sslsplit(1) SSLsplit sslsplit(1) (NAME) sslsplit - SSL/TLS (SYNOPSIS) sslsplit [-kCKqwWOPZdDgGsrRxeumjplLSFXYyTIMiab] -c pem proxyspecs [...] sslsplit [-kCKqwWOPZdDgGsrRxeumjplLSFXYyTIMiab] -c pem -t dir proxyspecs [...] sslsplit [-OPZwWdDgGsrRxeumjplLSFXYyTIMiab] -t dir proxyspecs [...] sslsplit [-kCKwWOPZdDgGsrRxeumjplLSFXYyTIMi] -f conffile sslsplit -E sslsplit -V sslsplit -h (DESCRIPTION) SSLsplit (MitM) SSL/TLS . . SSLsplit (NAT) . SSLsplit SSL/TLS SSL/TLS . NAT SSLsplit SNI . SSLsplit HTTP SOCKS . (NAT ENGINES) (PROXY SPECIFICATIONS) . SSLsplit TCP SSL HTTP HTTPS IPv4 IPv6 . TCP SSL SMTP STARTTLS . SSLsplit Server Name Indication (SNI) RSA DSA ECDSA DHE ECDHE . OpenSSL SSLsplit SSL 3.0 TLS 1.0 TLS 1.1 TLS 1.2 SSL 2.0 . SSL HTTPS SSLsplit X509v3 DN subjectAltName . SSLsplit . SSLsplit CN NULL SSL/TLS . SSLsplit . OCSP . HTTP HTTPS SSLsplit (HPKP) (HSTS) (Expect-CT) QUIC/SPDY HTTP/2 WebSockets (Upgrade Alternate Protocols). (keep-alive) HTTP . SSLsplit PCAP (mirroring) . master secret . SSLsplit . SNI . SSLsplit . sslsplit . sslsplit ARP (ARP spoofing) ND (ND spoofing) DNS (DNS poisoning) ( hostap) VLAN /etc/hosts . (OPTIONS) -a pemfile pemfile . -A pemfile PEM pemfile (leaf certificate) . PEM CA . -t SSLsplit certdir . -t -t -A . -b pemfile pemfile . -c pemfile CA pemfile . pemfile CA -k . pemfile - (Diffie-Hellman) -g . -t SSLsplit . -C pemfile CA pemfile . CA -k -c - (sub-CA) CA CA . -d TTY (daemon) syslog . -D (debug) . -d . -e engine engine NAT proxyspecs NAT SNI. engine NAT -E . -E NAT . NAT SSLsplit (NAT ENGINES) . -f conffile conffile. -F logspec ( (LOG SPECIFICATIONS) ). . . -F -L -S ( ). -g pemfile - pemfile - (EDH/DHE). -g SSLsplit DH PEM -K -k -c . DH . -g SSLsplit OpenSSL - . -G curve curve - (ECDHE). -G (prime256v1) . -G SSLsplit OpenSSL - . -h . -i . pid : (owner:group) SSLsplit -F . -i Mac OS X FreeBSD ..TP -I if (Mirror) if -T. SSLsplit . -j jaildir jaildir chroot(2) . proxyspecs sni . /etc/resolv.conf jaildir . proxyspec sni . /dev/null (jail) . . -k pemfile CA pemfile (on-the-fly). pemfile CA -c . pemfile Diffie-Hellman -g . -t SSLsplit . -K pemfile pemfile (leaf certificates) . -K SSLsplit RSA . -l logfile logfile HTTP SSL. SIGUSR1 logfile . -L logfile logfile. . SIGUSR1 logfile . -F -L -S ( ). -m -u group . -M logfile (master keys) logfile SSLKEYLOGFILE . SSL/TLS Wireshark . SSLKEYLOGFILE SSLsplit . SIGUSR1 logfile . -O (OCSP) proxyspecs OCSP OCSP tryLater OCSP . HTTP OCSP GET URI OCSPRequest ASN.1 OpenSSL POST Content-Type application/ocsp-request . SSLsplit OCSP . SSLsplit OCSP certdir -t . -p pidfile (PID) pidfile pidfile . -P (Passthrough) SSL/TLS (drop) . -c -k -t SSL/TLS . . -P . SSL/TLS . -P . -q crlurl (CDP) crlurl . .NET CDP . -q CRL CA -c -k crlurl . -r proto SSL/TLS proto OpenSSL SSLv23_method() . SSL/TLS . OpenSSL proto : ssl2 ssl3 tls10 tls11 tls12. SSL 2.0 SSL 2.0 Client Hello . -R proto SSL/TLS proto OpenSSL. -R . -r . . OpenSSL proto : ssl2 ssl3 tls10 tls11 tls12. SSL 2.0 SSL 2.0 Client Hello . -s ciphers (ciphers) OpenSSL SSL/TLS . -s ALL:-aNULL . SSL/TLS . OpenSSL eNULL . SSLsplit . OpenSSL ciphers(1) . -S logdir logdir. . . -F -L -S ( ). -t certdir PEM certdir . PEM CA . -t SSLsplit certdir . -A certdir PEM -A . -c -k (Common Names) certdir . -P SSL/TLS . -T addr addr -I. IPv4 . SSLsplit . -u user user . -u SSLsplit EUID UID ( setuid) UID root ( EUID == UID == 0) nobody . user TCP DNS . (privilege separation) . -u root SSLsplit . -u proxyspec pf Mac OS X . -x engine (engine) OpenSSL engine . OpenSSL OpenSSL . engine OpenSSL . OpenSSL engine . -X pcapfile pcapfile PCAP TCP IP Ethernet. SIGUSR1 pcapfile . -X -Y -y ( ). -Y pcapdir PCAP pcapdir. PCAP . -X -Y -y ( ). -y pcapspec PCAP ( << >> ). PCAP . -X -Y -y ( ). -V ..TP -w gendir gendir . SHA-1 ASN.1 subjectKeyIdentifier . SHA-1 () . . -W gendir -w ( -t ) . -Z SSL/TLS . CPU . -Z SSLsplit OpenSSL . (PROXY SPECIFICATIONS) (proxyspecs) (static forward) ( NAT DNS SNI) : https listenaddr port [nat-engine|fwdaddr port|sni port] ssl listenaddr port [nat-engine|fwdaddr port|sni port] http listenaddr port [nat-engine|fwdaddr port] tcp listenaddr port [nat-engine|fwdaddr port] autossl listenaddr port [nat-engine|fwdaddr port] https SSL/TLS HTTP HPKP HSTS Upgrade Alternate Protocol. WebSockets HTTP/2 . ssl SSL/TLS () . http TCP SSL/TLS HTTP HPKP HSTS Upgrade Alternate Protocol. WebSockets HTTP/2 . tcp TCP SSL/TLS . autossl TCP Client Hello SSL/TLS SSL/TLS . STARTTLS Client Hello STARTTLS . listenaddr port IPv4 IPv6 . NAT . nat-engine NAT . -e . NAT sslsplit NAT sslsplit . NAT NAT ENGINES . fwdaddr port IPv4 IPv6 . . fwdaddr (hostname) IP . sni port SNI (Server Name Indication) Client Hello SSL/TLS IP . proxyspecs ssl https . DNS NAT ( ) NAT sslsplit NAT . -j sni jaildir chroot . (LOG SPECIFICATIONS) printf . SSLsplit : %T ISO 8601 UTC. %d IPv6 (underscore) . %D IPv6 . %p . %s IPv6 . %S IPv6 . %q . %x . -i . . %X . -i . . %u (uid) . -i . . %g (gid) . -i . . %% '%'. SSLsplit NAT : pf NAT rdr/rdr-to (pf) FreeBSD NetBSD Mac OS X . IPv6. SSLsplit /dev/pf root . em0 (FreeBSD Mac OS X) (+OpenBSD 4.7): rdr pass on em0 proto tcp from 2001:db8::/64 to any port 80 \ -> ::1 port 10080 rdr pass on em0 proto tcp from 2001:db8::/64 to any port 443 \ -> ::1 port 10443 rdr pass on em0 proto tcp from 192.0.2.0/24 to any port 80 \ -> 127.0.0.1 port 10080 rdr pass on em0 proto tcp from 192.0.2.0/24 to any port 443 \ -> 127.0.0.1 port 10443 pass in quick on em0 proto tcp from 2001:db8::/64 to any \ port 80 rdr-to ::1 port 10080 pass in quick on em0 proto tcp from 2001:db8::/64 to any \ port 443 rdr-to ::1 port 10443 pass in quick on em0 proto tcp from 192.0.2.0/24 to any \ port 80 rdr-to 127.0.0.1 port 10080 pass in quick on em0 proto tcp from 192.0.2.0/24 to any \ port 443 rdr-to 127.0.0.1 port 10443 ipfw divert (IPFW) Mac OS X. FreeBSD OpenBSD divert-to pf. FreeBSD OpenBSD IPv6. Mac OS X IPFW IPv4 . IPFW divert-to pf: ipfw add fwd ::1,10080 tcp from 2001:db8::/64 to any 80 ipfw add fwd ::1,10443 tcp from 2001:db8::/64 to any 443 ipfw add fwd 127.0.0.1,10080 tcp from 192.0.2.0/24 to any 80 ipfw add fwd 127.0.0.1,10443 tcp from 192.0.2.0/24 to any 443 pass in quick on em0 proto tcp from 2001:db8::/64 to any \ port 80 divert-to ::1 port 10080 pass in quick on em0 proto tcp from 2001:db8::/64 to any \ port 443 divert-to ::1 port 10443 pass in quick on em0 proto tcp from 192.0.2.0/24 to any \ port 80 divert-to 127.0.0.1 port 10080 pass in quick on em0 proto tcp from 192.0.2.0/24 to any \ port 443 divert-to 127.0.0.1 port 10443 ipfilter IPFilter (ipfilter ipf) FreeBSD NetBSD Linux Solaris. SSLsplit /dev/ipnat root . ioctl(2) SIOCGNATL IPv4 . bge0: rdr bge0 0.0.0.0/0 port 80 -> 127.0.0.1 port 10080 rdr bge0 0.0.0.0/0 port 443 -> 127.0.0.1 port 10443 netfilter netfilter REDIRECT iptables. v3.8-rc1 IPv6 getsockopt(2) SO_ORIGINAL_DST IPv4 . iptables -t nat -A PREROUTING -s 192.0.2.0/24 \ -p tcp --dport 80 \ -j REDIRECT --to-ports 10080 iptables -t nat -A PREROUTING -s 192.0.2.0/24 \ -p tcp --dport 443 \ -j REDIRECT --to-ports 10443 # please contribute a tested ip6tables config SSLsplit IP ( 192.0.2.1) (0.0.0.0) (bind) . REDIRECT IP 127.0.0.1 . tproxy netfilter TPROXY iptables (routing table) . IPv6. ip -f inet6 rule add fwmark 1 lookup 100 ip -f inet6 route add local default dev lo table 100 ip6tables -t mangle -N DIVERT ip6tables -t mangle -A DIVERT -j MARK --set-mark 1 ip6tables -t mangle -A DIVERT -j ACCEPT ip6tables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT ip6tables -t mangle -A PREROUTING -s 2001:db8::/64 \ -p tcp --dport 80 \ -j TPROXY --tproxy-mark 0x1/0x1 --on-port 10080 ip6tables -t mangle -A PREROUTING -s 2001:db8::/64 \ -p tcp --dport 443 \ -j TPROXY --tproxy-mark 0x1/0x1 --on-port 10443 ip -f inet rule add fwmark 1 lookup 100 ip -f inet route add local default dev lo table 100 iptables -t mangle -N DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A PREROUTING -s 192.0.2.0/24 \ -p tcp --dport 80 \ -j TPROXY --tproxy-mark 0x1/0x1 --on-port 10080 iptables -t mangle -A PREROUTING -s 192.0.2.0/24 \ -p tcp --dport 443 \ -j TPROXY --tproxy-mark 0x1/0x1 --on-port 10443 (rp_filter) TPROXY . sslsplit SIGINT SIGTERM (clean shutdown) SIGUSR1 ( -l -L -X) . (log rotation) SIGUSR1 PID PID -p SSLsplit (flush) . ( -S -F) . (EXIT STATUS) sslsplit (SIGINT SIGTERM) 0 SIGHUP 128 + . 1..127 . (EXAMPLES) NAT HTTP HTTPS IPv4 IPv6 ca.key ca.crt connect.log /tmp ( -e nat-engine ): sslsplit -k ca.key -c ca.crt -l connect.log -S /tmp \ https ::1 10443 https 127.0.0.1 10443 \ http ::1 10080 http 127.0.0.1 10080 netfilter REDIRECT iptables IP ( 192.0.2.1) (0.0.0.0) SSLsplit . IMAP/IMAPS : sslsplit -k ca.key -c ca.crt -l connect.log -S /tmp \ ssl ::1 10993 ssl 127.0.0.1 10993 \ tcp ::1 10143 tcp 127.0.0.1 10143 HTTPS // /path/to/cert.d www.example.org NAT: sslsplit -t /path/to/cert.d -l connect.log -S /tmp \ https ::1 10443 www.example.org 443 \ https 127.0.0.1 10443 www.example.org 443 (proxyspecs) ssl tcp PCAP . SIGUSR1 -p PID PID . sslsplit -k ca.key -c ca.crt -X log.pcap -p /var/run/sslsplit.pid \ ssl ::1 10443 ssl 127.0.0.1 10443 \ tcp ::1 10080 tcp 127.0.0.1 10080 SSL (cipher suites) leaf.key . CA (leaf) . openssl speed . . . sslsplit -Z -s NULL:RC4:AES128:-DHE -K leaf.key \ -k ca.key -c ca.crt -l connect.log -S /tmp \ https ::1 10443 https 127.0.0.1 10443 \ http ::1 10080 http 127.0.0.1 10080 (daemon) sslsplit PID: sslsplit -d -p /var/run/sslsplit.pid -u sslsplit \ -k ca.key -c ca.crt -l connect.log -S /tmp \ https ::1 10443 https 127.0.0.1 10443 \ http ::1 10080 http 127.0.0.1 10080 CA ca.key ca.crt OpenSSL: cat >x509v3ca.cnf <<'EOF' [ req ] distinguished_name = reqdn [ reqdn ] [ v3_ca ] basicConstraints = CA:TRUE subjectKeyIdentifier = hash authorityKeyIdentifier = keyid:always,issuer:always EOF openssl genrsa -out ca.key 2048 openssl req -new -nodes -x509 -sha256 -out ca.crt -key ca.key \ -config x509v3ca.cnf -extensions v3_ca \ -subj '/O=SSLsplit Root CA/CN=SSLsplit Root CA/' \ -set_serial 0 -days 3650 (NOTES) SSLsplit libevent ()select kqueue (listeners) . (worker threads) CPU SSL/TLS CPU . SSL . I/O (block) . DNS . SSLsplit SSL (handshakes) SSL SSL (bignum) . SSLsplit root (privilege separation) . : (-F -S) PCAP (-Y -y) (-w -W). . (root) -u root ..SH " (SEE ALSO)" sslsplit.conf(5), openssl(1), ciphers(1), speed(1), pf(4), ipfw(8), iptables(8), ip6tables(8), ip(8), hostapd(8), arpspoof(8), parasite6(8), yersinia(8), https://www.roe.ch/SSLsplit (AUTHORS) SSLsplit Daniel Roethlisberger . SSLsplit Daniel Roethlisberger Soner Tari . : Steve Wills, Landon Fuller, Wayne Jensen, Rory McNamara, Alexander Neumann, Adam Jacob Muller, Richard Poole, Maciej Kotowicz, Eun Soo Park, Christian Groschupp, Alexander Savchenkov, Soner Tari, Petr Vanek, Hilko Bengen, Philip Duldig, Levente Polyak, Nick French, Cihan Komecoglu Sergey Pinaev. SSLsplit HackerOne . (BUGS) GitHub : https://github.com/droe/sslsplit sslsplit 0.5.5 2023-10-22 sslsplit(1)