Member Avatar for Taximus

Hi everyone! Can you help me please? I need to write sniffer for internet explorer 9.0 using hooks in c# Is it possible? I searched google.com found some information: SharpCap (packet capture framework for .NET), using .NET Socket class to listen user's activities on the web browser but I didn't find anything how I can create sniffer with usage of hooks. Can you guys give me some advice how to do that? Is there any way? Well, if it's not possible to use hooks than maybe some fuctions which incapsulates hooks inside. Maybe there is some way to hook winsock and steal packets from there?

Thank you for your help.

Edited by Taximus
  • 2 Contributors
  • 2 Replies
  • 824 Views
  • 7 Hours Discussion Span
  • Latest Post Latest Post by Taximus

Dani AI

Generated

As asked about C# "hooks" for IE9 and sketched the two broad choices, here is a practical, up-to-date expansion with concrete tradeoffs and a recommended path.

If the goal is to see or modify HTTP/HTTPS requests and responses, the cleanest route is a local HTTP(S) proxy that IE is pointed at. Implementing or embedding a proxy in C# gives you full access to headers and bodies without kernel drivers or process injection. HTTPS requires TLS interception (generate and trust a local root cert) and you may run into certificate pinning or security prompts; handle those deliberately. This approach is cross-browser and easiest to prototype and debug.

If you need browser context (DOM, JavaScript state, navigation events, cookies), use IE’s supported extension mechanisms (BHO / COM event handlers). C# can be used but must be registered correctly as a COM server and be built for the target bitness; keep in-process work tiny or use a native shim to avoid destabilizing the browser. This gives richer context than a proxy but is browser-specific.

If raw TCP/UDP or non-HTTP protocols are required, you must move to packet/filtering solutions that rely on native drivers or user-mode drivers with native components. That path needs admin rights, driver signing on modern Windows, and careful testing; it is more work and risk than a proxy or extension. Older Winsock-layer tricks are fragile and generally not recommended.

Suggested workflow:

  1. decide scope (IE-only vs all apps, HTTP-only vs raw packets);
  2. prototype with a local proxy in C# (fast feedback);
  3. add HTTPS handling only when needed;
  4. only then consider a BHO for browser context or native drivers for raw packets.

Also verify legal/privacy and obtain consent before intercepting others' traffic.

Recommended Answers

All 2 Replies

Member Avatar for skatamatic

There's 2 ways to do this. 1 would be to hook IE directly by injecting code into it and knowing what you are monitoring (basically would have to know how IE works inside which I unfortunately can't help you with). This would be pretty troublesome and complicated so I recommend not doing this. 2 would be to monitor all HTTP packets coming in (port 80). It's actually more robust to do it this way since it will work for all browsers. This describes how to sniff packets in C#, you would probably want to filter the port to 80 unless you care about TCP/UDP/other random ports as well.

Edited by skatamatic
Member Avatar for Taximus

Thank you for your help. Got it. I will look at codeproject.com

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.