ecapture

by gojue

14.7Kstars

1.6Kforks

103watchers

Updated 5 months ago

About

eCapture captures SSL/TLS plaintext data without needing a CA certificate by leveraging eBPF on Linux and Android systems.

Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64.

Primary Use Case

This tool is primarily used by security analysts and system administrators to monitor and capture decrypted SSL/TLS traffic in real-time on Linux and Android devices without installing CA certificates. It is especially useful for auditing encrypted communications and commands on hosts running supported kernels and architectures.

Key Features

Captures SSL/TLS plaintext from multiple SSL libraries including OpenSSL, LibreSSL, BoringSSL, GnuTLS, and NSS
Supports GoTLS plaintext capture for Go language TLS programs
Host security audit by capturing bash and zsh shell commands
MySQL and MariaDB query auditing for versions 5.6, 5.7, and 8.0
Works on Linux and Android kernels (x86_64 4.18+ and aarch64 5.5+)
Uses eBPF technology to capture data without requiring CA certificates
Requires root permissions for operation
Provides both ELF binaries and Docker images for deployment

Installation

Download the ELF binary zip file from the GitHub releases page
Unzip the downloaded ELF binary package
Run the tool using sudo privileges, e.g., sudo ecapture --help
Alternatively, pull the Docker image with: docker pull gojue/ecapture:latest
Run the Docker container with privileged mode and network host: docker run --rm --privileged=true --net=host -v ${HOST_PATH}:${CONTAINER_PATH} gojue/ecapture ARGS

Usage

>_ sudo ecapture tls

Starts capturing SSL/TLS plaintext traffic using eCapture with root privileges.

Security Frameworks

Collection

Discovery

Credential Access

Defense Evasion

Reconnaissance

Usage Insights

Leverages eBPF for low-overhead, real-time plaintext capture without requiring CA certificates, enabling stealthy monitoring.
Ideal for blue teams to audit encrypted traffic and detect suspicious command execution on Linux/Android hosts.
Can be integrated into purple team exercises to validate detection capabilities against encrypted traffic interception.
Root permission requirement suggests deployment in controlled environments or hardened hosts to minimize risk.
Consider combining with SIEM tools to automate alerting on suspicious captured plaintext data or commands.