6

Basically I'd like to sniff HTTP requests made by an .exe on Windows. I tried using wireshark, but it's somewhat unhandy since it sniffs all traffic on the interface. Are there any alternatives?

1

2 Answers 2

4

Take a look at SocketSniff; it lets you examine connection activity for a specified program.

enter image description here

1

I prefer procmon http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx, and you get much more of what the app is doing as well.

2
  • Ok, I can see processes with it, but how do I see tcp queries?? Like, GET/POST requests, headers, etc. I filtered it by "TCP Send" and by "TCP Receive" but by opening each of that, I can only see date, PID, parent PID, timestamps when it ended, call stack, probably anything possible except the content itself! (paths, headers, arguments/values, like on a screenshot in accepted answer) Commented Jan 26, 2021 at 8:02
  • @JerryGreen you might want to use a tool more suited for the job, maybe procmon in addition to Wireshark maybe? You can see IP:Port info in procmon, and filter Wireshark traffic based on that, but Wireshark will give you a much better picture of what the traffic looks like imho.
    – MDMoore313
    Commented Jan 26, 2021 at 16:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .