bcc-sslsniff - Man Page

Print data passed to OpenSSL, GnuTLS or NSS. Uses Linux eBPF/bcc.

Synopsis

sslsniff [-h] [-p PID] [-u UID] [-x] [-c COMM] [-o] [-g] [-n] [-d] [--hexdump] [--max-buffer-size SIZE] [-l] [--handshake] [--extra-lib EXTRA_LIB]

sslsniff prints data sent to write/send and read/recv functions of OpenSSL, GnuTLS and NSS, allowing us to read plain text content before encryption (when writing) and after decryption (when reading).

This works reading the second parameter of both functions (*buf).

Since this uses BPF, only the root user can use this tool.

Requirements

CONFIG_BPF and bcc.

Options

-h: Print usage message.
-p PID: Trace only functions in this process PID.
-u UID: Trace only calls made by this UID.
-x: Show extra fields: UID and TID.
-c COMM: Show only processes that match this COMM exactly.
-o, --no-openssl: Do not trace OpenSSL functions.
-g, --no-gnutls: Do not trace GnuTLS functions.
-n, --no-nss: Do not trace GnuTLS functions.
--hexdump: Show data as hexdump instead of trying to decode it as UTF-8
--max-buffer-size SIZE: Sets maximum buffer size of intercepted data. Longer values would be truncated. Default value is 8 Kib, maximum possible value is a bit less than 32 Kib.
-l, --latency: Show function latency in ms.
--handshake: Show handshake latency, enabled only if latency option is on.
--extra-lib EXTRA_LIB: Consist type of the library and library path separated by colon. Supported library types are: openssl, gnutls, nss. Can be specified multiple times.

Examples

Print all calls to SSL write/send and read/recv system-wide:: # sslsniff
Print only OpenSSL calls issued by user with UID 1000: # sslsniff -u 1000 --no-nss --no-gnutls
Print SSL handshake event and latency for all traced functions:: # sslsniff -l --handshake
Print only calls to OpenSSL from /some/path/libssl.so: sslsniff --no-openssl --no-gnutls --no-nss --extra-lib openssl:/some/path/libssl.so