Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I expect the program to scan memory of all local processes (or debug them, or provide crypto libraries with hook like in LD_PRELOAD) and use keys to decrypt traffic, making it analysable with Wireshark and other tools (at least tcpdump -A).

Are there tools that collects keys from running processes and decrypts SSL/SSH? Like "see though all local encryption".

The target goal is to see everything flowing to/from my computer, including in encrypted form. I don't like "mysterious" unattended network activity and not being able to know what this process is sending them (and too lazy to deal with each case individually).

share|improve this question
Yes, but they are only available in your local office of the Камітэт дзяржаўнай бяспекі, КДБ. ;-) – RedGrittyBrick Nov 14 '11 at 19:32
Also, the NSA we hear has cracked SSL - you might ask them about this. Seriously, though - why would you want to do this? Do you not trust some of your software? Equally important, do you have legal permission to do this (if done on somebody else's machine)? – new123456 Nov 14 '11 at 23:01
Primarily to view what is being transferred by various programs without manual extraction of things and "Follow SSL stream" per each program - to make it simple. – Vi. Nov 14 '11 at 23:46
Basically I don't like when there are spurious network transfers from/to my computer and I don't know what is it (due to encryption). I want to have simple way to observe what is flowing to/from my computer. – Vi. Nov 14 '11 at 23:54
Encrypted packets will be from secure sessions; they don't just happen out of the blue. You have a VPN running or something? Are you visiting your bank's website? – goblinbox Nov 15 '11 at 1:31

Take a look at ssldump. It's similar in functionality to tcpdump, but with appropriate privs and keys, you'll can monitor traffic.

share|improve this answer

I believe encryption keys are not static and they change during the course of a session. So would be almost impossible to achieve this.

share|improve this answer
Why? Everything is on my computer (including that encryption keys). The program may even LD_PRELOAD into crypto libraries to subscribe for keys. – Vi. Nov 15 '11 at 9:58
Was thinking off the shelf packet capturing tool, e.g., Wireshark. LD_PRELOAD would require writing custom libraries. – HanSooloo Nov 17 '11 at 2:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .