eCapture is a network security tool that captures SSL/TLS plaintext without requiring a CA certificate using eBPF technology on Linux and Android systems.
The tool solves the problem of inspecting encrypted traffic for security auditing and debugging purposes without needing to install or trust a certificate authority. It works by leveraging eBPF (extended Berkeley Packet Filter) to hook into encryption libraries at the kernel level, intercepting plaintext before it is encrypted or after it is decrypted. This approach operates transparently without modifying applications or their configurations.
eCapture suits security professionals, system administrators, and developers who need to audit encrypted communications on Linux or Android systems running on x86_64 or aarch64 architectures. The tool is particularly valuable for environments where installing CA certificates is impractical or where you need to capture traffic from multiple applications simultaneously. It supports multiple encryption libraries including OpenSSL, LibreSSL, BoringSSL, GnuTLS, and NSPR, as well as Go's native TLS implementation. Beyond TLS capture, the tool includes modules for auditing shell commands in Bash and Zsh, and for capturing SQL queries from MySQL and PostgreSQL databases. Users should be aware that the tool requires root permission or specific Linux capabilities, and kernel version requirements vary by CPU architecture.
The project maintains active development with regular updates to support new library versions and architectures. The codebase is written primarily in C with Go components, reflecting the complexity of kernel-level instrumentation required for this functionality. Documentation includes detailed examples of captured output and guidance on running the tool with minimal required privileges rather than full root access, indicating attention to security best practices in deployment.
