WhoYouCalling - A tool to get a pcap per process and much more

If you're paranoid like me, or just like to check where applications are reaching out, WhoYouCalling is probably something for you. I've created a Windows tool that allows for tracking network activity through the use of Windows Event Tracing (ETW) that captures TCPIP activity and DNS queries and the respective DNS responses. A full network packet capture is also initialized and is subjected to BPF filtering which provides a per process pcap file. Sounds too good? By default WhoYouCalling monitors all of the child processes too, nicely sorting out all of their respective phone call shenanigans. Ive added a timer where you specify in seconds for how long a process should be monitored. Want it in JSON? gotcha. You want it in XML? Too bad. I haven't implemented that but will if there's a need for it. After playing around with game hacking for a while i felt that there was a tool missing for getting everything in regard to process telemetry. WhoYouCalling is fresh in development, so if you have any suggestions or pointers, shoot! Example output from WhoYouCalling Link to tool: https://github.com/H4NM/WhoYouCalling I've provided instructions for compiling the tool by yourself, or you can download the release files. If there are any questions i hope the README.md will suffice. submitted by /u/73637269707420 [link] [comments]

from hacking: security in practice https://ift.tt/DGpyVfz