Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Requests originating from a program. I've managed to track the particular requests via wireshark, they are HTTP requests.

This is the image below on wireshark.

enter image description here

This is the request it's a POST

POST http://site.com/?login=null HTTP/1.0
Host: 55.32.33.11
Connection: Close
Content-Length: 16
Cache-Control: no-cache

//password

This is the response

HTTP/1.1 200 OK
Date: Fri, 09 Nov 2012 13:06:29 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Content-Length: 12
Connection: close
Content-Type: text/html; charset=UTF-8

unauthorized

The request itself is a bit confusing, I would appreciate a clarification.

Surprisingly as this is A HTTP request, it doesn't show up on fiddler. So, how can I make a response to this? Is it possible via wireshark? Make the response go from unauthorized to authorized?

What tools are there to do this?

I have also tried editing the windows host file but it just ignores it.

Thanks

==========================================

Edit, how can I direct all requests to a particular IP to my localhost? 127.0.0.1

Bounty added

share|improve this question
    
So you want to make the program think it was authenticated at the server when it actually wasn't? In what way did you edit the HOSTS file in attempts to facilitate what you're asking for (changing the response)? What exactly do you find confusing about the POST? –  techie007 Nov 9 '12 at 15:14
    
@techie007 Thank you immensely for your response. I put this rule in my hosts file 127.0.0.1 webpay.site.com So the request gets sent to my localhost, where I return a simple "authorized". But it seems to ignore the new rule and proceeds to wait from a response from the server itself. –  Mob Nov 9 '12 at 15:20
    
I find it confusing because it wasn't showing up in fiddler. –  Mob Nov 9 '12 at 15:20
add comment

2 Answers

In your place, I would try to trace the origin of that request and uninstall that product.

Use a tracer such as TCPView, or try some of the alternatives found here.
As regarding Fiddler, try installing the latest Fiddler version 4.

If this is happening from the browser, then check your add-ons.

share|improve this answer
    
The url that doesn't inspire much confidence is put in an image to avoid google text caching. Please edit. –  Mob Nov 11 '12 at 19:12
    
Not understood. Do you mean this url is legit? –  harrymc Nov 11 '12 at 19:47
    
Thanks. Yes it is legit. –  Mob Nov 11 '12 at 20:05
    
Is this coming from a browser? If so you could maybe use Greasemonkey to modify in the html the address to localhost before it's sent. –  harrymc Nov 11 '12 at 20:30
add comment

Check out this question, which seems to be about what you're trying to do.

"Redirect request to an external IP to localhost (emulate a server)"

http://serverfault.com/questions/171850/redirect-request-to-an-external-ip-to-localhost-emulate-a-server

The "route add" answer looks like a better, uh, route.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.