CaptureSetup/ETW/HTTPS

Using Wireshark's etwdump, you can capture decrypted client HTTPS traffic on Windows by tapping into the ETW logs. These logs are internal Windows traces that enable capturing traffic before HTTPS encryption.

There are multiple HTTP libraries on Windows, the main two ones are:

Services usually use WinHTTP while applications use WinInet, but that's not a hard rule. For instance, Windows Update uses WinHTTP, the Windows Store uses WinInet, but winget uses WinHTTP too.

Capture WinInet traffic

  1. You need Wireshark 4.7.3 or greater
  2. Open wireshark as Administrator
  3. Select etwdump in the interface list (if it doesn't appear, make sure you selected 'etwdump' during install)
  4. Click on 'Add' to add a provider and select "Wininet pre-encryption", then start the capture

wininet

Demo

Capture WinHTTP traffic

  1. You need Wireshark 4.7.3 or greater
  2. Open wireshark as Administrator
  3. Select etwdump in the interface list (if it doesn't appear, make sure you selected 'etwdump' during install)
  4. Click on 'Add' to add a provider and select "WebIO (WinHTTP)", then start the capture

winhttp

See also