Intercept HTTP/HTTPS traffic of one application (Windows 10)

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP











up vote
8
down vote

favorite












I'd like to capture all traffic from one particular .exe application. I tried to follow this guide with only the one application running on a windows 10 VM, but the VM was very slow and crashed a plenty of times.



Is there any other way to capture the traffic?










share|improve this question













migrated from security.stackexchange.com Sep 2 at 16:09


This question came from our site for information security professionals.














  • A couple solutions: You could run the program in a Virtual Machine and sniff the traffic from that network device, or you could try using something called ForceBindIP and sniff it using a VPN. Either of those might work.
    – xorist
    Aug 28 at 15:06










  • The easiest and IMHO most effective solution. We doing it in enterprise environments to keep corporate's secrets.
    – Alex
    Sep 2 at 17:10











  • Why was this question migrated from security stackexchange?
    – sandyp
    Sep 2 at 18:14















up vote
8
down vote

favorite












I'd like to capture all traffic from one particular .exe application. I tried to follow this guide with only the one application running on a windows 10 VM, but the VM was very slow and crashed a plenty of times.



Is there any other way to capture the traffic?










share|improve this question













migrated from security.stackexchange.com Sep 2 at 16:09


This question came from our site for information security professionals.














  • A couple solutions: You could run the program in a Virtual Machine and sniff the traffic from that network device, or you could try using something called ForceBindIP and sniff it using a VPN. Either of those might work.
    – xorist
    Aug 28 at 15:06










  • The easiest and IMHO most effective solution. We doing it in enterprise environments to keep corporate's secrets.
    – Alex
    Sep 2 at 17:10











  • Why was this question migrated from security stackexchange?
    – sandyp
    Sep 2 at 18:14













up vote
8
down vote

favorite









up vote
8
down vote

favorite











I'd like to capture all traffic from one particular .exe application. I tried to follow this guide with only the one application running on a windows 10 VM, but the VM was very slow and crashed a plenty of times.



Is there any other way to capture the traffic?










share|improve this question













I'd like to capture all traffic from one particular .exe application. I tried to follow this guide with only the one application running on a windows 10 VM, but the VM was very slow and crashed a plenty of times.



Is there any other way to capture the traffic?







networking windows-10 packet






share|improve this question













share|improve this question











share|improve this question




share|improve this question










asked Aug 28 at 14:56









GrenadeBlade

463




463




migrated from security.stackexchange.com Sep 2 at 16:09


This question came from our site for information security professionals.






migrated from security.stackexchange.com Sep 2 at 16:09


This question came from our site for information security professionals.













  • A couple solutions: You could run the program in a Virtual Machine and sniff the traffic from that network device, or you could try using something called ForceBindIP and sniff it using a VPN. Either of those might work.
    – xorist
    Aug 28 at 15:06










  • The easiest and IMHO most effective solution. We doing it in enterprise environments to keep corporate's secrets.
    – Alex
    Sep 2 at 17:10











  • Why was this question migrated from security stackexchange?
    – sandyp
    Sep 2 at 18:14

















  • A couple solutions: You could run the program in a Virtual Machine and sniff the traffic from that network device, or you could try using something called ForceBindIP and sniff it using a VPN. Either of those might work.
    – xorist
    Aug 28 at 15:06










  • The easiest and IMHO most effective solution. We doing it in enterprise environments to keep corporate's secrets.
    – Alex
    Sep 2 at 17:10











  • Why was this question migrated from security stackexchange?
    – sandyp
    Sep 2 at 18:14
















A couple solutions: You could run the program in a Virtual Machine and sniff the traffic from that network device, or you could try using something called ForceBindIP and sniff it using a VPN. Either of those might work.
– xorist
Aug 28 at 15:06




A couple solutions: You could run the program in a Virtual Machine and sniff the traffic from that network device, or you could try using something called ForceBindIP and sniff it using a VPN. Either of those might work.
– xorist
Aug 28 at 15:06












The easiest and IMHO most effective solution. We doing it in enterprise environments to keep corporate's secrets.
– Alex
Sep 2 at 17:10





The easiest and IMHO most effective solution. We doing it in enterprise environments to keep corporate's secrets.
– Alex
Sep 2 at 17:10













Why was this question migrated from security stackexchange?
– sandyp
Sep 2 at 18:14





Why was this question migrated from security stackexchange?
– sandyp
Sep 2 at 18:14











3 Answers
3






active

oldest

votes

















up vote
13
down vote



accepted










You can use Fiddler. Just download and install the CA root cert and you should be good to go.



Helpful information on how to do this -



https://audministrator.wordpress.com/2016/03/21/fiddler-how-to-capture-non-web-browser-traffic/






share|improve this answer




















  • Relevant information should be provided from links the one you provided
    – Ramhound
    yesterday

















up vote
2
down vote













You might start with something like TCPview to determine the source and destination IPs/ports/protocols. Then you can find and isolate the specific stream in Wireshark to look at the actual packets



https://docs.microsoft.com/en-us/sysinternals/downloads/tcpview
https://www.wireshark.org/



You shouldn't need a VM for this approach






share|improve this answer




















  • You can also do SSL Decryption with wireshark for SSL traffic that you have the keys for
    – xorist
    Aug 28 at 17:00

















up vote
0
down vote













Your guide is pointing to intercept traffic. I think you just need to capture the traffic, not intercepting and modifying them.



Fidder most probably will meet with your need as sandyp answered. However, it captures only HTTP, HTTPS, and FTP protocols. Just to extend Matt G's answer, If you want to capture other protocols as well, you might use more advanced sniffing tools such as Wireshark. Wireshark is a very well known tool, so you can find guides and examples very easily on the internet.



It may seem more difficult to use than using Fiddler. Wireshark captures whole network traffic ( not only application layer, but other layers too ) You need to use right IP address, protocol , packet ( whatever you need to ) for filtering. Wireshark Filtering



You can use Wireshark, just in case you need an advanced capturing.



In addition, decrypting SSL is also possible in Wireshark How to Decrypt SSL and TLS Traffic Using Wireshark






share|improve this answer




















    Your Answer







    StackExchange.ready(function()
    var channelOptions =
    tags: "".split(" "),
    id: "3"
    ;
    initTagRenderer("".split(" "), "".split(" "), channelOptions);

    StackExchange.using("externalEditor", function()
    // Have to fire editor after snippets, if snippets enabled
    if (StackExchange.settings.snippets.snippetsEnabled)
    StackExchange.using("snippets", function()
    createEditor();
    );

    else
    createEditor();

    );

    function createEditor()
    StackExchange.prepareEditor(
    heartbeatType: 'answer',
    convertImagesToLinks: true,
    noModals: false,
    showLowRepImageUploadWarning: true,
    reputationToPostImages: 10,
    bindNavPrevention: true,
    postfix: "",
    onDemand: true,
    discardSelector: ".discard-answer"
    ,immediatelyShowMarkdownHelp:true
    );



    );













     

    draft saved


    draft discarded


















    StackExchange.ready(
    function ()
    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1354619%2fintercept-http-https-traffic-of-one-application-windows-10%23new-answer', 'question_page');

    );

    Post as a guest






























    3 Answers
    3






    active

    oldest

    votes








    3 Answers
    3






    active

    oldest

    votes









    active

    oldest

    votes






    active

    oldest

    votes








    up vote
    13
    down vote



    accepted










    You can use Fiddler. Just download and install the CA root cert and you should be good to go.



    Helpful information on how to do this -



    https://audministrator.wordpress.com/2016/03/21/fiddler-how-to-capture-non-web-browser-traffic/






    share|improve this answer




















    • Relevant information should be provided from links the one you provided
      – Ramhound
      yesterday














    up vote
    13
    down vote



    accepted










    You can use Fiddler. Just download and install the CA root cert and you should be good to go.



    Helpful information on how to do this -



    https://audministrator.wordpress.com/2016/03/21/fiddler-how-to-capture-non-web-browser-traffic/






    share|improve this answer




















    • Relevant information should be provided from links the one you provided
      – Ramhound
      yesterday












    up vote
    13
    down vote



    accepted







    up vote
    13
    down vote



    accepted






    You can use Fiddler. Just download and install the CA root cert and you should be good to go.



    Helpful information on how to do this -



    https://audministrator.wordpress.com/2016/03/21/fiddler-how-to-capture-non-web-browser-traffic/






    share|improve this answer












    You can use Fiddler. Just download and install the CA root cert and you should be good to go.



    Helpful information on how to do this -



    https://audministrator.wordpress.com/2016/03/21/fiddler-how-to-capture-non-web-browser-traffic/







    share|improve this answer












    share|improve this answer



    share|improve this answer










    answered Aug 28 at 16:00









    sandyp

    26423




    26423











    • Relevant information should be provided from links the one you provided
      – Ramhound
      yesterday
















    • Relevant information should be provided from links the one you provided
      – Ramhound
      yesterday















    Relevant information should be provided from links the one you provided
    – Ramhound
    yesterday




    Relevant information should be provided from links the one you provided
    – Ramhound
    yesterday












    up vote
    2
    down vote













    You might start with something like TCPview to determine the source and destination IPs/ports/protocols. Then you can find and isolate the specific stream in Wireshark to look at the actual packets



    https://docs.microsoft.com/en-us/sysinternals/downloads/tcpview
    https://www.wireshark.org/



    You shouldn't need a VM for this approach






    share|improve this answer




















    • You can also do SSL Decryption with wireshark for SSL traffic that you have the keys for
      – xorist
      Aug 28 at 17:00














    up vote
    2
    down vote













    You might start with something like TCPview to determine the source and destination IPs/ports/protocols. Then you can find and isolate the specific stream in Wireshark to look at the actual packets



    https://docs.microsoft.com/en-us/sysinternals/downloads/tcpview
    https://www.wireshark.org/



    You shouldn't need a VM for this approach






    share|improve this answer




















    • You can also do SSL Decryption with wireshark for SSL traffic that you have the keys for
      – xorist
      Aug 28 at 17:00












    up vote
    2
    down vote










    up vote
    2
    down vote









    You might start with something like TCPview to determine the source and destination IPs/ports/protocols. Then you can find and isolate the specific stream in Wireshark to look at the actual packets



    https://docs.microsoft.com/en-us/sysinternals/downloads/tcpview
    https://www.wireshark.org/



    You shouldn't need a VM for this approach






    share|improve this answer












    You might start with something like TCPview to determine the source and destination IPs/ports/protocols. Then you can find and isolate the specific stream in Wireshark to look at the actual packets



    https://docs.microsoft.com/en-us/sysinternals/downloads/tcpview
    https://www.wireshark.org/



    You shouldn't need a VM for this approach







    share|improve this answer












    share|improve this answer



    share|improve this answer










    answered Aug 28 at 16:47







    Matt G


















    • You can also do SSL Decryption with wireshark for SSL traffic that you have the keys for
      – xorist
      Aug 28 at 17:00
















    • You can also do SSL Decryption with wireshark for SSL traffic that you have the keys for
      – xorist
      Aug 28 at 17:00















    You can also do SSL Decryption with wireshark for SSL traffic that you have the keys for
    – xorist
    Aug 28 at 17:00




    You can also do SSL Decryption with wireshark for SSL traffic that you have the keys for
    – xorist
    Aug 28 at 17:00










    up vote
    0
    down vote













    Your guide is pointing to intercept traffic. I think you just need to capture the traffic, not intercepting and modifying them.



    Fidder most probably will meet with your need as sandyp answered. However, it captures only HTTP, HTTPS, and FTP protocols. Just to extend Matt G's answer, If you want to capture other protocols as well, you might use more advanced sniffing tools such as Wireshark. Wireshark is a very well known tool, so you can find guides and examples very easily on the internet.



    It may seem more difficult to use than using Fiddler. Wireshark captures whole network traffic ( not only application layer, but other layers too ) You need to use right IP address, protocol , packet ( whatever you need to ) for filtering. Wireshark Filtering



    You can use Wireshark, just in case you need an advanced capturing.



    In addition, decrypting SSL is also possible in Wireshark How to Decrypt SSL and TLS Traffic Using Wireshark






    share|improve this answer
























      up vote
      0
      down vote













      Your guide is pointing to intercept traffic. I think you just need to capture the traffic, not intercepting and modifying them.



      Fidder most probably will meet with your need as sandyp answered. However, it captures only HTTP, HTTPS, and FTP protocols. Just to extend Matt G's answer, If you want to capture other protocols as well, you might use more advanced sniffing tools such as Wireshark. Wireshark is a very well known tool, so you can find guides and examples very easily on the internet.



      It may seem more difficult to use than using Fiddler. Wireshark captures whole network traffic ( not only application layer, but other layers too ) You need to use right IP address, protocol , packet ( whatever you need to ) for filtering. Wireshark Filtering



      You can use Wireshark, just in case you need an advanced capturing.



      In addition, decrypting SSL is also possible in Wireshark How to Decrypt SSL and TLS Traffic Using Wireshark






      share|improve this answer






















        up vote
        0
        down vote










        up vote
        0
        down vote









        Your guide is pointing to intercept traffic. I think you just need to capture the traffic, not intercepting and modifying them.



        Fidder most probably will meet with your need as sandyp answered. However, it captures only HTTP, HTTPS, and FTP protocols. Just to extend Matt G's answer, If you want to capture other protocols as well, you might use more advanced sniffing tools such as Wireshark. Wireshark is a very well known tool, so you can find guides and examples very easily on the internet.



        It may seem more difficult to use than using Fiddler. Wireshark captures whole network traffic ( not only application layer, but other layers too ) You need to use right IP address, protocol , packet ( whatever you need to ) for filtering. Wireshark Filtering



        You can use Wireshark, just in case you need an advanced capturing.



        In addition, decrypting SSL is also possible in Wireshark How to Decrypt SSL and TLS Traffic Using Wireshark






        share|improve this answer












        Your guide is pointing to intercept traffic. I think you just need to capture the traffic, not intercepting and modifying them.



        Fidder most probably will meet with your need as sandyp answered. However, it captures only HTTP, HTTPS, and FTP protocols. Just to extend Matt G's answer, If you want to capture other protocols as well, you might use more advanced sniffing tools such as Wireshark. Wireshark is a very well known tool, so you can find guides and examples very easily on the internet.



        It may seem more difficult to use than using Fiddler. Wireshark captures whole network traffic ( not only application layer, but other layers too ) You need to use right IP address, protocol , packet ( whatever you need to ) for filtering. Wireshark Filtering



        You can use Wireshark, just in case you need an advanced capturing.



        In addition, decrypting SSL is also possible in Wireshark How to Decrypt SSL and TLS Traffic Using Wireshark







        share|improve this answer












        share|improve this answer



        share|improve this answer










        answered Aug 29 at 8:04







        Doğukan Uçak


































             

            draft saved


            draft discarded















































             


            draft saved


            draft discarded














            StackExchange.ready(
            function ()
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1354619%2fintercept-http-https-traffic-of-one-application-windows-10%23new-answer', 'question_page');

            );

            Post as a guest













































































            Popular posts from this blog

            Peggy Mitchell

            Palaiologos

            The Forum (Inglewood, California)