6 votes

Sniffing TCP traffic for specific process using Wireshark

Arbitrary packets are typically not associated with a process. For established TCP sockets, this information could potentially be looked up on-the-fly, but there is no way to express a capture filter ...
Lekensteyn's user avatar
3 votes

Sniffing TCP traffic for specific process using Wireshark

An alternative suggestion to Wireshark as of ~2018, the current Microsoft-developed solution that has superseded Microsoft Network Monitor is Microsoft Message Analyzer. The latest build of Version 1....
gcode's user avatar
  • 131
2 votes

Sniffing TCP packets using Wireshark

You can instead try injecting code into the process to dump the raw data before it is encrypted/after it is decrypted. You can use Google's ssl_logger for that. You need to run python ssl_logger.py -...
CherryDT's user avatar
  • 141
2 votes

Sniffing serial Bluetooth traffic on Android

According to this StackOverflow answer, Android has a setting in Developer Options from 4.4 onwards. You first need to enable Developer Settings (if you have not done so already), then enable “Enable ...
user149408's user avatar
2 votes

What functions (in which modules) can be hooked by Frida to access unencrypted data of SSL connections in Java programs running under Windows?

That requires some research on your end. Find out what API functions (not Java level) are used on a system level to deal with SSL. I could imagine that the Java runtime on Windows uses the Internet ...
Johann Aydinbas's user avatar
2 votes

Catch connection string between exe and mdb

You can find the connection string with an API Monitor tool or Debugger. However first you will need to know are you looking at .NET based executable (i.e. has it loaded clr.dll or mscorlib.dll) and ...
chentiangemalc's user avatar
1 vote

Is it possible to see the traffic on Virtual COM Port to reverse engineer how a device works?

I haven’t used it myself but I think com0com or one of the related projects should help http://com0com.sourceforge.net In particular, hub4com sounds promising: The HUB for communications (hub4com) is ...
Igor Skochinsky's user avatar
  • 36.4k
1 vote

Sniffing TCP traffic for specific process using Wireshark

On Mac sudo unbuffer tshark -lni utun1 2>/dev/null |unbuffer -p grep TCP |tee /dev/tty | unbuffer -p awk -v ip=`ifconfig utun1 |grep inet |awk '{print $2}'` '{if($3==ip){print $8}else{print $10}}' ...
marcobazzani's user avatar
1 vote

Sniffing https traffic of an android app

If you're a Windows user, as a matter of dynamic analysis, you could try using an emulator like BlueStacks, then inspect your system network traffic with a program like Fiddler or WireShark. ...
dsasmblr's user avatar
  • 2,234
1 vote
Accepted

How to sniff HTTPS traffic of apps that ignore system proxy setting?

If you can install an extra CA, it shouldn't be a problem. Mitmproxy has documentation on how to set up transparent intercepting. http://docs.mitmproxy.org/en/stable/transparent.html
Willem's user avatar
  • 156
1 vote

Analysis of SSL traffic from a Windows 10 application

I'm not sure if this will solve your issue, but have you tried using Charles Proxy with SSL Proxying enabled? Charles can perform a man-in-the-middle attack and get the contents of the applications's ...
JAL's user avatar
  • 605
1 vote

Sniffing traffic of Outlook android app

I believe the key here is "Content-Type: application/bond-compact-binary" Have a look at https://microsoft.github.io/bond/manual/bond_cpp.html#protocols, maybe that might help. A plugin for Fiddler ...
Alexandre Dumont's user avatar
1 vote
Accepted

XMPP clubs in league of legends

There are two possibilities: The League of Legends client uses an embedded algorithm to injectively map a club name to a club UUID. The League of Legends client sends the club name to the server and ...
Jason Geffner's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible