Re: Android Phone Sniff Tool Crack
Yvette Burkhammer
Usually phone connects to the device and exchanges some data. I connected PC to the device and looked into serial debugger and menaged to discover the protocol (one way only). Phone sends only one command to the device. But this time I'm not able to find out what it containts.
When the Analyst has finished populating the capture file by running the application being tested, he can pull the file generated by Android into the external storage of the device and analyze it (with Wireshark, for example).
We can then open a shell and pull the file: $adb pull /sdcard/btsnoop_hci.log and inspect it with Wireshark, just like a PCAP collected by sniffing WiFi traffic for example, so it is very simple and well supported:
What I wanted to write about is some notes about my experience, if nothing else because it took me a while to get all the fragments ready, and I could not find a single entry anywhere that would explain what the error message I was receiving was about.
The explanation is kind of simple: this set of interfaces is effetively just a matrioska of interfaces. Wireshark calls into extcap, that calls into androiddump, that calls into adb, that calls into tcpdump on the device.
Depending on the working system you use to set the capture up, you may be able to set up your computer to be an access point, and connect the phone to it. But this is not easy particularly on a laptop with already-oversubscribed USB ports. So I had to look for alternatives.
On the bright side, my router is currently running OpenWRT (with all the warts it has). Which means I have som leeway on the network access already. Googling around would suggest setting up a tee: tell iptables to forward a copy of every single packet coming from or to the phone to another mac address. This is relativel expensive, and no reliable over WiFi networks anyway, beside increasing congestion on an already busy network.
I opted instead to use another tool that is available in extcap: ssh-based packet captures. In Gentoo these require the sshdump and libssh USE flags enabled. With this interface, Wireshark effectively opens a session via SSH to the router, and runs tcpdump on it. It can also use dumpcap or tshark, which are Wireshark-specific tools, and would be significantly more performant, but there is no build for them on OpenWRT so that does not help either.
TraceCase is the small and handy contactless spy tool for NFC sniffing discreetly into transactions under real-life conditions. The powerful TraceCase software allows analyzing and debugging in order to create a reliable NFC ecosystem.
Download and test the latest version of our TraceCase App including an embedded test session of a typical payment transaction. TraceCase is available in the Apple App Store and for Android devices from Google Play.
TraceCase is also available as TraceCase Fit - a tailor-made test solution hidden in a smartphone case, for various phones including various iPhones. For a detailed list of form factors, please feel free to get in touch with our Sales Team.
"We value the TraceCase for its compact and discreet design that enables reliable detection of NFC communication in real-world environments. The user-friendly interface makes it easy to use the TraceCase effectively in all scenarios. In addition, capturing and analyzing both digital and analog signals has greatly improved our fault diagnosis and resolution capabilities."
TraceCase app controls the mini NFC sniffer for taking captures in the field - or on your desk. This webinar is a walkthrough of the complete TraceCase App for both, Android and iOS: With this step-by-step explanation you will get all you need to master your next NFC captures.
See how the TraceCase web interface helps you to work with TraceCase directly on your PC, Sometimes the app is not possible to use. But this is no reason to worry! Watch the video and simply start tracing with your PC!
I want to sniff traffic going through my wireless router. The router is provided by my cable company, so I don't want to flash the firmware or anything, so my questions is: Is there any software or such that I can install on one of the computers on my network, and have it log the HTTP request/response?
Note: I've already tried setting up a proxy and logging that way. The game seems to be bypassing my Proxy settings. Other web traffic will go through my proxy, but not the game's traffic. I know it's using HTTP, because the game DOES obey the proxy on my friend's iphone (same game). So setting up a proxy isn't a solution that will work.
Another approach is to try using ettercap to sniff your LAN. It has various man-in-the-middle techniques - the most useful on a LAN is the poison ARP Man-In-The-Middle (MITM) approach (assuming your default gateway is 192.168.0.1 - check in your network settings):
Otherwise you'll need to investigate your router and check if it can support port mirroring or link layer bridge modes. The Thomson/Technicolor/Speedtouch routers do support PPP over Ethernet (PPPoE) bridging and some can also do port mirroring.
cheapest fix - use your cable router as a modem, then buy a router that supports mirroring to broadcast your wifi. (*shut off wifi on the cable modem and hard wire the new router to it for internet - that way all wireless traffic gets captured.) You can then pick any connected device as the target of your mirror - pick one with decent storage and remember it can only capture when connected to your new router.
Remotely sniffing all Android traffic in real-time is possible with tcpdump, netcat (nc), and Wireshark. First, make sure that you have the latest version of Android tcpdump on your phone. Here are the installation steps:
By using the pipe (), we sent all output from tcpdump to netcat, which opens a listener on port 11111. You'll usually want to monitor the wlan0 interface. If you need another interface, list the available options with the command $ ip addr.
You can display the captured traffic in a human-readable format with Wireshark. Figure out which protocols are used and whether they are unencrypted. Capturing all traffic (TCP and UDP) is important, so you should execute all functions of the tested application and analyze it.
This neat little trick allows you now to identify what kind of protocols are used and to which endpoints the app is talking to. The questions is now, how can I test the endpoints if Burp is not capable of showing the traffic? There is no easy answer for this, but a few Burp plugins that can get you started.
Firebase Cloud Messaging (FCM), the successor to Google Cloud Messaging (GCM), is a free service offered by Google that allows you to send messages between an application server and client apps. The server and client app communicate via the FCM/GCM connection server, which handles downstream and upstream messages.
FCM is available for Android, iOS, and Chrome. FCM currently provides two connection server protocols: HTTP and XMPP. As described in the official documentation, these protocols are implemented differently. The following example demonstrates how to intercept both protocols.
As an additional layer of security, push notifications can be encrypted by using Capillary. Capillary is a library to simplify the sending of end-to-end (E2E) encrypted push messages from Java-based application servers to Android clients.
Security researchers have long maintained that malware is a problem on Android, the Google operating system that's on 80% of the world's smartphones. In extreme cases, hackers with malicious intent can do more than send premium text messages - they can turn a phone into a spying tool too. The scenario was recently demonstrated at hacker conference Black Hat, and in one real-life incident, an unnamed company executive unwittingly became a conduit to short-sellers who were listening in on a board meeting he attended -- all possible thanks to the smartphone in his pocket.
The crackers had set up a false, rogue cell tower in the near vicinity, and surreptitiously turned on his device's mic once the company meeting was underway. Not long after, an organization shorted the stock of his firm and netted themselves $30 million. The incident took place in the last year, according to Gregg Smith, the CEO of mobile security company KoolSpan, and is by no means an isolated case. In fact, researchers say it's becoming easier to to take control of certain Android device features, like the mic or camera, with free online tools that are becoming more user friendly.
Security research firm Symantec recently highlighted a remote access tool (or RAT) known as AndroRAT being exchanged in underground forums, which together with a new tool called a binder, allow attackers to scrape personal information from an Android phone.
AndroRAT can retrieve a phone's call logs, monitor SMS messages and calls, take photos and make a call. Once a would-be cracker has downloaded the remote access tool, they can use the binder to package AndroRAT into a legitimate-looking app, such as a game like Angry Birds. The binder costs $37 to buy online, while AndroRAT is free and open source.
AndroRAT was first discovered in November 2012, but the binder has made its appearance more recently, and is key to making it possible for people without programing skills to infect an Android phone with the malicious tool.
Once they've done so, they only have to upload their infected app to a third-party site and wait for others to download it. Symantec analyst Vikram Thakur estimates that roughly 50% of Android apps downloaded globally have come from third-party sites, and the practice is common in China, where the government has banned access to the official Google Play store.
Attackers will typically infect a copy of a paid-for gaming app, and advertise it as being for free to entice more downloads. "[The victim is] playing the game," says Thakur, "and the Trojan is doing its deed in the background."
Sometimes attackers will just want to steal contact information, which depending on its origins can be highly prized in underground markets. Other times they'll want the hijacked phone to send premium SMS's. In the latter case, victims can remain oblivious until they see the extra digits on their monthly bill -- Trojaned apps can also intercept warnings messages from carriers and delete them.
b1e95dc632