Arch Linux

castor

Member

From: Europe

Registered: 2022-03-14

Posts: 24

Website

[CLOSED] How to trace network requests of applications?

Hello,

I want to trace the network requests of my applications running.
To be honest, I want to figure out a certain API request, that a registration form in a java client of an online game calls.

So I believe it is an http get request to something like:

https://game.com/nameavailable/<playername>

Now I tried out these tools:
stackexchange

%strace -f -e trace=network xterm 2>&1 | grep sin_addr

# now in xterm I enter the following:
%wget https://archlinux.org/static/logos/apple-touch-icon-144x144.38cf584757c3.png

# that's the output in strace
[pid 52321] connect(3, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("192.168.178.1")}, 16) = 0
[pid 52321] recvfrom(3, "\372\4\201\200\0\1\0\1\0\0\0\0\tarchlinux\3org\0\0\1\0\1\300"..., 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("192.168.178.1")}, [28 => 16]) = 47
[pid 52321] recvfrom(3, "\321\371\201\200\0\1\0\1\0\0\0\0\tarchlinux\3org\0\0\34\0\1\300"..., 65536, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("192.168.178.1")}, [28 => 16]) = 59
[pid 52321] connect(3, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("95.217.163.246")}, 16) = 0
[pid 52321] getsockname(3, {sa_family=AF_INET, sin_port=htons(53203), sin_addr=inet_addr("192.168.178.29")}, [28 => 16]) = 0

I've also used wireshark-qt, but I can't identify the right data.

How can I find out the url, the java client is requesting, and also the parameter?

-- I know, I can just use a workaround, like

https://game.com/statsforplayer/<playername>

, and use a response like "player doesn't exist", but I'm also curious
what the game itself uses. And eager to 'disassemble' the program a bit.

The game is called oldschool runescape.
Thanks for any help.

Last edited by castor (2022-04-29 20:31:15)