1

I expect the program to scan memory of all local processes (or debug them, or provide crypto libraries with hook like in LD_PRELOAD) and use keys to decrypt traffic, making it analysable with Wireshark and other tools (at least tcpdump -A).

Are there tools that collects keys from running processes and decrypts SSL/SSH? Like "see though all local encryption".

The target goal is to see everything flowing to/from my computer, including in encrypted form. I don't like "mysterious" unattended network activity and not being able to know what this process is sending them (and too lazy to deal with each case individually).

7
  • 1
    Yes, but they are only available in your local office of the Камітэт дзяржаўнай бяспекі, КДБ. ;-) Nov 14, 2011 at 19:32
  • Also, the NSA we hear has cracked SSL - you might ask them about this. Seriously, though - why would you want to do this? Do you not trust some of your software? Equally important, do you have legal permission to do this (if done on somebody else's machine)?
    – new123456
    Nov 14, 2011 at 23:01
  • Primarily to view what is being transferred by various programs without manual extraction of things and "Follow SSL stream" per each program - to make it simple.
    – Vi.
    Nov 14, 2011 at 23:46
  • Basically I don't like when there are spurious network transfers from/to my computer and I don't know what is it (due to encryption). I want to have simple way to observe what is flowing to/from my computer.
    – Vi.
    Nov 14, 2011 at 23:54
  • Encrypted packets will be from secure sessions; they don't just happen out of the blue. You have a VPN running or something? Are you visiting your bank's website?
    – goblinbox
    Nov 15, 2011 at 1:31

2 Answers 2

1

Take a look at ssldump. It's similar in functionality to tcpdump, but with appropriate privs and keys, you'll can monitor traffic.

0

I believe encryption keys are not static and they change during the course of a session. So would be almost impossible to achieve this.

2
  • Why? Everything is on my computer (including that encryption keys). The program may even LD_PRELOAD into crypto libraries to subscribe for keys.
    – Vi.
    Nov 15, 2011 at 9:58
  • Was thinking off the shelf packet capturing tool, e.g., Wireshark. LD_PRELOAD would require writing custom libraries.
    – HanSooloo
    Nov 17, 2011 at 2:09

Not the answer you're looking for? Browse other questions tagged .