Member Avatar for 9tontruck

Hi guys,

I have recently installed a non-official program that supports me to do things easily. But one concern that I have is that I dont know if this program sends any of my personal information to somewhere on the web.If the program is made by hackers and they made it to automatically collect my personal information and send it to themselves, how can I capture it? There must be some kinds of network connection such as cURL and socket, right? How can I know if there is any connection bwt the program and a web server? And how can I know what kind of data does it send?

  • 5 Contributors
  • 4 Replies
  • 191 Views
  • 5 Days Discussion Span
  • Latest Post Latest Post by L7Sqr

Dani AI

Generated

Good starting points were posted by , , and . The suggestions to capture traffic and run the program in an isolated environment are correct; the next step is to make those captures actionable by tying network flows to the process that opened them, inspecting encrypted channels where possible, and falling back to static inspection of the binary when runtime interception is blocked.

Process-to-network correlation makes packet captures useful. On Windows, tools that enumerate per-process endpoints (showing PID, local/remote addresses and states) let an analyst filter a pcap to only the program of interest; on Unix-like systems the modern ss -p/lsof -i family reveals sockets and owning PIDs so flows can be matched to a process. (learn.microsoft.com)

When connections are TLS-encrypted, an intercepting HTTPS proxy (for example mitmproxy) can reveal HTTP-level requests if the proxy’s CA is trusted by the test system; this is the standard way to read what an app sends over HTTPS. Certificate/public-key pinning in the app will defeat a simple proxy, so checking for pinning and treating it as a signal that deeper analysis is required is important. See the mitmproxy docs and OWASP guidance on pinning for caveats and safe practices. (mitmproxy.org)

If runtime interception is blocked or if the binary must be inspected offline, quick static checks (for example strings to find hard-coded hostnames or libraries) followed by a proper disassembly/decompilation step will often reveal endpoints, libraries (libcurl/WinHTTP), or obvious data formatting. For deeper static work, a tool like Ghidra supports multi-architecture analysis. Finally, enforce egress controls (host firewall or sandbox NAT to a logging proxy), snapshot the analysis VM, and treat suspected exfiltration tools with caution—malicious samples can detect VMs or attempt further abuse. (man7.org)

Recommended Answers

All 4 Replies

Member Avatar for JorgeM

You are on the right track Install a packet capture on the box. I would recommend Wireshark.

Member Avatar for CimmerianX

I'll offer this suggestion. Load the application into a Virtual Machine with no outbound connectivity to the public web. This way you can analyze the app without risk of data exposure. Or if you have the software available, you can load it in a sandbox (i.e. Avast offers this IIRC).

Member Avatar for L7Sqr

: If his application needs connectivity this is not an option.

tcpdump or wireshark are two easy to use approaches. The difficulty is knowing which connections are related to your application (your will see all connections by default with these tools).
If you can watch your application from the system level (e.g. monitor the sockets it opens) then you can get a finer grained view. The difficulty increases significantly with such an approach, however.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.