Post by Charles F. Hamilton

As pentesters and red teamers, we often come across thick client applications. These tend to be a goldmine of vulnerabilities and sensitive information, including credentials. The problem is that most of these applications are not proxy-aware, which limits our ability to inspect network traffic, understand the protocol structure, and identify sensitive data being transmitted over the network. One solution is to inject yourself into the target process and hook the relevant APIs before the data is encrypted. Unfortunately, there are not many tools that properly achieve this in modern Windows environments. So, I decided to build one myself with all the features I always wanted. NetHook includes capabilities such as search and replace, process monitoring with automatic injection when a target process is launched, multi-process injection, support for a wide range of TLS and SSL APIs, as well as file read and write interception. It also provides numerous configuration options, quality-of-life settings, and built-in shortcuts, just to name a few features. If you are involved in thick client testing, you may want to take a look at NetHook, the tool I recently released. I also wrote a blog post about it if you would like to learn more about the project and give it a try. https://lnkd.in/gPvH3qes #NetHook #ThickClient #RedTeam