Does anyone know of a program/system that is purpose built to allow you to sandbox/contain an outbound connection from a Windows PC? The aim being that you can analyse the data being sent via the connection, without actually letting the data go to a device/system that is not under your control.
The best I can come up with is:
- Configure a server with the relevant IP and set it to accept connections for the protocol(s) and port(s).
- Statically route the traffic for the outbound connection to said device (either in the client PC's routing table or in the default gateway device).
- Configure Wireshark on one end (or both ends) and capture the traffic and then analyse away...
Obviously the above is:
- Not terribly convenient or quick to setup each time.
- Doesn't give the full picture since any device I setup to masquerade as the same IP/Port probably won't behave in the same manner that the real end point device might. (i.e. I don't know what the other device is configured to do if its a command and control server sending back instructions etc).
How do people lab test this, do they just setup a genuine sandbox environment that is free of sensitive data and let the connection go to the genuine endpoint and monitor the two way traffic?