droe/sslsplit
FreeTransparent SSL/TLS interception
About droe/sslsplit
SSLsplit is a tool for man-in-the-middle attacks against SSL/TLS encrypted network connections. It is designed for network forensics, application security analysis, and penetration testing. SSLsplit transparently terminates connections redirected via network address translation (NAT), then terminates SSL/TLS and initiates a new SSL/TLS connection to the original destination while logging all transmitted data. It supports plain TCP, plain SSL, HTTP, and HTTPS over IPv4 and IPv6, and can dynamically upgrade plain TCP to SSL (e.g., SMTP STARTTLS). SSLsplit fully supports Server Name Indication (SNI), RSA/DSA/ECDSA keys, DHE/ECDHE cipher suites, and on-the-fly forging of X509v3 certificates. Depending on the OpenSSL version, it supports SSL 3.0, TLS 1.0, TLS 1.1, TLS 1.2, and optionally SSL 2.0.
Key Features
Pros & Cons
- Open source and free to use
- Supports a wide range of protocols and cipher suites
- Dynamic SSL upgrade allows generic handling of protocols like SMTP STARTTLS
- On-the-fly certificate forging simplifies man-in-the-middle setup
- Works with both IPv4 and IPv6
- Cannot act as a HTTP or SOCKS proxy configured in a browser; purely a transparent proxy
- Requires network address translation (NAT) redirection for typical use
- SSL/TLS support depends on the OpenSSL version compiled against (up to TLS 1.2)
- Potential for misuse as a man-in-the-middle tool if used without authorization