EBPF program to extract data from HTTPS traffic using MITM proxy and Java

Using eBPF (extended Berkeley Packet Filter) to extract data from HTTPS traffic is a highly specialized and advanced task that involves a few key steps and technologies. eBPF is typically used for monitoring and filtering network packets at a very low level within the Linux kernel, and it can be extended to capture network traffic. However, HTTPS traffic is encrypted, so even if you capture the traffic with eBPF, the payload will still be encrypted unless you have the decryption key (like a session key or the server's private key, which is generally not accessible unless you're doing a man-in-the-middle attack in a controlled environment). Problem statement and uses To generate logs without the need to write any separate application code. Just installing this will generate the logs. Key Concepts: eBPF: A powerful framework for running custom programs inside the Linux kernel that can hook into various network events (e.g., packet capture, system calls, etc.). HTTPS: Secure communication over HTTP using SSL/TLS encryption. Traffic captured at the network level will be encrypted unless decrypted by an entity that has access to the encryption keys. High-Level Flow to Extract HTTPS Traffic Using eBPF and Java:  Capture HTTPS Traffic with eBPF: eBPF is capable of intercepting network traffic, but it operates at a kernel level. It’s primarily used for network packet analysis, tracing system calls, and monitoring low-level system behavior. However, HTTPS traffic is encrypted (using SSL/TLS), so you can only see the encrypted packets unless you're able to decrypt them, which requires access to the decryption keys.  Decrypt the Traffic: For decrypting HTTPS traffic in real time, you’ll need to either: Use SSL/TLS interception (man-in-the-middle) where you control the certificate and key exchange. Or use key logging to capture the session keys if you have control over the system and can enable key logging in the browser or client.  Extract Data in Java: Once the traffic is decrypted, you can use a packet capture tool to grab the HTTP request/response and headers. You can use libraries like pcap4j to capture packets in Java. Components: eBPF Program: Captures network packets. Java Program: Interacts with the eBPF output (e.g., using a library to read and process network traffic). Traffic Decryption (Optional): You would need to decrypt the traffic using SSL/TLS libraries or tools like mitmproxy, openssl, or other decryption methods. How to extract the data using below method Man-in-the-Middle Proxy (MITM) Method you can use a MITM proxy like mitmproxy or Burp Suite. These proxies act as intermediaries between the client and the server, decrypting the HTTPS traffic as it passes through. Steps for using mitmproxy: Install mitmproxy: You can install it using Python’s pip: bash pip install mitmproxy Start mitmproxy: Start the proxy on a port (e.g., 8080): bash mitmproxy -p 8080 Configure your client: Set your client or browser to use the proxy. In Chrome, for instance, you can do this by configuring the HTTP/HTTPS proxy settings to point to localhost:8080. Trust the mitmproxy certificate: Mitmproxy will generate a self-signed certificate for HTTPS decryption. Install the generated certificate (~/.mitmproxy/mitmproxy-ca-cert.pem) as a trusted certificate in your client (browser or application) to prevent SSL errors. Start intercepting traffic: Once the proxy is set up and the traffic is flowing through it, mitmproxy will decrypt the HTTPS traffic and you will be able to inspect the plaintext data. So, your Application or load balancer should Redirect all traffic through the MITM proxy ie, to the port opened by MITM proxy. So proxy listen to that port and once traffic is received by the proxy, it extracts the request using the master key. Once the message is decrypted you can write that to a log file and forward the request to the actual application end point. So the flow will be as below LB/App sends traffic to MITM proxy port – MITM listens to that port and extracts the message – Forward to the backend real application port. And application receives the request and process it. Processing and Output in Java: Once the eBPF program is capturing traffic, you need to feed the captured data to Java for processing and output. This can be done by: Using a user-space program (e.g., bcc, libbpf, or bpftool) to interact with the eBPF program. Sending packet data to Java through inter-process communication (IPC), such as using sockets, files, or shared memory. Example in Java to Capture eBPF Output: You can write a Java program that opens a socket or listens to a file where the eBPF program dumps the captured packets. Java Code to Handle Traffic: `import java.io.; import java.net.; public class MITMAppProxy { public static void main(String[] args) throws IOException { int port = 9090; // Example listening port ServerSocket serverSocket = new ServerSocket(port); Syst

Feb 19, 2025 - 02:43

EBPF program to extract data from HTTPS traffic using MITM proxy and Java

Using eBPF (extended Berkeley Packet Filter) to extract data from HTTPS traffic is a highly specialized and advanced task that involves a few key steps and technologies. eBPF is typically used for monitoring and filtering network packets at a very low level within the Linux kernel, and it can be extended to capture network traffic.

However, HTTPS traffic is encrypted, so even if you capture the traffic with eBPF, the payload will still be encrypted unless you have the decryption key (like a session key or the server's private key, which is generally not accessible unless you're doing a man-in-the-middle attack in a controlled environment).

Problem statement and uses
To generate logs without the need to write any separate application code. Just installing this will generate the logs.
Key Concepts:
eBPF: A powerful framework for running custom programs inside the Linux kernel that can hook into various network events (e.g., packet capture, system calls, etc.).
HTTPS: Secure communication over HTTP using SSL/TLS encryption. Traffic captured at the network level will be encrypted unless decrypted by an entity that has access to the encryption keys.

High-Level Flow to Extract HTTPS Traffic Using eBPF and Java:
 Capture HTTPS Traffic with eBPF:
eBPF is capable of intercepting network traffic, but it operates at a kernel level. It’s primarily used for network packet analysis, tracing system calls, and monitoring low-level system behavior.
However, HTTPS traffic is encrypted (using SSL/TLS), so you can only see the encrypted packets unless you're able to decrypt them, which requires access to the decryption keys.

 Decrypt the Traffic:
For decrypting HTTPS traffic in real time, you’ll need to either:
Use SSL/TLS interception (man-in-the-middle) where you control the certificate and key exchange.
Or use key logging to capture the session keys if you have control over the system and can enable key logging in the browser or client.

 Extract Data in Java:
Once the traffic is decrypted, you can use a packet capture tool to grab the HTTP request/response and headers. You can use libraries like pcap4j to capture packets in Java.

Components:
eBPF Program: Captures network packets.
Java Program: Interacts with the eBPF output (e.g., using a library to read and process network traffic).
Traffic Decryption (Optional): You would need to decrypt the traffic using SSL/TLS libraries or tools like mitmproxy, openssl, or other decryption methods.

How to extract the data using below method
Man-in-the-Middle Proxy (MITM) Method
you can use a MITM proxy like mitmproxy or Burp Suite. These proxies act as intermediaries between the client and the server, decrypting the HTTPS traffic as it passes through.

Steps for using mitmproxy:

Install mitmproxy: You can install it using Python’s pip:

bash
pip install mitmproxy

Start mitmproxy: Start the proxy on a port (e.g., 8080):

bash
mitmproxy -p 8080

Configure your client: Set your client or browser to use the proxy. In Chrome, for instance, you can do this by configuring the HTTP/HTTPS proxy settings to point to localhost:8080.
Trust the mitmproxy certificate: Mitmproxy will generate a self-signed certificate for HTTPS decryption. Install the generated certificate (~/.mitmproxy/mitmproxy-ca-cert.pem) as a trusted certificate in your client (browser or application) to prevent SSL errors.
Start intercepting traffic: Once the proxy is set up and the traffic is flowing through it, mitmproxy will decrypt the HTTPS traffic and you will be able to inspect the plaintext data. So, your Application or load balancer should Redirect all traffic through the MITM proxy ie, to the port opened by MITM proxy. So proxy listen to that port and once traffic is received by the proxy, it extracts the request using the master key. Once the message is decrypted you can write that to a log file and forward the request to the actual application end point. So the flow will be as below LB/App sends traffic to MITM proxy port – MITM listens to that port and extracts the message – Forward to the backend real application port. And application receives the request and process it.

Processing and Output in Java:
Once the eBPF program is capturing traffic, you need to feed the captured data to Java for processing and output. This can be done by:
Using a user-space program (e.g., bcc, libbpf, or bpftool) to interact with the eBPF program.
Sending packet data to Java through inter-process communication (IPC), such as using sockets, files, or shared memory.
Example in Java to Capture eBPF Output:
You can write a Java program that opens a socket or listens to a file where the eBPF program dumps the captured packets.
Java Code to Handle Traffic:

`import java.io.*;
import java.net.*;

public class MITMAppProxy {
    public static void main(String[] args) throws IOException {
        int port = 9090; // Example listening port
        ServerSocket serverSocket = new ServerSocket(port);
        System.out.println("MITM App Proxy Listening on port " + port);

        // Handle incoming traffic
        while (true) {
            Socket clientSocket = serverSocket.accept();
            handleClient(clientSocket);
        }
    }

    private static void handleClient(Socket clientSocket) {
        try {
            BufferedReader in = new BufferedReader(new InputStreamReader(clientSocket.getInputStream()));
            PrintWriter out = new PrintWriter(clientSocket.getOutputStream(), true);

            String requestLine;
            while ((requestLine = in.readLine()) != null) {
                System.out.println("Received from client: " + requestLine);
                // Process the request here (e.g., modify packets if needed)
                out.println("HTTP/1.1 200 OK");
                out.println("Content-Type: text/plain");
                out.println("");
                out.println("MITM App Proxy Response");
            }
        } catch (IOException e) {
            e.printStackTrace();
        }
    }
}

Putting It All Together: eBPF program is running on the kernel side, capturing packets and logging or modifying them. MITM App proxy will forward the intercepted traffic to Java for further processing. Java program listens to the traffic and outputs or modifies it as needed.

To bundle your project (including the eBPF program, Java code, and proxy setup) into a JAR (for Java) or RPM (for deployment on Linux systems), you'll need to follow specific steps for each type of package.

Bundle as a JAR File (Java Project) You can bundle your Java application (the MITM proxy, which processes network traffic captured by eBPF) into a JAR (Java ARchive) file. Here's how: **** **Step-by-Step Guide to Create a JAR: **1. Organize Your Project: Make sure your project is structured as follows:

graphql my-mitm-proxy/ ├── src/ │ ├── Main.java │ ├── MITMAppProxy.java ├── lib/ ├── eBPF/ # If you have a directory for eBPF code └── build.gradle (or pom.xml) # For build configuration if using Gradle or Maven

Using Maven (or Gradle): If you're using Maven, here’s a pom.xml template for building a JAR:

`

4.0.0

com.example
mitm-proxy
1.0-SNAPSHOT
jar


    



    
        
            org.apache.maven.plugins
            maven-jar-plugin
            3.1.0
            
                
                    
                        jar

For Gradle:

`
plugins {
id 'java'
}

group 'com.example'
version '1.0-SNAPSHOT'

repositories {
mavenCentral()
}

dependencies {
implementation 'org.apache.logging.log4j:log4j-api:2.14.1'
}

jar {
archiveBaseName = 'mitm-proxy'
archiveVersion = '1.0.0'
}
`

Build the JAR: For Maven: Run the following in the project directory:

`
mvn clean package

`
This will generate a .jar file in the target/ directory.
For Gradle: Run the following in the project directory:

`
gradle clean build

`
The .jar will be found in the build/libs/ directory.

Running the JAR: To run the generated JAR, use the following command:

`
java -jar target/mitm-proxy-1.0-SNAPSHOT.jar

Bundle eBPF Program and MITM Proxy into an RPM Package To bundle both the eBPF program and Java MITM proxy into an RPM package for distribution on Linux systems, follow these steps: Step-by-Step Guide to Create an RPM:
Prepare eBPF Program: If you have the eBPF program written in C (like shown in the earlier example), compile it into an object file (.o) first.

`
gcc -o capture.o -c capture.c

Prepare Your Directory Structure for RPM: Create a directory structure for the RPM package: perl

my-mitm-proxy-rpm/
├── BUILD/
├── RPMS/
├── SOURCES/
├── SPECS/
│ └── mitm-proxy.spec
└── SRPMS/
`

Create a Spec File (mitm-proxy.spec): Create a .spec file inside the SPECS/ directory to describe the build process for your RPM package. Below is a basic mitm-proxy.spec example: spec

Name: mitm-proxy
Version: 1.0
Release: 1%{?dist}
Summary: MITM Proxy using eBPF

License: GPL
URL: http://example.com
Source0: mitm-proxy-1.0.tar.gz

BuildRequires: java-11-openjdk-devel, gcc
Requires: java-11-openjdk

%description
A man-in-the-middle proxy application that uses eBPF to capture and log network traffic.

%prep
%setup -q

%build
gcc -o capture.o -c eBPF/capture.c
javac src/*.java

%install
mkdir -p %{buildroot}/usr/local/bin
cp capture.o %{buildroot}/usr/local/bin/capture.o
cp target/mitm-proxy-1.0-SNAPSHOT.jar %{buildroot}/usr/local/bin/mitm-proxy.jar

%files
/usr/local/bin/capture.o
/usr/local/bin/mitm-proxy.jar

%changelog

Thu Feb 17 2025 Your Name youremail@example.com - 1.0-1
Initial release
Prepare the Sources: Put the mitm-proxy-1.0.tar.gz source archive in the SOURCES/ directory. This should include the Java code, eBPF program, and any other necessary files. You can create the tar archive using: bash Copy tar czf mitm-proxy-1.0.tar.gz my-mitm-proxy/ mv mitm-proxy-1.0.tar.gz SOURCES/
Build the RPM: Once the spec file and sources are in place, use the rpmbuild command to create the RPM package: bash rpmbuild -ba SPECS/mitm-proxy.spec
Install the RPM: Once built, the RPM package will be in the RPMS/ directory. You can install it on a Linux system using: bash sudo rpm -ivh RPMS/x86_64/mitm-proxy-1.0-1.x86_64.rpm
Final Steps: After bundling your eBPF program and MITM proxy into a JAR or RPM, you can: Distribute the JAR: Users can run the MITM proxy directly with java -jar. Install RPM on Linux: The RPM will install everything, including the compiled eBPF program, Java JAR, and any configuration files you need to provide.