Take the 2-minute tour ×

I am trying to reverse engineer a script so I can submit a form using Mechanize. The form is using some weird Javascript form upload script that I just can't seem to understand. So I was thinking I would sniff the traffic going from my browser to the server.

First of all, is this even possible? If so, what would be a good way to do it? I have tried Wireshark with the filter 'http.request.method == "POST"', but it doesn't seem to work.

share|improve this question

6 Answers 6

up vote 3 down vote accepted

I use the HTTP Live Headers Plugin for Firefox. This is a sample capture from HTTP Live Headers

POST /Login HTTP/1.1
Host: signup.netflix.com
Accept-Encoding: gzip,deflate
Keep-Alive: 115
Connection: keep-alive
Referer: https://signup.netflix.com/Login?country=1&rdirfdc=true
--->Insert lots of private stuff here
Content-Length: 168
share|improve this answer

All HTTP traffic using HTTPS over TLS is encrypted, POST parameters included. You will need to configure Wireshark especially for this: http://wiki.wireshark.org/SSL and it is not likely that you will have access to the keys necessary to decrypt the traffic unless you own the HTTPS server.

share|improve this answer

You won't be able to get the request data using Wireshark. That's the point of HTTPS.

You should be able to use the Firebug extension for Firefox to monitor the requests your browser makes. It shows request and response headers, as well as form data.


share|improve this answer

http://www.fiddler2.com will allow you to see the unencrypted traffic. Or you can use the F12 Developer Tools built into IE9.

share|improve this answer
+1 for Fiddler, but it looks like overkill for his requirements. –  Mike Pennington Apr 29 '11 at 3:26

You can sniff SSL traffic, but it will be quite the trick to figure out what data is in it. You would probably have better luck posting the java script and asking a specific question about it... i.e. the part you don't understand.

If you're trying to do something unethical, it's probably best that you just let it go.

share|improve this answer
The only thing unethical is the company that I am trying to sniff. FFFFFUUUUUU Steve Jobs. –  dan-klasson Apr 30 '11 at 3:36
Hahaha - more power to you. –  Mikecito Apr 30 '11 at 5:04

I use Firefug to analyze requests.

Sometimes i need to sniff https traffic, and i do it with Charles Proxy firefox plugin.

share|improve this answer

Your Answer


