Skip to main content
Information Security

Return to Question

Notice removed Draw attention by CommunityBot
Bounty Ended with BenjaminH's answer chosen by CommunityBot
Tweeted twitter.com/StackSecurity/status/894478361971625985
corrected grammar: past and present tense, plurals vs singular.
Source Link
edit approved Aug 7, 2017 at 8:03
llorrac
edit approved Aug 7, 2017 at 8:03
llorrac
  • 324
  • 1
  • 7

Recently I am learning about thick client application pentestpentesting and findhave found that it is hard to get a tool for intercepting thick client application traffic.

Anyone hasHas anyone come across witha thick client application pentest andfor pentesting, or know iswhether there is any software that can work as an interceptor proxy like Burp Suite for thick client applicationapplications? I am looking for a tool that is not only able to intercept http traffic but also tcp traffic.

I have done some searchsearching on google and found Mallory. So far this is the best tool I can foundfind out there. I have tested it and it is working as expected, however it is not stable and has not been updated for quite some timestime.

Another problem I haveam facing is, if the application is using windows domain authentication (NTLM Authentication), the TCP traffic will then be encrypted. Is there any way to see the plain text traffic and modify the data before sendit's sent to server (just like how Burp did it for HTTPS traffic)?

Recently I am learning thick client application pentest and find that it is hard to get a tool for intercepting thick client application traffic.

Anyone has come across with thick client application pentest and know is there any software that can work as an interceptor proxy like Burp Suite for thick client application? I am looking for a tool that is not only able to intercept http traffic but also tcp traffic.

I have done some search on google and found Mallory. So far this is the best tool I can found out there. I have tested it and it is working as expected, however it is not stable and not updated for quite some times.

Another problem I have facing if the application is using windows domain authentication (NTLM Authentication), the TCP traffic will then be encrypted. Is there any way to see the plain text traffic and modify the data before send to server (just like how Burp did it for HTTPS traffic)?

Recently I am learning about thick client application pentesting and have found that it is hard to get a tool for intercepting thick client application traffic.

Has anyone come across a thick client application for pentesting, or know whether there is any software that can work as an interceptor proxy like Burp Suite for thick client applications? I am looking for a tool that is not only able to intercept http traffic but also tcp traffic.

I have done some searching on google and found Mallory. So far this is the best tool I can find out there. I have tested it and it is working as expected, however it is not stable and has not been updated for quite some time.

Another problem I am facing is, if the application is using windows domain authentication (NTLM Authentication), the TCP traffic will then be encrypted. Is there any way to see the plain text traffic and modify the data before it's sent to server (just like how Burp did it for HTTPS traffic)?

Notice added Draw attention by overshadow
Bounty Started worth 50 reputation by overshadow
Source Link
overshadow
overshadow
  • 361
  • 3
  • 6
  • 18

How to intercept thick client application traffic (tcp or http[s])

Recently I am learning thick client application pentest and find that it is hard to get a tool for intercepting thick client application traffic.

Anyone has come across with thick client application pentest and know is there any software that can work as an interceptor proxy like Burp Suite for thick client application? I am looking for a tool that is not only able to intercept http traffic but also tcp traffic.

I have done some search on google and found Mallory. So far this is the best tool I can found out there. I have tested it and it is working as expected, however it is not stable and not updated for quite some times.

Another problem I have facing if the application is using windows domain authentication (NTLM Authentication), the TCP traffic will then be encrypted. Is there any way to see the plain text traffic and modify the data before send to server (just like how Burp did it for HTTPS traffic)?