ssldump/README.md

104 lines
4.4 KiB
Markdown
Raw Permalink Normal View History

# ssldump - (de-facto repository gathering patches around the cyberspace)
2016-11-20 10:26:24 +00:00
[![Build CI](https://github.com/adulau/ssldump/actions/workflows/build.yml/badge.svg)](https://github.com/adulau/ssldump/actions/workflows/build.yml)
2023-02-04 23:50:29 +00:00
[![CodeQL analysis](https://github.com/adulau/ssldump/actions/workflows/codeql-analysis.yml/badge.svg)](https://github.com/adulau/ssldump/actions/workflows/codeql-analysis.yml)
2024-04-01 14:14:19 +00:00
[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/adulau/ssldump/badge)](https://securityscorecards.dev/viewer/?uri=github.com/adulau/ssldump)
2020-10-03 08:32:19 +00:00
# Release and tagging
2020-04-23 08:59:31 +00:00
2024-11-03 10:21:02 +00:00
- Current version of ssldump is [v1.9](https://github.com/adulau/ssldump/releases/tag/v1.9) (released: 2024-11-03) - [ChangeLog](https://raw.githubusercontent.com/adulau/ssldump/master/ChangeLog)
2020-09-22 14:04:20 +00:00
# What about the original ssldump?
2016-11-20 10:26:24 +00:00
This repository is composed of the original SSLDUMP 0.9b3 + a myriad of patches (from Debian and other distributions) + contributions via PR
2016-11-20 10:26:24 +00:00
ssldump is an SSLv3/TLS network protocol analyzer. It identifies TCP
connections on the chosen network interface and attempts to interpret
them as SSLv3/TLS traffic. When it identifies SSLv3/TLS traffic, it
decodes the records and displays them in a textual form to stdout. If
provided with the appropriate keying material, it will also decrypt
the connections and display the application data traffic. It also
2021-04-12 08:11:37 +00:00
includes a JSON output option, supports [JA3](https://github.com/salesforce/ja3) and IPv6.
2016-11-20 10:26:24 +00:00
2021-04-12 08:11:37 +00:00
# How to do I run ssldump?
2023-08-10 09:40:34 +00:00
`./ssldump -j -ANH -n -i any | jq` will run ssldump on all interfaces and output the result in JSON format including ja3 hashes.
2021-04-12 08:11:37 +00:00
For more details, check the man page.
2016-11-20 10:26:24 +00:00
2022-03-06 10:22:21 +00:00
## How can I lookup ja3 hashes?
This example will query ja3er.com service to display the known ja3 hashes from the TLS handshaked in the pcap.
2023-08-14 10:47:12 +00:00
`./ssldump -r yourcapture.pcap -j | jq -r 'select(.ja3_fp != null) | .ja3_fp' | parallel 'curl -s -X GET 'https://ja3er.com/search/{}' | jq .'`
2022-03-06 10:22:21 +00:00
2016-11-20 10:26:24 +00:00
# Why do you maintain this repository?
Because it's a mess. The software maintenance process for old free (unmaintained) software
like ssldump is a complete chaotic process. I do this to ease my pain and this could help
other too (but this is just a collateral damage).
2021-04-12 08:17:56 +00:00
# Where ssldump is used?
2016-11-20 10:26:24 +00:00
2021-04-12 08:17:56 +00:00
- I used it for a relatively small project called Passive SSL. For more information, [Passive SSL Passive Detection and Reconnaissance Techniques, to Find, Track, and Attribute Vulnerable ”Devices”](https://www.first.org/resources/papers/conf2015/first_2015_-_leverett_-_dulaunoy_-_passive_detection_20150604.pdf). Additional back-end code available is in the [crl-monitor ](https://github.com/adulau/crl-monitor/tree/master/bin/x509) repository.
- ssldump is used in the [D4-Project](https://github.com/D4-project/).
2016-11-20 10:26:24 +00:00
# Where ssldump is available?
- Alpine Linux [ssldump](https://pkgs.alpinelinux.org/packages?name=ssldump&branch=edge&repo=&arch=&maintainer=)
- Arch Linux [ssldump](https://aur.archlinux.org/packages/ssldump)
- CentOS, RHEL, Rocky (via [EPEL](https://docs.fedoraproject.org/en-US/epel/)) [ssldump](https://packages.fedoraproject.org/pkgs/ssldump/ssldump/)
2024-11-04 05:34:25 +00:00
- Debian [ssldump](https://tracker.debian.org/pkg/ssldump)
- Fedora [ssldump](https://packages.fedoraproject.org/pkgs/ssldump/ssldump/)
- Kali Linux [ssldump](https://www.kali.org/tools/ssldump/)
- Ubuntu Linux [ssldump](http://changelogs.ubuntu.com/changelogs/pool/universe/s/ssldump/)
2020-08-27 14:20:38 +00:00
# Build instructions
2023-08-10 10:07:09 +00:00
Install dependencies on Debian & Ubuntu (as root):
2020-08-27 14:24:51 +00:00
```
2023-08-10 14:29:45 +00:00
apt install build-essential git cmake ninja-build libssl-dev libpcap-dev libnet1-dev libjson-c-dev
2020-08-28 08:44:31 +00:00
```
2023-08-10 10:07:09 +00:00
On Fedora, CentOS, RHEL & Rocky (as root):
2020-08-28 08:44:31 +00:00
```
2023-08-10 14:29:45 +00:00
dnf install git cmake ninja-build gcc openssl-devel libpcap-devel libnet-devel json-c-devel
```
On OpenBSD (as root):
```
pkg_add git cmake ninja json-c libnet
```
On FreeBSD (as root):
```
pkg install git cmake ninja json-c libnet
2023-08-10 10:07:09 +00:00
```
2023-08-10 15:03:54 +00:00
On MacOS (as root):
```
brew install cmake ninja openssl@3 libpcap libnet json-c
```
2023-08-10 10:07:09 +00:00
Compile & install:
```
2023-08-10 14:29:45 +00:00
git clone https://github.com/adulau/ssldump.git
cd ssldump
2023-08-10 09:40:34 +00:00
cmake -G Ninja -B build
ninja -C build
./build/ssldump -v
2023-08-10 10:07:09 +00:00
(optional, as root) ninja -C build install
```
2023-08-10 14:29:45 +00:00
# Notes
The "save to pcap" (-w) option by @ryabkov, is heavily based on the work of
@droe on https://github.com/droe/sslsplit .
# Contributing
2016-11-20 10:26:24 +00:00
The contributing policy is simple. If you have a patch to propose, make a pull-request
via the interface. If the patch works for me, it's merged.