I wonder if this is the result of some tool that intercepts all traffic in Layer... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

gaius_baltar on Sept 21, 2021 | parent | context | favorite | on: Text entered into Windows' Run dialogue gets sent ...

I wonder if this is the result of some tool that intercepts all traffic in Layer 2 and rewrites everything to put a MitM proxy while keeping the original IP addresses. It can even be running in a different machine, with the traffic coming through an actual NIC and cable (so the OS being analyzed does not see strange network interfaces nor changes behavior when it detects that it is running in a VM).

Does somebody know about such a tool?

It does not explain the port 80, however.

mr_mitm on Sept 21, 2021 | [–]

I wrote such a tool once: https://github.com/SySS-Research/Lauschgeraet

Unfortunately, no one really uses it (not even me) and it is probably full of bugs.

netresec on Sept 21, 2021 | [–]

The PCAP in the referenced tweet was created using PolarProxy, which decrypts and re-encrypts TLS traffic while saving the decrypted traffic to a PCAP file.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact