214 lines
6.7 KiB
Plaintext
214 lines
6.7 KiB
Plaintext
Demonstrations of sslsniff.py
|
|
|
|
|
|
This tool traces the write/send and read/recv functions of OpenSSL,
|
|
GnuTLS and NSS. Data passed to this functions is printed as plain
|
|
text. Useful, for example, to sniff HTTP before encrypted with SSL.
|
|
|
|
|
|
Output of tool executing in other shell "curl https://example.com"
|
|
|
|
% sudo python sslsniff.py
|
|
FUNC TIME(s) COMM PID LEN
|
|
WRITE/SEND 0.000000000 curl 12915 75
|
|
----- DATA -----
|
|
GET / HTTP/1.1
|
|
Host: example.com
|
|
User-Agent: curl/7.50.1
|
|
Accept: */*
|
|
|
|
|
|
----- END DATA -----
|
|
|
|
READ/RECV 0.127144585 curl 12915 333
|
|
----- DATA -----
|
|
HTTP/1.1 200 OK
|
|
Cache-Control: max-age=604800
|
|
Content-Type: text/html
|
|
Date: Tue, 16 Aug 2016 15:42:12 GMT
|
|
Etag: "359670651+gzip+ident"
|
|
Expires: Tue, 23 Aug 2016 15:42:12 GMT
|
|
Last-Modified: Fri, 09 Aug 2013 23:54:35 GMT
|
|
Server: ECS (iad/18CB)
|
|
Vary: Accept-Encoding
|
|
X-Cache: HIT
|
|
x-ec-custom-error: 1
|
|
Content-Length: 1270
|
|
|
|
|
|
----- END DATA -----
|
|
|
|
READ/RECV 0.129967972 curl 12915 1270
|
|
----- DATA -----
|
|
<!doctype html>
|
|
<html>
|
|
<head>
|
|
<title>Example Domain</title>
|
|
|
|
<meta charset="utf-8" />
|
|
<meta http-equiv="Content-type" content="text/html; charset=utf-8" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
|
<style type="text/css">
|
|
body {
|
|
background-color: #f0f0f2;
|
|
margin: 0;
|
|
padding: 0;
|
|
font-family: "Open Sans", "Helvetica Neue", Helvetica, Arial, sans-serif;
|
|
|
|
}
|
|
div {
|
|
w
|
|
----- END DATA (TRUNCATED, 798 bytes lost) -----
|
|
|
|
Using the --hexdump option you will get the exact same output, only the lines
|
|
between DATA and END DATA will differ. Those will be replaced with a 16 byte
|
|
(32 characters) wide hex-dump, an example of a block of output from sslsniff
|
|
called with that option is
|
|
|
|
READ/RECV 7.405609173 curl 201942 1256
|
|
----- DATA -----
|
|
3c21646f63747970652068746d6c3e0a
|
|
3c68746d6c3e0a3c686561643e0a2020
|
|
20203c7469746c653e4578616d706c65
|
|
20446f6d61696e3c2f7469746c653e0a
|
|
0a202020203c6d657461206368617273
|
|
65743d227574662d3822202f3e0a2020
|
|
20203c6d65746120687474702d657175
|
|
69763d22436f6e74656e742d74797065
|
|
2220636f6e74656e743d22746578742f
|
|
68746d6c3b20636861727365743d7574
|
|
662d3822202f3e0a202020203c6d6574
|
|
61206e616d653d2276696577706f7274
|
|
2220636f6e74656e743d227769647468
|
|
3d6465766963652d77696474682c2069
|
|
6e697469616c2d7363616c653d312220
|
|
2f3e0a202020203c7374796c65207479
|
|
70653d22746578742f637373223e0a20
|
|
202020626f6479207b0a202020202020
|
|
20206261636b67726f756e642d636f6c
|
|
6f723a20236630663066323b0a202020
|
|
20202020206d617267696e3a20303b0a
|
|
202020202020202070616464696e673a
|
|
20303b0a2020202020202020666f6e74
|
|
2d66616d696c793a202d6170706c652d
|
|
73797374656d2c2073797374656d2d75
|
|
692c20426c696e6b4d61635379737465
|
|
6d466f6e742c20225365676f65205549
|
|
222c20224f70656e2053616e73222c20
|
|
2248656c766574696361204e65756522
|
|
----- END DATA (TRUNCATED, 792 bytes lost) -----
|
|
|
|
This is useful to sniff binary protocols where the UTF-8 decode might insert a
|
|
lot of characters that are not printable or even Unicode replacement
|
|
characters.
|
|
|
|
|
|
Use -l or --latency option to show function latency, and show handshake latency
|
|
by using both -l and --handshake. This is useful for SSL/TLS performance
|
|
analysis. Tracing output of "echo | openssl s_client -connect example.com:443":
|
|
|
|
# ./sslsniff.py -l --handshake
|
|
FUNC TIME(s) COMM PID LEN LAT(ms)
|
|
WRITE/SEND 0.000000000 openssl 10377 1 0.005
|
|
----- DATA -----
|
|
|
|
|
|
----- END DATA -----
|
|
|
|
Trace localhost server instead of example.com. It takes 0.7ms for server
|
|
handshake before secure connection is ready for initial SSL_read or SSL_write.
|
|
|
|
# ./sslsniff.py -l --handshake
|
|
FUNC TIME(s) COMM PID LEN LAT(ms)
|
|
HANDSHAKE 0.000000000 nginx 7081 1 0.699
|
|
WRITE/SEND 0.000132180 openssl 14800 1 0.010
|
|
----- DATA -----
|
|
|
|
|
|
----- END DATA -----
|
|
|
|
READ/RECV 0.000136583 nginx 7081 1 0.004
|
|
----- DATA -----
|
|
|
|
|
|
----- END DATA -----
|
|
|
|
Tracing output of "echo | gnutls-cli -p 443 example.com":
|
|
|
|
# ./sslsniff.py -l --handshake
|
|
FUNC TIME(s) COMM PID LEN LAT(ms)
|
|
WRITE/SEND 0.000000000 gnutls-cli 43554 1 0.012
|
|
----- DATA -----
|
|
|
|
|
|
----- END DATA -----
|
|
|
|
Tracing output of "echo | gnutls-cli -p 443 --insecure localhost":
|
|
|
|
# ./sslsniff.py -l --handshake
|
|
FUNC TIME(s) COMM PID LEN LAT(ms)
|
|
HANDSHAKE 0.000000000 nginx 7081 1 0.710
|
|
WRITE/SEND 0.000045126 gnutls-cli 43752 1 0.014
|
|
----- DATA -----
|
|
|
|
|
|
----- END DATA -----
|
|
|
|
READ/RECV 0.000049464 nginx 7081 1 0.004
|
|
----- DATA -----
|
|
|
|
|
|
----- END DATA -----
|
|
|
|
Tracing few extra libraries (useful for docker containers and other isolated
|
|
apps)
|
|
|
|
# ./sslsniff.py --extra-lib openssl:/var/lib/docker/overlay2/l/S4EMHE/lib/libssl.so.1.1
|
|
|
|
|
|
|
|
USAGE message:
|
|
|
|
usage: sslsniff.py [-h] [-p PID] [-u UID] [-x] [-c COMM] [-o] [-g] [-n] [-d]
|
|
[--hexdump] [--max-buffer-size MAX_BUFFER_SIZE] [-l]
|
|
[--handshake] [--extra-lib EXTRA_LIB]
|
|
|
|
Sniff SSL data
|
|
|
|
optional arguments:
|
|
-h, --help show this help message and exit
|
|
-p PID, --pid PID sniff this PID only.
|
|
-u UID, --uid UID sniff this UID only.
|
|
-x, --extra show extra fields (UID, TID)
|
|
-c COMM, --comm COMM sniff only commands matching string.
|
|
-o, --no-openssl do not show OpenSSL calls.
|
|
-g, --no-gnutls do not show GnuTLS calls.
|
|
-n, --no-nss do not show NSS calls.
|
|
-d, --debug debug mode.
|
|
--hexdump show data as hexdump instead of trying to decode it as
|
|
UTF-8
|
|
--max-buffer-size MAX_BUFFER_SIZE
|
|
Size of captured buffer
|
|
-l, --latency show function latency
|
|
--handshake show SSL handshake latency, enabled only if latency
|
|
option is on.
|
|
--extra-lib EXTRA_LIB
|
|
Intercept calls from extra library
|
|
(format: lib_type:lib_path)
|
|
|
|
|
|
|
|
examples:
|
|
./sslsniff # sniff OpenSSL and GnuTLS functions
|
|
./sslsniff -p 181 # sniff PID 181 only
|
|
./sslsniff -u 1000 # sniff only UID 1000
|
|
./sslsniff -c curl # sniff curl command only
|
|
./sslsniff --no-openssl # don't show OpenSSL calls
|
|
./sslsniff --no-gnutls # don't show GnuTLS calls
|
|
./sslsniff --no-nss # don't show NSS calls
|
|
./sslsniff --hexdump # show data as hex instead of trying to decode it as UTF-8
|
|
./sslsniff -x # show process UID and TID
|
|
./sslsniff -l # show function latency
|
|
./sslsniff -l --handshake # show SSL handshake latency
|
|
./sslsniff --extra-lib openssl:/path/libssl.so.1.1 # sniff extra library
|