In my opinion, signing a certificate with a leaf certificate in trust chain need to know the private key in left certificate. However, sslsniff has no way to know the leaf certificate's private key. So how can it work? Am I missing something?
signing a certificate with a leaf certificate in trust chain need to know the private key in left certificate.
It is true that signing a certificate needs the private key of the issuer (signers) certificate. But it also needs to have a certificate as signer which can be used as CA, i.e. where basic constraints allow use as CA. This is usually not true for leaf certificates.
Am I missing something?
You are missing that sslsniff used a specific bug in IE as described on its website:
This tool was originally written to demonstrate and exploit IE's vulnerabilityto a specific "basicConstraints" man-in-the-middle attack. While Microsoft has since fixed the vulnerability that allowed leaf certificates to act as signing certificates,...
Which means because of this bug it was possible that an attacker could use an easily and legally to obtain leaf certificate issued by a publicly trusted CA for the attackers website to sign other certificates so that they get accepted by IE. Since in this case the attacker had of course the private key to its own certificate the signing was no problem. The problem instead was that IE accepted built the trust chain by using the attackers certificate as intermediate in the path to a trusted root CA even though the basic constraints in the attackers certificate allowed it to be used as CA.