sslsplit

SSLsplit is designed for transparent and scalable SSL/TLS interception. Connections are intercepted through a network address translation engine like netfilter and redirected to SSLsplit. The tool terminates the SSL/TLS connection and initiates a new one to the original destination, enabling logging of all data transmitted.

It is intended for network forensics and penetration testing. SSLsplit supports features like TLS Server Name Indication (SNI) and works with NAT engines such as netfilter and tproxy. The tool generates forged certificates signed by a provided CA key and cert for man-in-the-middle operations.

Compiled against OpenSSL with specific flags like -DDISABLE_SSLV2_SESSION_CACHE and -DHAVE_NETFILTER, it requires dependencies including libevent, libnet, libpcap, and libssl.

Connections are transparently intercepted via netfilter (IP_TRANSPARENT, SOL_IPV6, !IPV6_ORIGINAL_DST) or tproxy and redirected to sslsplit. SSLsplit terminates the intercepted SSL/TLS connection, generates leaf certificates using a provided CA key/cert or generates them dynamically, and initiates a new SSL/TLS connection to the original destination. All data transmitted is logged. It supports SNI for targeting specific sites and uses chroot jails and file storage for captured data.