Offensive BPF: Sniffing Firefox traffic with bpftrace

This post describes how to use bpftrace (a tool for tracing system behavior) with uprobes (hooks into user-space functions) to intercept and read Firefox's encrypted traffic by hooking into the NSS library (Mozilla's Network Security Services, which Firefox uses for encryption). The author discovered that Firefox uses local NSS libraries rather than system-wide encryption libraries, and created a bpftrace script that hooks the PR_Write function to capture and display the data Firefox sends.