p1llus

4 ms·

1. 1.▲
   by p1llus 2mo ago

   Exactly this :) You can either attach the uprobes directly to the systems OpenSSL to capture anything using it (curl etc), though most of these LLM clients and similar uses their own static compiled BoringSSL, but its very straight forward
2. 2.▲
   by p1llus 2mo ago

   It is similar but no real shenanigans but rather a common functionality called uprobes. For most of these LLM clients which uses a static compiled OpenSSL or BoringSSL the functions you attach to is also the same overall, making it easily r
3. 3.▲
   by p1llus 2mo ago

   One thing I found that I thought was a fun addition, is using eBPF made this even easier. No need to fight with anyone that is using certificate pinning, mTLS or anything else, you just get the raw plaintext data straight of the wire (right