4 votes

Sniffing TCP traffic for specific process using Wireshark

Arbitrary packets are typically not associated with a process. For established TCP sockets, this information could potentially be looked up on-the-fly, but there is no way to express a capture filter ...
user avatar
4 votes
Accepted

Identifying protocol in a pcap file?

Is it possible to identify a protocol in a pcap file? Yes, but this appears to be a proprietary protocol over TCP/IP. The first four bytes of every message is a 32-bit big-endian value that ...
user avatar
3 votes

Using Stunnel to packet capture HTTPS connection

Myself I've made a backdoord openssl.so file that writes everything it encrypts to a file so I can tail it in a different terminal. And ignore issues like certificate pinning.
user avatar
  • 2,265
3 votes

Sniffing TCP traffic for specific process using Wireshark

An alternative suggestion to Wireshark as of ~2018, the current Microsoft-developed solution that has superseded Microsoft Network Monitor is Microsoft Message Analyzer. The latest build of Version 1....
user avatar
  • 131
2 votes
Accepted

Using Stunnel to packet capture HTTPS connection

If you can make the application use a proxy, check Fiddler. I used stunnel recently to do the same with an android application - used the dextojar suite to take the application apart, replace the ...
user avatar
2 votes

Using Stunnel to packet capture HTTPS connection

An alternative approach would be to use the browser tools or a browser extension, such as Google Developer Tools for Chrome or Web Console for Firefox. These tools will show you the entire request, ...
user avatar
2 votes

Using Stunnel to packet capture HTTPS connection

An alternative approach might be to use panda to extract the key from a trace as documented in the panda ssl tutorial. That said, the usual mitm approach is probably a bit easier to get going unless ...
user avatar
  • 1,561
2 votes

Catch connection string between exe and mdb

You can find the connection string with an API Monitor tool or Debugger. However first you will need to know are you looking at .NET based executable (i.e. has it loaded clr.dll or mscorlib.dll) and ...
user avatar
2 votes

Sniffing TCP packets using Wireshark

You can instead try injecting code into the process to dump the raw data before it is encrypted/after it is decrypted. You can use Google's ssl_logger for that. You need to run python ssl_logger.py -...
user avatar
  • 141
2 votes

Sniffing serial Bluetooth traffic on Android

According to this StackOverflow answer, Android has a setting in Developer Options from 4.4 onwards. You first need to enable Developer Settings (if you have not done so already), then enable “Enable ...
user avatar
1 vote

Is it possible to see the traffic on Virtual COM Port to reverse engineer how a device works?

I haven’t used it myself but I think com0com or one of the related projects should help http://com0com.sourceforge.net In particular, hub4com sounds promising: The HUB for communications (hub4com) is ...
user avatar
  • 34.6k
1 vote

What functions (in which modules) can be hooked by Frida to access unencrypted data of SSL connections in Java programs running under Windows?

That requires some research on your end. Find out what API functions (not Java level) are used on a system level to deal with SSL. I could imagine that the Java runtime on Windows uses the Internet ...
user avatar
1 vote

Sniffing https traffic of an android app

If you're a Windows user, as a matter of dynamic analysis, you could try using an emulator like BlueStacks, then inspect your system network traffic with a program like Fiddler or WireShark. ...
user avatar
  • 2,144
1 vote
Accepted

How to sniff HTTPS traffic of apps that ignore system proxy setting?

If you can install an extra CA, it shouldn't be a problem. Mitmproxy has documentation on how to set up transparent intercepting. http://docs.mitmproxy.org/en/stable/transparent.html
user avatar
  • 156
1 vote

Analysis of SSL traffic from a Windows 10 application

I'm not sure if this will solve your issue, but have you tried using Charles Proxy with SSL Proxying enabled? Charles can perform a man-in-the-middle attack and get the contents of the applications's ...
user avatar
  • 605
1 vote

Sniffing traffic of Outlook android app

I believe the key here is "Content-Type: application/bond-compact-binary" Have a look at https://microsoft.github.io/bond/manual/bond_cpp.html#protocols, maybe that might help. A plugin for Fiddler ...
user avatar
1 vote
Accepted

XMPP clubs in league of legends

There are two possibilities: The League of Legends client uses an embedded algorithm to injectively map a club name to a club UUID. The League of Legends client sends the club name to the server and ...
user avatar
1 vote
Accepted

Reversing checksum algorithm

I'm not sure it's a checksum either. FF may be used as a padding flag. Also I think your "record size" needs to be reevaluated. I see this as a series of bytes that start with 10 02 xx yy yy zz zz x ...
user avatar
1 vote

Interpreting bluetooth string Pebble watch

You have captured the bluetooth RFCOMM frames. These include various control fields which are handled by the bluetooth stack and are transparent to the overlying application layer. (Think serial port ...
user avatar
  • 2,134
1 vote

Interpreting bluetooth string Pebble watch

Because you have 3 of 5 messages absolutely identical, and because the other two differ very little, it seems probable that the first two messages were simply captured incorrectly. The way to try ...
user avatar
  • 2,381
1 vote

Identifying protocol in a pcap file?

Looking at the website for the software vendor, it recommends that the DVR on the other end of the connection be set to "Substream, CIF or QCIF at 6-10 FPS". Those refer to the "Common Intermediate ...
user avatar
  • 2,381
1 vote

Using Stunnel to packet capture HTTPS connection

If the application in question doesn't verify SSL encryption then you can strip SSL using an intercepting proxy. However, if the application does verify SSL and throws an error if encryption is ...
user avatar
1 vote

Sniffing TCP traffic for specific process using Wireshark

On Mac sudo unbuffer tshark -lni utun1 2>/dev/null |unbuffer -p grep TCP |tee /dev/tty | unbuffer -p awk -v ip=`ifconfig utun1 |grep inet |awk '{print $2}'` '{if($3==ip){print $8}else{print $10}}' ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible