G
gojue/ecapture
Ecapture
Ecapture is a suite of specialized auditing tools designed to capture plaintext database queries, log executed shell commands, forward packet captures, and decrypt TLS traffic.
The system extracts plaintext content from encrypted communications and TLS master secrets without requiring CA certificates. It further monitors data interactions by capturing SQL queries from database instances and recording commands from shell environments for host-level auditing.
The toolset includes capabilities for network traffic analysis, exporting captured data to pcapng files, and forwarding events to external packet analysis software. It also provides an interface to modify capture parameters and tool settings in real time via HTTP.
Features
- Traffic Decryption - Hooks into library functions to intercept and decrypt TLS-encrypted network traffic for plaintext analysis.
- Library Function Hooking - Uses library-level hooking to intercept and extract plaintext data from encryption and database libraries.
- TLS Plaintext Extractions - Extracts plaintext content from encrypted communication across various libraries without needing CA certificates.
- TLS Session Key Extractions - Extracts TLS master secrets from memory to enable external decryption of recorded network traffic.
- Database Query Logging - Captures plaintext SQL queries from database instances to audit data interactions.
- Network Traffic Analysis - Analyzes network traffic by exporting captured data to pcapng files or forwarding to external analysis tools.
- Shell Command Auditing - Records executed shell commands to monitor system activity and facilitate host-level security auditing.
- Pcapng File Exports - Saves captured network traffic into Pcapng format including embedded decryption secrets for analysis.
- Dynamic Configuration - Allows the dynamic update of capture parameters and tool settings via HTTP while processes are actively running.
- Packet Stream Exports - Provides real-time streaming of captured network packets to both local storage and external analysis software.
- Packet Fragmentation and Reassembly - Reassembles fragmented network traffic in user-space to reconstruct plaintext events for security auditing.
- Dynamic Configuration Interfaces - Ships an HTTP-based interface for modifying capture parameters and tool settings during runtime without process restarts.
- Dynamic Configuration APIs - Provides a dynamic configuration API via HTTP to update tool settings without restarting the capture process.
- Network Event Forwarders - Forwards captured network events to third-party software for detailed external analysis.
- Traffic Event Forwarders - Acts as a bridge that forwards captured traffic events to third-party packet analysis software.
- Security Lab Environments - Tool for capturing encrypted traffic using eBPF.
