Hacker GitHub

← All repos

gojue/ecapture

View on GitHub ↗ ★ 15,526 C

Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. Supports Linux and Android on x86_64 and arm64.

13 mentions on Hacker News by 12 people: 4 stories, 9 comments · first 2022-03-31 · latest 2025-05-08

Mentions per year 13 mentions · busiest year 2025 (5)
20082026
AllStoriesComments NewestTopOldest
  1. There's a similiar tool https://github.com/gojue/ecapture
    comment by zxilly · 2025-05-08 · in Show HN: Using eBPF to see through encryption without a proxy
  2. Not today, maybe one day! Edit: Another user posted a link to https://github.com/gojue/ecapture which looks like it supports android and has some overlapping functionality.
    comment by jonfriesen · 2025-05-08 · in Show HN: Using eBPF to see through encryption without a proxy
  3. here is one example: https://github.com/gojue/ecapture in short, you can hook calls within SSL libraries (like OpenSSL)
    comment by beaugunderson · 2025-04-10 · in The Agent2Agent Protocol (A2A)
  4. I believe that's how https://github.com/gojue/ecapture works. I don't know the details, but it seems to work!
    comment by jeroenhd · 2025-02-04 · in Httptap: View HTTP/HTTPS requests made by any Linux program
  5. …The downside is this doesn't work with anything not using OpenSSL, there are projects like https://github.com/gojue/ecapture which have interceptors for many common libraries, but the downside is that needs different code for each library.…
    comment by dgl · 2025-02-03 · in Httptap: View HTTP/HTTPS requests made by any Linux program
  6. Latest release: 2024-07-09 changelog: https://github.com/gojue/ecapture/blob/master/CHANGELOG.md
    comment by walterbell · 2024-07-11 · in Capturing Linux SSL/TLS plaintext without a CA certificate using eBPF
  7. ▲ 183
    Capturing Linux SSL/TLS plaintext without a CA certificate using eBPF
    story by walterbell · 2024-07-11 · 70 comments
  8. https://github.com/gojue/ecapture/releases/expanded_assets/v... Anyone know why there is an aarch64 nocore but not an x86_64 nocore.
    comment by 1vuio0pswjnm7 · 2023-09-15 · in Yes, Android 14 still allows modification of system certificates
  9. …by the Android system, even if they were real. Android ships with eBPF, so you just need root. https://github.com/gojue/ecapture
    comment by maven29 · 2023-09-15 · in Yes, Android 14 still allows modification of system certificates
  10. ▲ 1
    ECapture: Capture SSL/TLS text content without CA cert using eBPF
    story by cfc4n · 2022-12-02 · 1 comment
  11. One option is to use ebpf uprobes to dump the key material or plaintext ( https://github.com/ehids/ecapture ). Should be easy for c-like TLS libraries probably less useful for JIT languages.
    comment by benmmurphy · 2022-11-22 · in Kubeshark: The API Traffic Viewer for Kubernetes
  12. ▲ 2
    Ecapture: Capture and Decode TLS with eBPF
    story by wey-gu · 2022-05-04 · 2 comments
  13. ▲ 2
    Capture SSL/TLS text content without CA cert by eBPF
    story by minton · 2022-03-31 · 0 comments