How to intercept an application that bypasses local proxy

Question

I am behind a corporate proxy and the application that i have to test will work only if it is given an exception for using proxy server(i.e it is added to the exceptions list of the sites that do not use proxy server).
In this case, how do i intercept the traffic as all the proxy tools (fiddler, charles proxy, web scarab) are unable to intercept its traffic?

Answer 1

Well, if your application won't work through a proxy, then you're obviously going to have to use non-proxy based analysis.

Note that this will probably not be anything like as user friendly as the proxy tools you are using. For example, Web Scarab knows that an application is communicating over HTTP/HTTPS (simply because it is working over an HTTP proxy) and so it can tell a lot about what it going on. If you have to use a low level sniffer like Wireshark then you are going to be looking at individual packets that could be anything and, while Wireshark will try to decode them as much as possible, you're going to have to do a lot more work.

You're going to miss fiddler even more if you were using it to modify the data going through - at the packet level you're going to use something like Nemesis which is heavy going.

Answer 2

If it is a windows system, then use wireshark, if it is linux use tcpdump, if sun use snoop. Alternatively you can set up a packet capture using a switch span which would need to be directed to one of the packet captures listed above.

Answer 3

You could try using burp in invisible proxying mode. Burp Help files are here.

Essentially you tell the client to connect to burp instead of the real server and then create a mapping in Burp to forward the request.

YMMV depending on the application, but I've used it successfully for this kind of thing in the past.