Application-Layer Capture
This guide shows you how to use Application-Layer Capture to capture an already-running program — reading plaintext straight from its internals. It doesn't matter if it uses certificate pinning, refuses to acknowledge proxies at all, or relies on home-grown encryption: with no certificates installed, no proxy configured, and no NIC sniffing, none of those defenses work against it, and you still see exactly what it sends and receives. This is the most typical blind spot of ordinary capture tools.
1. When to Use This Capture Method
When neither a proxy nor a NIC capture can get anywhere with the target, take this route. It suits you if any of the following applies:
- The target program is already running; restarting it is inconvenient and you don't want to change any of its settings — you just want to see what it's sending, right where it is.
- The target uses certificate pinning, so the moment a proxy takes over, connections fail or throw errors.
- The target ignores the system proxy entirely, so with a proxy configured you can't capture a single packet.
- The target uses home-grown / non-standard encryption, so even a NIC capture yields only a pile of undecryptable ciphertext.
- The target communicates directly through the OS's built-in crypto libraries (often the most maddening blind spot elsewhere).
If the target is just an ordinary program you can launch from the command line (browser / script / CLI), Launch-by-Program Capture is less hassle; if what stands in your way is a built-in macOS app, or a particularly stubborn, deeply hidden application that rejects any external interference, switch to System-Level Capture.
2. Prerequisites
- TraceEagle is installed and running (on first launch, just accept the system permissions it asks for).
- The target program is already running (you only need to recognize its name); or you have its executable path and let the tool launch it for you.
- No certificates to install, no system proxy to change, no configuration of the target program to touch.
3. Start Capturing: Three Steps to Plaintext
- Create a new session and select Local Application-Layer Capture.
- Choose the target:
- Go straight at a running program — select a live process from the process list and read plaintext from its internals on the spot; no restart, no changes to any of its settings.
- Alternatively, enter the program path and let the tool launch it for you.
- Click Start. The tool reads the plaintext the target program sends and receives from inside the program itself, listing each entry in real time, sorted by direction (Sent ↑ / Rec ↓).
Make the target program generate a network request (click something, refresh, send a message) and the plaintext will appear in the list in real time.
Two optional toggles — turn them on only when you hit a tough nut:
- Restart Target (capture early startup): much of the authentication and handshaking happens the instant the program starts up. Enable this to have the target closed first and then relaunched by the tool, so you also capture that early-startup traffic and don't miss the crucial first request.
- Socket Traffic (lower-level fallback): with programs that are trimmed down, with symbols removed, or written on a newer tech stack, where the normal approach can't find their encrypt/decrypt entry point, turn this toggle on and it takes a lower-level path to the data and still decrypts the plaintext. For plenty of programs that defeat every other approach, this one move gets the job done.
4. Verify: Confirm You've Got Plaintext
Click any entry in the list to see its details:
- There are send/receive records: listed by direction (Sent ↑ / Rec ↓), with entries growing in real time.
- It's plaintext, not ciphertext: the details show complete, readable content (such as JSON or HTTP request headers), not a pile of garbled bytes.
No crypto library is off limits, no tech stack is off limits — browsers, desktop clients, apps written on all kinds of cross-platform frameworks, native binaries: many targets that show "nothing but ciphertext" elsewhere come out as plaintext right here.
5. Can't Capture or Decrypt? Check Each Case
| Symptom | Most Likely Cause | What to Do |
|---|---|---|
| You selected the program, but not a single send/receive appears | The target hasn't generated network traffic yet; or it sent all the key traffic the moment it started | Get it moving first (click, refresh, send a message); if the startup traffic is what you're missing, enable Restart Target and let the tool relaunch it and capture from the very beginning |
| There's traffic, but the normal approach can't locate its encrypt/decrypt entry point | The target is stripped, has its symbols removed, or is written on a newer tech stack | Turn on Socket Traffic for a lower-level fallback and decrypt the plaintext anyway |
| A multi-window / multi-process program, and you only capture part of it | By default only the single selected program is targeted; its child processes aren't expanded automatically | Select the other processes / windows one at a time and open a separate capture for each |
| You can't select it at all / can't get into it (usually a built-in macOS app) | The target is a built-in app, or a particularly stubborn, deeply hidden application that rejects any external interference | Switch to System-Level Capture (observing from the system level without entering the program) |
| You just want the easy route for an ordinary program | The target can already be launched from the command line and honors proxies | Launch-by-Program Capture or Proxy Capture is lighter-weight |
6. How to Choose Among the Four Local Capture Methods
| Your Situation | Which One to Use |
|---|---|
| Program already running / certificate pinning / ignores proxies / home-grown encryption / system crypto libraries | Application-Layer Capture (this guide) |
| Ordinary program you can launch from the command line (browser / script / CLI) | Launch-by-Program Capture (less hassle) |
| You want to see all traffic on the machine, including non-HTTP traffic | NIC Capture |
| Built-in macOS apps / stubborn applications | System-Level Capture |
Next Steps
- Plaintext obtained from the inside goes through the same processing pipeline as the other capture methods — how to read it, switch views, and decode it: see Viewing and Decoding Data.
- Up against a proprietary / home-grown socket protocol and want to teach the tool how to read it: see Custom Protocol Decoding.
- If the target is stuck on certificate pinning: you can also try Defeating Certificate Pinning first.
- To modify a request before resending it, or intercept and edit it mid-flight: see Request Construction and Replay and Rule Rewriting and Breakpoint Interception.
Top comments (0)