Intercept HTTP/HTTPS traffic of one application (Windows 10)










8















I'd like to capture all traffic from one particular .exe application. I tried to follow this guide with only the one application running on a windows 10 VM, but the VM was very slow and crashed a plenty of times.



Is there any other way to capture the traffic?










share|improve this question













migrated from security.stackexchange.com Sep 2 '18 at 16:09


This question came from our site for information security professionals.


















  • A couple solutions: You could run the program in a Virtual Machine and sniff the traffic from that network device, or you could try using something called ForceBindIP and sniff it using a VPN. Either of those might work.

    – xorist
    Aug 28 '18 at 15:06











  • The easiest and IMHO most effective solution. We doing it in enterprise environments to keep corporate's secrets.

    – Alex
    Sep 2 '18 at 17:10












  • Why was this question migrated from security stackexchange?

    – sandyp
    Sep 2 '18 at 18:14
















8















I'd like to capture all traffic from one particular .exe application. I tried to follow this guide with only the one application running on a windows 10 VM, but the VM was very slow and crashed a plenty of times.



Is there any other way to capture the traffic?










share|improve this question













migrated from security.stackexchange.com Sep 2 '18 at 16:09


This question came from our site for information security professionals.


















  • A couple solutions: You could run the program in a Virtual Machine and sniff the traffic from that network device, or you could try using something called ForceBindIP and sniff it using a VPN. Either of those might work.

    – xorist
    Aug 28 '18 at 15:06











  • The easiest and IMHO most effective solution. We doing it in enterprise environments to keep corporate's secrets.

    – Alex
    Sep 2 '18 at 17:10












  • Why was this question migrated from security stackexchange?

    – sandyp
    Sep 2 '18 at 18:14














8












8








8


0






I'd like to capture all traffic from one particular .exe application. I tried to follow this guide with only the one application running on a windows 10 VM, but the VM was very slow and crashed a plenty of times.



Is there any other way to capture the traffic?










share|improve this question














I'd like to capture all traffic from one particular .exe application. I tried to follow this guide with only the one application running on a windows 10 VM, but the VM was very slow and crashed a plenty of times.



Is there any other way to capture the traffic?







networking windows-10 packet






share|improve this question













share|improve this question











share|improve this question




share|improve this question










asked Aug 28 '18 at 14:56









GrenadeBladeGrenadeBlade

464




464




migrated from security.stackexchange.com Sep 2 '18 at 16:09


This question came from our site for information security professionals.









migrated from security.stackexchange.com Sep 2 '18 at 16:09


This question came from our site for information security professionals.














  • A couple solutions: You could run the program in a Virtual Machine and sniff the traffic from that network device, or you could try using something called ForceBindIP and sniff it using a VPN. Either of those might work.

    – xorist
    Aug 28 '18 at 15:06











  • The easiest and IMHO most effective solution. We doing it in enterprise environments to keep corporate's secrets.

    – Alex
    Sep 2 '18 at 17:10












  • Why was this question migrated from security stackexchange?

    – sandyp
    Sep 2 '18 at 18:14


















  • A couple solutions: You could run the program in a Virtual Machine and sniff the traffic from that network device, or you could try using something called ForceBindIP and sniff it using a VPN. Either of those might work.

    – xorist
    Aug 28 '18 at 15:06











  • The easiest and IMHO most effective solution. We doing it in enterprise environments to keep corporate's secrets.

    – Alex
    Sep 2 '18 at 17:10












  • Why was this question migrated from security stackexchange?

    – sandyp
    Sep 2 '18 at 18:14

















A couple solutions: You could run the program in a Virtual Machine and sniff the traffic from that network device, or you could try using something called ForceBindIP and sniff it using a VPN. Either of those might work.

– xorist
Aug 28 '18 at 15:06





A couple solutions: You could run the program in a Virtual Machine and sniff the traffic from that network device, or you could try using something called ForceBindIP and sniff it using a VPN. Either of those might work.

– xorist
Aug 28 '18 at 15:06













The easiest and IMHO most effective solution. We doing it in enterprise environments to keep corporate's secrets.

– Alex
Sep 2 '18 at 17:10






The easiest and IMHO most effective solution. We doing it in enterprise environments to keep corporate's secrets.

– Alex
Sep 2 '18 at 17:10














Why was this question migrated from security stackexchange?

– sandyp
Sep 2 '18 at 18:14






Why was this question migrated from security stackexchange?

– sandyp
Sep 2 '18 at 18:14











3 Answers
3






active

oldest

votes


















13














You can use Fiddler. Just download and install the CA root cert and you should be good to go.



Helpful information on how to do this -



https://audministrator.wordpress.com/2016/03/21/fiddler-how-to-capture-non-web-browser-traffic/






share|improve this answer























  • Relevant information should be provided from links the one you provided

    – Ramhound
    Sep 23 '18 at 19:38


















2














You might start with something like TCPview to determine the source and destination IPs/ports/protocols. Then you can find and isolate the specific stream in Wireshark to look at the actual packets



https://docs.microsoft.com/en-us/sysinternals/downloads/tcpview
https://www.wireshark.org/



You shouldn't need a VM for this approach






share|improve this answer























  • You can also do SSL Decryption with wireshark for SSL traffic that you have the keys for

    – xorist
    Aug 28 '18 at 17:00


















0














Your guide is pointing to intercept traffic. I think you just need to capture the traffic, not intercepting and modifying them.



Fidder most probably will meet with your need as sandyp answered. However, it captures only HTTP, HTTPS, and FTP protocols. Just to extend Matt G's answer, If you want to capture other protocols as well, you might use more advanced sniffing tools such as Wireshark. Wireshark is a very well known tool, so you can find guides and examples very easily on the internet.



It may seem more difficult to use than using Fiddler. Wireshark captures whole network traffic ( not only application layer, but other layers too ) You need to use right IP address, protocol , packet ( whatever you need to ) for filtering. Wireshark Filtering



You can use Wireshark, just in case you need an advanced capturing.



In addition, decrypting SSL is also possible in Wireshark How to Decrypt SSL and TLS Traffic Using Wireshark






share|improve this answer























    Your Answer








    StackExchange.ready(function()
    var channelOptions =
    tags: "".split(" "),
    id: "3"
    ;
    initTagRenderer("".split(" "), "".split(" "), channelOptions);

    StackExchange.using("externalEditor", function()
    // Have to fire editor after snippets, if snippets enabled
    if (StackExchange.settings.snippets.snippetsEnabled)
    StackExchange.using("snippets", function()
    createEditor();
    );

    else
    createEditor();

    );

    function createEditor()
    StackExchange.prepareEditor(
    heartbeatType: 'answer',
    autoActivateHeartbeat: false,
    convertImagesToLinks: true,
    noModals: true,
    showLowRepImageUploadWarning: true,
    reputationToPostImages: 10,
    bindNavPrevention: true,
    postfix: "",
    imageUploader:
    brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
    contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
    allowUrls: true
    ,
    onDemand: true,
    discardSelector: ".discard-answer"
    ,immediatelyShowMarkdownHelp:true
    );



    );













    draft saved

    draft discarded


















    StackExchange.ready(
    function ()
    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1354619%2fintercept-http-https-traffic-of-one-application-windows-10%23new-answer', 'question_page');

    );

    Post as a guest















    Required, but never shown

























    3 Answers
    3






    active

    oldest

    votes








    3 Answers
    3






    active

    oldest

    votes









    active

    oldest

    votes






    active

    oldest

    votes









    13














    You can use Fiddler. Just download and install the CA root cert and you should be good to go.



    Helpful information on how to do this -



    https://audministrator.wordpress.com/2016/03/21/fiddler-how-to-capture-non-web-browser-traffic/






    share|improve this answer























    • Relevant information should be provided from links the one you provided

      – Ramhound
      Sep 23 '18 at 19:38















    13














    You can use Fiddler. Just download and install the CA root cert and you should be good to go.



    Helpful information on how to do this -



    https://audministrator.wordpress.com/2016/03/21/fiddler-how-to-capture-non-web-browser-traffic/






    share|improve this answer























    • Relevant information should be provided from links the one you provided

      – Ramhound
      Sep 23 '18 at 19:38













    13












    13








    13







    You can use Fiddler. Just download and install the CA root cert and you should be good to go.



    Helpful information on how to do this -



    https://audministrator.wordpress.com/2016/03/21/fiddler-how-to-capture-non-web-browser-traffic/






    share|improve this answer













    You can use Fiddler. Just download and install the CA root cert and you should be good to go.



    Helpful information on how to do this -



    https://audministrator.wordpress.com/2016/03/21/fiddler-how-to-capture-non-web-browser-traffic/







    share|improve this answer












    share|improve this answer



    share|improve this answer










    answered Aug 28 '18 at 16:00









    sandypsandyp

    26423




    26423












    • Relevant information should be provided from links the one you provided

      – Ramhound
      Sep 23 '18 at 19:38

















    • Relevant information should be provided from links the one you provided

      – Ramhound
      Sep 23 '18 at 19:38
















    Relevant information should be provided from links the one you provided

    – Ramhound
    Sep 23 '18 at 19:38





    Relevant information should be provided from links the one you provided

    – Ramhound
    Sep 23 '18 at 19:38













    2














    You might start with something like TCPview to determine the source and destination IPs/ports/protocols. Then you can find and isolate the specific stream in Wireshark to look at the actual packets



    https://docs.microsoft.com/en-us/sysinternals/downloads/tcpview
    https://www.wireshark.org/



    You shouldn't need a VM for this approach






    share|improve this answer























    • You can also do SSL Decryption with wireshark for SSL traffic that you have the keys for

      – xorist
      Aug 28 '18 at 17:00















    2














    You might start with something like TCPview to determine the source and destination IPs/ports/protocols. Then you can find and isolate the specific stream in Wireshark to look at the actual packets



    https://docs.microsoft.com/en-us/sysinternals/downloads/tcpview
    https://www.wireshark.org/



    You shouldn't need a VM for this approach






    share|improve this answer























    • You can also do SSL Decryption with wireshark for SSL traffic that you have the keys for

      – xorist
      Aug 28 '18 at 17:00













    2












    2








    2







    You might start with something like TCPview to determine the source and destination IPs/ports/protocols. Then you can find and isolate the specific stream in Wireshark to look at the actual packets



    https://docs.microsoft.com/en-us/sysinternals/downloads/tcpview
    https://www.wireshark.org/



    You shouldn't need a VM for this approach






    share|improve this answer













    You might start with something like TCPview to determine the source and destination IPs/ports/protocols. Then you can find and isolate the specific stream in Wireshark to look at the actual packets



    https://docs.microsoft.com/en-us/sysinternals/downloads/tcpview
    https://www.wireshark.org/



    You shouldn't need a VM for this approach







    share|improve this answer












    share|improve this answer



    share|improve this answer










    answered Aug 28 '18 at 16:47







    Matt G



















    • You can also do SSL Decryption with wireshark for SSL traffic that you have the keys for

      – xorist
      Aug 28 '18 at 17:00

















    • You can also do SSL Decryption with wireshark for SSL traffic that you have the keys for

      – xorist
      Aug 28 '18 at 17:00
















    You can also do SSL Decryption with wireshark for SSL traffic that you have the keys for

    – xorist
    Aug 28 '18 at 17:00





    You can also do SSL Decryption with wireshark for SSL traffic that you have the keys for

    – xorist
    Aug 28 '18 at 17:00











    0














    Your guide is pointing to intercept traffic. I think you just need to capture the traffic, not intercepting and modifying them.



    Fidder most probably will meet with your need as sandyp answered. However, it captures only HTTP, HTTPS, and FTP protocols. Just to extend Matt G's answer, If you want to capture other protocols as well, you might use more advanced sniffing tools such as Wireshark. Wireshark is a very well known tool, so you can find guides and examples very easily on the internet.



    It may seem more difficult to use than using Fiddler. Wireshark captures whole network traffic ( not only application layer, but other layers too ) You need to use right IP address, protocol , packet ( whatever you need to ) for filtering. Wireshark Filtering



    You can use Wireshark, just in case you need an advanced capturing.



    In addition, decrypting SSL is also possible in Wireshark How to Decrypt SSL and TLS Traffic Using Wireshark






    share|improve this answer



























      0














      Your guide is pointing to intercept traffic. I think you just need to capture the traffic, not intercepting and modifying them.



      Fidder most probably will meet with your need as sandyp answered. However, it captures only HTTP, HTTPS, and FTP protocols. Just to extend Matt G's answer, If you want to capture other protocols as well, you might use more advanced sniffing tools such as Wireshark. Wireshark is a very well known tool, so you can find guides and examples very easily on the internet.



      It may seem more difficult to use than using Fiddler. Wireshark captures whole network traffic ( not only application layer, but other layers too ) You need to use right IP address, protocol , packet ( whatever you need to ) for filtering. Wireshark Filtering



      You can use Wireshark, just in case you need an advanced capturing.



      In addition, decrypting SSL is also possible in Wireshark How to Decrypt SSL and TLS Traffic Using Wireshark






      share|improve this answer

























        0












        0








        0







        Your guide is pointing to intercept traffic. I think you just need to capture the traffic, not intercepting and modifying them.



        Fidder most probably will meet with your need as sandyp answered. However, it captures only HTTP, HTTPS, and FTP protocols. Just to extend Matt G's answer, If you want to capture other protocols as well, you might use more advanced sniffing tools such as Wireshark. Wireshark is a very well known tool, so you can find guides and examples very easily on the internet.



        It may seem more difficult to use than using Fiddler. Wireshark captures whole network traffic ( not only application layer, but other layers too ) You need to use right IP address, protocol , packet ( whatever you need to ) for filtering. Wireshark Filtering



        You can use Wireshark, just in case you need an advanced capturing.



        In addition, decrypting SSL is also possible in Wireshark How to Decrypt SSL and TLS Traffic Using Wireshark






        share|improve this answer













        Your guide is pointing to intercept traffic. I think you just need to capture the traffic, not intercepting and modifying them.



        Fidder most probably will meet with your need as sandyp answered. However, it captures only HTTP, HTTPS, and FTP protocols. Just to extend Matt G's answer, If you want to capture other protocols as well, you might use more advanced sniffing tools such as Wireshark. Wireshark is a very well known tool, so you can find guides and examples very easily on the internet.



        It may seem more difficult to use than using Fiddler. Wireshark captures whole network traffic ( not only application layer, but other layers too ) You need to use right IP address, protocol , packet ( whatever you need to ) for filtering. Wireshark Filtering



        You can use Wireshark, just in case you need an advanced capturing.



        In addition, decrypting SSL is also possible in Wireshark How to Decrypt SSL and TLS Traffic Using Wireshark







        share|improve this answer












        share|improve this answer



        share|improve this answer










        answered Aug 29 '18 at 8:04







        Doğukan Uçak


































            draft saved

            draft discarded
















































            Thanks for contributing an answer to Super User!


            • Please be sure to answer the question. Provide details and share your research!

            But avoid


            • Asking for help, clarification, or responding to other answers.

            • Making statements based on opinion; back them up with references or personal experience.

            To learn more, see our tips on writing great answers.




            draft saved


            draft discarded














            StackExchange.ready(
            function ()
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1354619%2fintercept-http-https-traffic-of-one-application-windows-10%23new-answer', 'question_page');

            );

            Post as a guest















            Required, but never shown





















































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown

































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown







            Popular posts from this blog

            𛂒𛀶,𛀽𛀑𛂀𛃧𛂓𛀙𛃆𛃑𛃷𛂟𛁡𛀢𛀟𛁤𛂽𛁕𛁪𛂟𛂯,𛁞𛂧𛀴𛁄𛁠𛁼𛂿𛀤 𛂘,𛁺𛂾𛃭𛃭𛃵𛀺,𛂣𛃍𛂖𛃶 𛀸𛃀𛂖𛁶𛁏𛁚 𛂢𛂞 𛁰𛂆𛀔,𛁸𛀽𛁓𛃋𛂇𛃧𛀧𛃣𛂐𛃇,𛂂𛃻𛃲𛁬𛃞𛀧𛃃𛀅 𛂭𛁠𛁡𛃇𛀷𛃓𛁥,𛁙𛁘𛁞𛃸𛁸𛃣𛁜,𛂛,𛃿,𛁯𛂘𛂌𛃛𛁱𛃌𛂈𛂇 𛁊𛃲,𛀕𛃴𛀜 𛀶𛂆𛀶𛃟𛂉𛀣,𛂐𛁞𛁾 𛁷𛂑𛁳𛂯𛀬𛃅,𛃶𛁼

            Crossroads (UK TV series)

            ữḛḳṊẴ ẋ,Ẩṙ,ỹḛẪẠứụỿṞṦ,Ṉẍừ,ứ Ị,Ḵ,ṏ ṇỪḎḰṰọửḊ ṾḨḮữẑỶṑỗḮṣṉẃ Ữẩụ,ṓ,ḹẕḪḫỞṿḭ ỒṱṨẁṋṜ ḅẈ ṉ ứṀḱṑỒḵ,ḏ,ḊḖỹẊ Ẻḷổ,ṥ ẔḲẪụḣể Ṱ ḭỏựẶ Ồ Ṩ,ẂḿṡḾồ ỗṗṡịṞẤḵṽẃ ṸḒẄẘ,ủẞẵṦṟầṓế