Set up a system to sandbox/capture outbound traffic from Windows PC? [closed]

Question

Does anyone know of a program/system that is purpose built to allow you to sandbox/contain an outbound connection from a Windows PC? The aim being that you can analyse the data being sent via the connection, without actually letting the data go to a device/system that is not under your control.

The best I can come up with is:

1. Configure a server with the relevant IP and set it to accept connections for the protocol(s) and port(s).
2. Statically route the traffic for the outbound connection to said device (either in the client PC's routing table or in the default gateway device).
3. Configure Wireshark on one end (or both ends) and capture the traffic and then analyse away...

Obviously the above is:

1. Not terribly convenient or quick to setup each time.
2. Doesn't give the full picture since any device I setup to masquerade as the same IP/Port probably won't behave in the same manner that the real end point device might. (i.e. I don't know what the other device is configured to do if its a command and control server sending back instructions etc).

How do people lab test this, do they just setup a genuine sandbox environment that is free of sensitive data and let the connection go to the genuine endpoint and monitor the two way traffic?

Answer 1

If it is malware analysis that you wish one virtual machine that is the analysed subject that forwards traffic to another one that is one proxy. There in the proxy you can decide what passes and what stays and reroute packages if you wish to pre build answers in order to deceive the malware. (fake cc server) when possible :)

For that I usually use vmware workstations Lab with 1 network interface connected to Network A in VMware Proxy with 2 network connections one in Network A and another Nated or bridged with another physical interface.

If you wish to have something that handles all this for you fully automated search for cuckoo sandbox :)

Answer 2

analyse the data being sent via the connection, without actually letting the data go to a device/system that is not under your control.

At various levels of abstraction, data will only be sent out when a negotiation has occurred - no attempt to make a connection until DNS is resolved, no TCP stream until the TCP handshake completes, no HTTP request over TLS until the SSL handshake completes, and then there's the specifics of the application on top of that). So unless you fake the responses to all possible protocols the subject will use, or allow the traffic to flow freely you won't see any useful data.

(From memory, I think you can see unencypted data between an application and winsock on MSWindows machines - and there are tools available to intercept this exchange on the PC)

Statically route the traffic

....will cover the case where the malware tries to contact a C&C - but you won't see what its doing on your local network. I would configure the capture device as the default route, but run the PC in its own sub-net / physical net along with the capture device.

Beyond that.....wireshark.