33
Process Attribution In Network Traffic (PAINT)/Wireshark from DigitalOperatives might be what you're looking for. It's based on Wireshark 1.6.5, and it works with Windows Vista and above. It has been released to the public in December 2012 for research purposes, and I've been using it since then. Not only does it work - you can filter the traffic ...
16
Well, if you're willing to not use Wireshark, you can do this out of the box with Microsoft Network Monitor.
And the even better news is that on Windows 7 (or Win2008 R2) and newer, you can start/stop captures from the command line without installing anything (you can even do it remotely).
This MSDN blog post explains the entire (simple) process.
The ...
13
You can try Netzob tool. This is a tool dedicated to reverse engineering protocols.
You can download it here : http://www.netzob.org/
A great example w/ ZeroAccess C&C protocol : http://www.netzob.org/documentations/presentations/netzob_29C3_2012.pdf
You can also take a look at CANAPE : http://www.contextis.com/research/tools/canape/
8
I can't give you a specific solution, though I can tell you a tool to make reverse engineering a protocol easier.
Scapy is a python packet manipulation tool. One of the problems you have is, that wireshark doesn't know those packets. With Scapy its very easy to build and dissect strange/own packets. This will definetly help when you start to reverse ...
7
There's only one solution that always works.
Look at the code.
That is, disassemble the firmware and find the code which is sending or receiving the packets. It's often not very difficult with many embedded solutions - they tend to have unstripped symbols and copious amounts of debug output which will help you finding the necessary place.
It's possible in ...
7
From what I have recently gathered DxClient is designed as a client for DVR Netview technology. Just by looking at functionality of the DxClient, it is clear that it is more then just binary transfer of AVI formatted stream. I think, it is safe to assume, that rather proprietary transfer and control protocol is used. 2 frames that you provided is just not ...
4
Is it possible to identify a protocol in a pcap file?
Yes, but this appears to be a proprietary protocol over TCP/IP.
The first four bytes of every message is a 32-bit big-endian value that specifies the length of the following bytes in the message.
The messages aren't encrypted, so you might be able to do some data carving. But if you really want to know ...
3
Myself I've made a backdoord openssl.so file that writes everything it encrypts to a file so I can tail it in a different terminal. And ignore issues like certificate pinning.
3
An alternative suggestion to Wireshark as of ~2018, the current Microsoft-developed solution that has superseded Microsoft Network Monitor is Microsoft Message Analyzer.
The latest build of Version 1.4 as of this post is published October 28, 2016, and the Message Analyzer TechNet Blog has gone mysteriously radio silent as of ~September 2016 after regular ...
3
I've never closely analyzed an IP camera's proprietary protocol, but I've reversed a fair number of protocols over the years.
If you can grab several hundred packets there might be more that we could do to help you out. Just reading what you've written, my gut feeling that I would pursue is that the sequential value is in fact just that; a sequential value ...
2
You can instead try injecting code into the process to dump the raw data before it is encrypted/after it is decrypted.
You can use Google's ssl_logger for that.
You need to run python ssl_logger.py -pcap log.pcap 123 with 123 being the process ID. Add -verbose to see live output.
(Note that it needs Python2 and not Python3.)
Once you are done, quit with ...
2
According to this StackOverflow answer, Android has a setting in Developer Options from 4.4 onwards. You first need to enable Developer Settings (if you have not done so already), then enable “Enable Bluetooth HCI snoop log”.
I have not tried this myself yet, but according to the information I could find:
Communication should be logged to a file called /...
2
You can find the connection string with an API Monitor tool or Debugger. However first you will need to know are you looking at .NET based executable (i.e. has it loaded clr.dll or mscorlib.dll) and how does it access the database.
To work this out you can use a tool like Process Monitor and filter on Process Name is Include and Operation is Load Image ...
2
If you can make the application use a proxy, check Fiddler.
I used stunnel recently to do the same with an android application - used the dextojar suite to take the application apart, replace the https://game.server.com URL with a http://game.server.com URL in the .dex file, re-create the .dex checksum, re-create and sign the apk, install the apk.
Use this ...
2
An alternative approach might be to use panda to extract the key from a trace as documented in the panda ssl tutorial. That said, the usual mitm approach is probably a bit easier to get going unless you're dealing with certificate pinning.
2
An alternative approach would be to use the browser tools or a browser extension, such as Google Developer Tools for Chrome or Web Console for Firefox. These tools will show you the entire request, response, and body of all network traffic and timeline of when connections are made. In Chrome, you can even edit the page content and review how it affects the ...
1
I haven’t used it myself but I think com0com or one of the related projects should help
http://com0com.sourceforge.net
In particular, hub4com sounds promising:
The HUB for communications (hub4com) is a Windows application and is a
part of the com0com project.
It allows to receive data and signals from one port, modify and send
it to a number of ports and ...
1
If the application in question doesn't verify SSL encryption then you can strip SSL using an intercepting proxy. However, if the application does verify SSL and throws an error if encryption is stripped, one option is to create your own SSL certificate pair and add it to your OS certificate trust store like so:
http://pubs.vmware.com/view-51/topic/com....
1
If you're a Windows user, as a matter of dynamic analysis, you could try using an emulator like BlueStacks, then inspect your system network traffic with a program like Fiddler or WireShark.
Additionally, you could use a program like Cheat Engine to open the BlueStacks process and scan its memory for strings related to URLs. As an aside, you could ...
1
If you can install an extra CA, it shouldn't be a problem. Mitmproxy has documentation on how to set up transparent intercepting.
http://docs.mitmproxy.org/en/stable/transparent.html
1
I'm not sure if this will solve your issue, but have you tried using Charles Proxy with SSL Proxying enabled? Charles can perform a man-in-the-middle attack and get the contents of the applications's web request if the application is not using certificate pinning.
I've only used the Mac version, but generally what you would do is install the Charles root ...
1
I believe the key here is "Content-Type: application/bond-compact-binary"
Have a look at https://microsoft.github.io/bond/manual/bond_cpp.html#protocols, maybe that might help. A plugin for Fiddler or ZAP Proxy would be great!
Protocols
Bond protocols are pluggable, allowing application to choose the most
appropriate encoding format. Bond supports ...
1
There are two possibilities:
The League of Legends client uses an embedded algorithm to injectively map a club name to a club UUID.
The League of Legends client sends the club name to the server and receives the club UUID in response.
Either way, you'd be able to see what UUID-channel is eventually joined by the League of Legends client by sniffing the ...
1
I'm not sure it's a checksum either. FF may be used as a padding flag. Also I think your "record size" needs to be reevaluated. I see this as a series of bytes that start with
10 02 xx yy yy zz zz
x and y might be options
z looks like data or a sequence (ish)
Then the next record looks like this
10 03 xx xx
Here's an observation on the 10 03 records:
10 ...
1
You have captured the bluetooth RFCOMM frames. These include various control fields which are handled by the bluetooth stack and are transparent to the overlying application layer. (Think serial port like communication with start/stop/parity bits being added but just over bluetooth instead.)
In your frames:
The 1st byte 0B is the address field.
The 2nd ...
1
Because you have 3 of 5 messages absolutely identical, and because the other two differ very little, it seems probable that the first two messages were simply captured incorrectly.
The way to try to detect that would be to do the same thing several more times to see if that pattern holds.
More generally, reverse engineering a protocol like this often ...
1
Looking at the website for the software vendor, it recommends that the DVR on the other end of the connection be set to "Substream, CIF or QCIF at 6-10 FPS". Those refer to the "Common Intermediate Format" and "Quarter Common Intermediate Format" respectively. They are defined within the "H.261 Video codec for audiovisual services at p x 64 kbit/s" ...
1
Arbitrary packets are typically not associated with a process. For established TCP sockets, this information could potentially be looked up on-the-fly, but there is no way to express a capture filter to limit filtering to a single process.
Some of the options are:
If you know that an application contacts certain IP addresses or ports, you could specify a ...
1
On Mac
sudo unbuffer tshark -lni utun1 2>/dev/null |unbuffer -p grep TCP |tee /dev/tty | unbuffer -p awk -v ip=`ifconfig utun1 |grep inet |awk '{print $2}'` '{if($3==ip){print $8}else{print $10}}' |unbuffer -p grep -owE "[0-9]{1,5}" |xargs -I {} sh -c 'G=$(echo {}|tr -d "\r"); sudo lsof -i TCP -OPn -o | grep $G'
Change lsof -i TCP -OPn -o with ...
Only top voted, non community-wiki answers of a minimum length are eligible
