sslsniff(8)

✨ sslsniff(8) · System Manager's Manual ✨

💖 NAME

okay so sslsniff is the tool that prints data passed to OpenSSL, GnuTLS or NSS 🔍 and it runs on Linux eBPF/bcc 🧚

🎀 SYNOPSIS

sslsniff [-h] [-p PID] [-u UID] [-x] [-c COMM] [-o] [-g] [-n] [-d]
[--hexdump] [--max-buffer-size SIZE] [-l] [--handshake] [--extra-lib
EXTRA_LIB]

🦋 DESCRIPTION

bestie, this one is iconic 💅 sslsniff prints the data that gets sent through the write/send and read/recv functions of OpenSSL, GnuTLS and NSS. That means you can see the plain text before it gets encrypted (when writing) and after it gets decrypted (when reading) 👀✨

It works by reading the second parameter of both functions, which is *buf. 🫶

⚠️ Since this uses BPF, only the root user can run this tool. No exceptions, sorry babe 💀

🌸 REQUIREMENTS

You need CONFIG_BPF and bcc 🔧

💜 OPTIONS

• -h — the vibe check option 🙈 prints the usage message
• -p PID — only traces functions inside this process PID 🎯
• -u UID — only shows calls made by this UID 👑
• -x — shows the extra fields: UID and TID ✨
• -c COMM — only shows processes whose COMM matches exactly, no fuzzy stuff 🍓
• -o, --no-openssl — skips tracing OpenSSL functions 🙅‍♀️
• -g, --no-gnutls — skips tracing GnuTLS functions 🙅‍♀️
• -n, --no-nss — also skips tracing GnuTLS functions 🤔

🙈 Heads up: the original page says -n/--no-nss skips GnuTLS functions, which looks like a typo since NSS is the library it's named after. I'm just passing along what the page says, so double-check before you rely on it.

• --hexdump — shows the data as a hexdump instead of trying to decode it as UTF-8 🧾
• --max-buffer-size SIZE — sets the max buffer size for intercepted data. Anything longer gets truncated ✂️ The default is 8 Kib, and the max possible value is a bit less than 32 Kib 📏
• -l, --latency — shows function latency in ms ⏱️
• --handshake — shows handshake latency, but it only works if the latency option is on 🤝
• --extra-lib EXTRA_LIB — the library type and the library path, separated by a colon 🧩 Supported library types are openssl, gnutls and nss. You can use this more than once, so go wild 🌈

🧚 EXAMPLES

Print all calls to SSL write/send and read/recv system-wide:

# sslsniff

Print only OpenSSL calls issued by user with UID 1000:

# sslsniff -u 1000 --no-nss --no-gnutls

Print SSL handshake event and latency for all traced functions:

# sslsniff -l --handshake

Print only calls to OpenSSL from /some/path/libssl.so:

sslsniff --no-openssl --no-gnutls --no-nss --extra-lib
openssl:/some/path/libssl.so

🔍 FIELDS

• FUNC — which function is being called (write/send or read/recv) 📤📥
• TIME — the time of the command, in seconds ⏰
• COMM — the entered command 💬
• PID — the process ID calling SSL 🆔
• LEN — bytes written or read by SSL functions 📦
• UID — the UID of the process, only shown if you launch with -x 👑
• TID — the thread ID, only shown if you launch with -x 🧵
• LAT(ms) — function latency in ms 💨

🌈 SOURCE

This comes from bcc, bestie 🫶

https://github.com/iovisor/bcc

Also check the bcc distribution for a companion _examples.txt file. It has example usage, output and commentary for this tool 📚

🖥️ OS

Linux 🐧

🧪 STABILITY

Unstable, it's still in development 🚧

👩‍💻 AUTHORS

Adrian Lopez and Mark Drayton 🌟

🔗 SEE ALSO

trace(8) 🦋

---

Okay that's the whole tea 🫖 This page came from bcc, dated 2016-08-16, in the USER COMMANDS section. Go forth and sniff responsibly, bestie 💖🧚✨