通过Wireshark分析HTTPS(1)

- 日理万妓 2022-12-19 06:24 153阅读 0赞

在[HTTPS系列之密码学基础–证书及签名][HTTPS] 中对证书以及签名进行了介绍。本为基于此介绍https的建立过程。

### Wireshark ###

#### 过滤器 ####

捕捉过滤器（CaptureFilters）：**用于决定将什么样的信息记录在捕捉结果中**。  
显示过滤器（DisplayFilters）：**用于在捕捉结果中进行详细查找**。

捕捉过滤器在抓抱前进行设置，决定抓取怎样的数据；显示过滤器用于过滤抓包数据，方便stream的追踪和排查。

捕捉过滤器仅支持协议过滤，显示过滤器既支持协议过滤也支持内容过滤。

#### 语法 ####

##### 捕捉过滤器 #####

![在这里插入图片描述][20201107234941119.png_pic_center]捕捉IP为10.4.1.12或者源IP位于网络10.6.0.0/16，目的IP的TCP端口号在200至10000之间，并且目的IP位于网络 10.0.0.0/8内的所有封包。  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ_size_16_color_FFFFFF_t_70_pic_center]

##### 显示过滤器 #####

###### 协议过滤 ######

![在这里插入图片描述][20201107235222743.png_pic_center]过滤http2协议: `http2`  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ_size_16_color_FFFFFF_t_70_pic_center 1]

###### 内容过滤 ######

![在这里插入图片描述][20201107235309187.png_pic_center]过滤get请求：`tcp[20:3] == 47:45:54`(16进制形式，tcp头部一般是20字节，所以这个是对**payload的前三个字节进行过滤**)  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ_size_16_color_FFFFFF_t_70_pic_center 2]

### 分析一次https连接 ###

还是这篇文章https://www.bilibili.com/read/cv7495834  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ_size_16_color_FFFFFF_t_70_pic_center 3]  
通过wireshark分析其中的一次https连接，过滤规则是`ip.addr == 27.115.124.159`  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ_size_16_color_FFFFFF_t_70_pic_center 4]

#### 三次握手 ####

(1)客户端发起SYN请求 seq = 0  
(2)服务器端进行确认 Ack=1 向客户端发起连接请求 seq = 0  
(3)客户端进行确认Ack = 1 **经典的三次握手**

#### Client Hello ####

(4)客户端发送client hello  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ_size_16_color_FFFFFF_t_70_pic_center 5]  
(5)服务器端进行确认ACK

#### Server Hello ####

(6)服务器端发送Server Hello，生成一个随机数  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ_size_16_color_FFFFFF_t_70_pic_center 6]  
(7)客户端进行确认Ack = 1411 Seq = 518  
(8)服务器端进行确认  
(9)客户端进行确认

#### Server Certificates ####

(10)服务器端发送证书Certificate  
(11)客户端进行确认

#### Server Hello Done ####

(12)服务器密钥交换 Server Key Exchange Server Hello Done

(13)客户端进行确认

#### ClientKey Exchange Message ####

(14)客户端进行密钥交换 Change Ciper Spec  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ_size_16_color_FFFFFF_t_70_pic_center 7]

#### CiperSpec Exchage ####

(15)服务器端给出session ticket  
(16)客户端进行确认  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ_size_16_color_FFFFFF_t_70_pic_center 8]

#### http请求 ####

(17)http get请求GET /so/zz.gif?url=https%3A%2F%2Fwww.bilibili.com%2Fread%2Fcv7495834&sid=e6352779c080ceddc1bc4c6bbe047b69&token=e46338552974779vcc0/8d0aceerd/dm HTTP/1.1\\r\\n  
(18)服务器端进行响应 200  
(19)客户端进行确认

#### 断开链接 ####

(20)服务器端 Close Notify  
(21)客户端进行确认  
(22)服务器发起FIN请求 冰对客户端进行确认  
(23)客户端进行确认  
(24)释放连接

https的连接建立过程可参见下图：  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ_size_16_color_FFFFFF_t_70_pic_center 9]

### 写在最后 ###

一次简单的https请求竟然有如此复杂的流程，而这一切对用户是透明的，向http设计者致敬。更对https的内容，欢迎关注我的微信公众号。  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ_size_16_color_FFFFFF_t_70_pic_center 10]

[HTTPS]: https://mp.weixin.qq.com/s?__biz=MzI1NjEyMzgxMw==&mid=2247484593&idx=1&sn=38a908c0263daef5ed8a3ea015afc971&chksm=ea2a327bdd5dbb6d6a568870baa7f0176ae96a7784654edf82c792939c9f00ee7116d647b957&token=2123270124&lang=zh_CN#rd
[20201107234941119.png_pic_center]: /images/20221120/2c72ee844e964004bf2960cfd2c83dd3.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ_size_16_color_FFFFFF_t_70_pic_center]: /images/20221120/c0eb49ba82c44ca898ee2ec3e2937ac8.png
[20201107235222743.png_pic_center]: https://img-blog.csdnimg.cn/20201107235222743.png#pic_center
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ_size_16_color_FFFFFF_t_70_pic_center 1]: https://img-blog.csdnimg.cn/20201108000125135.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ==,size_16,color_FFFFFF,t_70#pic_center
[20201107235309187.png_pic_center]: https://img-blog.csdnimg.cn/20201107235309187.png#pic_center
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ_size_16_color_FFFFFF_t_70_pic_center 2]: https://img-blog.csdnimg.cn/2020110723582468.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ==,size_16,color_FFFFFF,t_70#pic_center
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ_size_16_color_FFFFFF_t_70_pic_center 3]: https://img-blog.csdnimg.cn/20201105224503932.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ==,size_16,color_FFFFFF,t_70#pic_center
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ_size_16_color_FFFFFF_t_70_pic_center 4]: https://img-blog.csdnimg.cn/20201105224203193.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ==,size_16,color_FFFFFF,t_70#pic_center
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ_size_16_color_FFFFFF_t_70_pic_center 5]: https://img-blog.csdnimg.cn/20201107232245961.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ==,size_16,color_FFFFFF,t_70#pic_center
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ_size_16_color_FFFFFF_t_70_pic_center 6]: https://img-blog.csdnimg.cn/20201105230441913.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ==,size_16,color_FFFFFF,t_70#pic_center
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ_size_16_color_FFFFFF_t_70_pic_center 7]: https://img-blog.csdnimg.cn/20201107233333223.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ==,size_16,color_FFFFFF,t_70#pic_center
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ_size_16_color_FFFFFF_t_70_pic_center 8]: https://img-blog.csdnimg.cn/20201108092326344.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ==,size_16,color_FFFFFF,t_70#pic_center
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ_size_16_color_FFFFFF_t_70_pic_center 9]: https://img-blog.csdnimg.cn/20201107231607410.jpg?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ==,size_16,color_FFFFFF,t_70#pic_center
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ_size_16_color_FFFFFF_t_70_pic_center 10]: https://img-blog.csdnimg.cn/20201108000512496.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlbGxvd29ybGRkbQ==,size_16,color_FFFFFF,t_70#pic_center