SSLSNIFF(1)

✨ SSLSNIFF(1) — the sslsniff glow-up ✨

okay bestie, sit down, we're reading the sslsniff manual page together 💖 it lives in the General Commands Manual section, and it's literally the whole vibe.

🌸 NAME 🌸

sslsniff — SSL/TLS man-in-the-middle attack tool 👑

🎀 SYNOPSIS 🎀

sslsniff [options]

🦋 DESCRIPTION 🦋

so this page is the little quick rundown of the sslsniff command, no cap.

sslsniff is built to cook up man-in-the-middle (MITM) attacks on SSL/TLS connections, and it dynamically generates certs for the domains that are being accessed on the fly ✨. Those new certificates get constructed in a certificate chain that's signed by any certificate you provide. it's giving ✨effortless✨.

and sslsniff also supports other attacks, like null-prefix or OCSP attacks, to achieve silent interceptions of connections when possible. sneaky! 💅

💜 OPTIONS 💜

👑 Modes:

• -a — Authority mode. Specify a certificate that will act as a CA.
• -t — Targeted mode. Specify a directory full of certificates to target.

🫶 Required options:

• -c <file|directory> — File containing CA cert/key (authority mode) or directory containing a collection of certs/keys (targeted mode)
• -s <port> — Port to listen on for SSL interception.
• -w <file> — File to log to

🍓 Optional options:

• -u <updateLocation> — Location of any Firefox XML update files.
• -m <certificateChain> — Location of any intermediary certificates.
• -h <port> — Port to listen on for HTTP interception (required for fingerprinting).
• -f <ff,ie,safari,opera> — Only intercept requests from the specified browser(s).
• -d — Deny OCSP requests for our certificates.
• -p — Only log HTTP POSTs
• -e <url> — Intercept Mozilla Addon Updates
• -j <sha256> — The sha256sum value of the addon to inject

⭐ NOTES ⭐

heads up bestie: sslsniff works only on the FORWARD traffic (not on INPUT or OUTPUT). that's the rule, periodt.

🌈 EXAMPLES 🌈

so say you wanna intercept traffic on port 8443 — first, start sslsniff on a local port:

sslsniff -a -c /usr/share/sslsniff/certs/wildcard -s 4433 -w /tmp/sslsniff.log

and then redirect traffic to this port using the iptables nat table:

iptables -t nat -A PREROUTING -p tcp --destination-port 8443 -j REDIRECT --to-ports 4433

like, that's it. slay. 🔥

💖 AUTHOR 💖

sslsniff was written by Moxie Marlinspike.

This manual page was written by Pierre Chifflier <pollux@debian.org>, for the Debian project (and may be used by others).

mwah 💋 that's the whole page, bestie — and for the receipts: this came from the Debian sslsniff package, and the source date on it is August 16, 2009, filed under SSLSNIFF(1). iconic behavior honestly. go forth and read your man pages, ily 🫶✨