How to change TCP packet on the fly?

Question

Java

Hello.
There is a program that sets up a tcp socket with a server and sends unencrypted data. You need to change the data before sending it to the server.
I tried to make a proxy in C # but the program notices that the proxy is on the local IP and stops working, so the only way out is packet spoofing. How to do it? Is this some kind of spoofing? Does anyone know open source examples (preferably in C# or Java or C++)? Or which one to look for?

Answer 1

but the program notices that the proxy is on the local IP and stops working

It's probably easier to "break" the protection system if you master reverse engineering than to modify traffic.
The second option - if the problem is really in the local IP, then rent a VPS and let it not be on the local one.
Judging by the question, the open source example will not help you, especially in C ++, you still have to compile it, and so - the same Wireshark (Pcap) and other similar NT drivers, another option is to replace the system DLLs with a "wrapper" (hook, proxy pattern) , in particular wsock32.dll, I have not seen ready-made solutions with such a principle - it is not developed for some reason, but you can try to write it yourself.

Answer 2

Put hooks on socket functions like send/sendto/recv/recvfrom. And they can change anything.

Answer 3

If there is a Linux gateway between the server to which the data is sent and the program itself, then, in theory, you can install nfqsed and, when sending from the gateway to the program server, change the values ​​of interest in real time.
Here is a small article that describes almost a similar case. I personally tried it for a similar situation and everything works like clockwork with unencrypted packets.
https://sysadmin.ru/articles/changeyaem-soderzhimoe...

Answer 4

Tested on linux, namely substitution of a dot at the end of a demen in HTTP:
https://hastebin.com/quloxoxuhe.cpp
Compilation: gcc http_inject.c -o http_inject -lnetfilter_queue;
Set the iptables rule to OUTPUT and run: iptables -A OUTPUT -j NFQUEUE --queue-num 0; ./http_inject