3

Myself I've made a backdoord openssl.so file that writes everything it encrypts to a file so I can tail it in a different terminal. And ignore issues like certificate pinning.


3

Arbitrary packets are typically not associated with a process. For established TCP sockets, this information could potentially be looked up on-the-fly, but there is no way to express a capture filter to limit filtering to a single process. Some of the options are: If you know that an application contacts certain IP addresses or ports, you could specify a ...


3

An alternative suggestion to Wireshark as of ~2018, the current Microsoft-developed solution that has superseded Microsoft Network Monitor is Microsoft Message Analyzer. The latest build of Version 1.4 as of this post is published October 28, 2016, and the Message Analyzer TechNet Blog has gone mysteriously radio silent as of ~September 2016 after regular ...


2

I'm quite sure this isn't a pcap file at all, despite what file says, and the D8 doesn't seem to be a network type at all. First, because D8 (216) isn't a valid link type according to http://www.tcpdump.org/linktypes.html. Second, because hexdumping a bit more of the file yields this: 00000000 d4 c3 b2 a1 02 00 04 00 00 00 00 00 00 00 00 00 ...............


2

In a word: no. Wireshark's design includes the fundamental notion of a dissector. Each dissector is responsible for the interpretation of streams of bytes according the the corresponding protocol, so an IEEE 802.3 frame, for instance, is correctly broken into its constituent pieces based on the definitions in that standard. However, it is possible (and ...


2

An alternative approach would be to use the browser tools or a browser extension, such as Google Developer Tools for Chrome or Web Console for Firefox. These tools will show you the entire request, response, and body of all network traffic and timeline of when connections are made. In Chrome, you can even edit the page content and review how it affects the ...


2

If you can make the application use a proxy, check Fiddler. I used stunnel recently to do the same with an android application - used the dextojar suite to take the application apart, replace the https://game.server.com URL with a http://game.server.com URL in the .dex file, re-create the .dex checksum, re-create and sign the apk, install the apk. Use this ...


2

This isn't a complete answer but is a bit more than fits in a comment. There's definitely a pattern in the powers of 2. They all have exactly 4 bits set. The high bit is always 1 and the lower 15 bits seem to be the same bit pattern (11001) but rotated to different positions. Try filling in the gaps (32, 64, 128, 1024) and show in binary without spaces to ...


2

You can instead try injecting code into the process to dump the raw data before it is encrypted/after it is decrypted. You can use Google's ssl_logger for that. You need to run python ssl_logger.py -pcap log.pcap 123 with 123 being the process ID. Add -verbose to see live output. (Note that it needs Python2 and not Python3.) Once you are done, quit with ...


2

Got it! The algorithm is a CRC with the following parameters, stored in those two bytes as a big-endian short: Polynomial: 0x2e97 Xor In Value: 0 Xor Out Value: 0 Reflect Input: True Reflect Out: True To figure it out, I used my packet capture data, CRC RevEng, and some shell scripting to glue it together. I then used pycrc to calculate the check values ...


2

An alternative approach might be to use panda to extract the key from a trace as documented in the panda ssl tutorial. That said, the usual mitm approach is probably a bit easier to get going unless you're dealing with certificate pinning.


1

If the application in question doesn't verify SSL encryption then you can strip SSL using an intercepting proxy. However, if the application does verify SSL and throws an error if encryption is stripped, one option is to create your own SSL certificate pair and add it to your OS certificate trust store like so: http://pubs.vmware.com/view-51/topic/com....


1

To get an image from an mobile app you first want to know if it is stored on your device or if it is loaded when you log in to your account. In my case it was an profile picture witch will be loaded when you login into your app. In that case you can do the following: The first thing to do is Download and install Packet Capture. This app can be used to sniff ...


1

Wireshark will be ok, if the traffic is not encrypted. Otherwise you'll have to setup a proxy which will do sniffering of SSL traffic. Also the picture may be sent encoded in some application specific way, so you wouldn't be able to just save it as JPG. The most thorough way is to decompile the application and find how exactly it gets the picture from the ...


1

On Mac sudo unbuffer tshark -lni utun1 2>/dev/null |unbuffer -p grep TCP |tee /dev/tty | unbuffer -p awk -v ip=`ifconfig utun1 |grep inet |awk '{print $2}'` '{if($3==ip){print $8}else{print $10}}' |unbuffer -p grep -owE "[0-9]{1,5}" |xargs -I {} sh -c 'G=$(echo {}|tr -d "\r"); sudo lsof -i TCP -OPn -o | grep $G' Change lsof -i TCP -OPn -o with ...


Only top voted, non community-wiki answers of a minimum length are eligible