: 142..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 30 39 20 2d 20 45 43 44 48 45 |xC0,0x09 - ECDHE| | 2d 45 43 44 53 41 2d 41 45 53 31 32 38 2d 53 48 |-ECDSA-AES128-SH| | 41 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 |A SSLv3 Kx=ECDH| | 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 6e | Au=ECDSA En| | 63 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d |c=AES(128) Mac=| | 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 |SHA1R4.| | 7c 47 4e 8a 4f 9b 27 53 25 4f 25 da b0 df e6 19 ||GN.O.'S%O%.....| | ee 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |................| ssl_decrypt_record found padding 14 final len 385 checking mac (len 349, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 6b 25 04 aa c0 47 c5 4c af 6b 24 2d 55 97 94 38 |k%...G.L.k$-U..8| | c0 37 b7 3f |.7.? | ssl_decrypt_record: mac failed association_find: TCP port 4485 found 0x37382a0 dissect_ssl enter frame #432 (first time) conversation = 0x7fca71df0ae8, ssl_session = 0x7fca45c07d00 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 2a 90 3f 69 36 f5 12 b4 e7 d6 94 6a 56 28 26 fb |*.?i6......jV(&.| | 53 90 29 d0 7e 34 d1 08 0f 1c 52 67 ed e2 ae e3 |S.).~4....Rg....| | 31 e6 0d 6e 8c 61 40 5b b8 c7 6c ac 11 7d 9d c4 |1..n.a@[..l..}..| Plaintext[48]: | 67 94 f8 ad 1e cb 6d 1c 60 ae 83 11 6c f3 72 9e |g.....m.`...l.r.| | 01 00 3e 1f 90 57 87 4b 51 b2 ce 18 3e f9 38 8b |..>..W.KQ...>.8.| | d6 71 40 d0 06 6c 09 09 09 09 09 09 09 09 09 09 |.q@..l..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 3e 1f 90 57 87 4b 51 b2 ce 18 3e f9 38 8b d6 71 |>..W.KQ...>.8..q| | 40 d0 06 6c |@..l | ssl_decrypt_record: mac ok dissect_ssl enter frame #434 (first time) conversation = 0x7fca71df0ae8, ssl_session = 0x7fca45c07d00 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 0e f7 64 f1 ff d0 7b 67 8c 82 7c ca 28 94 88 75 |..d...{g..|.(..u| | 5d 4c 16 dd 78 77 7c aa 8a 52 d7 65 9f 42 69 f7 |]L..xw|..R.e.Bi.| | e2 28 fa 2b 05 76 7c 2c 4f 1c 41 7b 3b da c9 7f |.(.+.v|,O.A{;...| Plaintext[48]: | 33 d0 74 37 ef 30 dd ba 4f d0 ec 93 64 fa 7a d4 |3.t7.0..O...d.z.| | 01 00 73 c1 43 28 0c 95 f5 8c 44 6f 10 bd ad c3 |..s.C(....Do....| | 74 01 41 2e ea 94 09 09 09 09 09 09 09 09 09 09 |t.A.............| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 73 c1 43 28 0c 95 f5 8c 44 6f 10 bd ad c3 74 01 |s.C(....Do....t.| | 41 2e ea 94 |A... | ssl_decrypt_record: mac ok dissect_ssl enter frame #439 (first time) ssl_session_init: initializing ptr 0x7fca45c0a1c0 size 688 conversation = 0x7fca71df0d90, ssl_session = 0x7fca45c0a1c0 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 48250 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4486 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #441 (first time) conversation = 0x7fca71df0d90, ssl_session = 0x7fca45c0a1c0 record: offset = 0, reported_length_remaining = 751 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 66, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0xC00A -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 23 0e cc 7b 6e 87 b5 76 3b ab aa f1 28 c0 bd 1a |#..{n..v;...(...| | a2 65 68 7b 7d 84 50 6d 2f 5f 4a 2b ef d4 f8 a0 |.eh{}.Pm/_J+....| | 85 01 86 91 c9 f5 08 bd 0e 1a af 63 68 5a d5 04 |...........chZ..| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f4 7e dd e6 12 4f 5d a4 03 a7 60 cd 35 f7 2f 8c |.~...O]...`.5./.| | 55 c6 29 87 6f 7d 8e 06 29 8f da 9d 5f 52 34 c2 |U.).o}..)..._R4.| | f4 4e fc 1d 6a b6 a3 e3 40 b5 71 61 5b 38 e0 5a |.N..j...@.qa[8.Z| | b4 b2 c9 9c 13 36 91 7f eb 5d c4 56 30 |.....6...].V0 | hash out[136]: | 7e e8 64 cc 12 81 8d 35 ab 70 79 49 af d7 40 c4 |~.d....5.pyI..@.| | 3e e0 a5 61 5f fe a8 11 da 4e 26 c2 68 b3 97 9e |>..a_....N&.h...| | 6d 7c 52 d0 e6 7b 53 61 b5 8c 08 4d 58 42 ac 18 |m|R..{Sa...MXB..| | 63 10 4c cc e5 4a 79 5d bc 30 69 a4 56 ae c2 4e |c.L..Jy].0i.V..N| | 63 aa 4a 91 16 86 23 cc ee ce 83 b6 ad 00 fb 6e |c.J...#........n| | 7e 2c 6c ce 09 c4 d2 a2 25 1f 1e 3c fd 78 61 6b |~,l.....%..<.xak| | 12 bc f1 b5 ad 0d 35 43 c7 a1 49 2e ff 61 3c 0f |......5C..I..a<.| | 90 8a 95 3c e6 18 70 c5 3d 01 c9 a1 5f 65 b4 0a |...<..p.=..._e..| | 7e f7 73 b3 36 74 e0 f7 |~.s.6t.. | PRF out[136]: | 7e e8 64 cc 12 81 8d 35 ab 70 79 49 af d7 40 c4 |~.d....5.pyI..@.| | 3e e0 a5 61 5f fe a8 11 da 4e 26 c2 68 b3 97 9e |>..a_....N&.h...| | 6d 7c 52 d0 e6 7b 53 61 b5 8c 08 4d 58 42 ac 18 |m|R..{Sa...MXB..| | 63 10 4c cc e5 4a 79 5d bc 30 69 a4 56 ae c2 4e |c.L..Jy].0i.V..N| | 63 aa 4a 91 16 86 23 cc ee ce 83 b6 ad 00 fb 6e |c.J...#........n| | 7e 2c 6c ce 09 c4 d2 a2 25 1f 1e 3c fd 78 61 6b |~,l.....%..<.xak| | 12 bc f1 b5 ad 0d 35 43 c7 a1 49 2e ff 61 3c 0f |......5C..I..a<.| | 90 8a 95 3c e6 18 70 c5 3d 01 c9 a1 5f 65 b4 0a |...<..p.=..._e..| | 7e f7 73 b3 36 74 e0 f7 |~.s.6t.. | key expansion[136]: | 7e e8 64 cc 12 81 8d 35 ab 70 79 49 af d7 40 c4 |~.d....5.pyI..@.| | 3e e0 a5 61 5f fe a8 11 da 4e 26 c2 68 b3 97 9e |>..a_....N&.h...| | 6d 7c 52 d0 e6 7b 53 61 b5 8c 08 4d 58 42 ac 18 |m|R..{Sa...MXB..| | 63 10 4c cc e5 4a 79 5d bc 30 69 a4 56 ae c2 4e |c.L..Jy].0i.V..N| | 63 aa 4a 91 16 86 23 cc ee ce 83 b6 ad 00 fb 6e |c.J...#........n| | 7e 2c 6c ce 09 c4 d2 a2 25 1f 1e 3c fd 78 61 6b |~,l.....%..<.xak| | 12 bc f1 b5 ad 0d 35 43 c7 a1 49 2e ff 61 3c 0f |......5C..I..a<.| | 90 8a 95 3c e6 18 70 c5 3d 01 c9 a1 5f 65 b4 0a |...<..p.=..._e..| | 7e f7 73 b3 36 74 e0 f7 |~.s.6t.. | Client MAC key[20]: | 7e e8 64 cc 12 81 8d 35 ab 70 79 49 af d7 40 c4 |~.d....5.pyI..@.| | 3e e0 a5 61 |>..a | Server MAC key[20]: | 5f fe a8 11 da 4e 26 c2 68 b3 97 9e 6d 7c 52 d0 |_....N&.h...m|R.| | e6 7b 53 61 |.{Sa | Client Write key[32]: | b5 8c 08 4d 58 42 ac 18 63 10 4c cc e5 4a 79 5d |...MXB..c.L..Jy]| | bc 30 69 a4 56 ae c2 4e 63 aa 4a 91 16 86 23 cc |.0i.V..Nc.J...#.| Server Write key[32]: | ee ce 83 b6 ad 00 fb 6e 7e 2c 6c ce 09 c4 d2 a2 |.......n~,l.....| | 25 1f 1e 3c fd 78 61 6b 12 bc f1 b5 ad 0d 35 43 |%..<.xak......5C| Client Write IV[16]: | c7 a1 49 2e ff 61 3c 0f 90 8a 95 3c e6 18 70 c5 |..I..a<....<..p.| Server Write IV[16]: | 3d 01 c9 a1 5f 65 b4 0a 7e f7 73 b3 36 74 e0 f7 |=..._e..~.s.6t..| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 71, reported_length_remaining = 680 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 480, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 76 length 476 bytes, remaining 556 record: offset = 556, reported_length_remaining = 195 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 181, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 561 length 177 bytes, remaining 742 record: offset = 742, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 747 length 0 bytes, remaining 751 dissect_ssl enter frame #443 (first time) conversation = 0x7fca71df0d90, ssl_session = 0x7fca45c0a1c0 record: offset = 0, reported_length_remaining = 150 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 70, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2f44efc1d6ab6a3e340b571615b38e05ab4b2c99c13... looking for RSA pre-master4104a359eccc41af2ee300098d0ec449f8da856806ee6f69... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a88b3723405ec9f6d 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2ed4699771feefd3c969e60a3a051977784c4581a0c414211a97aad6e 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f28e1f7f2a7aca2e9c71ffb47ed2d846d11d723e2b9d4a44e41c19ecd8 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2330ea5edf65f3fbfece59d5033d2915b04625ca5bb934034eaa986eb 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f23bb1ff6b1a567cab274581ce4ae59ffe8a2e43ae2defe2afd7886633 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2968aa51a4ea28bcab908d2a0a5011eb847de99e38f014db53571e92d 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2888c7e15b7d5827fd75db4f7b7a1c450be4f9f14457607e1a26fce1a DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f21b0765b7ce7a5bd63502bcc79e63d2e53e6c7ba886d2a6d621b429d3 DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f22f616d5f9ad8f48c36410b08fcf872f0c92fbe02b4c3c86a91252574 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2d989534de7839fc5461dfb9290266a33b0f241faf93f4c984d1656a8 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f36756c62ee64b45cf17caefd0cd105ebe825275bec27aeb520d7294c9 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f36a2e00daced950610a278df5d5cbcd232469fee9bc7a06511da65e98 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f36a0b8704213d2d34b66f119345cc1d4b0b4c95a88834087a19cd83c1 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f37b6b5187ffb077f015a558da43d722e15602ae47a7fe15f05cf5450c 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f353f5a955b8e7e96e593058aa1b26905a5ce8ff6c36770eb218883539 49E10327AD96808A76FC339CFF686DB7C51DE85DD3CC81E6D9571FA3949162CADFF2FD4286473D0BB3A4CA0E3A1BDBCC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f3ea5ceb07107749af52624d674e47e964ae7e84abb14090900d9a9340 49E10327AD96808A76FC339CFF686DB7C51DE85DD3CC81E6D9571FA3949162CADFF2FD4286473D0BB3A4CA0E3A1BDBCC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f3767d57c73b3b64df636982c2a5db197f7ea73c027eb44ae405cb7c2e 50787B46430A893B2355D92AEF474B50067D8252EC544E904DCC0375DABE46AC7597C4ECB62A877B39D5C046BCCFF5D7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f33d02713be94b005a27e8ad854db7e265e04bf49064b2d33f46f703d2 50787B46430A893B2355D92AEF474B50067D8252EC544E904DCC0375DABE46AC7597C4ECB62A877B39D5C046BCCFF5D7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f3f85e503f39bbb60e91465b12622d25ae6d94a00983239d3f3d1334e5 230ECC7B6E87B5763BABAAF128C0BD1AA265687B7D84506D2F5F4A2BEFD4F8A085018691C9F508BD0E1AAF63685AD504 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f35bc3b625015f9e965f41c885c3ebb8fb559df8e243bc096ade437eeb 230ECC7B6E87B5763BABAAF128C0BD1AA265687B7D84506D2F5F4A2BEFD4F8A085018691C9F508BD0E1AAF63685AD504 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f44efc1d6ab6a3e340b571615b38e05ab4b2c99c1336917feb5dc45630 3BC84E249BE108C61E0E394D2AD1EC113D3CD82120977D38BE08AFDEB57166E16FC28F55BDE3A1998D58E0D579201F4F found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 3b c8 4e 24 9b e1 08 c6 1e 0e 39 4d 2a d1 ec 11 |;.N$......9M*...| | 3d 3c d8 21 20 97 7d 38 be 08 af de b5 71 66 e1 |=<.! .}8.....qf.| | 6f c2 8f 55 bd e3 a1 99 8d 58 e0 d5 79 20 1f 4f |o..U.....X..y .O| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f4 7e dd e6 12 4f 5d a4 03 a7 60 cd 35 f7 2f 8c |.~...O]...`.5./.| | 55 c6 29 87 6f 7d 8e 06 29 8f da 9d 5f 52 34 c2 |U.).o}..)..._R4.| | f4 4e fc 1d 6a b6 a3 e3 40 b5 71 61 5b 38 e0 5a |.N..j...@.qa[8.Z| | b4 b2 c9 9c 13 36 91 7f eb 5d c4 56 30 |.....6...].V0 | hash out[136]: | 9a 13 05 67 57 0b 26 fd 62 62 06 f2 19 1d d4 e2 |...gW.&.bb......| | c8 5d d9 13 6a e0 85 a8 10 9c ef ca c5 0c e1 d7 |.]..j...........| | e1 e0 92 1d 85 51 1c 5f 37 c2 a3 d9 8b 9f 50 94 |.....Q._7.....P.| | fe 0d 0d 42 e1 cc c0 a2 1b 3e 78 1c 74 4d 3f 5e |...B.....>x.tM?^| | d6 da 3b 21 55 70 c5 e1 f8 01 2c c9 b8 a6 70 1c |..;!Up....,...p.| | 47 ee 3d ee d3 12 34 1a 59 eb d2 9d a8 c9 e1 2e |G.=...4.Y.......| | 32 b5 ac 04 d7 07 20 02 cc b5 f4 3d e4 cc a5 4c |2..... ....=...L| | f2 2a be 49 41 51 c9 7d 3f 8f 3c ee b3 3b 0f d5 |.*.IAQ.}?.<..;..| | e9 f0 27 67 df 25 37 24 |..'g.%7$ | PRF out[136]: | 9a 13 05 67 57 0b 26 fd 62 62 06 f2 19 1d d4 e2 |...gW.&.bb......| | c8 5d d9 13 6a e0 85 a8 10 9c ef ca c5 0c e1 d7 |.]..j...........| | e1 e0 92 1d 85 51 1c 5f 37 c2 a3 d9 8b 9f 50 94 |.....Q._7.....P.| | fe 0d 0d 42 e1 cc c0 a2 1b 3e 78 1c 74 4d 3f 5e |...B.....>x.tM?^| | d6 da 3b 21 55 70 c5 e1 f8 01 2c c9 b8 a6 70 1c |..;!Up....,...p.| | 47 ee 3d ee d3 12 34 1a 59 eb d2 9d a8 c9 e1 2e |G.=...4.Y.......| | 32 b5 ac 04 d7 07 20 02 cc b5 f4 3d e4 cc a5 4c |2..... ....=...L| | f2 2a be 49 41 51 c9 7d 3f 8f 3c ee b3 3b 0f d5 |.*.IAQ.}?.<..;..| | e9 f0 27 67 df 25 37 24 |..'g.%7$ | key expansion[136]: | 9a 13 05 67 57 0b 26 fd 62 62 06 f2 19 1d d4 e2 |...gW.&.bb......| | c8 5d d9 13 6a e0 85 a8 10 9c ef ca c5 0c e1 d7 |.]..j...........| | e1 e0 92 1d 85 51 1c 5f 37 c2 a3 d9 8b 9f 50 94 |.....Q._7.....P.| | fe 0d 0d 42 e1 cc c0 a2 1b 3e 78 1c 74 4d 3f 5e |...B.....>x.tM?^| | d6 da 3b 21 55 70 c5 e1 f8 01 2c c9 b8 a6 70 1c |..;!Up....,...p.| | 47 ee 3d ee d3 12 34 1a 59 eb d2 9d a8 c9 e1 2e |G.=...4.Y.......| | 32 b5 ac 04 d7 07 20 02 cc b5 f4 3d e4 cc a5 4c |2..... ....=...L| | f2 2a be 49 41 51 c9 7d 3f 8f 3c ee b3 3b 0f d5 |.*.IAQ.}?.<..;..| | e9 f0 27 67 df 25 37 24 |..'g.%7$ | Client MAC key[20]: | 9a 13 05 67 57 0b 26 fd 62 62 06 f2 19 1d d4 e2 |...gW.&.bb......| | c8 5d d9 13 |.].. | Server MAC key[20]: | 6a e0 85 a8 10 9c ef ca c5 0c e1 d7 e1 e0 92 1d |j...............| | 85 51 1c 5f |.Q._ | Client Write key[32]: | 37 c2 a3 d9 8b 9f 50 94 fe 0d 0d 42 e1 cc c0 a2 |7.....P....B....| | 1b 3e 78 1c 74 4d 3f 5e d6 da 3b 21 55 70 c5 e1 |.>x.tM?^..;!Up..| Server Write key[32]: | f8 01 2c c9 b8 a6 70 1c 47 ee 3d ee d3 12 34 1a |..,...p.G.=...4.| | 59 eb d2 9d a8 c9 e1 2e 32 b5 ac 04 d7 07 20 02 |Y.......2..... .| Client Write IV[16]: | cc b5 f4 3d e4 cc a5 4c f2 2a be 49 41 51 c9 7d |...=...L.*.IAQ.}| Server Write IV[16]: | 3f 8f 3c ee b3 3b 0f d5 e9 f0 27 67 df 25 37 24 |?.<..;....'g.%7$| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 3b c8 4e 24 9b e1 08 c6 1e 0e 39 4d 2a d1 ec 11 |;.N$......9M*...| | 3d 3c d8 21 20 97 7d 38 be 08 af de b5 71 66 e1 |=<.! .}8.....qf.| | 6f c2 8f 55 bd e3 a1 99 8d 58 e0 d5 79 20 1f 4f |o..U.....X..y .O| dissect_ssl3_handshake session keys successfully generated record: offset = 75, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 81, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 7f 8f e3 35 ab 81 d4 1f f4 b3 8c c8 8e 11 04 6a |...5...........j| | 40 0b 5c 91 fa f3 5e 63 bb 2f 4d 2c 3c cb a1 ac |@.\...^c./M,<...| | 9e f1 28 bc cc 2e bd 5a 33 74 a7 0e 6d ed de bd |..(....Z3t..m...| | bb 77 c5 d3 69 42 e7 47 ef 03 e0 2d 74 f8 21 f5 |.w..iB.G...-t.!.| Plaintext[64]: | 48 91 ef 44 f2 9c c8 87 27 53 4e a5 71 74 26 bc |H..D....'SN.qt&.| | 14 00 00 0c f6 9c b2 18 ec 38 5c a3 7b 05 53 aa |.........8\.{.S.| | 31 7e 26 ee 0a 82 3c 62 f4 72 fb fd ce b2 5b 4b |1~&....hU.....P...Z| | 6e 89 63 a2 8c 90 01 18 f6 1a 72 f1 1c 5a ae b3 |n.c.......r..Z..| | 92 4e 7f a8 03 8b e0 c4 2a 4d e1 19 be a0 1a 47 |.N......*M.....G| | db ea ec ba 59 73 a4 75 36 0c cc 82 0d 4e 6d fd |....Ys.u6....Nm.| Plaintext[64]: | c7 50 05 fa 14 d3 66 c9 b5 8f f4 cd 99 58 a5 8b |.P....f......X..| | 14 00 00 0c 12 55 8f 22 af 9a a2 f2 2d 72 84 02 |.....U."....-r..| | e4 ff 8b 9c ae eb ca 16 07 f6 07 19 10 a6 c8 41 |...............A| | 6d 18 26 f8 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |m.&.............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | e4 ff 8b 9c ae eb ca 16 07 f6 07 19 10 a6 c8 41 |...............A| | 6d 18 26 f8 |m.&. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #445 (first time) conversation = 0x7fca71df0d90, ssl_session = 0x7fca45c0a1c0 record: offset = 0, reported_length_remaining = 133 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 128, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 128 Ciphertext[128]: | ec 62 b5 e1 46 0f fb 51 15 bc a4 8d ef e0 ba b4 |.b..F..Q........| | ce 03 3a 66 d0 fa c2 c5 5a 46 dd da c2 f9 3c 29 |..:f....ZF....<)| | fc dd 1a b8 2d 61 9f 50 3c 60 57 15 ea 54 ce 11 |....-a.P<`W..T..| | d0 d3 ba 5e 40 d7 e5 99 a8 aa 66 1c 56 22 37 fa |...^@.....f.V"7.| | d6 45 76 41 20 44 7a 00 a0 d5 af 45 1a 80 2b 3f |.EvA Dz....E..+?| | 73 f7 88 4e 37 57 7d bb 9e a4 ee b2 62 e1 62 40 |s..N7W}.....b.b@| | 47 f0 53 52 d1 61 5f 7e e9 17 a9 47 84 37 af a8 |G.SR.a_~...G.7..| | 23 2d 8e 15 59 8a 93 8d 61 6c b4 6a 85 f9 c7 8d |#-..Y...al.j....| Plaintext[128]: | 2e 93 43 b2 95 e2 e9 e6 bb 8d 5b 7d 60 82 06 84 |..C.......[}`...| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 65 2d 65 63 64 73 |Host: ecdhe-ecds| | 61 2d 61 65 73 32 35 36 2d 73 68 61 2e 6c 6f 63 |a-aes256-sha.loc| | 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e |al.al.lekensteyn| | 2e 6e 6c 3a 34 34 38 36 0d 0a 0d 0a 77 b2 66 d7 |.nl:4486....w.f.| | ab 32 91 72 b7 3c 10 aa 38 50 01 26 39 ff c0 46 |.2.r.<..8P.&9..F| | 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................| ssl_decrypt_record found padding 15 final len 112 checking mac (len 76, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 6a ae 68 0c f2 18 5e ac c2 e5 c4 11 d6 43 51 a1 |j.h...^......CQ.| | 39 6a 49 11 |9jI. | ssl_decrypt_record: mac failed association_find: TCP port 48250 found (nil) association_find: TCP port 4486 found 0x3738330 dissect_ssl enter frame #446 (first time) conversation = 0x7fca71df0d90, ssl_session = 0x7fca45c0a1c0 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | 80 16 90 4d d9 67 50 88 eb dc 61 30 c8 bd 01 f9 |...M.gP...a0....| | 56 de 6d 5d 20 03 94 4c bf 01 88 f8 73 4a d3 98 |V.m] ..L....sJ..| | 2c 17 d2 7b 43 a4 a4 70 86 74 80 aa 3b 2b 3a 24 |,..{C..p.t..;+:$| | 10 1e 1d 97 84 bf 6b 55 16 dd 02 93 eb 2e 90 72 |......kU.......r| | c6 a0 77 4c 7e 0c 05 ac 6e 5c 88 7f 2d 91 04 95 |..wL~...n\..-...| | dc 4b 8d d7 15 d1 15 6b 47 95 be 2b 62 84 28 fc |.K.....kG..+b.(.| | 36 85 8d e5 17 6b ba cc 68 ee ce 56 46 a5 f8 2c |6....k..h..VF..,| | 9f a6 17 93 95 03 7e 06 54 bb 03 f4 d1 5c 35 45 |......~.T....\5E| | f1 de 85 23 0f 9d 1d 38 4a 52 7e 6a 7e 78 4e ff |...#...8JR~j~xN.| | 38 e4 de 4e b0 0c a7 72 3b ad f7 f1 bb af 7a cb |8..N...r;.....z.| | b9 d5 f7 a2 09 cb d7 6e ec 70 76 10 17 ca 20 55 |.......n.pv... U| | a7 6b 9e 1b f8 57 26 a2 cb 85 41 13 ed dd aa 4d |.k...W&...A....M| | c8 84 d0 61 a2 d4 e4 28 1e 81 ba 25 53 59 3d 27 |...a...(...%SY='| | 54 7b 7f c0 c9 d4 a9 84 71 b8 9b 5e 9b a3 fa 63 |T{......q..^...c| | 23 b9 34 74 62 b2 e6 48 bd 4c 31 4d 81 01 09 ec |#.4tb..H.L1M....| | ee be a3 17 9c 7c a9 7e 54 8a 60 b3 12 ca ea 61 |.....|.~T.`....a| | 7d 57 4c 8e bd 5e 31 5c 6d e6 13 de 60 2c 11 50 |}WL..^1\m...`,.P| | f4 1d 3c 32 e9 02 cb d5 55 a0 26 2f 6a a0 51 bb |..<2....U.&/j.Q.| | 8f 7b d1 5b 75 76 18 25 f8 70 da f5 41 59 3a 01 |.{.[uv.%.p..AY:.| | a1 ce 52 3c 3a bc d1 0c bc 86 10 3f 03 7b e7 f6 |..R<:......?.{..| | 37 b1 87 94 24 0c 95 93 77 7a a1 bb dd e9 88 98 |7...$...wz......| | 15 fb c5 7b 17 5e 2d a6 b5 d2 a8 39 b7 2f 36 6c |...{.^-....9./6l| | 65 cc ea be ae b6 05 68 5f 88 a8 fa 74 04 72 49 |e......h_...t.rI| | d5 0c ff a6 b5 42 c5 38 ec ef 64 98 87 77 70 9a |.....B.8..d..wp.| | 63 0c e2 68 c7 d6 72 6b 08 cd 27 92 fd 99 d1 63 |c..h..rk..'....c| Plaintext[400]: | 81 a4 a3 7a 99 1f e7 ad 53 c5 b4 24 fb 50 3b 00 |...z....S..$.P;.| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:| | 31 31 3a 33 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:32 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 32 0d 0a 43 6f 6e 6e 65 63 74 |th: 142..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 30 41 20 2d 20 45 43 44 48 45 |xC0,0x0A - ECDHE| | 2d 45 43 44 53 41 2d 41 45 53 32 35 36 2d 53 48 |-ECDSA-AES256-SH| | 41 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 |A SSLv3 Kx=ECDH| | 20 20 20 20 20 41 75 3d 45 43 44 53 41 20 45 6e | Au=ECDSA En| | 63 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d |c=AES(256) Mac=| | 53 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 |SHA1.DQ| | 4e 2f 6e c9 53 d7 dd f1 7d 20 40 52 62 0f 4b 21 |N/n.S...} @Rb.K!| | 32 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |2...............| ssl_decrypt_record found padding 14 final len 385 checking mac (len 349, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 77 19 96 15 26 08 42 16 87 10 8a d2 b5 17 57 16 |w...&.B.......W.| | df 66 36 96 |.f6. | ssl_decrypt_record: mac failed association_find: TCP port 4486 found 0x3738330 dissect_ssl enter frame #447 (first time) conversation = 0x7fca71df0d90, ssl_session = 0x7fca45c0a1c0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | b7 21 55 93 96 0b f7 d5 45 43 0d e0 39 3d 56 8e |.!U.....EC..9=V.| | 56 08 a8 af 14 15 7a 43 da 20 22 27 7d 33 45 66 |V.....zC. "'}3Ef| | f0 ba 8b 71 a3 37 91 82 f5 da 7c c9 8f 3d d7 a9 |...q.7....|..=..| Plaintext[48]: | 1a 16 9b 3f 11 ea 3f 6e 37 2f c0 10 d5 2e 90 1b |...?..?n7/......| | 01 00 ad 29 78 5b 99 79 4b 94 d4 f4 3e 8d c6 fa |...)x[.yK...>...| | fa 68 0e 66 92 a9 09 09 09 09 09 09 09 09 09 09 |.h.f............| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | ad 29 78 5b 99 79 4b 94 d4 f4 3e 8d c6 fa fa 68 |.)x[.yK...>....h| | 0e 66 92 a9 |.f.. | ssl_decrypt_record: mac ok dissect_ssl enter frame #449 (first time) conversation = 0x7fca71df0d90, ssl_session = 0x7fca45c0a1c0 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 86 dc 96 1b a4 2a bb 3e a4 65 62 d9 84 d9 c2 98 |.....*.>.eb.....| | a0 68 7b 6d 57 40 65 84 f4 a8 89 d8 10 5f 2e 3d |.h{mW@e......_.=| | bc e8 f3 a3 c7 d3 6e b2 6e c8 19 cf 85 66 10 8d |......n.n....f..| Plaintext[48]: | 49 f4 df 58 0f 21 4c b8 38 40 cd 19 0f 3d 83 5d |I..X.!L.8@...=.]| | 01 00 4f a4 a7 57 7f c1 e7 16 a1 ba 24 83 4a 75 |..O..W......$.Ju| | c6 af e3 66 f2 7c 09 09 09 09 09 09 09 09 09 09 |...f.|..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 4f a4 a7 57 7f c1 e7 16 a1 ba 24 83 4a 75 c6 af |O..W......$.Ju..| | e3 66 f2 7c |.f.| | ssl_decrypt_record: mac ok dissect_ssl enter frame #454 (first time) ssl_session_init: initializing ptr 0x7fca45c0c680 size 688 conversation = 0x7fca71df1038, ssl_session = 0x7fca45c0c680 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 34675 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4492 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #456 (first time) conversation = 0x7fca71df1038, ssl_session = 0x7fca45c0c680 record: offset = 0, reported_length_remaining = 1230 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 66, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0xC012 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 3b c8 4e 24 9b e1 08 c6 1e 0e 39 4d 2a d1 ec 11 |;.N$......9M*...| | 3d 3c d8 21 20 97 7d 38 be 08 af de b5 71 66 e1 |=<.! .}8.....qf.| | 6f c2 8f 55 bd e3 a1 99 8d 58 e0 d5 79 20 1f 4f |o..U.....X..y .O| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f4 ce 92 33 b8 9d d4 aa 17 6a 84 fb 68 66 8e af |...3.....j..hf..| | ad 9e 37 a8 0a 0a e9 c2 89 19 7e 5f 78 52 34 c2 |..7.......~_xR4.| | f4 0f 4c c7 06 7b 7a 2e 51 06 ed a1 99 e8 50 e1 |..L..{z.Q.....P.| | 5f 08 5a 6d 2d 85 e7 55 e3 ee b0 3b 5e |_.Zm-..U...;^ | hash out[104]: | 9e c0 0f d3 8b dc 79 d8 cd 9e 79 89 16 61 59 e7 |......y...y..aY.| | 01 b6 fa e8 78 45 c8 cb cf 2f 2e 1e 2a 91 7f 74 |....xE.../..*..t| | 2b 4d 38 9a a3 ea 07 71 e3 c1 f8 fc 2f 81 55 62 |+M8....q..../.Ub| | 89 90 87 07 61 ad 63 e8 71 9a cb d4 52 2c ed 89 |....a.c.q...R,..| | 88 b3 a4 a5 fa 8c bb 8b eb 39 c2 ce bb fb 51 87 |.........9....Q.| | 32 a3 9c 94 3a f4 f2 fa 67 12 b1 21 33 40 56 09 |2...:...g..!3@V.| | cf 9b 27 41 6d 2b c1 25 |..'Am+.% | PRF out[104]: | 9e c0 0f d3 8b dc 79 d8 cd 9e 79 89 16 61 59 e7 |......y...y..aY.| | 01 b6 fa e8 78 45 c8 cb cf 2f 2e 1e 2a 91 7f 74 |....xE.../..*..t| | 2b 4d 38 9a a3 ea 07 71 e3 c1 f8 fc 2f 81 55 62 |+M8....q..../.Ub| | 89 90 87 07 61 ad 63 e8 71 9a cb d4 52 2c ed 89 |....a.c.q...R,..| | 88 b3 a4 a5 fa 8c bb 8b eb 39 c2 ce bb fb 51 87 |.........9....Q.| | 32 a3 9c 94 3a f4 f2 fa 67 12 b1 21 33 40 56 09 |2...:...g..!3@V.| | cf 9b 27 41 6d 2b c1 25 |..'Am+.% | key expansion[104]: | 9e c0 0f d3 8b dc 79 d8 cd 9e 79 89 16 61 59 e7 |......y...y..aY.| | 01 b6 fa e8 78 45 c8 cb cf 2f 2e 1e 2a 91 7f 74 |....xE.../..*..t| | 2b 4d 38 9a a3 ea 07 71 e3 c1 f8 fc 2f 81 55 62 |+M8....q..../.Ub| | 89 90 87 07 61 ad 63 e8 71 9a cb d4 52 2c ed 89 |....a.c.q...R,..| | 88 b3 a4 a5 fa 8c bb 8b eb 39 c2 ce bb fb 51 87 |.........9....Q.| | 32 a3 9c 94 3a f4 f2 fa 67 12 b1 21 33 40 56 09 |2...:...g..!3@V.| | cf 9b 27 41 6d 2b c1 25 |..'Am+.% | Client MAC key[20]: | 9e c0 0f d3 8b dc 79 d8 cd 9e 79 89 16 61 59 e7 |......y...y..aY.| | 01 b6 fa e8 |.... | Server MAC key[20]: | 78 45 c8 cb cf 2f 2e 1e 2a 91 7f 74 2b 4d 38 9a |xE.../..*..t+M8.| | a3 ea 07 71 |...q | Client Write key[24]: | e3 c1 f8 fc 2f 81 55 62 89 90 87 07 61 ad 63 e8 |..../.Ub....a.c.| | 71 9a cb d4 52 2c ed 89 |q...R,.. | Server Write key[24]: | 88 b3 a4 a5 fa 8c bb 8b eb 39 c2 ce bb fb 51 87 |.........9....Q.| | 32 a3 9c 94 3a f4 f2 fa |2...:... | Client Write IV[8]: | 67 12 b1 21 33 40 56 09 |g..!3@V. | Server Write IV[8]: | cf 9b 27 41 6d 2b c1 25 |..'Am+.% | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 71, reported_length_remaining = 1159 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 76 length 803 bytes, remaining 883 record: offset = 883, reported_length_remaining = 347 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 333, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 888 length 329 bytes, remaining 1221 record: offset = 1221, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1226 length 0 bytes, remaining 1230 dissect_ssl enter frame #458 (first time) conversation = 0x7fca71df1038, ssl_session = 0x7fca45c0c680 record: offset = 0, reported_length_remaining = 134 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 70, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2f40f4cc7067b7a2e5106eda199e850e15f085a6d2d... looking for RSA pre-master410478754e69dfa147c2c03c970d182a3bd0b3a18dc30f6d... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a88b3723405ec9f6d 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2ed4699771feefd3c969e60a3a051977784c4581a0c414211a97aad6e 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f28e1f7f2a7aca2e9c71ffb47ed2d846d11d723e2b9d4a44e41c19ecd8 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2330ea5edf65f3fbfece59d5033d2915b04625ca5bb934034eaa986eb 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f23bb1ff6b1a567cab274581ce4ae59ffe8a2e43ae2defe2afd7886633 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2968aa51a4ea28bcab908d2a0a5011eb847de99e38f014db53571e92d 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2888c7e15b7d5827fd75db4f7b7a1c450be4f9f14457607e1a26fce1a DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f21b0765b7ce7a5bd63502bcc79e63d2e53e6c7ba886d2a6d621b429d3 DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f22f616d5f9ad8f48c36410b08fcf872f0c92fbe02b4c3c86a91252574 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2d989534de7839fc5461dfb9290266a33b0f241faf93f4c984d1656a8 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f36756c62ee64b45cf17caefd0cd105ebe825275bec27aeb520d7294c9 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f36a2e00daced950610a278df5d5cbcd232469fee9bc7a06511da65e98 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f36a0b8704213d2d34b66f119345cc1d4b0b4c95a88834087a19cd83c1 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f37b6b5187ffb077f015a558da43d722e15602ae47a7fe15f05cf5450c 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f353f5a955b8e7e96e593058aa1b26905a5ce8ff6c36770eb218883539 49E10327AD96808A76FC339CFF686DB7C51DE85DD3CC81E6D9571FA3949162CADFF2FD4286473D0BB3A4CA0E3A1BDBCC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f3ea5ceb07107749af52624d674e47e964ae7e84abb14090900d9a9340 49E10327AD96808A76FC339CFF686DB7C51DE85DD3CC81E6D9571FA3949162CADFF2FD4286473D0BB3A4CA0E3A1BDBCC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f3767d57c73b3b64df636982c2a5db197f7ea73c027eb44ae405cb7c2e 50787B46430A893B2355D92AEF474B50067D8252EC544E904DCC0375DABE46AC7597C4ECB62A877B39D5C046BCCFF5D7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f33d02713be94b005a27e8ad854db7e265e04bf49064b2d33f46f703d2 50787B46430A893B2355D92AEF474B50067D8252EC544E904DCC0375DABE46AC7597C4ECB62A877B39D5C046BCCFF5D7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f3f85e503f39bbb60e91465b12622d25ae6d94a00983239d3f3d1334e5 230ECC7B6E87B5763BABAAF128C0BD1AA265687B7D84506D2F5F4A2BEFD4F8A085018691C9F508BD0E1AAF63685AD504 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f35bc3b625015f9e965f41c885c3ebb8fb559df8e243bc096ade437eeb 230ECC7B6E87B5763BABAAF128C0BD1AA265687B7D84506D2F5F4A2BEFD4F8A085018691C9F508BD0E1AAF63685AD504 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f44efc1d6ab6a3e340b571615b38e05ab4b2c99c1336917feb5dc45630 3BC84E249BE108C61E0E394D2AD1EC113D3CD82120977D38BE08AFDEB57166E16FC28F55BDE3A1998D58E0D579201F4F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f47edde6124f5da403a760cd35f72f8c55c629876f7d8e06298fda9d5f 3BC84E249BE108C61E0E394D2AD1EC113D3CD82120977D38BE08AFDEB57166E16FC28F55BDE3A1998D58E0D579201F4F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f40f4cc7067b7a2e5106eda199e850e15f085a6d2d85e755e3eeb03b5e 40BF454607A5877C969E9876BEC31289EA113C0873B4A16C129B0F717C560ADCB543A40F463EC1CD623AF9847ED1504E found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 40 bf 45 46 07 a5 87 7c 96 9e 98 76 be c3 12 89 |@.EF...|...v....| | ea 11 3c 08 73 b4 a1 6c 12 9b 0f 71 7c 56 0a dc |..<.s..l...q|V..| | b5 43 a4 0f 46 3e c1 cd 62 3a f9 84 7e d1 50 4e |.C..F>..b:..~.PN| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f4 ce 92 33 b8 9d d4 aa 17 6a 84 fb 68 66 8e af |...3.....j..hf..| | ad 9e 37 a8 0a 0a e9 c2 89 19 7e 5f 78 52 34 c2 |..7.......~_xR4.| | f4 0f 4c c7 06 7b 7a 2e 51 06 ed a1 99 e8 50 e1 |..L..{z.Q.....P.| | 5f 08 5a 6d 2d 85 e7 55 e3 ee b0 3b 5e |_.Zm-..U...;^ | hash out[104]: | 82 a3 f2 a9 a6 25 2e 93 f7 91 ed 3a 1a ef f4 80 |.....%.....:....| | ec 63 67 e2 de 76 8b 33 f5 02 0e cb 92 a7 da 4e |.cg..v.3.......N| | f0 ad ab 97 63 ac c1 9b c3 b3 bc 9e 58 0a 86 aa |....c.......X...| | c2 ff a2 75 da 9c 9d d0 98 88 1a 25 3e b5 47 63 |...u.......%>.Gc| | 79 40 95 46 71 d9 b8 56 c0 61 08 37 d8 2d 02 08 |y@.Fq..V.a.7.-..| | 8c 1e 09 25 fa b1 4f b1 ec 73 62 96 56 61 6d 71 |...%..O..sb.Vamq| | 12 b3 1c 19 79 20 b0 2a |....y .* | PRF out[104]: | 82 a3 f2 a9 a6 25 2e 93 f7 91 ed 3a 1a ef f4 80 |.....%.....:....| | ec 63 67 e2 de 76 8b 33 f5 02 0e cb 92 a7 da 4e |.cg..v.3.......N| | f0 ad ab 97 63 ac c1 9b c3 b3 bc 9e 58 0a 86 aa |....c.......X...| | c2 ff a2 75 da 9c 9d d0 98 88 1a 25 3e b5 47 63 |...u.......%>.Gc| | 79 40 95 46 71 d9 b8 56 c0 61 08 37 d8 2d 02 08 |y@.Fq..V.a.7.-..| | 8c 1e 09 25 fa b1 4f b1 ec 73 62 96 56 61 6d 71 |...%..O..sb.Vamq| | 12 b3 1c 19 79 20 b0 2a |....y .* | key expansion[104]: | 82 a3 f2 a9 a6 25 2e 93 f7 91 ed 3a 1a ef f4 80 |.....%.....:....| | ec 63 67 e2 de 76 8b 33 f5 02 0e cb 92 a7 da 4e |.cg..v.3.......N| | f0 ad ab 97 63 ac c1 9b c3 b3 bc 9e 58 0a 86 aa |....c.......X...| | c2 ff a2 75 da 9c 9d d0 98 88 1a 25 3e b5 47 63 |...u.......%>.Gc| | 79 40 95 46 71 d9 b8 56 c0 61 08 37 d8 2d 02 08 |y@.Fq..V.a.7.-..| | 8c 1e 09 25 fa b1 4f b1 ec 73 62 96 56 61 6d 71 |...%..O..sb.Vamq| | 12 b3 1c 19 79 20 b0 2a |....y .* | Client MAC key[20]: | 82 a3 f2 a9 a6 25 2e 93 f7 91 ed 3a 1a ef f4 80 |.....%.....:....| | ec 63 67 e2 |.cg. | Server MAC key[20]: | de 76 8b 33 f5 02 0e cb 92 a7 da 4e f0 ad ab 97 |.v.3.......N....| | 63 ac c1 9b |c... | Client Write key[24]: | c3 b3 bc 9e 58 0a 86 aa c2 ff a2 75 da 9c 9d d0 |....X......u....| | 98 88 1a 25 3e b5 47 63 |...%>.Gc | Server Write key[24]: | 79 40 95 46 71 d9 b8 56 c0 61 08 37 d8 2d 02 08 |y@.Fq..V.a.7.-..| | 8c 1e 09 25 fa b1 4f b1 |...%..O. | Client Write IV[8]: | ec 73 62 96 56 61 6d 71 |.sb.Vamq | Server Write IV[8]: | 12 b3 1c 19 79 20 b0 2a |....y .* | ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: 3DES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 40 bf 45 46 07 a5 87 7c 96 9e 98 76 be c3 12 89 |@.EF...|...v....| | ea 11 3c 08 73 b4 a1 6c 12 9b 0f 71 7c 56 0a dc |..<.s..l...q|V..| | b5 43 a4 0f 46 3e c1 cd 62 3a f9 84 7e d1 50 4e |.C..F>..b:..~.PN| dissect_ssl3_handshake session keys successfully generated record: offset = 75, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 81, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | e6 50 31 95 fe fb 11 a9 e7 07 72 e8 03 8f fd 9a |.P1.......r.....| | 35 30 2a 63 ca cb cc fa 1a 90 9e 43 8b 43 d2 e4 |50*c.......C.C..| | 89 1d 86 d8 31 7b b0 f9 ef 11 d0 9e 65 92 a6 59 |....1{......e..Y| Plaintext[48]: | ac d8 fc e7 68 d7 ee 28 14 00 00 0c 32 2e 24 db |....h..(....2.$.| | 9c e0 6a e1 cd 90 9a 84 c4 8d a6 a4 dd a5 99 5c |..j............\| | 1d e0 c8 04 c8 a5 79 dd b7 17 4d b3 03 03 03 03 |......y...M.....| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | c4 8d a6 a4 dd a5 99 5c 1d e0 c8 04 c8 a5 79 dd |.......\......y.| | b7 17 4d b3 |..M. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #459 (first time) conversation = 0x7fca71df1038, ssl_session = 0x7fca45c0c680 record: offset = 0, reported_length_remaining = 234 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 61 dc 13 02 06 28 25 78 a2 09 96 b0 fd 7e a5 db |a....(%x.....~..| | 56 35 39 39 f1 dc 19 82 6a c7 ee f3 92 ec 28 a1 |V599....j.....(.| | ea 72 87 43 aa 3d 77 a9 82 2d 93 17 0b 24 bd 5b |.r.C.=w..-...$.[| Plaintext[48]: | 50 8b 94 ae 52 a1 02 67 14 00 00 0c f5 da 03 46 |P...R..g.......F| | 0f c1 55 0e 57 3a 4e 1e f6 88 81 97 36 67 06 b5 |..U.W:N.....6g..| | 67 59 b8 34 2b 7e 54 45 1a 30 6d 82 03 03 03 03 |gY.4+~TE.0m.....| ssl_decrypt_record found padding 3 final len 44 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | f6 88 81 97 36 67 06 b5 67 59 b8 34 2b 7e 54 45 |....6g..gY.4+~TE| | 1a 30 6d 82 |.0m. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #460 (first time) conversation = 0x7fca71df1038, ssl_session = 0x7fca45c0c680 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | 81 80 6b 8d 20 12 8f 43 83 2a b0 df 83 77 e0 3e |..k. ..C.*...w.>| | 19 2b 22 72 ee 8e 2c 62 37 43 77 b7 c4 76 46 f5 |.+"r..,b7Cw..vF.| | a1 b5 6f 46 f1 21 2f 62 4e 7b 67 f2 4f 57 2a 53 |..oF.!/bN{g.OW*S| | f6 ff 12 45 58 5e 51 39 04 52 94 4c 13 06 a1 b5 |...EX^Q9.R.L....| | a7 7d 61 8f 62 5f e3 86 0e 2d e9 af 17 7f 76 74 |.}a.b_...-....vt| | 7d 20 e9 9f 6a 84 67 6e 02 9c 88 9b 61 43 c7 6a |} ..j.gn....aC.j| | 72 9f 7e d9 f7 98 9f a6 4d dd c4 34 16 7f a7 37 |r.~.....M..4...7| Plaintext[112]: | 6c 8f 15 ab 9f 0b 1b 29 47 45 54 20 2f 20 48 54 |l......)GET / HT| | 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 63 |TP/1.1..Host: ec| | 64 68 65 2d 72 73 61 2d 64 65 73 2d 63 62 63 33 |dhe-rsa-des-cbc3| | 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 |-sha.local.al.le| | 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 39 32 |kensteyn.nl:4492| | 0d 0a 0d 0a 51 21 de d4 d5 5c 79 d6 33 30 6a 37 |....Q!...\y.30j7| | 42 ad 3d 80 63 12 e7 fa 07 07 07 07 07 07 07 07 |B.=.c...........| ssl_decrypt_record found padding 7 final len 104 checking mac (len 76, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 30 d6 bc f4 3b 3e 3a 08 64 4f af bc b6 a8 43 8d |0...;>:.dO....C.| | d5 b5 30 93 |..0. | ssl_decrypt_record: mac failed association_find: TCP port 34675 found (nil) association_find: TCP port 4492 found 0x3738c90 dissect_ssl enter frame #461 (first time) conversation = 0x7fca71df1038, ssl_session = 0x7fca45c0c680 record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 384, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 384 Ciphertext[384]: | 8e f3 9c 72 d2 3c 2c b6 77 e9 37 60 c8 97 f7 19 |...r.<,.w.7`....| | 27 24 c5 4c 79 0a c3 93 f9 25 ef 34 ff 91 0b 50 |'$.Ly....%.4...P| | 4d be c9 e4 bd 1e eb 0e 66 5a de 94 ca 1e 88 9c |M.......fZ......| | 74 2a 54 ea 60 40 cd 7d dd 06 63 c9 b1 3b 19 95 |t*T.`@.}..c..;..| | ef 70 2c 21 02 25 67 65 7e 4d 06 1f 44 ff ee 82 |.p,!.%ge~M..D...| | 45 45 c2 6e a0 a1 62 86 54 0d b6 bb 22 75 ea d6 |EE.n..b.T..."u..| | 8f 8e 41 9c 08 ed cf 6a 20 7f 5a ee 87 f8 39 17 |..A....j .Z...9.| | fa 42 da f0 b8 58 d0 a6 e4 e9 cb 0e b9 43 30 d0 |.B...X.......C0.| | 51 1c 27 28 94 14 5a 0b c0 a2 c9 0e ae e9 e3 85 |Q.'(..Z.........| | fa ce f4 dc 19 cd 1a dd ec fd 0a b5 a6 14 4e f1 |..............N.| | 11 2b 7a bd 38 55 f9 a9 b4 74 3b cf 41 3a f7 e8 |.+z.8U...t;.A:..| | 99 fb 6b 89 f3 30 2f 8a 9c 85 36 7a 44 3b 6b 24 |..k..0/...6zD;k$| | af 62 c8 83 36 89 6d ee 21 12 5e ed fb 2e 27 a2 |.b..6.m.!.^...'.| | 6e cb a1 e1 30 1d cd 99 bc 0b 05 17 b6 fb 47 07 |n...0.........G.| | dd 77 5a a1 fe be fc c9 a2 6e f4 03 c1 02 71 26 |.wZ......n....q&| | 23 57 d2 9a 1e 87 3a 07 83 fb 28 1b d8 d5 d4 f9 |#W....:...(.....| | 3c ab 09 40 e1 2b 44 36 0d 34 d9 2c 72 04 fc 63 |<..@.+D6.4.,r..c| | 00 61 cd 1d 0f a1 e8 78 2a 66 d5 b4 b4 e3 70 bc |.a.....x*f....p.| | 2c 2b 29 2c 63 38 60 c7 d3 3f 50 37 70 99 64 fa |,+),c8`..?P7p.d.| | 1f ab b3 82 7a a8 6d d1 a7 64 de 5d 2f 8b ec 26 |....z.m..d.]/..&| | 20 ee c7 20 92 5c 38 0e 23 e8 c7 51 8e ff c8 32 | .. .\8.#..Q...2| | f2 7a 7f 40 65 72 ac c4 92 bd 32 6a 05 a7 64 28 |.z.@er....2j..d(| | a4 b2 b7 06 17 1a 5c 5e 54 cb f1 8c 7b 32 2c fc |......\^T...{2,.| | f0 b8 72 a2 6c 76 4f 63 84 72 c4 fa 2c 26 bc 82 |..r.lvOc.r..,&..| Plaintext[384]: | dd cb 0f 81 42 3c fb 9c 48 54 54 50 2f 31 2e 31 |....B<..HTTP/1.1| | 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:| | 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da| | 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep | | 32 30 31 33 20 32 30 3a 31 31 3a 33 32 20 47 4d |2013 20:11:32 GM| | 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:| | 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont| | 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.| | 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo| | 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu| | 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00| | 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach| | 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca| | 63 68 65 0d 0a 0d 0a 30 78 43 30 2c 30 78 31 32 |che....0xC0,0x12| | 20 2d 20 45 43 44 48 45 2d 52 53 41 2d 44 45 53 | - ECDHE-RSA-DES| | 2d 43 42 43 33 2d 53 48 41 20 20 53 53 4c 76 33 |-CBC3-SHA SSLv3| | 20 4b 78 3d 45 43 44 48 20 20 20 20 20 41 75 3d | Kx=ECDH Au=| | 52 53 41 20 20 45 6e 63 3d 33 44 45 53 28 31 36 |RSA Enc=3DES(16| | 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 |8) Mac=SHA1document.doma| | 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek| | 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'Y@~....Ww.E.| | 58 1f fa 12 48 da cb 5e 07 07 07 07 07 07 07 07 |X...H..^........| ssl_decrypt_record found padding 7 final len 376 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | fc b8 d8 2d 04 e7 ab 9b 62 dd fc 75 d0 f9 3f d3 |...-....b..u..?.| | 6f ea da 0b |o... | ssl_decrypt_record: mac failed association_find: TCP port 4492 found 0x3738c90 dissect_ssl enter frame #462 (first time) conversation = 0x7fca71df1038, ssl_session = 0x7fca45c0c680 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 32, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 32 Ciphertext[32]: | ab 5f 5c 36 39 90 ad c2 df 7c 3f ae ad 83 2a 61 |._\69....|?...*a| | 0d ad a8 0b 31 ba 6f ba 4e 4a 51 98 5b 22 c0 dd |....1.o.NJQ.["..| Plaintext[32]: | c8 23 01 e5 f8 68 41 ea 01 00 c5 cc 7a 91 0b f8 |.#...hA.....z...| | a2 ea a4 8f 3c 70 3f 3b e2 f3 8b 26 b1 d3 01 01 |.... state 0x01 dissect_ssl enter frame #471 (first time) conversation = 0x7fca71df12e0, ssl_session = 0x7fca45c0eb80 record: offset = 0, reported_length_remaining = 1230 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 66, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0xC013 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 40 bf 45 46 07 a5 87 7c 96 9e 98 76 be c3 12 89 |@.EF...|...v....| | ea 11 3c 08 73 b4 a1 6c 12 9b 0f 71 7c 56 0a dc |..<.s..l...q|V..| | b5 43 a4 0f 46 3e c1 cd 62 3a f9 84 7e d1 50 4e |.C..F>..b:..~.PN| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f4 b7 18 c2 08 21 9b 56 be 7a a2 74 e3 f1 f0 bb |.....!.V.z.t....| | 1d ff 87 bd 24 a2 e1 66 de 81 ff b6 0c 52 34 c2 |....$..f.....R4.| | f4 38 0a 55 6e 40 19 98 a3 ec 46 b9 91 e2 1d 18 |.8.Un@....F.....| | 84 7c b4 f8 fa 2a 08 0a 0a 12 02 53 72 |.|...*.....Sr | hash out[104]: | 3a 86 d1 09 c9 90 ef e1 99 40 ce 36 30 5f 62 ef |:........@.60_b.| | c4 bf f6 ec 17 44 3a e6 31 52 65 0d ff fb 1c cf |.....D:.1Re.....| | f7 93 37 78 7e c8 8e 9c 99 65 68 13 73 94 5e d0 |..7x~....eh.s.^.| | 03 55 9d 00 fd bd 10 73 fc 1a b0 44 7b 00 51 e2 |.U.....s...D{.Q.| | 86 9f 75 5c a3 1d 33 50 bc a4 03 2e 6f 0d 24 78 |..u\..3P....o.$x| | 39 09 fc a7 76 aa 4d c2 f3 cb 69 2b f8 e7 df 26 |9...v.M...i+...&| | 2f aa 13 24 4d 89 c0 d1 |/..$M... | PRF out[104]: | 3a 86 d1 09 c9 90 ef e1 99 40 ce 36 30 5f 62 ef |:........@.60_b.| | c4 bf f6 ec 17 44 3a e6 31 52 65 0d ff fb 1c cf |.....D:.1Re.....| | f7 93 37 78 7e c8 8e 9c 99 65 68 13 73 94 5e d0 |..7x~....eh.s.^.| | 03 55 9d 00 fd bd 10 73 fc 1a b0 44 7b 00 51 e2 |.U.....s...D{.Q.| | 86 9f 75 5c a3 1d 33 50 bc a4 03 2e 6f 0d 24 78 |..u\..3P....o.$x| | 39 09 fc a7 76 aa 4d c2 f3 cb 69 2b f8 e7 df 26 |9...v.M...i+...&| | 2f aa 13 24 4d 89 c0 d1 |/..$M... | key expansion[104]: | 3a 86 d1 09 c9 90 ef e1 99 40 ce 36 30 5f 62 ef |:........@.60_b.| | c4 bf f6 ec 17 44 3a e6 31 52 65 0d ff fb 1c cf |.....D:.1Re.....| | f7 93 37 78 7e c8 8e 9c 99 65 68 13 73 94 5e d0 |..7x~....eh.s.^.| | 03 55 9d 00 fd bd 10 73 fc 1a b0 44 7b 00 51 e2 |.U.....s...D{.Q.| | 86 9f 75 5c a3 1d 33 50 bc a4 03 2e 6f 0d 24 78 |..u\..3P....o.$x| | 39 09 fc a7 76 aa 4d c2 f3 cb 69 2b f8 e7 df 26 |9...v.M...i+...&| | 2f aa 13 24 4d 89 c0 d1 |/..$M... | Client MAC key[20]: | 3a 86 d1 09 c9 90 ef e1 99 40 ce 36 30 5f 62 ef |:........@.60_b.| | c4 bf f6 ec |.... | Server MAC key[20]: | 17 44 3a e6 31 52 65 0d ff fb 1c cf f7 93 37 78 |.D:.1Re.......7x| | 7e c8 8e 9c |~... | Client Write key[16]: | 99 65 68 13 73 94 5e d0 03 55 9d 00 fd bd 10 73 |.eh.s.^..U.....s| Server Write key[16]: | fc 1a b0 44 7b 00 51 e2 86 9f 75 5c a3 1d 33 50 |...D{.Q...u\..3P| Client Write IV[16]: | bc a4 03 2e 6f 0d 24 78 39 09 fc a7 76 aa 4d c2 |....o.$x9...v.M.| Server Write IV[16]: | f3 cb 69 2b f8 e7 df 26 2f aa 13 24 4d 89 c0 d1 |..i+...&/..$M...| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 71, reported_length_remaining = 1159 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 76 length 803 bytes, remaining 883 record: offset = 883, reported_length_remaining = 347 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 333, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 888 length 329 bytes, remaining 1221 record: offset = 1221, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1226 length 0 bytes, remaining 1230 dissect_ssl enter frame #473 (first time) conversation = 0x7fca71df12e0, ssl_session = 0x7fca45c0eb80 record: offset = 0, reported_length_remaining = 150 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 70, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2f4380a556e401998a3ec46b991e21d18847cb4f8fa... looking for RSA pre-master41042cc3fd46a683672b719b04ca25c6a7e4450038267669... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a88b3723405ec9f6d 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2ed4699771feefd3c969e60a3a051977784c4581a0c414211a97aad6e 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f28e1f7f2a7aca2e9c71ffb47ed2d846d11d723e2b9d4a44e41c19ecd8 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2330ea5edf65f3fbfece59d5033d2915b04625ca5bb934034eaa986eb 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f23bb1ff6b1a567cab274581ce4ae59ffe8a2e43ae2defe2afd7886633 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2968aa51a4ea28bcab908d2a0a5011eb847de99e38f014db53571e92d 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2888c7e15b7d5827fd75db4f7b7a1c450be4f9f14457607e1a26fce1a DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f21b0765b7ce7a5bd63502bcc79e63d2e53e6c7ba886d2a6d621b429d3 DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f22f616d5f9ad8f48c36410b08fcf872f0c92fbe02b4c3c86a91252574 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2d989534de7839fc5461dfb9290266a33b0f241faf93f4c984d1656a8 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f36756c62ee64b45cf17caefd0cd105ebe825275bec27aeb520d7294c9 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f36a2e00daced950610a278df5d5cbcd232469fee9bc7a06511da65e98 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f36a0b8704213d2d34b66f119345cc1d4b0b4c95a88834087a19cd83c1 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f37b6b5187ffb077f015a558da43d722e15602ae47a7fe15f05cf5450c 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f353f5a955b8e7e96e593058aa1b26905a5ce8ff6c36770eb218883539 49E10327AD96808A76FC339CFF686DB7C51DE85DD3CC81E6D9571FA3949162CADFF2FD4286473D0BB3A4CA0E3A1BDBCC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f3ea5ceb07107749af52624d674e47e964ae7e84abb14090900d9a9340 49E10327AD96808A76FC339CFF686DB7C51DE85DD3CC81E6D9571FA3949162CADFF2FD4286473D0BB3A4CA0E3A1BDBCC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f3767d57c73b3b64df636982c2a5db197f7ea73c027eb44ae405cb7c2e 50787B46430A893B2355D92AEF474B50067D8252EC544E904DCC0375DABE46AC7597C4ECB62A877B39D5C046BCCFF5D7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f33d02713be94b005a27e8ad854db7e265e04bf49064b2d33f46f703d2 50787B46430A893B2355D92AEF474B50067D8252EC544E904DCC0375DABE46AC7597C4ECB62A877B39D5C046BCCFF5D7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f3f85e503f39bbb60e91465b12622d25ae6d94a00983239d3f3d1334e5 230ECC7B6E87B5763BABAAF128C0BD1AA265687B7D84506D2F5F4A2BEFD4F8A085018691C9F508BD0E1AAF63685AD504 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f35bc3b625015f9e965f41c885c3ebb8fb559df8e243bc096ade437eeb 230ECC7B6E87B5763BABAAF128C0BD1AA265687B7D84506D2F5F4A2BEFD4F8A085018691C9F508BD0E1AAF63685AD504 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f44efc1d6ab6a3e340b571615b38e05ab4b2c99c1336917feb5dc45630 3BC84E249BE108C61E0E394D2AD1EC113D3CD82120977D38BE08AFDEB57166E16FC28F55BDE3A1998D58E0D579201F4F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f47edde6124f5da403a760cd35f72f8c55c629876f7d8e06298fda9d5f 3BC84E249BE108C61E0E394D2AD1EC113D3CD82120977D38BE08AFDEB57166E16FC28F55BDE3A1998D58E0D579201F4F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f40f4cc7067b7a2e5106eda199e850e15f085a6d2d85e755e3eeb03b5e 40BF454607A5877C969E9876BEC31289EA113C0873B4A16C129B0F717C560ADCB543A40F463EC1CD623AF9847ED1504E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f4ce9233b89dd4aa176a84fb68668eafad9e37a80a0ae9c289197e5f78 40BF454607A5877C969E9876BEC31289EA113C0873B4A16C129B0F717C560ADCB543A40F463EC1CD623AF9847ED1504E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f4380a556e401998a3ec46b991e21d18847cb4f8fa2a080a0a12025372 17568857B197E1281FFC30AD3A5B59479FEFCD3C0428830E797414F85B63CF2A3D16F6FDFA6398114E9F36453C902F03 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 17 56 88 57 b1 97 e1 28 1f fc 30 ad 3a 5b 59 47 |.V.W...(..0.:[YG| | 9f ef cd 3c 04 28 83 0e 79 74 14 f8 5b 63 cf 2a |...<.(..yt..[c.*| | 3d 16 f6 fd fa 63 98 11 4e 9f 36 45 3c 90 2f 03 |=....c..N.6E<./.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f4 b7 18 c2 08 21 9b 56 be 7a a2 74 e3 f1 f0 bb |.....!.V.z.t....| | 1d ff 87 bd 24 a2 e1 66 de 81 ff b6 0c 52 34 c2 |....$..f.....R4.| | f4 38 0a 55 6e 40 19 98 a3 ec 46 b9 91 e2 1d 18 |.8.Un@....F.....| | 84 7c b4 f8 fa 2a 08 0a 0a 12 02 53 72 |.|...*.....Sr | hash out[104]: | 5c 6a f0 44 c5 37 b7 2d d5 9b 26 70 58 bb 8d 76 |\j.D.7.-..&pX..v| | e9 47 72 69 29 b4 48 f0 78 31 fb f2 3d e3 96 c8 |.Gri).H.x1..=...| | 70 94 1a 76 8e 84 06 ad 8a 02 c7 b7 bf 53 16 c6 |p..v.........S..| | b0 be 72 a0 ae 77 84 22 fc 22 78 75 81 e5 45 b8 |..r..w."."xu..E.| | e9 32 10 d7 fc 51 3b 64 74 88 4b 93 52 b2 5f 89 |.2...Q;dt.K.R._.| | 30 5c 96 a7 f7 b5 d4 bd ac 02 14 80 71 31 40 e3 |0\..........q1@.| | 75 f6 4d c3 82 8c 66 08 |u.M...f. | PRF out[104]: | 5c 6a f0 44 c5 37 b7 2d d5 9b 26 70 58 bb 8d 76 |\j.D.7.-..&pX..v| | e9 47 72 69 29 b4 48 f0 78 31 fb f2 3d e3 96 c8 |.Gri).H.x1..=...| | 70 94 1a 76 8e 84 06 ad 8a 02 c7 b7 bf 53 16 c6 |p..v.........S..| | b0 be 72 a0 ae 77 84 22 fc 22 78 75 81 e5 45 b8 |..r..w."."xu..E.| | e9 32 10 d7 fc 51 3b 64 74 88 4b 93 52 b2 5f 89 |.2...Q;dt.K.R._.| | 30 5c 96 a7 f7 b5 d4 bd ac 02 14 80 71 31 40 e3 |0\..........q1@.| | 75 f6 4d c3 82 8c 66 08 |u.M...f. | key expansion[104]: | 5c 6a f0 44 c5 37 b7 2d d5 9b 26 70 58 bb 8d 76 |\j.D.7.-..&pX..v| | e9 47 72 69 29 b4 48 f0 78 31 fb f2 3d e3 96 c8 |.Gri).H.x1..=...| | 70 94 1a 76 8e 84 06 ad 8a 02 c7 b7 bf 53 16 c6 |p..v.........S..| | b0 be 72 a0 ae 77 84 22 fc 22 78 75 81 e5 45 b8 |..r..w."."xu..E.| | e9 32 10 d7 fc 51 3b 64 74 88 4b 93 52 b2 5f 89 |.2...Q;dt.K.R._.| | 30 5c 96 a7 f7 b5 d4 bd ac 02 14 80 71 31 40 e3 |0\..........q1@.| | 75 f6 4d c3 82 8c 66 08 |u.M...f. | Client MAC key[20]: | 5c 6a f0 44 c5 37 b7 2d d5 9b 26 70 58 bb 8d 76 |\j.D.7.-..&pX..v| | e9 47 72 69 |.Gri | Server MAC key[20]: | 29 b4 48 f0 78 31 fb f2 3d e3 96 c8 70 94 1a 76 |).H.x1..=...p..v| | 8e 84 06 ad |.... | Client Write key[16]: | 8a 02 c7 b7 bf 53 16 c6 b0 be 72 a0 ae 77 84 22 |.....S....r..w."| Server Write key[16]: | fc 22 78 75 81 e5 45 b8 e9 32 10 d7 fc 51 3b 64 |."xu..E..2...Q;d| Client Write IV[16]: | 74 88 4b 93 52 b2 5f 89 30 5c 96 a7 f7 b5 d4 bd |t.K.R._.0\......| Server Write IV[16]: | ac 02 14 80 71 31 40 e3 75 f6 4d c3 82 8c 66 08 |....q1@.u.M...f.| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | 17 56 88 57 b1 97 e1 28 1f fc 30 ad 3a 5b 59 47 |.V.W...(..0.:[YG| | 9f ef cd 3c 04 28 83 0e 79 74 14 f8 5b 63 cf 2a |...<.(..yt..[c.*| | 3d 16 f6 fd fa 63 98 11 4e 9f 36 45 3c 90 2f 03 |=....c..N.6E<./.| dissect_ssl3_handshake session keys successfully generated record: offset = 75, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 81, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 4d b4 38 95 85 e9 d7 83 90 60 06 39 69 59 eb 79 |M.8......`.9iY.y| | 31 c8 69 76 31 08 03 41 02 e4 2f f9 1f d5 12 b9 |1.iv1..A../.....| | 40 bc 41 7f 40 ea 11 e4 a7 18 53 6f 83 c3 16 5b |@.A.@.....So...[| | 8b 76 90 aa 75 f1 58 c0 f8 c5 82 97 1f 26 bd 51 |.v..u.X......&.Q| Plaintext[64]: | ab a9 33 70 90 9f 86 bd d7 1f fe da 3e 1d 9b e6 |..3p........>...| | 14 00 00 0c 10 6a 98 cb 6c 2c 7b c1 21 35 1d df |.....j..l,{.!5..| | 3b 90 19 ab 6b 00 d4 02 c3 1d d1 03 b4 08 7a c2 |;...k.........z.| | 48 64 dd 00 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |Hd..............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 3b 90 19 ab 6b 00 d4 02 c3 1d d1 03 b4 08 7a c2 |;...k.........z.| | 48 64 dd 00 |Hd.. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #474 (first time) conversation = 0x7fca71df12e0, ssl_session = 0x7fca45c0eb80 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | a1 7a c0 10 9a 06 b5 5a cd ea 12 63 d5 5a 21 cf |.z.....Z...c.Z!.| | 91 6b 18 c1 16 92 75 92 1a 3e 08 8d 34 ff ae 8b |.k....u..>..4...| | 81 d9 f1 3e 18 77 48 81 9c 34 b5 32 70 95 42 3b |...>.wH..4.2p.B;| | a7 43 08 4c 31 6c 8a 98 8a 89 70 07 4c 9c a7 86 |.C.L1l....p.L...| Plaintext[64]: | e8 73 8b dc 98 14 bb 1e ad 32 4d bf 59 17 09 f1 |.s.......2M.Y...| | 14 00 00 0c 4e cf 9d 2d b1 7f c5 ac d4 92 b2 02 |....N..-........| | 42 31 dd 10 5d 97 48 4a ae ef 21 dc b4 68 eb 76 |B1..].HJ..!..h.v| | eb 80 af f0 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 42 31 dd 10 5d 97 48 4a ae ef 21 dc b4 68 eb 76 |B1..].HJ..!..h.v| | eb 80 af f0 |.... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #475 (first time) conversation = 0x7fca71df12e0, ssl_session = 0x7fca45c0eb80 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | 2b 01 7a 0a 26 9f d5 a4 00 ce 7e 32 4d bb 0c d7 |+.z.&.....~2M...| | 25 e6 b7 c3 7b b8 fe 3b 83 f3 75 39 7d 89 31 7c |%...{..;..u9}.1|| | 0e 80 4f aa 64 3c f7 ef 95 d6 30 ac e7 32 2e 12 |..O.d<....0..2..| | 15 74 62 dd 8b aa 73 4a 20 64 11 ac 37 f8 35 41 |.tb...sJ d..7.5A| | 61 2b 13 7f 4e 87 8e 8b ef 85 56 3b 55 85 a5 cd |a+..N.....V;U...| | d9 f6 56 c4 49 f8 dd 9e e6 78 9a ae cb bf 70 59 |..V.I....x....pY| | 73 2b 2c a9 94 6f 1a 41 2e f2 5c 43 29 d2 47 38 |s+,..o.A..\C).G8| Plaintext[112]: | 6d c3 c5 f6 1f 80 34 7f c6 59 6a 0e e4 42 56 45 |m.....4..Yj..BVE| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-| | 61 65 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 6c |aes128-sha.local| | 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n| | 6c 3a 34 34 39 33 0d 0a 0d 0a 50 de 49 60 37 95 |l:4493....P.I`7.| | cf 0b 4c 2c e1 48 55 77 be 63 fe e5 67 ee 01 01 |..L,.HUw.c..g...| ssl_decrypt_record found padding 1 final len 110 checking mac (len 74, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 34 ab ba 62 2c 60 ca 30 82 c8 d9 47 30 55 12 b5 |4..b,`.0...G0U..| | 1d 53 4e 7c |.SN| | ssl_decrypt_record: mac failed association_find: TCP port 55377 found (nil) association_find: TCP port 4493 found 0x3738d20 dissect_ssl enter frame #476 (first time) conversation = 0x7fca71df12e0, ssl_session = 0x7fca45c0eb80 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | 6d 25 95 2b 09 2b 7d f1 61 4f 8c 28 f9 d7 57 3a |m%.+.+}.aO.(..W:| | 29 42 1c 58 57 a7 62 1a d2 c0 f0 b1 e0 64 fb 23 |)B.XW.b......d.#| | 48 0d 7d af b6 05 1b 1e 6a 57 8d 9a 01 ea a7 92 |H.}.....jW......| | c1 8b 5e 73 71 23 5a 81 31 a2 76 42 a7 68 5b c5 |..^sq#Z.1.vB.h[.| | db 7e 02 e0 f5 09 cf 65 9d 13 2f 49 dc 1b c8 49 |.~.....e../I...I| | 05 88 60 77 4c db 4a e4 9d ff 8e 52 7c 9c 7f 4d |..`wL.J....R|..M| | 35 a2 c7 f7 d8 bc f8 3e 31 ec 5c 81 05 11 12 b3 |5......>1.\.....| | 7f 32 60 ca e9 c7 a9 f3 73 b1 52 7b 79 e1 b4 3c |.2`.....s.R{y..<| | 77 91 35 70 af 3c fa 42 07 b5 f5 53 b7 fa f3 f9 |w.5p.<.B...S....| | 02 dd 33 1f 89 98 2c c0 91 91 75 d1 a1 83 0d 69 |..3...,...u....i| | 94 3b 9a 80 d3 81 29 f9 a3 b1 ec d8 92 fa 67 fd |.;....).......g.| | 2f 8f fa 32 1b 55 84 8d 14 f3 a9 a1 3c e0 4b f3 |/..2.U......<.K.| | 66 8a fe 28 79 b0 d0 0b 5e 4a 05 22 8a 3a da 05 |f..(y...^J.".:..| | 29 80 2c 16 c2 1f 2b 85 6f cc 8d db 22 4f d6 0a |).,...+.o..."O..| | 17 54 41 45 a5 90 4a de 19 69 7c 34 20 c9 b6 c3 |.TAE..J..i|4 ...| | ce 41 3f b5 73 8b b3 85 ae 22 3a 00 47 b8 08 ad |.A?.s....":.G...| | 83 b8 cb dc 96 07 9f 9c 44 7d ea 4f ee ac eb 3a |........D}.O...:| | 8d 15 21 ab 2d 47 a1 b5 ba 31 0f b9 49 b4 1a 2b |..!.-G...1..I..+| | fd b5 ea cc 8a a8 e0 48 fd aa 25 d3 b4 16 bc ca |.......H..%.....| | 30 a4 61 d2 5b 00 d9 75 e5 19 94 b4 fa 10 e2 f3 |0.a.[..u........| | e8 61 0d 49 f7 07 fb 21 e0 13 17 61 6a 78 01 e0 |.a.I...!...ajx..| | 62 19 11 84 23 41 c9 38 c6 5b 3a a5 31 f1 ba 81 |b...#A.8.[:.1...| | 94 10 7f a5 c9 5e 86 bd 09 2d a9 f5 86 57 5b 59 |.....^...-...W[Y| | aa aa 55 83 7a b7 9c 9e 4f ab 7c d1 12 29 55 5a |..U.z...O.|..)UZ| | 65 76 89 b8 61 b5 02 2f aa 4f 00 b4 f1 9d e9 74 |ev..a../.O.....t| Plaintext[400]: | c8 90 db 49 f5 a9 c5 a5 30 4b e7 d7 35 db 05 1c |...I....0K..5...| | 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.| | 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1| | 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,| | 20 31 34 20 53 65 70 20 32 30 31 33 20 32 30 3a | 14 Sep 2013 20:| | 31 31 3a 33 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 |11:32 GMT..Conte| | 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht| | 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng| | 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect| | 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi| | 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan| | 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G| | 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro| | 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0| | 78 43 30 2c 30 78 31 33 20 2d 20 45 43 44 48 45 |xC0,0x13 - ECDHE| | 2d 52 53 41 2d 41 45 53 31 32 38 2d 53 48 41 20 |-RSA-AES128-SHA | | 20 20 20 53 53 4c 76 33 20 4b 78 3d 45 43 44 48 | SSLv3 Kx=ECDH| | 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc| | 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S| | 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1..{.| | af 86 e8 17 32 fa c7 22 6d 75 1d 7c 60 d5 de af |....2.."mu.|`...| | 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................| ssl_decrypt_record found padding 15 final len 384 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 8a f8 05 f0 61 80 c1 a3 29 04 5c 86 39 8e ea cd |....a...).\.9...| | c2 b3 e2 77 |...w | ssl_decrypt_record: mac failed association_find: TCP port 4493 found 0x3738d20 dissect_ssl enter frame #477 (first time) conversation = 0x7fca71df12e0, ssl_session = 0x7fca45c0eb80 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 84 22 01 72 bc bc 6c f8 96 91 0f 7e f4 f0 f6 29 |.".r..l....~...)| | 8b fc 82 2e fe 04 df b7 4c 76 51 20 4b 05 3a a2 |........LvQ K.:.| | 7c 4e 62 41 04 4d c7 e1 81 e8 c8 3c 0f e1 f2 89 ||NbA.M.....<....| Plaintext[48]: | f1 38 b9 fe ab 65 ae 56 57 2f de 7b 84 85 b1 7b |.8...e.VW/.{...{| | 01 00 b8 0f 1b 19 c8 e1 1b 19 98 a7 55 fb d5 b6 |............U...| | d0 88 96 3a 88 47 09 09 09 09 09 09 09 09 09 09 |...:.G..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | b8 0f 1b 19 c8 e1 1b 19 98 a7 55 fb d5 b6 d0 88 |..........U.....| | 96 3a 88 47 |.:.G | ssl_decrypt_record: mac ok dissect_ssl enter frame #479 (first time) conversation = 0x7fca71df12e0, ssl_session = 0x7fca45c0eb80 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | 0e f5 39 20 06 66 12 8a e9 c7 b3 14 71 a2 ca ea |..9 .f......q...| | 46 31 bc bb 4b ac b1 ba f8 35 45 a4 75 f8 6f 05 |F1..K....5E.u.o.| | a4 2f 15 af 60 a4 1c 3e 86 95 a4 b9 42 e3 c0 ff |./..`..>....B...| Plaintext[48]: | ab 02 89 87 9d f8 7f 8d f3 16 1b f8 0b db 12 84 |................| | 01 00 79 3e 80 47 7b 39 b5 1e 55 3b 71 ed 4f 98 |..y>.G{9..U;q.O.| | 08 0c df bd 4a 25 09 09 09 09 09 09 09 09 09 09 |....J%..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 79 3e 80 47 7b 39 b5 1e 55 3b 71 ed 4f 98 08 0c |y>.G{9..U;q.O...| | df bd 4a 25 |..J% | ssl_decrypt_record: mac ok dissect_ssl enter frame #484 (first time) ssl_session_init: initializing ptr 0x7fca45c11040 size 688 conversation = 0x7fca71df1588, ssl_session = 0x7fca45c11040 record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 317, ssl state 0x00 association_find: TCP port 41596 found (nil) packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 packet_from_server: is from server - FALSE ssl_find_private_key server 127.0.0.1:4494 ssl_find_private_key can't find private key for this server! Try it again with universal port 0 ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0 ssl_find_private_key can't find any private key! dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #486 (first time) conversation = 0x7fca71df1588, ssl_session = 0x7fca45c11040 record: offset = 0, reported_length_remaining = 1230 dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 66, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 62 bytes, remaining 71 dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_restore_session master key retrieved dissect_ssl3_hnd_srv_hello found CIPHER 0xC014 -> state 0x37 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | 17 56 88 57 b1 97 e1 28 1f fc 30 ad 3a 5b 59 47 |.V.W...(..0.:[YG| | 9f ef cd 3c 04 28 83 0e 79 74 14 f8 5b 63 cf 2a |...<.(..yt..[c.*| | 3d 16 f6 fd fa 63 98 11 4e 9f 36 45 3c 90 2f 03 |=....c..N.6E<./.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f4 85 33 55 63 5c b2 ab 38 2e c6 41 0b 62 06 03 |..3Uc\..8..A.b..| | 52 6b 93 a1 19 2f 96 0a 1b cc 40 3e 50 52 34 c2 |Rk.../....@>PR4.| | f4 0a 09 b6 fc f7 21 c3 05 06 c8 d6 4b 44 9b 2c |......!.....KD.,| | d4 73 80 05 8c 5c 91 69 89 92 37 fe a3 |.s...\.i..7.. | hash out[136]: | b4 0f 4d 53 65 0e 1a 64 d9 d2 97 4a d1 6a 9a 1e |..MSe..d...J.j..| | 2e 87 a1 fb 4b b0 56 dc c2 9f 26 1a 5b ae ae d0 |....K.V...&.[...| | a2 f0 1f 81 69 89 90 2e 16 e4 cf ec 11 bb 76 94 |....i.........v.| | 13 6f 60 5f 68 00 0b e7 d0 76 96 4b a9 51 ea 65 |.o`_h....v.K.Q.e| | 9b 02 1a ee 7a 6e d9 27 d0 e1 17 90 04 4b db 60 |....zn.'.....K.`| | 32 7a dd 7d f8 93 96 14 e2 17 f2 16 37 52 cb c9 |2z.}........7R..| | 49 0f 72 d5 88 eb 55 35 11 b2 33 7c 90 8c e7 ec |I.r...U5..3|....| | 31 f1 aa 69 2d 70 4a 90 91 d2 c0 7a 70 ae 8e 54 |1..i-pJ....zp..T| | 44 ae 84 93 ab 78 da a9 |D....x.. | PRF out[136]: | b4 0f 4d 53 65 0e 1a 64 d9 d2 97 4a d1 6a 9a 1e |..MSe..d...J.j..| | 2e 87 a1 fb 4b b0 56 dc c2 9f 26 1a 5b ae ae d0 |....K.V...&.[...| | a2 f0 1f 81 69 89 90 2e 16 e4 cf ec 11 bb 76 94 |....i.........v.| | 13 6f 60 5f 68 00 0b e7 d0 76 96 4b a9 51 ea 65 |.o`_h....v.K.Q.e| | 9b 02 1a ee 7a 6e d9 27 d0 e1 17 90 04 4b db 60 |....zn.'.....K.`| | 32 7a dd 7d f8 93 96 14 e2 17 f2 16 37 52 cb c9 |2z.}........7R..| | 49 0f 72 d5 88 eb 55 35 11 b2 33 7c 90 8c e7 ec |I.r...U5..3|....| | 31 f1 aa 69 2d 70 4a 90 91 d2 c0 7a 70 ae 8e 54 |1..i-pJ....zp..T| | 44 ae 84 93 ab 78 da a9 |D....x.. | key expansion[136]: | b4 0f 4d 53 65 0e 1a 64 d9 d2 97 4a d1 6a 9a 1e |..MSe..d...J.j..| | 2e 87 a1 fb 4b b0 56 dc c2 9f 26 1a 5b ae ae d0 |....K.V...&.[...| | a2 f0 1f 81 69 89 90 2e 16 e4 cf ec 11 bb 76 94 |....i.........v.| | 13 6f 60 5f 68 00 0b e7 d0 76 96 4b a9 51 ea 65 |.o`_h....v.K.Q.e| | 9b 02 1a ee 7a 6e d9 27 d0 e1 17 90 04 4b db 60 |....zn.'.....K.`| | 32 7a dd 7d f8 93 96 14 e2 17 f2 16 37 52 cb c9 |2z.}........7R..| | 49 0f 72 d5 88 eb 55 35 11 b2 33 7c 90 8c e7 ec |I.r...U5..3|....| | 31 f1 aa 69 2d 70 4a 90 91 d2 c0 7a 70 ae 8e 54 |1..i-pJ....zp..T| | 44 ae 84 93 ab 78 da a9 |D....x.. | Client MAC key[20]: | b4 0f 4d 53 65 0e 1a 64 d9 d2 97 4a d1 6a 9a 1e |..MSe..d...J.j..| | 2e 87 a1 fb |.... | Server MAC key[20]: | 4b b0 56 dc c2 9f 26 1a 5b ae ae d0 a2 f0 1f 81 |K.V...&.[.......| | 69 89 90 2e |i... | Client Write key[32]: | 16 e4 cf ec 11 bb 76 94 13 6f 60 5f 68 00 0b e7 |......v..o`_h...| | d0 76 96 4b a9 51 ea 65 9b 02 1a ee 7a 6e d9 27 |.v.K.Q.e....zn.'| Server Write key[32]: | d0 e1 17 90 04 4b db 60 32 7a dd 7d f8 93 96 14 |.....K.`2z.}....| | e2 17 f2 16 37 52 cb c9 49 0f 72 d5 88 eb 55 35 |....7R..I.r...U5| Client Write IV[16]: | 11 b2 33 7c 90 8c e7 ec 31 f1 aa 69 2d 70 4a 90 |..3|....1..i-pJ.| Server Write IV[16]: | 91 d2 c0 7a 70 ae 8e 54 44 ae 84 93 ab 78 da a9 |...zp..TD....x..| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 record: offset = 71, reported_length_remaining = 1159 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 807, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 76 length 803 bytes, remaining 883 record: offset = 883, reported_length_remaining = 347 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 333, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 888 length 329 bytes, remaining 1221 record: offset = 1221, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 1226 length 0 bytes, remaining 1230 dissect_ssl enter frame #488 (first time) conversation = 0x7fca71df1588, ssl_session = 0x7fca45c11040 record: offset = 0, reported_length_remaining = 150 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 70, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 trying to use SSL keylog in /tmp/snif/tls/broken/premaster.txt looking for CLIENT_RANDOM 5234c2f40a09b6fcf721c30506c8d64b449b2cd47380058c... looking for RSA pre-master4104c327482617ac5e1fb9b9695fa90f517d621bf6156578... checking keylog line: CLIENT_RANDOM 5234c2ee38b626be645849cc5984f3014708e6d534b09fd6e5ceaa9799ae7206 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eec1c5a350c924cc9b3b9e48af3991ecabb7b862bdcd03927b29e65fa5 10228071CA87EB4BB184ACEC91EB507875DDE5F601000E99CF82E8176D45B6AFA416A68A6E54561017AE711D7D4894FA line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee0cc7c1540e8ce7b523a2e131b7541e93f17a523b4f4aab3e028c7d33 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eed1305b253a1eed99b3a41b172a378c35073db2c9c7e7872486276fe5 0AA2451750138D1DC58DA3C73710559E4307EAA2C78607D4B22192DFD0031DAFCF5E6E94C6AF472DEF55E1602484999C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eebdc1e5e77a46d64eb4b6053cc2411edc8e2bba740c522c900f0e6c5a 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2eea5c99dc7f6a2838e5fb19c19e7baf582a54534b8583eec8fc259f2c7 0BAB274B82B719B462149D8FCBFC235442762B08293B1FF7A31E8E12EBE4206E5852A23E327BDED183BE8FF4EAC03BE8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee7bbc7308c974f0a0555b676cfee719ca578a0746b691b42efa4e7452 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ee3baef190c5e54112cc6e9ad6a1ea91ae19c301fc8cf8e186388bc9fc 3DED667B214E577C2AE422044336C72A7D6B4D52A3A51213666D2BC003C9BAC02A864B9C5B8D34BF25C99CDC8C6CD3E1 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efa0b5d9195b2cd59e832b618c821a47e9132e3d55997ced6ac9b38b06 E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2effa63d23ce8898660149d578f6d08f08c9ed6022ed3255234e3cbeb5d E53F663B4B293647239FEA491DD22EB989046F7CE534DD87F569B4CC06D4A772EF9472FD349CFC2CF94155F7A8587975 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb1f8c8d7d842d4aa8224fd0492214b6a7296aa1982aafbe291974636 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efb9596d7bcb9a7a2949404a7d618755247b423a699053f0a72f007894 E37D1296526F48CF5663D34D9991CDB53DAB6627D1FCD5805F935EEF74443BEA11BF87EF93D3563792BD252DA1119557 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef44af091cca74a56b45c0bc18439673e5b4f593527a24f8af3bc70920 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef1162759c98f5e2d695908d43e7744b722a00eb3f4a3c22e886142a20 86F6861F4AC51A480695D8D1BF20AA2894F7FE1D637F5CE292C667B649A5E0B702146E8A0C6895C5B26D9A6AC161645E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efedf3e631023fb8ca909820c24feedbc61f95637b7ab7519f1e32a664 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef9c1bc46c87f7d2f0e441be5774df905dee5aec15c74661e3bccd50d4 B5839EC05C29DAD636E0D24B94DA8B17B75B006B0AB149FB085792811FDFAF0887E14A0357CF73B1A59FE8C18AAEC774 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2efcd7218d597f7e630f72bb41f08d63dcd1c214114e53fdb910093ba24 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2ef7a50f4f676426b9da83ee86759b11a44850b1dc7c1ce8ad6cee19fed 321ECA178E72C8B6CF4D0665121F99F5EC248D3A1C087C2BD276F4FEDE4888E2CB343CC8444C4C30AAEB10AB4366C6B4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0eac025bab072a31d4c3156ff06226639d019879b3ec746f50843e2b8 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0fed3fbdb797842dc68326ec342fada96d5075b9eccc8b2baa62a3bc5 00064233898D6FA2B7F2ABA63BC969C2C8264DD979CD8BFA5351DE37A2E1E9AB332DE89D9FB30FA238C05F2FA2AF810C line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f065c9d0edcc0145d386f04d145a87cdbec212070be8bc2d4f1735ab34 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f01f1db52a593d17d14369a583a8f3d6c6b47fadf0513e642e895cb21f 8E2C59CBFCDDB9AA120A82E8E86287E960FE1A1F8EDDB48BB0B7098A39983044DCFD3EE80CFD93871F6011B39B084DD4 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f092dd25769ef912f09d22224f83c9f8a18906ca74ac164c7ab6c9dcc5 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0a90c69825fcd60f730997580ca8683008ab3984af969f7f51b115329 DBBBBF650847E15AF807FB9D25E64589851A41AD12ACB5F675E1DBAA925C56ED2B8AE80DCC52E5EFD944D064788B8D87 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0cf09171a90bd157c663c3ef3d026927e9674e0adc207d0ac8c6f9e66 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f08dec81a899832a03c5b097338253f7d901566c70becc8a2431717273 14BBDD69E9D2DFCAAE2C7978361C6243F263CD8931557FEC4AE6FD3658D40CC0580A0915CE278DF4FF0E7296D056A4B5 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f0d88758c9e9b8c60725ceeab91598715e86a9fc5b2ea565da3b56126f AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f048ff58ca7c79fe2c01920ac69bb126b95158901d167d7fef06a528da AFF58F23605173D7B93124692A279DEEB0AD9E41A797C3F4A1046470E13799E8EF5CE6B203BE706605364F234BCD23C0 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1ab05917995d3364109de0e9c4fbaa57ba313999bcbfd6230b430dada D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1891ad7f382cab14a6fe1b69eff5f43b86123bd296b35353301b5fe0e D6B054281C6319123AC69DEAA619849C6C413E7D03E813C0DA48AE4ADD46F5F63A582E2B1687B8748BE2829CE9F9285F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f17e34bba1b8a7045343f0679ee4dc8539febbc87f1b20272fca95b883 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f192617ea87fca247d17342b23ad77d89c3c667b26aa7b15ab599964d4 E11C3CFC6F8BA7FE2DF3AD7F47B8E0DB3E51A89AEB208C45C03DCEE3B79DC8DC1406670360FBD1DC5CB46097CF1F66E6 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f14d909b21343d9cab5485193fa167bd3af80512cc1bac166fdbea9684 BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1868cdbabaa517f0b470c34813405e892083877ef521a6d1f6bf2018c BFB3A6E22A71EE4A9054A45587D9A1F99B7C7C107BF0491E551C676DC3D46BA1AC86B4DE3947584CAD09D15FB24FBB91 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f18516cdf3be9544a5559d3efadd760ad88ade2361a1fbcb35454eaf70 E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f1637de37973f0f7cb4c9ca2eebc559cb627176079f272626f72fc48ab E0AC82C73569C518CD008C8C2747DDDA2DC7F7B031B741B0C19634F2751DE57C064BA8C322ED95BE54196A47CCD9897B line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f184eef3dac8b422c89da5e0eafbb746d0111266eccf45344889518bec 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f10f5ac63a3a3ab8770137244c5627b3346a4f34a2e7b5365ada9ab8c0 33E5C3739641EA8B003E5C4269955FC9B57041122332361B15124611C43BC38D98DB5BFDE37523EC0955DE3C3C8CD011 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2b4b61b5a11c969e9d6dc8015ac90dd21dff00a7a88b3723405ec9f6d 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2ed4699771feefd3c969e60a3a051977784c4581a0c414211a97aad6e 1B0313AEFDA9DC38B168F2FDD5F70848B697F8F55B7DF8DBB86337CDB00B4E4FF25977AFDC1C4BD80D1584A7EA8BE04D line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f28e1f7f2a7aca2e9c71ffb47ed2d846d11d723e2b9d4a44e41c19ecd8 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2330ea5edf65f3fbfece59d5033d2915b04625ca5bb934034eaa986eb 84C3E2C97270908B22AF4A2D269F7C0A6375B184FE4B365DAFC8BA925778727A6D296F11E9B94CB9643642E65DC47E56 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f23bb1ff6b1a567cab274581ce4ae59ffe8a2e43ae2defe2afd7886633 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2968aa51a4ea28bcab908d2a0a5011eb847de99e38f014db53571e92d 83A338E2E574EDDE13CD973B3E3B53EE76FA23AE647CE607B9ED3A691EDD60FAE400B876729B99E2AABCEC188A72B960 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2888c7e15b7d5827fd75db4f7b7a1c450be4f9f14457607e1a26fce1a DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f21b0765b7ce7a5bd63502bcc79e63d2e53e6c7ba886d2a6d621b429d3 DE2F0945CEF28D0DFE5C2DEAB34255C749CBC4B11D1A224F6FE68E17F3E6116D2A636212AF715326CA7A7F96251D29D8 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f22f616d5f9ad8f48c36410b08fcf872f0c92fbe02b4c3c86a91252574 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f2d989534de7839fc5461dfb9290266a33b0f241faf93f4c984d1656a8 DBE55201D31D01F89861384343FD021C8EC979EC9B6C78C1D9798306014004E48BD984666E2B4B4D26A89DCC7931F164 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f36756c62ee64b45cf17caefd0cd105ebe825275bec27aeb520d7294c9 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f36a2e00daced950610a278df5d5cbcd232469fee9bc7a06511da65e98 938DC66DA66EF1ECEDED6495E3CBDD9963BA878C80C4A36327B52F4D8110D94C6B414C756CAB1492598AF0714877188F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f36a0b8704213d2d34b66f119345cc1d4b0b4c95a88834087a19cd83c1 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f37b6b5187ffb077f015a558da43d722e15602ae47a7fe15f05cf5450c 86C412444E5F67A3A8D978E6980B1E5C4A22D534DDFD05047BEEE36B27A9376423332611A5A7F9F609EB751BEED80C7F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f353f5a955b8e7e96e593058aa1b26905a5ce8ff6c36770eb218883539 49E10327AD96808A76FC339CFF686DB7C51DE85DD3CC81E6D9571FA3949162CADFF2FD4286473D0BB3A4CA0E3A1BDBCC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f3ea5ceb07107749af52624d674e47e964ae7e84abb14090900d9a9340 49E10327AD96808A76FC339CFF686DB7C51DE85DD3CC81E6D9571FA3949162CADFF2FD4286473D0BB3A4CA0E3A1BDBCC line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f3767d57c73b3b64df636982c2a5db197f7ea73c027eb44ae405cb7c2e 50787B46430A893B2355D92AEF474B50067D8252EC544E904DCC0375DABE46AC7597C4ECB62A877B39D5C046BCCFF5D7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f33d02713be94b005a27e8ad854db7e265e04bf49064b2d33f46f703d2 50787B46430A893B2355D92AEF474B50067D8252EC544E904DCC0375DABE46AC7597C4ECB62A877B39D5C046BCCFF5D7 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f3f85e503f39bbb60e91465b12622d25ae6d94a00983239d3f3d1334e5 230ECC7B6E87B5763BABAAF128C0BD1AA265687B7D84506D2F5F4A2BEFD4F8A085018691C9F508BD0E1AAF63685AD504 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f35bc3b625015f9e965f41c885c3ebb8fb559df8e243bc096ade437eeb 230ECC7B6E87B5763BABAAF128C0BD1AA265687B7D84506D2F5F4A2BEFD4F8A085018691C9F508BD0E1AAF63685AD504 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f44efc1d6ab6a3e340b571615b38e05ab4b2c99c1336917feb5dc45630 3BC84E249BE108C61E0E394D2AD1EC113D3CD82120977D38BE08AFDEB57166E16FC28F55BDE3A1998D58E0D579201F4F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f47edde6124f5da403a760cd35f72f8c55c629876f7d8e06298fda9d5f 3BC84E249BE108C61E0E394D2AD1EC113D3CD82120977D38BE08AFDEB57166E16FC28F55BDE3A1998D58E0D579201F4F line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f40f4cc7067b7a2e5106eda199e850e15f085a6d2d85e755e3eeb03b5e 40BF454607A5877C969E9876BEC31289EA113C0873B4A16C129B0F717C560ADCB543A40F463EC1CD623AF9847ED1504E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f4ce9233b89dd4aa176a84fb68668eafad9e37a80a0ae9c289197e5f78 40BF454607A5877C969E9876BEC31289EA113C0873B4A16C129B0F717C560ADCB543A40F463EC1CD623AF9847ED1504E line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f4380a556e401998a3ec46b991e21d18847cb4f8fa2a080a0a12025372 17568857B197E1281FFC30AD3A5B59479FEFCD3C0428830E797414F85B63CF2A3D16F6FDFA6398114E9F36453C902F03 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f4b718c208219b56be7aa274e3f1f0bb1dff87bd24a2e166de81ffb60c 17568857B197E1281FFC30AD3A5B59479FEFCD3C0428830E797414F85B63CF2A3D16F6FDFA6398114E9F36453C902F03 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f4853355635cb2ab382ec6410b620603526b93a1192f960a1bcc403e50 D6DCD0ADA9C6F7D26DDACC44ADDF480E1524A7644FE45A4A0901DD107E02C63038147C8EE151C75832839B1677083D19 line does not match client random line does not match checking keylog line: CLIENT_RANDOM 5234c2f40a09b6fcf721c30506c8d64b449b2cd47380058c5c9169899237fea3 D6DCD0ADA9C6F7D26DDACC44ADDF480E1524A7644FE45A4A0901DD107E02C63038147C8EE151C75832839B1677083D19 found master secret in key log ssl_generate_keyring_material sess key generation tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 ) tls_hash: hash secret[48]: | d6 dc d0 ad a9 c6 f7 d2 6d da cc 44 ad df 48 0e |........m..D..H.| | 15 24 a7 64 4f e4 5a 4a 09 01 dd 10 7e 02 c6 30 |.$.dO.ZJ....~..0| | 38 14 7c 8e e1 51 c7 58 32 83 9b 16 77 08 3d 19 |8.|..Q.X2...w.=.| tls_hash: hash seed[77]: | 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 c2 |key expansionR4.| | f4 85 33 55 63 5c b2 ab 38 2e c6 41 0b 62 06 03 |..3Uc\..8..A.b..| | 52 6b 93 a1 19 2f 96 0a 1b cc 40 3e 50 52 34 c2 |Rk.../....@>PR4.| | f4 0a 09 b6 fc f7 21 c3 05 06 c8 d6 4b 44 9b 2c |......!.....KD.,| | d4 73 80 05 8c 5c 91 69 89 92 37 fe a3 |.s...\.i..7.. | hash out[136]: | 95 e3 fb 9e 5b 41 40 5e d4 5b eb c3 3f 7f 68 d6 |....[A@^.[..?.h.| | 02 06 e2 6d cc 36 26 4b 38 bf fb cb 73 d6 a8 1c |...m.6&K8...s...| | 92 86 38 33 78 73 56 f0 01 19 d8 c6 62 33 e6 b5 |..83xsV.....b3..| | 1e 76 f1 86 99 90 68 3c f6 c0 f2 d7 c7 5c b0 08 |.v....h<.....\..| | 50 cb f1 af ce 35 9a 26 14 02 8f 53 a5 6a 5a d6 |P....5.&...S.jZ.| | 06 58 1f f2 5a c4 3a 99 cf 90 43 22 67 c7 aa ed |.X..Z.:...C"g...| | e3 0b 6c e1 2b 45 18 b4 a5 3a 62 b7 d8 26 b9 88 |..l.+E...:b..&..| | f6 20 d7 5d e3 fc 44 37 2f c5 95 a7 30 88 2e ae |. .]..D7/...0...| | d4 6e 3a 60 2a f1 0c c2 |.n:`*... | PRF out[136]: | 95 e3 fb 9e 5b 41 40 5e d4 5b eb c3 3f 7f 68 d6 |....[A@^.[..?.h.| | 02 06 e2 6d cc 36 26 4b 38 bf fb cb 73 d6 a8 1c |...m.6&K8...s...| | 92 86 38 33 78 73 56 f0 01 19 d8 c6 62 33 e6 b5 |..83xsV.....b3..| | 1e 76 f1 86 99 90 68 3c f6 c0 f2 d7 c7 5c b0 08 |.v....h<.....\..| | 50 cb f1 af ce 35 9a 26 14 02 8f 53 a5 6a 5a d6 |P....5.&...S.jZ.| | 06 58 1f f2 5a c4 3a 99 cf 90 43 22 67 c7 aa ed |.X..Z.:...C"g...| | e3 0b 6c e1 2b 45 18 b4 a5 3a 62 b7 d8 26 b9 88 |..l.+E...:b..&..| | f6 20 d7 5d e3 fc 44 37 2f c5 95 a7 30 88 2e ae |. .]..D7/...0...| | d4 6e 3a 60 2a f1 0c c2 |.n:`*... | key expansion[136]: | 95 e3 fb 9e 5b 41 40 5e d4 5b eb c3 3f 7f 68 d6 |....[A@^.[..?.h.| | 02 06 e2 6d cc 36 26 4b 38 bf fb cb 73 d6 a8 1c |...m.6&K8...s...| | 92 86 38 33 78 73 56 f0 01 19 d8 c6 62 33 e6 b5 |..83xsV.....b3..| | 1e 76 f1 86 99 90 68 3c f6 c0 f2 d7 c7 5c b0 08 |.v....h<.....\..| | 50 cb f1 af ce 35 9a 26 14 02 8f 53 a5 6a 5a d6 |P....5.&...S.jZ.| | 06 58 1f f2 5a c4 3a 99 cf 90 43 22 67 c7 aa ed |.X..Z.:...C"g...| | e3 0b 6c e1 2b 45 18 b4 a5 3a 62 b7 d8 26 b9 88 |..l.+E...:b..&..| | f6 20 d7 5d e3 fc 44 37 2f c5 95 a7 30 88 2e ae |. .]..D7/...0...| | d4 6e 3a 60 2a f1 0c c2 |.n:`*... | Client MAC key[20]: | 95 e3 fb 9e 5b 41 40 5e d4 5b eb c3 3f 7f 68 d6 |....[A@^.[..?.h.| | 02 06 e2 6d |...m | Server MAC key[20]: | cc 36 26 4b 38 bf fb cb 73 d6 a8 1c 92 86 38 33 |.6&K8...s.....83| | 78 73 56 f0 |xsV. | Client Write key[32]: | 01 19 d8 c6 62 33 e6 b5 1e 76 f1 86 99 90 68 3c |....b3...v....h<| | f6 c0 f2 d7 c7 5c b0 08 50 cb f1 af ce 35 9a 26 |.....\..P....5.&| Server Write key[32]: | 14 02 8f 53 a5 6a 5a d6 06 58 1f f2 5a c4 3a 99 |...S.jZ..X..Z.:.| | cf 90 43 22 67 c7 aa ed e3 0b 6c e1 2b 45 18 b4 |..C"g.....l.+E..| Client Write IV[16]: | a5 3a 62 b7 d8 26 b9 88 f6 20 d7 5d e3 fc 44 37 |.:b..&... .]..D7| Server Write IV[16]: | 2f c5 95 a7 30 88 2e ae d4 6e 3a 60 2a f1 0c c2 |/...0....n:`*...| ssl_generate_keyring_material ssl_create_decoder(client) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material ssl_create_decoder(server) ssl_create_decoder CIPHER: AES256 decoder initialized (digest len 20) ssl_generate_keyring_material: client seq 0, server seq 0 ssl_save_session stored session id[0]: ssl_save_session stored master secret[48]: | d6 dc d0 ad a9 c6 f7 d2 6d da cc 44 ad df 48 0e |........m..D..H.| | 15 24 a7 64 4f e4 5a 4a 09 01 dd 10 7e 02 c6 30 |.$.dO.ZJ....~..0| | 38 14 7c 8e e1 51 c7 58 32 83 9b 16 77 08 3d 19 |8.|..Q.X2...w.=.| dissect_ssl3_handshake session keys successfully generated record: offset = 75, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 81, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 37 f7 7f ec 82 70 b0 39 24 dd 14 e1 a5 6f 6c 5f |7....p.9$....ol_| | a9 3b 50 a8 1a 4e 1d a7 12 e5 87 ea 0e ea 4c 77 |.;P..N........Lw| | 8c 38 94 5d ef 76 b7 2b 16 bf 86 f9 b2 ce a9 9d |.8.].v.+........| | 59 30 2a d9 27 e9 44 60 c2 b6 e0 b2 ec 77 89 0d |Y0*.'.D`.....w..| Plaintext[64]: | 41 87 90 f4 3a ee 1c d7 3c b1 b5 ab 64 cd 2f f2 |A...:...<...d./.| | 14 00 00 0c a8 80 ce 35 a2 47 5c e5 28 18 52 4c |.......5.G\.(.RL| | 8b aa da 03 ec a3 c4 97 bc 95 39 9f af 20 4d 8e |..........9.. M.| | 7b 34 ae a1 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |{4..............| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 8b aa da 03 ec a3 c4 97 bc 95 39 9f af 20 4d 8e |..........9.. M.| | 7b 34 ae a1 |{4.. | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #489 (first time) conversation = 0x7fca71df1588, ssl_session = 0x7fca45c11040 record: offset = 0, reported_length_remaining = 250 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 170, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 75 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 181, reported_length_remaining = 69 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 64, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 64 Ciphertext[64]: | 52 84 7b 64 9d 92 a9 d0 e8 d7 90 a9 3d 04 00 86 |R.{d........=...| | 17 ff b9 16 d8 62 f7 67 89 76 2f 65 b4 2c c5 06 |.....b.g.v/e.,..| | 6d 0f 14 5e 90 ee 3d bd 03 26 d8 3d d8 fc d6 1b |m..^..=..&.=....| | 52 1e 85 2c 0d b5 b4 8c b7 ed d6 14 13 f8 09 ae |R..,............| Plaintext[64]: | 86 64 11 0b e4 93 04 37 b1 b8 04 c9 2a 71 85 0a |.d.....7....*q..| | 14 00 00 0c 6e 74 5f 4f 97 5e 0f c6 97 3d 59 6e |....nt_O.^...=Yn| | 7f a4 ac 84 3a b5 ff 85 9b 74 c2 22 d2 ba 89 15 |....:....t."....| | 7f a5 fa 8b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................| ssl_decrypt_record found padding 11 final len 52 checking mac (len 16, version 303, ct 22 seq 0) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 7f a4 ac 84 3a b5 ff 85 9b 74 c2 22 d2 ba 89 15 |....:....t."....| | 7f a5 fa 8b |.... | ssl_decrypt_record: mac ok dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #490 (first time) conversation = 0x7fca71df1588, ssl_session = 0x7fca45c11040 record: offset = 0, reported_length_remaining = 117 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 112, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 112 Ciphertext[112]: | 1b 54 2e 94 7c 3a 39 c5 cc 08 71 bd 10 5c c5 65 |.T..|:9...q..\.e| | e7 07 9a bb 78 41 75 22 5b fb 0b 9c 78 34 c5 38 |....xAu"[...x4.8| | 3e 98 26 45 5e a7 84 77 68 d9 59 e9 d8 88 9c 0f |>.&E^..wh.Y.....| | 29 81 eb 1b e6 41 d9 c4 73 c2 ea 54 47 a3 42 a2 |)....A..s..TG.B.| | a6 eb 7a 06 14 3f 20 4d 8f 5c 84 d4 c3 d2 ec bd |..z..? M.\......| | 8b 1d 1d 54 18 08 92 b7 94 5f 4a b8 0e 65 ec ba |...T....._J..e..| | e6 88 3a 1b bd 7d 21 6b f5 d6 3b 95 44 99 22 36 |..:..}!k..;.D."6| Plaintext[112]: | 3a 38 d8 12 09 3b cb fe 52 e7 8e 90 54 01 dd 7f |:8...;..R...T...| | 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| | 48 6f 73 74 3a 20 65 63 64 68 65 2d 72 73 61 2d |Host: ecdhe-rsa-| | 61 65 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 6c |aes256-sha.local| | 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n| | 6c 3a 34 34 39 34 0d 0a 0d 0a dd 4b ac 02 a8 9c |l:4494.....K....| | 34 4d 11 7a 66 8c ec 52 7f cc 83 9b 71 ec 01 01 |4M.zf..R....q...| ssl_decrypt_record found padding 1 final len 110 checking mac (len 74, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | ea b7 0c e5 66 5f 07 21 6b 6f 9a ba a8 73 e4 f6 |....f_.!ko...s..| | c2 ba 2f c2 |../. | ssl_decrypt_record: mac failed association_find: TCP port 41596 found (nil) association_find: TCP port 4494 found 0x3738db0 dissect_ssl enter frame #491 (first time) conversation = 0x7fca71df1588, ssl_session = 0x7fca45c11040 record: offset = 0, reported_length_remaining = 405 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 400, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 400 Ciphertext[400]: | d3 e2 2c 4f 4e f8 55 fd 7d c2 80 69 d5 d8 0a 5e |..,ON.U.}..i...^| | 2d a6 71 3c b7 f2 2a 18 d1 c0 f6 1d 5f 8f 53 75 |-.q<..*....._.Su| | 5b ce 17 1b 8b b5 38 93 90 37 57 ed fd 0d 08 50 |[.....8..7W....P| | f3 78 55 93 df 71 7c 99 26 14 41 34 81 5e 0b 89 |.xU..q|.&.A4.^..| | 4c 86 da 21 db 45 93 f5 46 66 65 12 66 42 f7 bc |L..!.E..Ffe.fB..| | 28 01 5b aa ce 53 30 6a 18 08 f1 b1 1f 1b 14 03 |(.[..S0j........| | c9 81 cc 68 ec 44 27 00 72 0f 22 b4 38 b0 07 bb |...h.D'.r.".8...| | 67 9c 79 89 aa 52 b7 2a 9c 66 a4 08 41 d1 0d 48 |g.y..R.*.f..A..H| | 96 c6 1b f2 23 0d 6a 2c 23 e0 ab 36 4c 9f 8b 61 |....#.j,#..6L..a| | 6f 6e df f1 c6 6f 0f bc 65 a0 8c e0 3c 43 7e 30 |on...o..e...docum| | 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca| | 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.| | 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 08 0f 40 24 |nl'..@$| | ba 9d c0 48 55 92 79 7d 72 93 bc de 1f 5c 3d 1c |...HU.y}r....\=.| | 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................| ssl_decrypt_record found padding 15 final len 384 checking mac (len 348, version 303, ct 23 seq 1) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 2f 85 f4 de 37 41 84 cc b2 0c 78 a6 42 94 84 4e |/...7A....x.B..N| | 2a 12 9e 61 |*..a | ssl_decrypt_record: mac failed association_find: TCP port 4494 found 0x3738db0 dissect_ssl enter frame #492 (first time) conversation = 0x7fca71df1588, ssl_session = 0x7fca45c11040 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | f2 92 b7 6b a3 30 e6 86 97 6d 2b 20 99 4a 2a 9b |...k.0...m+ .J*.| | 16 7a 92 97 fb a5 95 27 eb 1f 31 5c d7 34 00 ef |.z.....'..1\.4..| | 7a 63 f0 a4 ee e3 c6 00 96 47 75 8d 14 77 33 55 |zc.......Gu..w3U| Plaintext[48]: | 0f 07 11 2c b8 e3 ec 50 08 bd 1a b9 cf ba 7b d0 |...,...P......{.| | 01 00 58 54 2e 7a c6 33 ab a7 5b 37 09 8a 94 d0 |..XT.z.3..[7....| | cb 6f 10 3f 65 6d 09 09 09 09 09 09 09 09 09 09 |.o.?em..........| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | 58 54 2e 7a c6 33 ab a7 5b 37 09 8a 94 d0 cb 6f |XT.z.3..[7.....o| | 10 3f 65 6d |.?em | ssl_decrypt_record: mac ok dissect_ssl enter frame #494 (first time) conversation = 0x7fca71df1588, ssl_session = 0x7fca45c11040 record: offset = 0, reported_length_remaining = 53 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 48, ssl state 0x3F packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder ssl_decrypt_record ciphertext len 48 Ciphertext[48]: | ae 74 c4 5e 9b 94 79 8b 6d 4b 26 26 37 38 08 e8 |.t.^..y.mK&&78..| | cb 4a 9c 2b 93 d1 dd 00 9e e0 4c e8 46 f0 04 58 |.J.+......L.F..X| | c2 03 08 8a 81 b5 92 c8 4b c8 9f 48 68 b0 b6 35 |........K..Hh..5| Plaintext[48]: | c9 fb 6b 2b 8b a2 08 78 3d 09 57 72 d3 53 c0 72 |..k+...x=.Wr.S.r| | 01 00 f0 20 4e cb 04 0d 5e c0 6a fc c2 7f 25 0d |... N...^.j...%.| | 49 46 a8 ad dd 05 09 09 09 09 09 09 09 09 09 09 |IF..............| ssl_decrypt_record found padding 9 final len 38 checking mac (len 2, version 303, ct 21 seq 2) tls_check_mac mac type:SHA1 md 2 Mac[20]: | f0 20 4e cb 04 0d 5e c0 6a fc c2 7f 25 0d 49 46 |. N...^.j...%.IF| | a8 ad dd 05 |.... | ssl_decrypt_record: mac ok dissect_ssl enter frame #4 (already visited) conversation = 0x7fca71dec088, ssl_session = (nil) record: offset = 0, reported_length_remaining = 322 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322 dissect_ssl enter frame #6 (already visited) conversation = 0x7fca71dec088, ssl_session = (nil) record: offset = 0, reported_length_remaining = 1224 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 record: offset = 63, reported_length_remaining = 1161 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875 record: offset = 875, reported_length_remaining = 349 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 12 offset 880 length 331 bytes, remaining 1215 record: offset = 1215, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 14 offset 1220 length 0 bytes, remaining 1224 dissect_ssl enter frame #8 (already visited) conversation = 0x7fca71dec088, ssl_session = (nil) record: offset = 0, reported_length_remaining = 134 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 record: offset = 75, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec record: offset = 81, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 9 offset 86 length 8168366 bytes, remaining 134 dissect_ssl enter frame #128 (already visited) conversation = 0x7fca71ded5c8, ssl_session = (nil) record: offset = 0, reported_length_remaining = 198 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139 record: offset = 139, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec record: offset = 145, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16 dissect_ssl enter frame #9 (already visited) conversation = 0x7fca71dec088, ssl_session = (nil) record: offset = 0, reported_length_remaining = 234 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175 record: offset = 175, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl3_change_cipher_spec record: offset = 181, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 9 offset 186 length 12721791 bytes, remaining 234 dissect_ssl enter frame #10 (already visited) conversation = 0x7fca71dec088, ssl_session = (nil) record: offset = 0, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data association_find: TCP port 43113 found (nil) association_find: TCP port 4437 found 0x27eeca0 dissect_ssl enter frame #11 (already visited) conversation = 0x7fca71dec088, ssl_session = (nil) record: offset = 0, reported_length_remaining = 389 dissect_ssl3_record: content_type 23 Application Data association_find: TCP port 4437 found 0x27eeca0 dissect_ssl enter frame #12 (already visited) conversation = 0x7fca71dec088, ssl_session = (nil) record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert dissect_ssl enter frame #14 (already visited) conversation = 0x7fca71dec088, ssl_session = (nil) record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 21 Alert