tools/sslsniff_example.txt

Demonstrations of sslsniff.py


This tool traces the write/send and read/recv functions of OpenSSL,
GnuTLS and NSS.  Data passed to this functions is printed as plain
text.  Useful, for example, to sniff HTTP before encrypted with SSL.


Output of tool executing in other shell "curl https://example.com"

% sudo python sslsniff.py
FUNC         TIME(s)            COMM             PID    LEN
WRITE/SEND   0.000000000        curl             12915  75
----- DATA -----
GET / HTTP/1.1
Host: example.com
User-Agent: curl/7.50.1
Accept: */*


----- END DATA -----

READ/RECV    0.127144585        curl             12915  333
----- DATA -----
HTTP/1.1 200 OK
Cache-Control: max-age=604800
Content-Type: text/html
Date: Tue, 16 Aug 2016 15:42:12 GMT
Etag: "359670651+gzip+ident"
Expires: Tue, 23 Aug 2016 15:42:12 GMT
Last-Modified: Fri, 09 Aug 2013 23:54:35 GMT
Server: ECS (iad/18CB)
Vary: Accept-Encoding
X-Cache: HIT
x-ec-custom-error: 1
Content-Length: 1270


----- END DATA -----

READ/RECV    0.129967972        curl             12915  1270
----- DATA -----
<!doctype html>
<html>
<head>
    <title>Example Domain</title>

    <meta charset="utf-8" />
    <meta http-equiv="Content-type" content="text/html; charset=utf-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1" />
    <style type="text/css">
    body {
        background-color: #f0f0f2;
        margin: 0;
        padding: 0;
        font-family: "Open Sans", "Helvetica Neue", Helvetica, Arial, sans-serif;

    }
    div {
        w
----- END DATA (TRUNCATED, 798 bytes lost) -----

Using the --hexdump option you will get the exact same output, only the lines
between DATA and END DATA will differ. Those will be replaced with a 16 byte
(32 characters) wide hex-dump, an example of a block of output from sslsniff
called with that option is

READ/RECV    7.405609173        curl             201942 1256
----- DATA -----
3c21646f63747970652068746d6c3e0a
3c68746d6c3e0a3c686561643e0a2020
20203c7469746c653e4578616d706c65
20446f6d61696e3c2f7469746c653e0a
0a202020203c6d657461206368617273
65743d227574662d3822202f3e0a2020
20203c6d65746120687474702d657175
69763d22436f6e74656e742d74797065
2220636f6e74656e743d22746578742f
68746d6c3b20636861727365743d7574
662d3822202f3e0a202020203c6d6574
61206e616d653d2276696577706f7274
2220636f6e74656e743d227769647468
3d6465766963652d77696474682c2069
6e697469616c2d7363616c653d312220
2f3e0a202020203c7374796c65207479
70653d22746578742f637373223e0a20
202020626f6479207b0a202020202020
20206261636b67726f756e642d636f6c
6f723a20236630663066323b0a202020
20202020206d617267696e3a20303b0a
202020202020202070616464696e673a
20303b0a2020202020202020666f6e74
2d66616d696c793a202d6170706c652d
73797374656d2c2073797374656d2d75
692c20426c696e6b4d61635379737465
6d466f6e742c20225365676f65205549
222c20224f70656e2053616e73222c20
2248656c766574696361204e65756522
----- END DATA (TRUNCATED, 792 bytes lost) -----

This is useful to sniff binary protocols where the UTF-8 decode might insert a
lot of characters that are not printable or even Unicode replacement
characters.


Use -l or --latency option to show function latency, and show handshake latency
by using both -l and --handshake. This is useful for SSL/TLS performance
analysis. Tracing output of "echo | openssl s_client -connect example.com:443":

# ./sslsniff.py -l --handshake
FUNC         TIME(s)            COMM             PID     LEN    LAT(ms)
WRITE/SEND   0.000000000        openssl          10377   1      0.005
----- DATA -----


----- END DATA -----

Trace localhost server instead of example.com. It takes 0.7ms for server
handshake before secure connection is ready for initial SSL_read or SSL_write.

# ./sslsniff.py -l --handshake
FUNC         TIME(s)            COMM             PID     LEN    LAT(ms)
HANDSHAKE    0.000000000        nginx            7081    1      0.699
WRITE/SEND   0.000132180        openssl          14800   1      0.010
----- DATA -----


----- END DATA -----

READ/RECV    0.000136583        nginx            7081    1      0.004
----- DATA -----


----- END DATA -----

Tracing output of "echo | gnutls-cli -p 443 example.com":

# ./sslsniff.py -l --handshake
FUNC         TIME(s)            COMM             PID     LEN    LAT(ms)
WRITE/SEND   0.000000000        gnutls-cli       43554   1      0.012
----- DATA -----


----- END DATA -----

Tracing output of "echo | gnutls-cli -p 443 --insecure localhost":

# ./sslsniff.py -l --handshake
FUNC         TIME(s)            COMM             PID     LEN    LAT(ms)
HANDSHAKE    0.000000000        nginx            7081    1      0.710
WRITE/SEND   0.000045126        gnutls-cli       43752   1      0.014
----- DATA -----


----- END DATA -----

READ/RECV    0.000049464        nginx            7081    1      0.004
----- DATA -----


----- END DATA -----

Tracing few extra libraries (useful for docker containers and other isolated
apps)

# ./sslsniff.py --extra-lib openssl:/var/lib/docker/overlay2/l/S4EMHE/lib/libssl.so.1.1


USAGE message:

usage: sslsniff.py [-h] [-p PID] [-u UID] [-x] [-c COMM] [-o] [-g] [-n] [-d]
                   [--hexdump] [--max-buffer-size MAX_BUFFER_SIZE] [-l]
                   [--handshake] [--extra-lib EXTRA_LIB]

Sniff SSL data

optional arguments:
  -h, --help            show this help message and exit
  -p PID, --pid PID     sniff this PID only.
  -u UID, --uid UID     sniff this UID only.
  -x, --extra           show extra fields (UID, TID)
  -c COMM, --comm COMM  sniff only commands matching string.
  -o, --no-openssl      do not show OpenSSL calls.
  -g, --no-gnutls       do not show GnuTLS calls.
  -n, --no-nss          do not show NSS calls.
  -d, --debug           debug mode.
  --hexdump             show data as hexdump instead of trying to decode it as
                        UTF-8
  --max-buffer-size MAX_BUFFER_SIZE
                        Size of captured buffer
  -l, --latency         show function latency
  --handshake           show SSL handshake latency, enabled only if latency
                        option is on. 
  --extra-lib EXTRA_LIB
                        Intercept calls from extra library
                        (format: lib_type:lib_path)


examples:
    ./sslsniff              # sniff OpenSSL and GnuTLS functions
    ./sslsniff -p 181       # sniff PID 181 only
    ./sslsniff -u 1000      # sniff only UID 1000
    ./sslsniff -c curl      # sniff curl command only
    ./sslsniff --no-openssl # don't show OpenSSL calls
    ./sslsniff --no-gnutls  # don't show GnuTLS calls
    ./sslsniff --no-nss     # don't show NSS calls
    ./sslsniff --hexdump    # show data as hex instead of trying to decode it as UTF-8
    ./sslsniff -x           # show process UID and TID
    ./sslsniff -l           # show function latency
    ./sslsniff -l --handshake  # show SSL handshake latency
    ./sslsniff --extra-lib openssl:/path/libssl.so.1.1 # sniff extra library