Intercept HTTP/HTTPS traffic of one application (Windows 10)

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP











up vote
8
down vote

favorite












I'd like to capture all traffic from one particular .exe application. I tried to follow this guide with only the one application running on a windows 10 VM, but the VM was very slow and crashed a plenty of times.



Is there any other way to capture the traffic?







share|improve this question












migrated from security.stackexchange.com Sep 2 at 16:09


This question came from our site for information security professionals.














  • A couple solutions: You could run the program in a Virtual Machine and sniff the traffic from that network device, or you could try using something called ForceBindIP and sniff it using a VPN. Either of those might work.
    – xorist
    Aug 28 at 15:06










  • The easiest and IMHO most effective solution. We doing it in enterprise environments to keep corporate's secrets.
    – Alex
    Sep 2 at 17:10











  • Why was this question migrated from security stackexchange?
    – sandyp
    Sep 2 at 18:14















up vote
8
down vote

favorite












I'd like to capture all traffic from one particular .exe application. I tried to follow this guide with only the one application running on a windows 10 VM, but the VM was very slow and crashed a plenty of times.



Is there any other way to capture the traffic?







share|improve this question












migrated from security.stackexchange.com Sep 2 at 16:09


This question came from our site for information security professionals.














  • A couple solutions: You could run the program in a Virtual Machine and sniff the traffic from that network device, or you could try using something called ForceBindIP and sniff it using a VPN. Either of those might work.
    – xorist
    Aug 28 at 15:06










  • The easiest and IMHO most effective solution. We doing it in enterprise environments to keep corporate's secrets.
    – Alex
    Sep 2 at 17:10











  • Why was this question migrated from security stackexchange?
    – sandyp
    Sep 2 at 18:14













up vote
8
down vote

favorite









up vote
8
down vote

favorite











I'd like to capture all traffic from one particular .exe application. I tried to follow this guide with only the one application running on a windows 10 VM, but the VM was very slow and crashed a plenty of times.



Is there any other way to capture the traffic?







share|improve this question












I'd like to capture all traffic from one particular .exe application. I tried to follow this guide with only the one application running on a windows 10 VM, but the VM was very slow and crashed a plenty of times.



Is there any other way to capture the traffic?









share|improve this question











share|improve this question




share|improve this question










asked Aug 28 at 14:56









GrenadeBlade

463




463




migrated from security.stackexchange.com Sep 2 at 16:09


This question came from our site for information security professionals.






migrated from security.stackexchange.com Sep 2 at 16:09


This question came from our site for information security professionals.













  • A couple solutions: You could run the program in a Virtual Machine and sniff the traffic from that network device, or you could try using something called ForceBindIP and sniff it using a VPN. Either of those might work.
    – xorist
    Aug 28 at 15:06










  • The easiest and IMHO most effective solution. We doing it in enterprise environments to keep corporate's secrets.
    – Alex
    Sep 2 at 17:10











  • Why was this question migrated from security stackexchange?
    – sandyp
    Sep 2 at 18:14

















  • A couple solutions: You could run the program in a Virtual Machine and sniff the traffic from that network device, or you could try using something called ForceBindIP and sniff it using a VPN. Either of those might work.
    – xorist
    Aug 28 at 15:06










  • The easiest and IMHO most effective solution. We doing it in enterprise environments to keep corporate's secrets.
    – Alex
    Sep 2 at 17:10











  • Why was this question migrated from security stackexchange?
    – sandyp
    Sep 2 at 18:14
















A couple solutions: You could run the program in a Virtual Machine and sniff the traffic from that network device, or you could try using something called ForceBindIP and sniff it using a VPN. Either of those might work.
– xorist
Aug 28 at 15:06




A couple solutions: You could run the program in a Virtual Machine and sniff the traffic from that network device, or you could try using something called ForceBindIP and sniff it using a VPN. Either of those might work.
– xorist
Aug 28 at 15:06












The easiest and IMHO most effective solution. We doing it in enterprise environments to keep corporate's secrets.
– Alex
Sep 2 at 17:10





The easiest and IMHO most effective solution. We doing it in enterprise environments to keep corporate's secrets.
– Alex
Sep 2 at 17:10













Why was this question migrated from security stackexchange?
– sandyp
Sep 2 at 18:14





Why was this question migrated from security stackexchange?
– sandyp
Sep 2 at 18:14











3 Answers
3






active

oldest

votes

















up vote
14
down vote



accepted










You can use Fiddler. Just download and install the CA root cert and you should be good to go.



Helpful information on how to do this -



https://audministrator.wordpress.com/2016/03/21/fiddler-how-to-capture-non-web-browser-traffic/






share|improve this answer



























    up vote
    2
    down vote













    You might start with something like TCPview to determine the source and destination IPs/ports/protocols. Then you can find and isolate the specific stream in Wireshark to look at the actual packets



    https://docs.microsoft.com/en-us/sysinternals/downloads/tcpview
    https://www.wireshark.org/



    You shouldn't need a VM for this approach






    share|improve this answer




















    • You can also do SSL Decryption with wireshark for SSL traffic that you have the keys for
      – xorist
      Aug 28 at 17:00

















    up vote
    1
    down vote













    Your guide is pointing to intercept traffic. I think you just need to capture the traffic, not intercepting and modifying them.



    Fidder most probably will meet with your need as sandyp answered. However, it captures only HTTP, HTTPS, and FTP protocols. Just to extend Matt G's answer, If you want to capture other protocols as well, you might use more advanced sniffing tools such as Wireshark. Wireshark is a very well known tool, so you can find guides and examples very easily on the internet.



    It may seem more difficult to use than using Fiddler. Wireshark captures whole network traffic ( not only application layer, but other layers too ) You need to use right IP address, protocol , packet ( whatever you need to ) for filtering. Wireshark Filtering



    You can use Wireshark, just in case you need an advanced capturing.



    In addition, decrypting SSL is also possible in Wireshark How to Decrypt SSL and TLS Traffic Using Wireshark






    share|improve this answer




















      Your Answer







      StackExchange.ready(function()
      var channelOptions =
      tags: "".split(" "),
      id: "3"
      ;
      initTagRenderer("".split(" "), "".split(" "), channelOptions);

      StackExchange.using("externalEditor", function()
      // Have to fire editor after snippets, if snippets enabled
      if (StackExchange.settings.snippets.snippetsEnabled)
      StackExchange.using("snippets", function()
      createEditor();
      );

      else
      createEditor();

      );

      function createEditor()
      StackExchange.prepareEditor(
      heartbeatType: 'answer',
      convertImagesToLinks: true,
      noModals: false,
      showLowRepImageUploadWarning: true,
      reputationToPostImages: 10,
      bindNavPrevention: true,
      postfix: "",
      onDemand: true,
      discardSelector: ".discard-answer"
      ,immediatelyShowMarkdownHelp:true
      );



      );













       

      draft saved


      draft discarded


















      StackExchange.ready(
      function ()
      StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1354619%2fintercept-http-https-traffic-of-one-application-windows-10%23new-answer', 'question_page');

      );

      Post as a guest






























      3 Answers
      3






      active

      oldest

      votes








      3 Answers
      3






      active

      oldest

      votes









      active

      oldest

      votes






      active

      oldest

      votes








      up vote
      14
      down vote



      accepted










      You can use Fiddler. Just download and install the CA root cert and you should be good to go.



      Helpful information on how to do this -



      https://audministrator.wordpress.com/2016/03/21/fiddler-how-to-capture-non-web-browser-traffic/






      share|improve this answer
























        up vote
        14
        down vote



        accepted










        You can use Fiddler. Just download and install the CA root cert and you should be good to go.



        Helpful information on how to do this -



        https://audministrator.wordpress.com/2016/03/21/fiddler-how-to-capture-non-web-browser-traffic/






        share|improve this answer






















          up vote
          14
          down vote



          accepted







          up vote
          14
          down vote



          accepted






          You can use Fiddler. Just download and install the CA root cert and you should be good to go.



          Helpful information on how to do this -



          https://audministrator.wordpress.com/2016/03/21/fiddler-how-to-capture-non-web-browser-traffic/






          share|improve this answer












          You can use Fiddler. Just download and install the CA root cert and you should be good to go.



          Helpful information on how to do this -



          https://audministrator.wordpress.com/2016/03/21/fiddler-how-to-capture-non-web-browser-traffic/







          share|improve this answer












          share|improve this answer



          share|improve this answer










          answered Aug 28 at 16:00









          sandyp

          26623




          26623






















              up vote
              2
              down vote













              You might start with something like TCPview to determine the source and destination IPs/ports/protocols. Then you can find and isolate the specific stream in Wireshark to look at the actual packets



              https://docs.microsoft.com/en-us/sysinternals/downloads/tcpview
              https://www.wireshark.org/



              You shouldn't need a VM for this approach






              share|improve this answer




















              • You can also do SSL Decryption with wireshark for SSL traffic that you have the keys for
                – xorist
                Aug 28 at 17:00














              up vote
              2
              down vote













              You might start with something like TCPview to determine the source and destination IPs/ports/protocols. Then you can find and isolate the specific stream in Wireshark to look at the actual packets



              https://docs.microsoft.com/en-us/sysinternals/downloads/tcpview
              https://www.wireshark.org/



              You shouldn't need a VM for this approach






              share|improve this answer




















              • You can also do SSL Decryption with wireshark for SSL traffic that you have the keys for
                – xorist
                Aug 28 at 17:00












              up vote
              2
              down vote










              up vote
              2
              down vote









              You might start with something like TCPview to determine the source and destination IPs/ports/protocols. Then you can find and isolate the specific stream in Wireshark to look at the actual packets



              https://docs.microsoft.com/en-us/sysinternals/downloads/tcpview
              https://www.wireshark.org/



              You shouldn't need a VM for this approach






              share|improve this answer












              You might start with something like TCPview to determine the source and destination IPs/ports/protocols. Then you can find and isolate the specific stream in Wireshark to look at the actual packets



              https://docs.microsoft.com/en-us/sysinternals/downloads/tcpview
              https://www.wireshark.org/



              You shouldn't need a VM for this approach







              share|improve this answer












              share|improve this answer



              share|improve this answer










              answered Aug 28 at 16:47







              Matt G


















              • You can also do SSL Decryption with wireshark for SSL traffic that you have the keys for
                – xorist
                Aug 28 at 17:00
















              • You can also do SSL Decryption with wireshark for SSL traffic that you have the keys for
                – xorist
                Aug 28 at 17:00















              You can also do SSL Decryption with wireshark for SSL traffic that you have the keys for
              – xorist
              Aug 28 at 17:00




              You can also do SSL Decryption with wireshark for SSL traffic that you have the keys for
              – xorist
              Aug 28 at 17:00










              up vote
              1
              down vote













              Your guide is pointing to intercept traffic. I think you just need to capture the traffic, not intercepting and modifying them.



              Fidder most probably will meet with your need as sandyp answered. However, it captures only HTTP, HTTPS, and FTP protocols. Just to extend Matt G's answer, If you want to capture other protocols as well, you might use more advanced sniffing tools such as Wireshark. Wireshark is a very well known tool, so you can find guides and examples very easily on the internet.



              It may seem more difficult to use than using Fiddler. Wireshark captures whole network traffic ( not only application layer, but other layers too ) You need to use right IP address, protocol , packet ( whatever you need to ) for filtering. Wireshark Filtering



              You can use Wireshark, just in case you need an advanced capturing.



              In addition, decrypting SSL is also possible in Wireshark How to Decrypt SSL and TLS Traffic Using Wireshark






              share|improve this answer
























                up vote
                1
                down vote













                Your guide is pointing to intercept traffic. I think you just need to capture the traffic, not intercepting and modifying them.



                Fidder most probably will meet with your need as sandyp answered. However, it captures only HTTP, HTTPS, and FTP protocols. Just to extend Matt G's answer, If you want to capture other protocols as well, you might use more advanced sniffing tools such as Wireshark. Wireshark is a very well known tool, so you can find guides and examples very easily on the internet.



                It may seem more difficult to use than using Fiddler. Wireshark captures whole network traffic ( not only application layer, but other layers too ) You need to use right IP address, protocol , packet ( whatever you need to ) for filtering. Wireshark Filtering



                You can use Wireshark, just in case you need an advanced capturing.



                In addition, decrypting SSL is also possible in Wireshark How to Decrypt SSL and TLS Traffic Using Wireshark






                share|improve this answer






















                  up vote
                  1
                  down vote










                  up vote
                  1
                  down vote









                  Your guide is pointing to intercept traffic. I think you just need to capture the traffic, not intercepting and modifying them.



                  Fidder most probably will meet with your need as sandyp answered. However, it captures only HTTP, HTTPS, and FTP protocols. Just to extend Matt G's answer, If you want to capture other protocols as well, you might use more advanced sniffing tools such as Wireshark. Wireshark is a very well known tool, so you can find guides and examples very easily on the internet.



                  It may seem more difficult to use than using Fiddler. Wireshark captures whole network traffic ( not only application layer, but other layers too ) You need to use right IP address, protocol , packet ( whatever you need to ) for filtering. Wireshark Filtering



                  You can use Wireshark, just in case you need an advanced capturing.



                  In addition, decrypting SSL is also possible in Wireshark How to Decrypt SSL and TLS Traffic Using Wireshark






                  share|improve this answer












                  Your guide is pointing to intercept traffic. I think you just need to capture the traffic, not intercepting and modifying them.



                  Fidder most probably will meet with your need as sandyp answered. However, it captures only HTTP, HTTPS, and FTP protocols. Just to extend Matt G's answer, If you want to capture other protocols as well, you might use more advanced sniffing tools such as Wireshark. Wireshark is a very well known tool, so you can find guides and examples very easily on the internet.



                  It may seem more difficult to use than using Fiddler. Wireshark captures whole network traffic ( not only application layer, but other layers too ) You need to use right IP address, protocol , packet ( whatever you need to ) for filtering. Wireshark Filtering



                  You can use Wireshark, just in case you need an advanced capturing.



                  In addition, decrypting SSL is also possible in Wireshark How to Decrypt SSL and TLS Traffic Using Wireshark







                  share|improve this answer












                  share|improve this answer



                  share|improve this answer










                  answered Aug 29 at 8:04







                  Doğukan Uçak


































                       

                      draft saved


                      draft discarded















































                       


                      draft saved


                      draft discarded














                      StackExchange.ready(
                      function ()
                      StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1354619%2fintercept-http-https-traffic-of-one-application-windows-10%23new-answer', 'question_page');

                      );

                      Post as a guest













































































                      這個網誌中的熱門文章

                      How to combine Bézier curves to a surface?

                      Carbon dioxide

                      Why am i infinitely getting the same tweet with the Twitter Search API?