Skip to content

friTap Documentation

friTap Logo

SSL/TLS Traffic Analysis Made Simple

Real-time key extraction and traffic decryption for security research

Quick Start

# Install friTap
pip install fritap

# Basic usage - Desktop application
sudo fritap --pcap capture.pcap firefox

# Mobile application analysis
fritap -m -k keys.log com.example.app

What is friTap?

friTap is a powerful cybersecurity research tool that simplifies SSL/TLS traffic analysis by automating key extraction and traffic decryption. Built on the Frida dynamic instrumentation framework, friTap enables security researchers to analyze encrypted network communications in real-time across multiple platforms.

Key Capabilities

  • Real-time Key Extraction: Automatically extract TLS keys as they're generated
  • Live Traffic Decryption: Decrypt and save TLS payload as PCAP files
  • Multi-Platform Support: Works on Linux, Windows, macOS, Android, and iOS
  • Extensive Library Support: Supports OpenSSL, BoringSSL, NSS, GnuTLS, WolfSSL, and more
  • Pattern-Based Hooking: Hook stripped libraries without symbols
  • Advanced Analysis: Bypass anti-analysis techniques and SSL pinning

Use Cases

  • Malware Analysis: Decrypt C&C communications and data exfiltration
  • Privacy Research: Analyze application data transmission practices
  • Security Testing: Validate SSL/TLS implementations and configurations
  • Digital Forensics: Recover encrypted network communications
  • Application Analysis: Understand how applications handle secure communications

How It Works

friTap uses dynamic instrumentation to intercept SSL/TLS operations at the library level:

  1. Library Detection: Automatically identifies the SSL/TLS library used by the target application
  2. Hook Injection: Dynamically hooks key functions (read, write, key generation)
  3. Data Extraction: Captures plaintext data and encryption keys in real-time
  4. Output Generation: Saves results as PCAP files or key logs for analysis

friTap Workflow

Supported Platforms & Libraries

Library Linux Windows macOS Android iOS Key Features
OpenSSL ✓ Full R/W TBI ✓ Full TBI Most widely used
BoringSSL ✓ Full R/W Keys ✓ Full Keys Google's OpenSSL fork
NSS ✓ Full R/W TBI Keys TBI Mozilla's library
GnuTLS R/W R/W TBI ✓ Full TBI GNU project library
WolfSSL R/W R/W TBI ✓ Full TBI Embedded/IoT focused
mbedTLS R/W R/W TBI ✓ Full TBI Lightweight library
Schannel ✗ ✓ Full ✗ ✗ ✗ Windows native SSL/TLS
Conscrypt TBA TBA TBA ✓ Full TBA Android system SSL
S2N-TLS ✓ Full ✗ TBA ✓ Full ✗ AWS library
RustTLS Keys TBI TBI Keys TBI Rust implementation

Legend: - ✓ Full: Complete support (keys + traffic decryption) - R/W: Read/Write hooks only (traffic without keys) - Keys: Key extraction only - TBI: To Be Implemented - TBA: To Be Analyzed - ✗ N/A: Not applicable to platform

Getting Started

Prerequisites

  • Python 3.7+
  • Frida 16.0+ (new changes will only work on frida >=17)
  • Administrative privileges (for desktop applications)
  • ADB access (for Android analysis)

Installation

# Install from PyPI
pip install fritap

# Verify installation
fritap --help

Basic Examples

# Capture Firefox traffic
sudo fritap --pcap firefox_traffic.pcap firefox

# Extract keys from Thunderbird
sudo fritap -k thunderbird_keys.log thunderbird

# Analyze mobile app with key extraction
fritap -m -k keys.log com.example.app

# Full packet capture with decryption
fritap -m --pcap decrypted.pcap com.example.app

# Hook libraries without symbols when the default patterns not working
fritap --patterns patterns.json -k keys.log target_app

# Debug pattern matching
fritap -do -v --patterns patterns.json target_app

Documentation Sections

Getting Started

Installation, setup, and basic concepts to get you up and running quickly.

Usage Examples

Comprehensive examples for different platforms and use cases with real-world scenarios.

Platform Guides

Detailed guides for Android, iOS, Linux, Windows, and macOS analysis.

Advanced Features

Pattern-based hooking, spawn gating, anti-detection techniques, and custom scripts.

API Reference

Complete API documentation for Python integration and CLI usage.

Troubleshooting

Solutions for common issues, debugging techniques, and performance optimization.

Community & Support

License

friTap is released under the GPL v3 License.

Inspired by SSL_Logger and developed by Fraunhofer FKIE CAD