AwesomeREA.org

Tool

friTap

Frida-based tool that hooks TLS libraries such as OpenSSL, BoringSSL, NSS and GnuTLS inside a running process and writes NSS key logs and decrypted payloads as PCAP, so analysts can inspect an application's encrypted traffic in Wireshark. For stripped or statically linked libraries it accepts byte patterns or offsets and can scan for renamed libraries, or it can recover TLS secrets by scanning heap memory instead of hooking. A terminal UI, a Python API and a Wireshark extcap integration wrap the same capture.

Requirements and limitations

  • Latest release at review: v2.5.2, uploaded to PyPI on 2026-09-29 and published on GitHub on 2026-10-04; the reviewed main commit is identical to that tag. The README describes Linux, Windows and Android as supported and macOS and iOS as partial and still under development, and says the Windows implementations were verified only on Windows 10.
  • Installed with pip as fritap on Python 3.10+. friTap 2.x requires frida 17.x and frida-tools 14.x; devices with an older frida-server need a legacy friTap line installed through the documented constraints files. Mobile apps need a frida-server running on the device, and the Android walkthrough uses a rooted phone or emulator with adb in PATH; the desktop example attaches with sudo. libpcap or Npcap is needed only for full packet capture, and live Wireshark piping works only on Linux and macOS.
  • Analysts name the process or app package to attach to or spawn. Coverage differs by library and platform: the README's support table marks many combinations as read/write hooks only, keys only or not yet implemented, so plaintext captures can be incomplete. Byte patterns for statically linked BoringSSL can come from the authors' separate BoringSecretHunter tool, which analyzes the user's own copy of the library.
  • GPL-3.0; setup.py declares GPL-3.0-only while its inline comment says GPLv3 or later. The README presents the tool for malware analysis and application privacy research and asks users to cite the authors' 2024 Forensic Science International: Digital Investigation paper on TLS key material extraction. No process was hooked and no traffic was captured.

About this entry

Type
Tool
Category
Protocol analysis tools
Relationship
Foundation tool
Targets
App · Protocol

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · fkie-cad/friTap · Revision d7398a1
  2. README.md#L175-L198 GitHub · fkie-cad/friTap · Revision d7398a1
  3. README.md#L200-L216 GitHub · fkie-cad/friTap · Revision d7398a1
  4. USAGE.md GitHub · fkie-cad/friTap · Revision d7398a1
  5. EXAMPLE.md GitHub · fkie-cad/friTap · Revision d7398a1
  6. setup.py#L35-L40 GitHub · fkie-cad/friTap · Revision d7398a1
  7. LICENSE GitHub · fkie-cad/friTap · Revision d7398a1
  8. integrations/wireshark GitHub · fkie-cad/friTap · Revision d7398a1
  9. https://github.com/fkie-cad/friTap/releases/tag/v2.5.2
  10. https://pypi.org/project/friTap/2.5.2/
  11. https://doi.org/10.1016/j.fsidi.2024.301766