Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Requests originating from a program. I've managed to track the particular requests via wireshark, they are HTTP requests.

This is the image below on wireshark.

enter image description here

This is the request it's a POST

Connection: Close
Content-Length: 16
Cache-Control: no-cache


This is the response

HTTP/1.1 200 OK
Date: Fri, 09 Nov 2012 13:06:29 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Content-Length: 12
Connection: close
Content-Type: text/html; charset=UTF-8


The request itself is a bit confusing, I would appreciate a clarification.

Surprisingly as this is A HTTP request, it doesn't show up on fiddler. So, how can I make a response to this? Is it possible via wireshark? Make the response go from unauthorized to authorized?

What tools are there to do this?

I have also tried editing the windows host file but it just ignores it.



Edit, how can I direct all requests to a particular IP to my localhost?

Bounty added

share|improve this question
So you want to make the program think it was authenticated at the server when it actually wasn't? In what way did you edit the HOSTS file in attempts to facilitate what you're asking for (changing the response)? What exactly do you find confusing about the POST? – Ƭᴇcʜιᴇ007 Nov 9 '12 at 15:14
@techie007 Thank you immensely for your response. I put this rule in my hosts file So the request gets sent to my localhost, where I return a simple "authorized". But it seems to ignore the new rule and proceeds to wait from a response from the server itself. – Mob Nov 9 '12 at 15:20
I find it confusing because it wasn't showing up in fiddler. – Mob Nov 9 '12 at 15:20

In your place, I would try to trace the origin of that request and uninstall that product.

Use a tracer such as TCPView, or try some of the alternatives found here.
As regarding Fiddler, try installing the latest Fiddler version 4.

If this is happening from the browser, then check your add-ons.

share|improve this answer
The url that doesn't inspire much confidence is put in an image to avoid google text caching. Please edit. – Mob Nov 11 '12 at 19:12
Not understood. Do you mean this url is legit? – harrymc Nov 11 '12 at 19:47
Thanks. Yes it is legit. – Mob Nov 11 '12 at 20:05
Is this coming from a browser? If so you could maybe use Greasemonkey to modify in the html the address to localhost before it's sent. – harrymc Nov 11 '12 at 20:30

Check out this question, which seems to be about what you're trying to do.

"Redirect request to an external IP to localhost (emulate a server)"

The "route add" answer looks like a better, uh, route.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .