eCapture (旁观者)
Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation.

English · 汉字

[!IMPORTANT] Supports Linux on x86_64 (kernel 4.18+), aarch64 (kernel 5.5+), and LoongArch64 loong64 (kernel 6.6+). Android supports x86_64 and aarch64 with the existing kernel minimums. Requires root privileges or specific Linux capabilities. Does not support Windows or macOS.

---

• Introduction
• Getting started
  • Download
    • ELF binary file
    • Docker image
  • Capture OpenSSL plaintext data
  • Modules
    • OpenSSL module
    • GoTLS module
    • Other modules
  • Videos
• Star History
• Security & operations
• Contributing
• Compilation

Introduction

• Captures plaintext TLS/SSL traffic from OpenSSL, LibreSSL, BoringSSL, GnuTLS, and NSS/NSPR libraries.
• Supports plaintext capture for Go TLS programs, including HTTPS/TLS traffic in Go applications.
• Audits bash and zsh command history for host security monitoring.
• Audits MySQL queries and supports MySQL 5.6/5.7/8.0 and MariaDB.

Run ecapture --help for the commands and flags available in your installed version.

Getting started

Download

ELF binary file

[!TIP] Supports Linux on x86_64, aarch64, and LoongArch64; Android supports x86_64 and aarch64.

Download the ELF binary package from the releases page, extract it, and run:

sudo ecapture --help

Docker image

[!TIP] Linux only.

# Pull the Docker image
docker pull gojue/ecapture:latest

# Run it
docker run --rm --privileged=true --net=host -v ${HOST_PATH}:${CONTAINER_PATH} gojue/ecapture ARGS

⚠️ Security note: --privileged=true grants full host access. For production use, prefer specific capabilities instead. See the Minimum Privileges Guide.

See Docker Hub for more information.

Capture OpenSSL plaintext data

sudo ecapture tls

eCapture automatically detects the system's OpenSSL library and starts capturing plaintext traffic. Generate an HTTPS request with an OpenSSL-linked client to see its captured reads and writes. This synthetic HTTP/1.1 example illustrates the text format:

[2026-01-01 12:00:00.000] PID:1234 TID:1234 Comm:curl FD:5 WRITE (37 bytes):
GET / HTTP/1.1
Host: example.com

📄 For output formats and verification examples, see docs/example-outputs.md.

Modules

The eCapture tool includes 8 modules that can capture plaintext data from TLS/SSL libraries such as OpenSSL, GnuTLS, NSS/NSPR, BoringSSL, and GoTLS. It also supports auditing commands and queries from Bash, MySQL, and PostgreSQL applications.

• bash: captures bash commands
• zsh: captures zsh commands
• gnutls: captures plaintext from GnuTLS libraries without needing a CA certificate
• gotls: captures plaintext communication from Go programs using TLS/HTTPS
• mysqld: captures SQL queries from MySQL 5.6/5.7/8.0 and MariaDB
• nss: captures plaintext from NSS/NSPR libraries without needing a CA certificate
• postgres: captures SQL queries from PostgreSQL 10+
• tls: captures plaintext TLS/SSL traffic without a CA certificate (supports OpenSSL 1.0.x/1.1.x/3.0.x and newer)

You can use ecapture -h to view the full list of subcommands.

OpenSSL module

eCapture searches the default library paths from /etc/ld.so.conf to locate shared libraries and detect the OpenSSL library location. You can also set the library path explicitly with the --libssl flag.

If the target program is statically linked, you can set the program path directly as the value of the --libssl flag.

The OpenSSL module supports three output modes:

• pcap/pcapng mode stores encrypted network packets and TLS secrets in pcap-NG format.
• keylog/key mode saves TLS handshake keys to a file.
• text mode captures plaintext through function hooks by default, or reconstructs complete HTTP/1.1 and HTTP/2 messages from live pcapng and DSB data with --text-source=pcapng.

For OpenSSL, GoTLS, and GnuTLS, --eventaddr is the uniform primary event destination. It accepts stdout, a plain path or file:// URI, tcp://host:port, and ws:///wss:// (ordered binary frames). The mode selects text, NSS Key Log, or pcapng representation; the address selects only the transport. --keylogfile and --pcapfile remain compatible primary-file aliases in their respective modes. Setting --eventaddr together with the corresponding alias is an error. In pcapng mode, --keylogfile is a separate optional keylog artifact.

Live decryption for text output

Use -m text --text-source=pcapng with tls, gotls, or gnutls to reconstruct complete HTTP/1.1 and HTTP/2 messages from the captured network stream. Each message includes direction, timestamp, IP/port tuple, connection identity, and an HTTP/2 stream ID when applicable. host comes from the HTTP Host header or HTTP/2 :authority; domain_source="server_ip" marks a fallback to the server IP. Output goes to --eventaddr (stdout by default). Raw pcapng and a standalone keylog are disabled by default; specify --pcapfile or --keylogfile to save either artifact.