Read SSL and TLS data in HTTPS traffic

Question

Is it possible to parse and store SSL and TLS data without decryption? Not the http headers which are encrypted but the data that is available without decryption? I see that Wireshark is able to present this data, but I dont know how/what approach to follow. I have successfully parsed HTTP traffic but am unable to do the same for HTTPS. The data I am talking about is the following:

Can this be achieved? I have the following code that captures traffic on port 443 and further forwards it to print the data like it does for my HTTP traffic on port 80.

payload = (u_char *)(packet + SIZE_ETHERNET + size_ip + size_tcp);
    /* Compute tcp payload (segment) size */
    size_payload = ntohs(ip->ip_len) - (size_ip + size_tcp);

            printf("%s:", inet_ntoa(ip->ip_src));
            printf("\n");
            printf("%d ", ntohs(tcp->th_sport));
            printf("\n");
            printf("%s:", inet_ntoa(ip->ip_dst));
            printf("\n");
            printf("%d ", ntohs(tcp->th_dport));
            printf("\n");


    if (ntohs(tcp->th_sport) == 443)
    {
            printf("Payload:- ");
            print_payload(payload, size_payload);
    }
    else if (ntohs(tcp->th_dport) == 443)
    {
            printf("Payload:- ");
            print_payload(payload, size_payload);
    }

The HTTP traffic prints just right, but in this case the output is all jumbled up characters.

Output:

52.114.128.9
443 
10.8.25.7
55605 
Payload:- ]4=]?).-`9)}e`B_.Zp*$'AJ}/)K.P;7%-=1dV2qN,fxU?A2{h;/TEi7("Bc`;Op<?TS8O]WhX_D]O<Zi*}aGg~`@ff)3!i[ieYm(-/JP'"+kOHNwmE 3jZBX[*y`{OR9w'!1SM

I'd be grateful if somebody could help me get through this, or atleast point me to a direction where I could work it out. Thanks in advance

Answer 1

TLS builds on TCP which provides host-to-host connectivity at the transport layer (layer 4). This means that you can always parse layer 4 and lower information (such as IP or TCP) since it is not protected by TLS at all.

Above layer 4, you can see (and parse) the unencrypted TLS handshake that initiates the encryption connection (*). Afterwards, all data above layer 4 is encrypted and you can only see what appears to be random data. Since HTTP lives above layer 4, you should never see any unencrypted HTTP traffic.

(*) TLS 1.3 encrypts part of the handshake. See this answer.