A tool for real-time SSL/TLS key extraction and traffic decryption to simplify encrypted network analysis for security researchers.
friTap is a tool that simplifies SSL/TLS traffic analysis for security researchers by automating real-time key extraction and traffic decryption. It hooks into processes to extract TLS key material and decrypt encrypted network traffic, outputting plaintext PCAP files for inspection. This is particularly useful for malware analysis, privacy investigations, and forensic research where encrypted traffic needs to be analyzed.
Security researchers, malware analysts, digital forensics investigators, and application security professionals who need to inspect encrypted SSL/TLS network traffic for analysis or compliance purposes.
Developers choose friTap because it automates the complex process of SSL/TLS decryption across multiple platforms and libraries, provides an interactive TUI for ease of use, and supports advanced scenarios like hooking statically linked libraries. Its integration with Frida and Python makes it extensible and suitable for both ad-hoc analysis and integration into larger security toolchains.
Simplifying SSL/TLS traffic analysis for researchers by making SSL decryption effortless.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Supports real-time key extraction and traffic decryption to PCAP on Linux, Windows, Android, and macOS, as evidenced by the compatibility table for major SSL libraries like OpenSSL and BoringSSL.
Can hook SSL libraries without symbols using byte patterns or offsets, enabling analysis of statically linked binaries, with tools like BoringSecretHunter provided for pattern generation.
Offers an interactive terminal interface with a guided wizard for device selection and capture mode, simplifying setup without command-line arguments.
Can be used as a Python library and extended with custom Frida scripts, allowing integration into automated security workflows, as detailed in INTEGRATION.md.
Some SSL implementations, like GnuTLS on multiple platforms, only support read/write hooking without full decryption, limiting analysis to key extraction only in certain cases.
Hooking statically linked libraries requires additional tools like BoringSecretHunter and manual JSON configuration for byte patterns or offsets, adding significant overhead.
Requires Frida and frida-server to be installed and configured, which can be invasive and challenging in restricted environments or for ad-hoc analysis.