About

capture SSL/TLS text content without a CA certificate using eBPF.
Supports Linux/Android kernel versions x86_64 4.18 and above, aarch64 5.5 and above. Need ROOT permission. Does not support Windows and macOS system.

Introduction

• SSL/TLS plaintext capture, support openssl\libressl\boringssl\gnutls\nspr(nss) libraries.
• GoTLS plaintext support go tls library, which refers to encrypted communication in https/tls programs written in the golang language.
• Bash audit, capture bash command for Host Security Audit.
• Zsh audit, capture zsh command for Host Security Audit.
• MySQL query SQL audit, support mysqld 5.6\5.7\8.0, and MariaDB.

Modules

The eCapture tool comprises 8 modules that respectively support plaintext capture for TLS/SSL encryption libraries like OpenSSL, GnuTLS, NSPR, BoringSSL, and GoTLS. Additionally, it facilitates software audits for Bash, MySQL, and PostgreSQL applications.

• bash capture bash command
• zsh capture zsh command
• gnutls capture gnutls text content without CA cert for gnutls libraries.
• gotls Capturing plaintext communication from Golang programs encrypted with TLS/HTTPS.
• mysqld capture sql queries from mysqld 5.6/5.7/8.0 .
• nss capture nss/nspr encrypted text content without CA cert for nss/nspr libraries.
• postgres capture sql queries from postgres 10+.
• tls use to capture tls/ssl text content without CA cert. (Support openssl 1.0.x/1.1.x/3.0.x or newer). You can use ecapture -h to view the list of subcommands.

OpenSSL Module

eCapture search /etc/ld.so.conf file default, to search load directories of SO file, and search openssl shard libraries location. or you can use --libssl flag to set shard library path.

If target program is compile statically, you can set program path as --libssl flag value directly。

The OpenSSL module supports three capture modes:

• pcap/pcapng mode stores captured plaintext data in pcap-NG format.
• keylog/key mode saves the TLS handshake keys to a file.
• text mode directly captures plaintext data, either outputting to a specified file or printing to the command line.

Pcap Mode

Supported TLS encrypted http 1.0/1.1/2.0 over TCP, and http3 QUIC protocol over UDP. You can specify -m pcap or -m pcapng and use it in conjunction with --pcapfile and -i parameters. The default value for --pcapfile is ecapture_openssl.pcapng.