Traffic Sniffer

I am researching a rootkit and looking for an application which logs data to and from the malware. Other than WireShark, what tools would you recommend for this purpose?


Regards,
CW

 

What OS are you running?

If Windows,
Have you tried Buster Sandbox Analyzer? Requires a paid liscense for Sandboxie.

 

Thanks for that, I've never heard of that aplication before so I'll give it a go.

Maybe I am overlooking something in WireShark but is there any easy way to filter POST data, or look for unusual connection activity without going through all the data manually.

 

Just an aside note.
Theoretically it is possible to compromise the kernel in a way that whatever traffic sniffer you might use its records can become unreliable.

 

TCPview may not be a packet sniffer, but is will show you some nice data.

http://technet.microsoft.com/en-us/sysinternals/bb897437.aspx

Sul.

 

I saw one on YouTube ages ago which acted as a proxy. This would allow you to use two different machines, logging the packets on a clean machine would give almost 100% accurate results. Shame I can't remember what its called.

 

Charles proxy?

 

No, I don't think it wasn't charles proxy.

 

google network miner, there are a few other programs similar

 

The only other that comes to mind is put out by TamoSoft. Check SnapFiles shareware sec-privacy and networking categories.

 

You could also try Networkminer

The wiki says : "NetworkMiner also comes in very handy when analyzing malware traffic, such as C&C (command-and-control) traffic from a BotNet, since uploaded and downloaded files are extracted to disk."

And check this

 

Got it, it was Fiddler Web Proxy... http://www.fiddler2.com/fiddler2/.

 

Along with Membrane, WebScarab and WFetch - the other "proxy" type application that slipped by.

 

Network Tracing in Windows 7
http://www.raymond.cc/blog/archives...and-decoding-packets-including-ssl-with-ospy/

 

Nirsoft has a free packet sniffer

http://www.nirsoft.net/utils/smsniff.html