4
votes
Sniffing TCP traffic for specific process using Wireshark
Arbitrary packets are typically not associated with a process. For established TCP sockets, this information could potentially be looked up on-the-fly, but there is no way to express a capture filter ...
- 191
4
votes
Accepted
Identifying protocol in a pcap file?
Is it possible to identify a protocol in a pcap file?
Yes, but this appears to be a proprietary protocol over TCP/IP.
The first four bytes of every message is a 32-bit big-endian value that ...
- 20.4k
3
votes
Using Stunnel to packet capture HTTPS connection
Myself I've made a backdoord openssl.so file that writes everything it encrypts to a file so I can tail it in a different terminal. And ignore issues like certificate pinning.
- 2,265
3
votes
Sniffing TCP traffic for specific process using Wireshark
An alternative suggestion to Wireshark as of ~2018, the current Microsoft-developed solution that has superseded Microsoft Network Monitor is Microsoft Message Analyzer.
The latest build of Version 1....
- 131
2
votes
Accepted
Using Stunnel to packet capture HTTPS connection
If you can make the application use a proxy, check Fiddler.
I used stunnel recently to do the same with an android application - used the dextojar suite to take the application apart, replace the ...
- 12.6k
2
votes
Using Stunnel to packet capture HTTPS connection
An alternative approach would be to use the browser tools or a browser extension, such as Google Developer Tools for Chrome or Web Console for Firefox. These tools will show you the entire request, ...
2
votes
Using Stunnel to packet capture HTTPS connection
An alternative approach might be to use panda to extract the key from a trace as documented in the panda ssl tutorial. That said, the usual mitm approach is probably a bit easier to get going unless ...
- 1,561
2
votes
Catch connection string between exe and mdb
You can find the connection string with an API Monitor tool or Debugger. However first you will need to know are you looking at .NET based executable (i.e. has it loaded clr.dll or mscorlib.dll) and ...
- 1,091
2
votes
Sniffing TCP packets using Wireshark
You can instead try injecting code into the process to dump the raw data before it is encrypted/after it is decrypted.
You can use Google's ssl_logger for that.
You need to run python ssl_logger.py -...
- 141
2
votes
Sniffing serial Bluetooth traffic on Android
According to this StackOverflow answer, Android has a setting in Developer Options from 4.4 onwards. You first need to enable Developer Settings (if you have not done so already), then enable “Enable ...
- 171
1
vote
Is it possible to see the traffic on Virtual COM Port to reverse engineer how a device works?
I haven’t used it myself but I think com0com or one of the related projects should help
http://com0com.sourceforge.net
In particular, hub4com sounds promising:
The HUB for communications (hub4com) is ...
- 34.6k
1
vote
What functions (in which modules) can be hooked by Frida to access unencrypted data of SSL connections in Java programs running under Windows?
That requires some research on your end.
Find out what API functions (not Java level) are used on a system level to deal with SSL. I could imagine that the Java runtime on Windows uses the Internet ...
- 1,331
1
vote
Sniffing https traffic of an android app
If you're a Windows user, as a matter of dynamic analysis, you could try using an emulator like BlueStacks, then inspect your system network traffic with a program like Fiddler or WireShark.
...
- 2,144
1
vote
Accepted
How to sniff HTTPS traffic of apps that ignore system proxy setting?
If you can install an extra CA, it shouldn't be a problem. Mitmproxy has documentation on how to set up transparent intercepting.
http://docs.mitmproxy.org/en/stable/transparent.html
- 156
1
vote
Analysis of SSL traffic from a Windows 10 application
I'm not sure if this will solve your issue, but have you tried using Charles Proxy with SSL Proxying enabled? Charles can perform a man-in-the-middle attack and get the contents of the applications's ...
- 605
1
vote
Sniffing traffic of Outlook android app
I believe the key here is "Content-Type: application/bond-compact-binary"
Have a look at https://microsoft.github.io/bond/manual/bond_cpp.html#protocols, maybe that might help. A plugin for Fiddler ...
1
vote
Accepted
XMPP clubs in league of legends
There are two possibilities:
The League of Legends client uses an embedded algorithm to injectively map a club name to a club UUID.
The League of Legends client sends the club name to the server and ...
- 20.4k
1
vote
Accepted
Reversing checksum algorithm
I'm not sure it's a checksum either. FF may be used as a padding flag. Also I think your "record size" needs to be reevaluated. I see this as a series of bytes that start with
10 02 xx yy yy zz zz
x ...
1
vote
Interpreting bluetooth string Pebble watch
You have captured the bluetooth RFCOMM frames. These include various control fields which are handled by the bluetooth stack and are transparent to the overlying application layer. (Think serial port ...
- 2,134
1
vote
Interpreting bluetooth string Pebble watch
Because you have 3 of 5 messages absolutely identical, and because the other two differ very little, it seems probable that the first two messages were simply captured incorrectly.
The way to try ...
- 2,381
1
vote
Identifying protocol in a pcap file?
Looking at the website for the software vendor, it recommends that the DVR on the other end of the connection be set to "Substream, CIF or QCIF at 6-10 FPS". Those refer to the "Common Intermediate ...
- 2,381
1
vote
Using Stunnel to packet capture HTTPS connection
If the application in question doesn't verify SSL encryption then you can strip SSL using an intercepting proxy. However, if the application does verify SSL and throws an error if encryption is ...
- 233
1
vote
Sniffing TCP traffic for specific process using Wireshark
On Mac
sudo unbuffer tshark -lni utun1 2>/dev/null |unbuffer -p grep TCP |tee /dev/tty | unbuffer -p awk -v ip=`ifconfig utun1 |grep inet |awk '{print $2}'` '{if($3==ip){print $8}else{print $10}}' ...
- 111
Only top scored, non community-wiki answers of a minimum length are eligible