Unit 6: HTTP and TLS on the wire · Lesson 2 of 5 · 20 min
The TLS handshake
Take three TLS handshakes apart and find the internal server still negotiating TLS 1.0.
mission
- You are
- The analyst preparing for an audit.
- Situation
- The auditors will ask whether any internal service still uses old TLS. You have a capture of three HTTPS sessions in tls.pcap.
- Goal
- Read each handshake, note the version and cipher suite the server picked, and flag anything outdated.
- Hand in
- The server name using old TLS and the suite it chose.
The handshake as an armoured courier
List the handshakes
Client Hello and Server Hello are the two messages you can always read. tshark adds the server name to the summary line.
tshark -r tls.pcap -Y 'tls.handshake.type==1 || tls.handshake.type==2'
4 0.002800 10.10.0.23 → 10.20.0.40 TLSv1 151 Client Hello (SNI=intranet.corp.example)
6 0.005200 10.20.0.40 → 10.10.0.23 TLSv1.3 1454 Server Hello
22 2.502800 10.10.0.31 → 10.20.0.70 TLSv1 145 Client Hello (SNI=hr.corp.example)
24 2.505200 10.20.0.70 → 10.10.0.31 TLSv1 1454 Server Hello
39 5.102800 10.10.0.23 → 198.51.100.20 TLSv1 145 Client Hello (SNI=www.example.com)
41 5.105200 198.51.100.20 → 10.10.0.23 TLSv1.3 1454 Server Hello
you should see Client Hellos always show as TLSv1 because of a compatibility field. The Server Hello is the one that counts.
Read what the client offered
The Client Hello lists the versions and suites the client will accept, and the server name it wants.
tshark -r tls.pcap -Y 'tls.handshake.type==1' -V | grep -E 'Server Name:|Supported Version:|Cipher Suites \(' | head -n 4
Cipher Suites (4 suites)
Server Name: intranet.corp.example
Supported Version: TLS 1.3 (0x0304)
Supported Version: TLS 1.2 (0x0303)
you should see Every client offered TLS 1.3 and 1.2.
Read what each server picked
In TLS 1.3 the real version is in the supported_version extension; older servers only fill in the version field.
tshark -r tls.pcap -Y 'tls.handshake.type==2' -T fields -e ip.src -e tls.handshake.version -e tls.handshake.extensions.supported_version -e tls.handshake.ciphersuite
10.20.0.40 0x0303 0x0304 0x1301
10.20.0.70 0x0301 0x002f
198.51.100.20 0x0303 0x0304 0x1301
you should see 10.20.0.70 picked 0x0301, TLS 1.0, with suite 0x002f.
Name the suite
-V turns the hex into a name you can put in the audit report.
tshark -r tls.pcap -Y 'tls.handshake.type==2 && ip.src==10.20.0.70' -V | grep -E 'Version: TLS|Cipher Suite:' | sort -u
Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f)
Version: TLS 1.0 (0x0301)
Version: TLS 1.0 (0x0301)
you should see TLS 1.0 with RSA key exchange and CBC: no forward secrecy and long deprecated.
defender tip The client offered 1.3 and the server still chose 1.0. The fix is on the server, so an audit finding names the server, not the users.
hr01's TLS settings
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers AES128-SHA:...;
Accepts protocols retired in 2021.
ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE+AESGCM:ECDHE+CHACHA20;
Modern versions and suites with forward secrecy.
What a defender takes away
- 1The Server Hello tells you what was actually negotiated.
- 2TLS 1.0 and 1.1 are retired. Flag any server that still picks them.
- 3Handshakes are readable in every capture, so this check needs no keys.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.