4 ms·
I wonder if this is the result of some tool that intercepts all traffic in Layer 2 and rewrites everything to put a MitM proxy while keeping the original IP add
by gaius_baltar 5y ago
I wonder if this is the result of some tool that intercepts all traffic in Layer 2 and rewrites everything to put a MitM proxy while keeping the original IP addresses. It can even be running in a different machine, with the traffic coming through an actual NIC and cable (so the OS being analyzed does not see strange network interfaces nor changes behavior when it detects that it is running in a VM).
Does somebody know about such a tool?
It does not explain the port 80, however.
- mr_mitm 5y agoI wrote such a tool once: https://github.com/SySS-Research/Lauschgeraet https://github.com/SySS-Research/Lauschgeraet Unfortunately, no one really uses it (not even me) and it is probably full of bugs.
- netresec 5y agoThe PCAP in the referenced tweet was created using PolarProxy, which decrypts and re-encrypts TLS traffic while saving the decrypted traffic to a PCAP file.