#WIRESHARK PORTABLE APP HOW TO#

There are a few changes i will definitely make to the setup. The setup is very far from perfect, but it gets the job done. You tend to learn a lot more from setup failures. I took a couple of tries to get it right, especially piping out the network traffic from the hotspot as well as analyzing the packet in real-time but it was definitely worth the effort.

#WIRESHARK PORTABLE APP HOW TO#

It might look a little complicated but it really isn't, as i shall illustrate its components and how to replicate it. The network packet capture and analysis setup that i came up with, is as shown below. I also needed the setup to be easy to install, configure, highly portable, such that i can easily setup and analyze the network traffic of any app of interest at a moments notice, and can work anywhere that i have access to my laptop. This means that i need an access point to provide internet access, the device that the app resides on, a tactic to capture/dump network packets and lastly the ability to analyze the packets in near real-time or passively.

My goal was to monitor mobile network traffic from any specific app of interest. On this blog post, i will focus on passive analysis, however, in the near future i will look into an active network analysis setup. spoofing etc This can be done using tools such as Bettercap / Bettercap-ng, MITMf, Charles proxy, Burp Suite etc Ideally, this is a network based MiTM (Man In The Middle) attack, some examples of the such modifications that could be performed are injecting scripts into web pages, packet injection, media replacement. On the other hand Active analysis, is where network traffic is intercepted and the packets are modifiedon the fly before they are forwarded to the respective intended destination. Its where you dump network packets usually in PCAP (Packet Capture) or PCAP-NG (Packet Capture - Next Generation Dump File) format and proceed analyze them using network protocol analysis tools such as wireshark. Passive analysis is where traffic is collected and analyzed at a later point in time.

There are two types of network traffic analysis approaches i.e. It can be used to identify insecure mobile app communication, potential mobile app or server side vulnerabilities, or even insecure mobile app or server-side configurations to name a few. One of the phases of mobile application pentesting is to analyze network traffic, usually in order to inspect the kind of data exchanged between the mobile app and the end point its connecting to.

Wireshark portable app