├── package.json
├── node_ssl_logger.js
├── README.md
├── script.js
└── LICENSE


/package.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "name": "node_ssl_logger",
 3 |   "description": "Decrypts and logs a process's SSL traffic using Frida",
 4 |   "author": "Lorenzo Mangani <lorenzo.mangani@gmail.com>",
 5 |   "version": "1.0.13",
 6 |   "dependencies": {
 7 |     "frida": "^11.0.13"
 8 |   },
 9 |   "config": {
10 |     "unsafe-perm": true
11 |   },
12 |   "scripts": {
13 |     "start": "nodejs node_ssl_logger.js"
14 |   },
15 |   "bin": {
16 |     "node_ssl_logger": "./node_ssl_logger.js"
17 |   }
18 | }
19 | 


--------------------------------------------------------------------------------
/node_ssl_logger.js:
--------------------------------------------------------------------------------
 1 | /*
 2 | 
 3 |   node_ssl_logger: Decrypts and logs a process's SSL traffic via Frida Code Injection
 4 |   Code based on https://github.com/google/ssl_logger
 5 |   2017, QXIP BV, Lorenzo Mangani <lorenzo.mangani@gmail.com>
 6 | 
 7 | */
 8 | 
 9 | var frida = require('frida');
10 | var fs = require('fs');
11 | var filename = './script.js';
12 | var fsscript;
13 | var debug = false;
14 | var quit = function(code,msg){
15 | 	if (msg) console.log(msg)
16 | 	process.exit(code ? code : 0);
17 | }
18 | 
19 | if(process.argv.indexOf("-p") != -1){ var pid = process.argv[process.argv.indexOf("-p") + 1]; }
20 | if(process.argv.indexOf("-v") != -1){ debug = true; }
21 | 
22 | try {
23 |       fs.readFile(filename, function read(err, data) {
24 |         if (!err) {
25 | 		fsscript = data.toString();
26 |         } else { quit(1,err); }
27 |       });
28 | } catch(e) { quit(1,'Failed loading script!'); }
29 | 
30 | if (!pid){ process.exit(1);}
31 | frida.attach(pid)
32 | .then(function (session) {
33 |   if (debug) console.log('attached:', session);
34 |   return session.createScript(fsscript);
35 | })
36 | .then(function (script) {
37 |   if(debug) { console.log('script created:', script); }
38 |   console.log('Press Ctrl+C to stop logging...');
39 |   script.events.listen('message', function (message, data) {
40 |     if(data.length >0) {
41 |     	if (debug) console.log('message from script:', message );
42 |     	console.log(data.toString('utf8'));
43 |     }
44 |   });
45 |   script.load();
46 | })
47 | .catch(function (error) {
48 |   console.log('error:', error.message);
49 | });
50 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | <img src="https://cdn.pixabay.com/photo/2012/04/16/13/32/lock-36018_640.png" width="50"/>
 2 | 
 3 | # node_ssl_logger
 4 | Decrypts and logs a process's SSL traffic via Frida Code Injection
 5 | 
 6 | The functionality offered by **node_ssl_logger** is intended to mimic Google's [ssl_logger](https://github.com/google/ssl_logger) and [Echo Mirage](http://resources.infosecinstitute.com/echo-mirage-walkthrough/)'s SSL logging functionality on NodeJS/Linux
 7 | 
 8 | Status:
 9 | * Experimental! Please use the original! (unless you hate python)
10 | 
11 | ## Requirements
12 | 
13 | This program uses the frida framework to perform code injection.
14 | 
15 | Frida can be installed as follows: ```sudo pip install frida```
16 | 
17 | ## Installation
18 | ```
19 | npm install
20 | ```
21 | 
22 | ## Usage
23 | ```
24 | nodejs node_ssl_logger.js -p <process>
25 | ```
26 | 
27 | #### Example
28 | ```
29 | # Make a local pipe for input to our openssl client
30 | $ mkfifo pipe
31 | 
32 | # Create our openssl client, which will receive input from our pipe
33 | $ openssl s_client -ign_eof -connect example.org:443 > /dev/null 2> /dev/null < pipe &
34 | [1] 98954
35 | 
36 | # Begin writing the request to our pipe
37 | $ printf "GET / HTTP/1.0\nHost:example.org\n" > pipe
38 | 
39 | # Begin logging the SSL traffic for our openssl client process
40 | $ nodejs node_ssl_logger.js -p openssl &
41 | [2] 98962
42 | Press Ctrl+C to stop logging.
43 | 
44 | # Write the final line-feed to our pipe to complete the HTTP request
45 | $ printf "\n" > pipe
46 | 
47 | # Check the output for magic!
48 | ```
49 | 
50 | ## Todo
51 | 
52 | * pcap export
53 | * plenty other things
54 | 
55 | #### Credits
56 | Script and Examples based on Jason Geffner's python [ssl_logger](https://github.com/google/ssl_logger)
57 | 
58 | 
59 | 


--------------------------------------------------------------------------------
/script.js:
--------------------------------------------------------------------------------
  1 | /*
  2 |   https://github.com/google/ssl_logger
  3 | */
  4 |   function initializeGlobals()
  5 |   {
  6 |     addresses = {};
  7 |     var resolver = new ApiResolver("module");
  8 |     var exps = [
  9 |       ["*libssl*",
 10 |         ["SSL_read", "SSL_write", "SSL_get_fd", "SSL_get_session",
 11 |         "SSL_SESSION_get_id"]],
 12 |       [Process.platform == "darwin" ? "*libsystem*" : "*libc*",
 13 |         ["getpeername", "getsockname", "ntohs", "ntohl"]]
 14 |       ];
 15 |     for (var i = 0; i < exps.length; i++)
 16 |     {
 17 |       var lib = exps[i][0];
 18 |       var names = exps[i][1];
 19 |       for (var j = 0; j < names.length; j++)
 20 |       {
 21 |         var name = names[j];
 22 |         var matches = resolver.enumerateMatchesSync("exports:" + lib + "!" +
 23 |           name);
 24 |         if (matches.length == 0)
 25 |         {
 26 |           throw "Could not find " + lib + "!" + name;
 27 |         }
 28 |         else if (matches.length != 1)
 29 |         {
 30 |           // Sometimes Frida returns duplicates.
 31 |           var address = 0;
 32 |           var s = "";
 33 |           var duplicates_only = true;
 34 |           for (var k = 0; k < matches.length; k++)
 35 |           {
 36 |             if (s.length != 0)
 37 |             {
 38 |               s += ", ";
 39 |             }
 40 |             s += matches[k].name + "@" + matches[k].address;
 41 |             if (address == 0)
 42 |             {
 43 |               address = matches[k].address;
 44 |             }
 45 |             else if (!address.equals(matches[k].address))
 46 |             {
 47 |               duplicates_only = false;
 48 |             }
 49 |           }
 50 |           if (!duplicates_only)
 51 |           {
 52 |             throw "More than one match found for " + lib + "!" + name + ": " +
 53 |               s;
 54 |           }
 55 |         }
 56 |         addresses[name] = matches[0].address;
 57 |       }
 58 |     }
 59 |     SSL_get_fd = new NativeFunction(addresses["SSL_get_fd"], "int",
 60 |       ["pointer"]);
 61 |     SSL_get_session = new NativeFunction(addresses["SSL_get_session"],
 62 |       "pointer", ["pointer"]);
 63 |     SSL_SESSION_get_id = new NativeFunction(addresses["SSL_SESSION_get_id"],
 64 |       "pointer", ["pointer", "pointer"]);
 65 |     getpeername = new NativeFunction(addresses["getpeername"], "int", ["int",
 66 |       "pointer", "pointer"]);
 67 |     getsockname = new NativeFunction(addresses["getsockname"], "int", ["int",
 68 |       "pointer", "pointer"]);
 69 |     ntohs = new NativeFunction(addresses["ntohs"], "uint16", ["uint16"]);
 70 |     ntohl = new NativeFunction(addresses["ntohl"], "uint32", ["uint32"]);
 71 |   }
 72 |   initializeGlobals();
 73 |   /**
 74 |    * Returns a dictionary of a sockfd's "src_addr", "src_port", "dst_addr", and
 75 |    * "dst_port".
 76 |    * @param {int} sockfd The file descriptor of the socket to inspect.
 77 |    * @param {boolean} isRead If true, the context is an SSL_read call. If
 78 |    *     false, the context is an SSL_write call.
 79 |    * @return {dict} Dictionary of sockfd's "src_addr", "src_port", "dst_addr",
 80 |    *     and "dst_port".
 81 |    */
 82 |   function getPortsAndAddresses(sockfd, isRead)
 83 |   {
 84 |     var message = {};
 85 |     var addrlen = Memory.alloc(4);
 86 |     var addr = Memory.alloc(16);
 87 |     var src_dst = ["src", "dst"];
 88 |     for (var i = 0; i < src_dst.length; i++)
 89 |     {
 90 |       Memory.writeU32(addrlen, 16);
 91 |       if ((src_dst[i] == "src") ^ isRead)
 92 |       {
 93 |         getsockname(sockfd, addr, addrlen);
 94 |       }
 95 |       else
 96 |       {
 97 |         getpeername(sockfd, addr, addrlen);
 98 |       }
 99 |       message[src_dst[i] + "_port"] = ntohs(Memory.readU16(addr.add(2)));
100 |       message[src_dst[i] + "_addr"] = ntohl(Memory.readU32(addr.add(4)));
101 |     }
102 |     return message;
103 |   }
104 |   /**
105 |    * Get the session_id of SSL object and return it as a hex string.
106 |    * @param {!NativePointer} ssl A pointer to an SSL object.
107 |    * @return {dict} A string representing the session_id of the SSL object's
108 |    *     SSL_SESSION. For example,
109 |    *     "59FD71B7B90202F359D89E66AE4E61247954E28431F6C6AC46625D472FF76336".
110 |    */
111 |   function getSslSessionId(ssl)
112 |   {
113 |     var session = SSL_get_session(ssl);
114 |     if (session == 0)
115 |     {
116 |       return 0;
117 |     }
118 |     var len = Memory.alloc(4);
119 |     var p = SSL_SESSION_get_id(session, len);
120 |     len = Memory.readU32(len);
121 |     var session_id = "";
122 |     for (var i = 0; i < len; i++)
123 |     {
124 |       // Read a byte, convert it to a hex string (0xAB ==> "AB"), and append
125 |       // it to session_id.
126 |       session_id +=
127 |         ("0" + Memory.readU8(p.add(i)).toString(16).toUpperCase()).substr(-2);
128 |     }
129 |     return session_id;
130 |   }
131 |   Interceptor.attach(addresses["SSL_read"],
132 |   {
133 |     onEnter: function (args)
134 |     {
135 |       var message = getPortsAndAddresses(SSL_get_fd(args[0]), true);
136 |       message["ssl_session_id"] = getSslSessionId(args[0]);
137 |       message["function"] = "SSL_read";
138 |       this.message = message;
139 |       this.buf = args[1];
140 |     },
141 |     onLeave: function (retval)
142 |     {
143 |       retval |= 0; // Cast retval to 32-bit integer.
144 |       if (retval <= 0)
145 |       {
146 |         return;
147 |       }
148 |       send(this.message, Memory.readByteArray(this.buf, retval));
149 |     }
150 |   });
151 |   Interceptor.attach(addresses["SSL_write"],
152 |   {
153 |     onEnter: function (args)
154 |     {
155 |       var message = getPortsAndAddresses(SSL_get_fd(args[0]), false);
156 |       message["ssl_session_id"] = getSslSessionId(args[0]);
157 |       message["function"] = "SSL_write";
158 |       send(message, Memory.readByteArray(args[1], parseInt(args[2])));
159 |     },
160 |     onLeave: function (retval)
161 |     {
162 |     }
163 |   });
164 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
  1 |                                  Apache License
  2 |                            Version 2.0, January 2004
  3 |                         http://www.apache.org/licenses/
  4 | 
  5 |    TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
  6 | 
  7 |    1. Definitions.
  8 | 
  9 |       "License" shall mean the terms and conditions for use, reproduction,
 10 |       and distribution as defined by Sections 1 through 9 of this document.
 11 | 
 12 |       "Licensor" shall mean the copyright owner or entity authorized by
 13 |       the copyright owner that is granting the License.
 14 | 
 15 |       "Legal Entity" shall mean the union of the acting entity and all
 16 |       other entities that control, are controlled by, or are under common
 17 |       control with that entity. For the purposes of this definition,
 18 |       "control" means (i) the power, direct or indirect, to cause the
 19 |       direction or management of such entity, whether by contract or
 20 |       otherwise, or (ii) ownership of fifty percent (50%) or more of the
 21 |       outstanding shares, or (iii) beneficial ownership of such entity.
 22 | 
 23 |       "You" (or "Your") shall mean an individual or Legal Entity
 24 |       exercising permissions granted by this License.
 25 | 
 26 |       "Source" form shall mean the preferred form for making modifications,
 27 |       including but not limited to software source code, documentation
 28 |       source, and configuration files.
 29 | 
 30 |       "Object" form shall mean any form resulting from mechanical
 31 |       transformation or translation of a Source form, including but
 32 |       not limited to compiled object code, generated documentation,
 33 |       and conversions to other media types.
 34 | 
 35 |       "Work" shall mean the work of authorship, whether in Source or
 36 |       Object form, made available under the License, as indicated by a
 37 |       copyright notice that is included in or attached to the work
 38 |       (an example is provided in the Appendix below).
 39 | 
 40 |       "Derivative Works" shall mean any work, whether in Source or Object
 41 |       form, that is based on (or derived from) the Work and for which the
 42 |       editorial revisions, annotations, elaborations, or other modifications
 43 |       represent, as a whole, an original work of authorship. For the purposes
 44 |       of this License, Derivative Works shall not include works that remain
 45 |       separable from, or merely link (or bind by name) to the interfaces of,
 46 |       the Work and Derivative Works thereof.
 47 | 
 48 |       "Contribution" shall mean any work of authorship, including
 49 |       the original version of the Work and any modifications or additions
 50 |       to that Work or Derivative Works thereof, that is intentionally
 51 |       submitted to Licensor for inclusion in the Work by the copyright owner
 52 |       or by an individual or Legal Entity authorized to submit on behalf of
 53 |       the copyright owner. For the purposes of this definition, "submitted"
 54 |       means any form of electronic, verbal, or written communication sent
 55 |       to the Licensor or its representatives, including but not limited to
 56 |       communication on electronic mailing lists, source code control systems,
 57 |       and issue tracking systems that are managed by, or on behalf of, the
 58 |       Licensor for the purpose of discussing and improving the Work, but
 59 |       excluding communication that is conspicuously marked or otherwise
 60 |       designated in writing by the copyright owner as "Not a Contribution."
 61 | 
 62 |       "Contributor" shall mean Licensor and any individual or Legal Entity
 63 |       on behalf of whom a Contribution has been received by Licensor and
 64 |       subsequently incorporated within the Work.
 65 | 
 66 |    2. Grant of Copyright License. Subject to the terms and conditions of
 67 |       this License, each Contributor hereby grants to You a perpetual,
 68 |       worldwide, non-exclusive, no-charge, royalty-free, irrevocable
 69 |       copyright license to reproduce, prepare Derivative Works of,
 70 |       publicly display, publicly perform, sublicense, and distribute the
 71 |       Work and such Derivative Works in Source or Object form.
 72 | 
 73 |    3. Grant of Patent License. Subject to the terms and conditions of
 74 |       this License, each Contributor hereby grants to You a perpetual,
 75 |       worldwide, non-exclusive, no-charge, royalty-free, irrevocable
 76 |       (except as stated in this section) patent license to make, have made,
 77 |       use, offer to sell, sell, import, and otherwise transfer the Work,
 78 |       where such license applies only to those patent claims licensable
 79 |       by such Contributor that are necessarily infringed by their
 80 |       Contribution(s) alone or by combination of their Contribution(s)
 81 |       with the Work to which such Contribution(s) was submitted. If You
 82 |       institute patent litigation against any entity (including a
 83 |       cross-claim or counterclaim in a lawsuit) alleging that the Work
 84 |       or a Contribution incorporated within the Work constitutes direct
 85 |       or contributory patent infringement, then any patent licenses
 86 |       granted to You under this License for that Work shall terminate
 87 |       as of the date such litigation is filed.
 88 | 
 89 |    4. Redistribution. You may reproduce and distribute copies of the
 90 |       Work or Derivative Works thereof in any medium, with or without
 91 |       modifications, and in Source or Object form, provided that You
 92 |       meet the following conditions:
 93 | 
 94 |       (a) You must give any other recipients of the Work or
 95 |           Derivative Works a copy of this License; and
 96 | 
 97 |       (b) You must cause any modified files to carry prominent notices
 98 |           stating that You changed the files; and
 99 | 
100 |       (c) You must retain, in the Source form of any Derivative Works
101 |           that You distribute, all copyright, patent, trademark, and
102 |           attribution notices from the Source form of the Work,
103 |           excluding those notices that do not pertain to any part of
104 |           the Derivative Works; and
105 | 
106 |       (d) If the Work includes a "NOTICE" text file as part of its
107 |           distribution, then any Derivative Works that You distribute must
108 |           include a readable copy of the attribution notices contained
109 |           within such NOTICE file, excluding those notices that do not
110 |           pertain to any part of the Derivative Works, in at least one
111 |           of the following places: within a NOTICE text file distributed
112 |           as part of the Derivative Works; within the Source form or
113 |           documentation, if provided along with the Derivative Works; or,
114 |           within a display generated by the Derivative Works, if and
115 |           wherever such third-party notices normally appear. The contents
116 |           of the NOTICE file are for informational purposes only and
117 |           do not modify the License. You may add Your own attribution
118 |           notices within Derivative Works that You distribute, alongside
119 |           or as an addendum to the NOTICE text from the Work, provided
120 |           that such additional attribution notices cannot be construed
121 |           as modifying the License.
122 | 
123 |       You may add Your own copyright statement to Your modifications and
124 |       may provide additional or different license terms and conditions
125 |       for use, reproduction, or distribution of Your modifications, or
126 |       for any such Derivative Works as a whole, provided Your use,
127 |       reproduction, and distribution of the Work otherwise complies with
128 |       the conditions stated in this License.
129 | 
130 |    5. Submission of Contributions. Unless You explicitly state otherwise,
131 |       any Contribution intentionally submitted for inclusion in the Work
132 |       by You to the Licensor shall be under the terms and conditions of
133 |       this License, without any additional terms or conditions.
134 |       Notwithstanding the above, nothing herein shall supersede or modify
135 |       the terms of any separate license agreement you may have executed
136 |       with Licensor regarding such Contributions.
137 | 
138 |    6. Trademarks. This License does not grant permission to use the trade
139 |       names, trademarks, service marks, or product names of the Licensor,
140 |       except as required for reasonable and customary use in describing the
141 |       origin of the Work and reproducing the content of the NOTICE file.
142 | 
143 |    7. Disclaimer of Warranty. Unless required by applicable law or
144 |       agreed to in writing, Licensor provides the Work (and each
145 |       Contributor provides its Contributions) on an "AS IS" BASIS,
146 |       WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
147 |       implied, including, without limitation, any warranties or conditions
148 |       of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
149 |       PARTICULAR PURPOSE. You are solely responsible for determining the
150 |       appropriateness of using or redistributing the Work and assume any
151 |       risks associated with Your exercise of permissions under this License.
152 | 
153 |    8. Limitation of Liability. In no event and under no legal theory,
154 |       whether in tort (including negligence), contract, or otherwise,
155 |       unless required by applicable law (such as deliberate and grossly
156 |       negligent acts) or agreed to in writing, shall any Contributor be
157 |       liable to You for damages, including any direct, indirect, special,
158 |       incidental, or consequential damages of any character arising as a
159 |       result of this License or out of the use or inability to use the
160 |       Work (including but not limited to damages for loss of goodwill,
161 |       work stoppage, computer failure or malfunction, or any and all
162 |       other commercial damages or losses), even if such Contributor
163 |       has been advised of the possibility of such damages.
164 | 
165 |    9. Accepting Warranty or Additional Liability. While redistributing
166 |       the Work or Derivative Works thereof, You may choose to offer,
167 |       and charge a fee for, acceptance of support, warranty, indemnity,
168 |       or other liability obligations and/or rights consistent with this
169 |       License. However, in accepting such obligations, You may act only
170 |       on Your own behalf and on Your sole responsibility, not on behalf
171 |       of any other Contributor, and only if You agree to indemnify,
172 |       defend, and hold each Contributor harmless for any liability
173 |       incurred by, or claims asserted against, such Contributor by reason
174 |       of your accepting any such warranty or additional liability.
175 | 
176 |    END OF TERMS AND CONDITIONS
177 | 
178 |    APPENDIX: How to apply the Apache License to your work.
179 | 
180 |       To apply the Apache License to your work, attach the following
181 |       boilerplate notice, with the fields enclosed by brackets "{}"
182 |       replaced with your own identifying information. (Don't include
183 |       the brackets!)  The text should be enclosed in the appropriate
184 |       comment syntax for the file format. We also recommend that a
185 |       file or class name and description of purpose be included on the
186 |       same "printed page" as the copyright notice for easier
187 |       identification within third-party archives.
188 | 
189 |    Copyright {yyyy} {name of copyright owner}
190 | 
191 |    Licensed under the Apache License, Version 2.0 (the "License");
192 |    you may not use this file except in compliance with the License.
193 |    You may obtain a copy of the License at
194 | 
195 |        http://www.apache.org/licenses/LICENSE-2.0
196 | 
197 |    Unless required by applicable law or agreed to in writing, software
198 |    distributed under the License is distributed on an "AS IS" BASIS,
199 |    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
200 |    See the License for the specific language governing permissions and
201 |    limitations under the License.
202 | 


--------------------------------------------------------------------------------