项目地址：https://github.com/droe/sslsplit
sslsplit介绍：
SLsplit 是针对 SSL/TLS 加密网络连接进行中间人攻击的工具。它旨在用于网络取证、应用程序安全分析和渗透测试。
你可以把SSLsplit 当作是一个透明代理，跟fiddler，burpsuit不同的是，sslsplit不能充当浏览器中配置的 HTTP 或 SOCKS 代理。
sslsplit解密Https请求的技术逻辑是，SSLsplit 会动态生成并签署伪造的 X509证书，通过生成的证书来执行中间人攻击，从而解密ssl数据。
sslsplit的安装
1，安装库和安装
apt-get install libssl-dev libevent-devmakemake install
2，生成自有证书
openssl genrsa -out ca.key 2048 //生成一个key文件//自签名用生成的key生成公钥证书:openssl req -new -x509 -days 1096 -key ca.key -out ca.crt
注意：生成证书的步骤可能需要填写证书信息，默认信息，可能IOS无法添加信任
3，设置流量转发
echo 1 > /proc/sys/net/ipv4/ip_forward //用iptables进行流量转发，需要把我们需要的端口进行转发:iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8080iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 8443
4，启动sslsplit
sslsplit通过命令行参数启动后，就可以进行解密，默认解密后的日志在/sslsplit/log目录下
sslsplit -D -l connect.log -j /sslsplit -S log/ -k ca.key -c ca.crt ssl 0.0.0.0 8443 tcp 0.0.0.0 8080
如果需要二次开发，可以过滤系统的日志，更改日志相关逻辑。
设备证书安装步骤
由于sslsplit生成的是自定义的x509证书，因此如果需要解密终端设备的流量，需要在终端流量上信任证书
步骤一种生成的ca.crt，需要在设备上通过浏览器访问的形式进行下载安装。
安卓步骤 IOS步骤
实际效果
进行一次百度搜索行为后，可以再日志里看到如下解密信息：
其中红色字体就是关心的关键信息
GET /rec?platform=wise&ms=1&lsAble=1&rset=rcmd&word=111111&qid=7590437445084944623&rq=111111&from=1020712d&baiduid=35E44EC3DB698CAEC1D9E669E14E2EC7%3AFG%3D1&tn=zbios&clientWidth=360&t=1638426456969&r=0443 HTTP/1.1
Host: m.baidu.com
Connection: keep-alive
Accept: application/json
User-Agent: Mozilla/5.0 (Linux; Android 10; ALP-AL00 Build/HUAWEIALP-AL00; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/83.0.4103.106 Mobile Safari/537.36 SP-engine/2.37.0 baiduboxapp/12.28.5.10 (Baidu; P1 10) NABar/1.0
X-Requested-With: XMLHttpRequest
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: MBD_AT=1590376235; BAIDUCUID=ga-_ijukHagH8v84_a2xu0iJvu0SPSi0guHoiYa52fKoLqqqB; BDUSS=ZKOVU0eG5saXh4ZkU2ajRINzhhVHFTczRuVEdRZFJEVE94YTV1MnhRbGtTUFJlRVFBQUFBJCQAAAAAAAAAAAEAAABG6cwsv~G46LLfwu3Qob34vfgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGS7zF5ku8xeYm; matrixstyle=0; cat_ms=T6kZzSYWBAg0qds%2FisxjrTgEpD7CdpkbSEheVcUAfz8TLNcPz4JWe7qPTRnnJYQq; CS_W_SIDS=6154_10580-6484_11783-5970_9877; player_params=iv_ver%401.0.0%2Cps%40100%2Cds_stc%400.4571; SP_FW_VER=3.360.23; SG_FW_VER=1.30.0; WISE_HIS_PM=0; fontsize=1.0; iadlist=2882303916135941257; BAIDUID=35E44EC3DB698CAEC1D9E669E14E2EC7:FG=1; BDPASSGATE=IlPT2AEptyoA_yiU4V_Q3kIN8ejBZrmAH4vDS6phQFePdCyWmhHWB_2EUjD6YnSgBC3gzDCweMpkkUXKXlVXa_EqnBsKol2NlVejzdSCxbzdH1hg52YM01PDXCgH64jymPRatukWAgwaLHQ79Oubexw4ovWc-w6sb4r55EDCmMrs1TCG1Ijvx9KuK9p5YnjYN0_Xx3jEhShwKSmBUuL2LTTtmU18ZoADx2OmjdAM1fjd5ys9DNLmYfYA1G85Jppg0huP3OyOtKOXJpUSmIZgKl1ddEOa-qnuSUZK2bbpzcpJH4a; H_WISE_SIDS=107316_110086_127969_179348_180276_181589_182237_183035_183327_184042_184720_185268_186319_186539_186840_187433_187447_188182_188333_188453_188553_188872_189094_189732_189755_190033_190145_190431_190473_190624_190655_190680_190684_190757_190779_190944_191074_191246_191287_191319_191369_191371_191419_191503_191810_191985_192132_192140_192508_192600_192713_192874_192907_192958_193038_193284_193492_193502_193558_193611_193733_193761_193844_193883_193891_194047_194084_194190_194215_194318_194368_194511_194520_194583_194672_194782_194880_194901_194922_194932_195047_195129_195150_195343_195401_195477_195531_195572_195903_1105806_1117836_1987759; delPer=0; BDSVRTM=712; PSINO=1; __bsi=7362313005912381139_00_5_R_R_0_0303_cca8_Y; BDSVRBFE=Go
HTTP/1.1 200 OK
Alt-Bd-Svc: quic="qm.baidu.com:443";ma=2592000;v="39,38,37,35"
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Thu, 02 Dec 2021 06:27:34 GMT
Server: apache
Set-Cookie: __bsi=7488253198036739682_00_5_R_R_116_0303_cca8_Y; max-age=3600; domain=m.baidu.com; path=/
Time: Thu Aug 10 16:57:43 CST 2017
Traceid: 163842645403660766827488253198036739682
Vary: Accept-Encoding
Transfer-Encoding: chunked
