Visual Learning · 04 · Live
HTTPS / TLS Handshake
ClientHello → certificate → session keys → encrypted AppData.
CYNARKS|Cyber Flow Explorer
Teaching simulation · not live capture
HTTPS / TLS Handshake
Do not intercept production TLS without authorization.
Real world · Banking apps, Learn portals, and admin desks all rely on TLS so passwords and session cookies are never cleartext on the wire.
Attack · MITM only works if the client accepts a forged cert (user click-through or compromised CA).
Defense · Valid cert chains, HSTS, and certificate pinning (where appropriate) close the MITM path.
- Control · TLS 1.2+ only; prefer TLS 1.3
- Control · HSTS + modern cipher suites
- Control · Monitor for unexpected certificate issuers
1. TCP
Browser
SNITCP
:443 up
HTTPS :443
lab.localTCP is already ESTABLISHED on port 443.
:443 up
- #1 client → server TCP :443 up
Space · ← → · R restart