SSL Packet Capture using Wireshark

After installing wireshark in your computer, capture the SSL packets and answer the following questions.

1. For each of the first 8 Ethernet frames, specify the source of the frame (client or server),determine the number of SSL records that are included in the frame, and list the SSL record types that are included in the frame. Draw a timing diagram between client and server, with one arrow for each SSL record.


Answer:

Total number of records =11

 2. Each of the SSL records begins with the same three fields (with possibly different values).One of these fields is “content type” and has length of one byte. List all three fields and their lengths.

Answer:

 Content type : 1 byte
 version : 2byte
 Length : 2byte

3. Expand the ClientHello record. (If your trace contains multiple ClientHello records, expand the frame that contains the first one.) What is the value of the content type?



 Answer:

The value of content type is Handshake(22)

4. Does the ClientHello record advertise the cipher suites it supports? If so, in the first listed suite, what are the public-key algorithm, the symmetric-key algorithm, and the hash algorithm?










Answer:

The client advertise the cipher suites with ECDHE(Elliptic curve Diffe-Hellman) and ECDSA (Elliptic curve Digitial Signature Algorithm) as public key algorithm ,AES as symmetric algorithm and SHA1 as hash algorithm

5. Look to the ServerHello packet. What cipher suite does it choose?

Answer :

Cipher Suite: TLS_RSA_WITH_RC4_128_SHA (0x0005)
RSA with SHA is used.

6. Does this record include a nonce? If so, how long is it? What is the purpose of the client and server nonces in SSL?






Answer:

This record includes a nonce under Random. The length of nonce is 28 bytes . The purpose is to prevent a replay attack.

7 .Does this record include a session ID? What is the purpose of the session ID?

Answer:

The record includes a session ID. It provides a unique persistent identifier for the SSL session which is sent in the clear. The client may resume the same session later by using the server provided session ID when it sends the ClientHello.

8. How many frames does the SSL certificate take to send?

Answer: 

SSL certificate takes 2 frames.

    

What is SSL and How to setup a https in Apache2 webserver

What is SSL?

Secure Socket Layer(SSL) is an encryption technology that was created by Netscape. SSL creates an encrypted connection between the web browser and the web server. This helps is transmitting private information like credit card numbers,passwords etc through a secure channel without the problem of eavesdropping,message tampering etc. 

To enable SSL on the webserver we need to get a SSL certificate that identifies the website. If the web server is SSL enabled ,we can access the webserver using https instead of http .Accessing websites with SSL certificate ensures that out data is encrypted and cannot be tampered by a third person.

How SSL works ?

Suppose a webserver wants to enable SSL then

1.The webserver produces a public and private key

2.The webserver contacts a trusted thrid party. This trusted third party checks whether the website(websever) is valid or not.

3.If it is valid then the trusted third party will give an SSL certificate.

Suppose a client wants to establish a SSL connection with the server

1.The client connects to the SSL port of the company.

2.The webserver then sends the certificate to the client and the client verifies it.Verification is as follows. The client has the public key of the trusted third party.It  verifies the certificate of the server with the public key which the client has.

3. If the certificate is valid then the client choose an SSL cipher to use from the list of encryption methods provided by the server and generates a symmetric key.

4.The symmetric key is then send to the server by encrypting it with the public key of the server.

5.The server decrypts the symmetric key using its private key.

6.Further communication between the client and server happens through the symmetric key.

Setting up a https in Apache2 webserver in ubuntu 12.04(self signed certificate)

1.Create a self signed certificate

  sudo make-ssl-cert generate-default-snakeoil-force-overwrite

2. next we need to activate ssl module

   sudo a2enmod ssl

3.Next we need to activate default ssl virtual host

sudo a2ensite default-ssl

4.restart apache 

sudo /etc/init.d/apache2 restart

if you encounter this error 

Could not reliably determine the server's fully qualified domain name, using 127.0.1.1 for ServerName

Then enter the following

sudo sh -c 'echo "ServerName localhost" >> /etc/apache2/conf.d/name' && sudo service apache2 restart

Open Browser then in address bar type "https://locahost/".In the address bar you can see a lock symbol in firefox or a cross symbol above the lock in google chrome