33

Process Attribution In Network Traffic (PAINT)/Wireshark from DigitalOperatives might be what you're looking for. It's based on Wireshark 1.6.5, and it works with Windows Vista and above. It has been released to the public in December 2012 for research purposes, and I've been using it since then. Not only does it work - you can filter the traffic ...


16

Well, if you're willing to not use Wireshark, you can do this out of the box with Microsoft Network Monitor. And the even better news is that on Windows 7 (or Win2008 R2) and newer, you can start/stop captures from the command line without installing anything (you can even do it remotely). This MSDN blog post explains the entire (simple) process. The ...


13

You can try Netzob tool. This is a tool dedicated to reverse engineering protocols. You can download it here : http://www.netzob.org/ A great example w/ ZeroAccess C&C protocol : http://www.netzob.org/documentations/presentations/netzob_29C3_2012.pdf You can also take a look at CANAPE : http://www.contextis.com/research/tools/canape/


8

I can't give you a specific solution, though I can tell you a tool to make reverse engineering a protocol easier. Scapy is a python packet manipulation tool. One of the problems you have is, that wireshark doesn't know those packets. With Scapy its very easy to build and dissect strange/own packets. This will definetly help when you start to reverse ...


7

There's only one solution that always works. Look at the code. That is, disassemble the firmware and find the code which is sending or receiving the packets. It's often not very difficult with many embedded solutions - they tend to have unstripped symbols and copious amounts of debug output which will help you finding the necessary place. It's possible in ...


7

From what I have recently gathered DxClient is designed as a client for DVR Netview technology. Just by looking at functionality of the DxClient, it is clear that it is more then just binary transfer of AVI formatted stream. I think, it is safe to assume, that rather proprietary transfer and control protocol is used. 2 frames that you provided is just not ...


3

I've never closely analyzed an IP camera's proprietary protocol, but I've reversed a fair number of protocols over the years. If you can grab several hundred packets there might be more that we could do to help you out. Just reading what you've written, my gut feeling that I would pursue is that the sequential value is in fact just that; a sequential value ...


3

Myself I've made a backdoord openssl.so file that writes everything it encrypts to a file so I can tail it in a different terminal. And ignore issues like certificate pinning.


3

An alternative suggestion to Wireshark as of ~2018, the current Microsoft-developed solution that has superseded Microsoft Network Monitor is Microsoft Message Analyzer. The latest build of Version 1.4 as of this post is published October 28, 2016, and the Message Analyzer TechNet Blog has gone mysteriously radio silent as of ~September 2016 after regular ...


2

I'm quite sure this isn't a pcap file at all, despite what file says, and the D8 doesn't seem to be a network type at all. First, because D8 (216) isn't a valid link type according to http://www.tcpdump.org/linktypes.html. Second, because hexdumping a bit more of the file yields this: 00000000 d4 c3 b2 a1 02 00 04 00 00 00 00 00 00 00 00 00 ...............


2

In a word: no. Wireshark's design includes the fundamental notion of a dissector. Each dissector is responsible for the interpretation of streams of bytes according the the corresponding protocol, so an IEEE 802.3 frame, for instance, is correctly broken into its constituent pieces based on the definitions in that standard. However, it is possible (and ...


2

An alternative approach would be to use the browser tools or a browser extension, such as Google Developer Tools for Chrome or Web Console for Firefox. These tools will show you the entire request, response, and body of all network traffic and timeline of when connections are made. In Chrome, you can even edit the page content and review how it affects the ...


2

If you can make the application use a proxy, check Fiddler. I used stunnel recently to do the same with an android application - used the dextojar suite to take the application apart, replace the https://game.server.com URL with a http://game.server.com URL in the .dex file, re-create the .dex checksum, re-create and sign the apk, install the apk. Use this ...


2

An alternative approach might be to use panda to extract the key from a trace as documented in the panda ssl tutorial. That said, the usual mitm approach is probably a bit easier to get going unless you're dealing with certificate pinning.


2

Got it! The algorithm is a CRC with the following parameters, stored in those two bytes as a big-endian short: Polynomial: 0x2e97 Xor In Value: 0 Xor Out Value: 0 Reflect Input: True Reflect Out: True To figure it out, I used my packet capture data, CRC RevEng, and some shell scripting to glue it together. I then used pycrc to calculate the check values ...


2

This isn't a complete answer but is a bit more than fits in a comment. There's definitely a pattern in the powers of 2. They all have exactly 4 bits set. The high bit is always 1 and the lower 15 bits seem to be the same bit pattern (11001) but rotated to different positions. Try filling in the gaps (32, 64, 128, 1024) and show in binary without spaces to ...


2

You can instead try injecting code into the process to dump the raw data before it is encrypted/after it is decrypted. You can use Google's ssl_logger for that. You need to run python ssl_logger.py -pcap log.pcap 123 with 123 being the process ID. Add -verbose to see live output. (Note that it needs Python2 and not Python3.) Once you are done, quit with ...


1

To get an image from an mobile app you first want to know if it is stored on your device or if it is loaded when you log in to your account. In my case it was an profile picture witch will be loaded when you login into your app. In that case you can do the following: The first thing to do is Download and install Packet Capture. This app can be used to sniff ...


1

Wireshark will be ok, if the traffic is not encrypted. Otherwise you'll have to setup a proxy which will do sniffering of SSL traffic. Also the picture may be sent encoded in some application specific way, so you wouldn't be able to just save it as JPG. The most thorough way is to decompile the application and find how exactly it gets the picture from the ...


1

If the application in question doesn't verify SSL encryption then you can strip SSL using an intercepting proxy. However, if the application does verify SSL and throws an error if encryption is stripped, one option is to create your own SSL certificate pair and add it to your OS certificate trust store like so: http://pubs.vmware.com/view-51/topic/com....


1

Arbitrary packets are typically not associated with a process. For established TCP sockets, this information could potentially be looked up on-the-fly, but there is no way to express a capture filter to limit filtering to a single process. Some of the options are: If you know that an application contacts certain IP addresses or ports, you could specify a ...


1

On Mac sudo unbuffer tshark -lni utun1 2>/dev/null |unbuffer -p grep TCP |tee /dev/tty | unbuffer -p awk -v ip=`ifconfig utun1 |grep inet |awk '{print $2}'` '{if($3==ip){print $8}else{print $10}}' |unbuffer -p grep -owE "[0-9]{1,5}" |xargs -I {} sh -c 'G=$(echo {}|tr -d "\r"); sudo lsof -i TCP -OPn -o | grep $G' Change lsof -i TCP -OPn -o with ...


Only top voted, non community-wiki answers of a minimum length are eligible