ecapture

gojue/ecapture

Capture plaintext SSL/TLS traffic with eBPF without a CA proxy

PersonalEnterpriseDeveloper toolsSecurity & identityDocker / self-hostMobileCLIPermissive

At a glance

stars on GitHub
16k
contributors
59+
last commit
latest release, last week
v2.9.0
license
Apache-2.0

About

eCapture is an eBPF-based traffic interception and security auditing tool for Linux and Android. It captures plaintext TLS and SSL traffic without requiring MITM proxies or custom CA certificates, and records command history and database queries. It runs via a command-line binary or as a privileged Docker container.

From the repository: “Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. Supports Linux and Android on x86_64 and arm64.”

Latest release: eCapture v2.9.0, . Its files were downloaded 419 times.

All files (10)

To check the files: checksum-v2.9.0.txt, checksum-loong64-v2.9.0.txt

These files come from the project's GitHub release. DigGitHub does not check them.

ecapture and its alternatives: GitHub stars, last commit, license and worth score
ProjectStarsLast commitLicenseWorth
ecaptureThis project
16kApache-2.078
mitmproxyInteractive TLS-capable intercepting proxy
47kMIT88 (best)
acme.shPure shell ACME client for TLS certificates
48k (best)GPL-3.081
CiliumeBPF-based networking and security
26kApache-2.080
AFLplusplusState-of-the-art coverage-guided fuzzer based on AFL
6.8kAGPL-3.078

▲ marks the most stars and the best worth score.

ecapture.cc
Preview of ecapture
Preview of ecapture at ecapture.cc

Topics