Search code examples
httpswiresharkpacket-sniffers

How do I sniff website url in a https packet request in wireshark?


I am able to sniff http packets and extract the website from there. But I am unable to sniff websites that use https. I only want the website to know what websites people are accessing. I have access to the router thus I can sniff all packets in the network. Is this possible?


Solution

  • It's impossible to get full url from HTTPS connection, since it's encrypted, but getting domain name is possible. In order to visit any website, PC must know its IP address, so it performs DNS lookup using site domain name, unless IP address is cached or stored locally in hosts file.

    So you can apply dns display filter and get domain names requested by PC thus getting list of domains for visited sites. Wireshark should be able to automatically show domain name instead of IP addresses for traces with DNS traffic, check resolve network addresses option.

    If DNS packets aren't presented, you can try getting domain name of site by using its address in reverse DNS lookup request.