Monitoring HTTP(S) Traffic undetected

Monitoring HTTP(S) Traffic undetected - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: Monitoring HTTP(S) Traffic undetected (/showthread.php?tid=6125413)

Monitoring HTTP(S) Traffic undetected - 1111moritz - Dec 4, 2020

Hello,

I want to reverse the traffic of some programs, but if I use a Proxy like Fiddler, the program I want to reverse has a security for that and detects that fiddler is running.
Is there any way to work around this? I am not certain if they detect it by the connection or just by the process of fiddler.
I thought of maybe running Fiddler on another machine and capturing the traffic remotely if they detect it by the proccess or using another method to capture the traffic if they detect it by the connections.
Would there be such an "external" method to capture the traffic?

Thanks in advance :)

RE: Monitoring HTTP(S) Traffic undetected - 0xRemote_IEMI - Dec 5, 2020

(Dec 4, 2020 10:37 AM)1111moritz Wrote: Hello,

I want to reverse the traffic of some programs, but if I use a Proxy like Fiddler, the program I want to reverse has a security for that and detects that fiddler is running.
Is there any way to work around this? I am not certain if they detect it by the connection or just by the process of fiddler.
I thought of maybe running Fiddler on another machine and capturing the traffic remotely if they detect it by the proccess or using another method to capture the traffic if they detect it by the connections.
Would there be such an "external" method to capture the traffic?

Thanks in advance :)

You cannot monitor HTTPs it uses cryptography unless your able to crack the RSA good luck.

RE: Monitoring HTTP(S) Traffic undetected - ThisBearScat - Dec 5, 2020

You need to understand the security protocols in place. Your proxy created by the program(fiddler) is your first issue. Even then you need to understand that many modern apps have multiple sorts of detection in place to detect fuzzing and similar operations preformed by pentesters. To many to explain without writing a book but I suggest you look into understanding the security employed by the web app in question or Web apps in general to get a better understanding of how these may be overcome.

RE: Monitoring HTTP(S) Traffic undetected - Shadow_Cloud - Dec 6, 2020

Have a look at the difference between shallow and deep packet inspection. This is often used to scan enterprise traffic for malware and shares a lot of traits with MITM attacks.