sslsnoop is a program that intercepts SSL content using eBPF to trace SSL libraries. It can be used to monitor SSL traffic of a specific process or all processes on the system.
- Support OpenSSL
- Support GNUTLS
- Handle statically linked libraries
- Filter by PID
- Filter by process name
Using eBPF uprobes, sslsnoop can intercept SSL content before it is encrypted and sent or after it is received and decrypted. For example by attaching to the SSL_write function of OpenSSL, sslsnoop can access data before it is encrypted and sent.
git clone https://github.com/sebastienwae/sslsnoop.git
cd sslsnoop
cargo build --releasesudo ./target/release/sslsnoop