News for hackers. Stuff that matters.

A comment on Capturing Linux SSL/TLS plaintext without a CA certificate using eBPF.

Re:Capturing Linux SSL/TLS plaintext without a CA certificat... by ranger_danger on Friday July 12, 2024 @12:51AM (#40942791)
Similar tools already available in many distros:

https://github.com/bpftrace/bpftrace/blob/master/tools/sslsn...

https://github.com/iovisor/bcc/blob/master/tools/sslsniff.py

https://embracethered.com/blog/posts/2021/offensive-bpf-snif...

On Ubuntu for example I can just "sudo apt install bpfcc-tools", then run "sudo sslsniff-bpfcc" and see curl TLS traffic right away.

[ Parent | on HN ]
Re:Capturing Linux SSL/TLS plaintext without a CA certificat... by _3u10 on Friday July 12, 2024 @01:31AM (#40942921)
Yes, but most of them don't output pcap. Its just sort of every bit of decrypted data. Sure it works well for curl, but for nginx, or multiple connections, not so much.
[ Parent | on HN ]
Re:Capturing Linux SSL/TLS plaintext without a CA certificat... by danobi on Friday July 12, 2024 @03:18AM (#40943344)
bpftrace has support for outputting pcap files now.
[ Parent | on HN ]