Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
PacketPirate — A headless , scriptable, command-line based MITM proxy designed for network traffic interception, analysis, and modification on Windows systems. | Kitploit
Tools/GitHubGitHub/d0rb/packetpirate
Packet Sniffing & AnalysisWeb Proxies & InterceptionScripting & AutomationAPI Security TestingInformation GatheringWeb SecurityPenetration TestingLearning & EducationLog Analysis
GitHubd0rb/packetpirate

PacketPirate

A headless , scriptable, command-line based MITM proxy designed for network traffic interception, analysis, and modification on Windows systems.

38 months agoNot yet reviewed
View Repository

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

PacketPirate

PacketPirate

A headless , scriptable, command-line based MITM proxy designed for network traffic interception, analysis, and modification on Windows systems. It operates similarly to industry-standard GUI proxies but is optimized for automation environments, headless operation, and integration with development workflows.

Note: This is a standalone, dependency-free tool implemented in Node.js.

Overview

  • PacketPirate is a system-wide network interception tool. By leveraging the Windows HTTP Proxy settings, it can capture traffic from any application running on your machine—including web browsers (Chrome, Edge), CLI tools (curl, git), and desktop applications (Spotify, VS Code, Discord).

  • Global System Interception: Captures HTTP/HTTPS traffic from any process respecting the system proxy.

  • Process-Aware: identify exactly which application is generating traffic.

  • Dynamic Rule Engine: Configurable via JSON to perform specific actions on matching traffic (e.g., token extraction, request logging).

  • Full Traffic Logging: Capable of dumping full request and response bodies (HTML, JSON, Binary) for analysis.

  • Headless Architecture: Runs entirely from the CLI, suitable for background services and automated testing pipelines.

  • Custom Certificate Management: Includes utilities for generating and trusting self-signed Root CAs for HTTPS decryption.

Installation

Prerequisites

  • Node.js (v14 or higher)
  • Windows 10/11 (Required for System Proxy automation features)
  • PowerShell (for certificate management scripts)

Setup

Clone the repository and initialize the environment:

root@kitploit:~
# 1. Generate local SSL certificates
npm run setup

# 2. Trust the generated Root CA
npm run trust
# Note: Requires administrative approval to add the certificate to the Trusted Root Store.

Usage

Start the proxy server:

root@kitploit:~
npm start

This launches the standard CLI interface.

CLI Operation

The interactive menu provides the following controls:

  1. Scan Processes: Lists active processes with established network connections. Allows filtering traffic to a specific PID (e.g., exclusively monitoring code.exe).
  2. Toggle Filters: Enable/disable specific monitoring subsystems:
    • API URL Scan: Logs requested API endpoints.
    • Header Dump: Outputs full request headers to the console.
    • Token Hunt: Heuristic detection of Bearer tokens in Authorization headers.
    • Full Traffic Dump: Captures all traffic (headers + full bodies) to structured jsonl log files.
  3. Start Proxy: Binds the server to the first available port (default 8080) and configures the Windows System Proxy.
  4. Generate Rules: Helper to quickly create new interception patterns.

Configuration

Interception logic is defined in config/rules.json. This file allows for persistent configuration of traffic handling.

Schema:

root@kitploit:~
{
  "rules": [
    {
      "name": "Description of rule",
      "host": "hostname.match",
      "urlPattern": "regex_pattern",
      "action": "log | save_token",
      "outputFile": "path/to/output.txt",
      "tokenFilter": "regex_filter"
    }
  ]
}

Example:

root@kitploit:~
{
    "rules": [
        {
            "name": "Test API",
            "host": "jsonplaceholder.typicode.com",
            "action": "save_token",
            "outputFile": "test_tokens.txt"
        }
    ]
}

Technical Details

Architecture

The tool uses a dual-server architecture:

  1. Proxy Server: Handles the initial CONNECT tunneling request and performs host filtering.
  2. MITM Server: Decrypts HTTPS traffic using the dynamically generated CA, inspects the payload against the rule engine, and forwards the request upstream.

Network handling

  • Port Management: Automatically detects EADDRINUSE errors and increments the port number until a free port is found.
  • System Proxy: Uses direct registry manipulation via PowerShell to enforce proxy settings system-wide.
  • Cleanup: Implements SIGINT/SIGTERM handlers to ensure proxy settings are reverted upon exit, preventing network connectivity issues.

Certificate Lifecycle & Security

The tool relies on a dual-certificate model for HTTPS interception:

  1. Root CA Generation: npm run setup creates a self-signed Root CA (PacketPirateRoot).
    • Logic: Uses PowerShell's New-SelfSignedCertificate to generate a key-pair valid for 5 years.
    • Export: The key is exported to src/certs/server.pfx (PKCS#12 format) with the password "headless".
  2. Trust Establishment: npm run trust injects this Root CA into the Windows CurrentUser\Root store.
    • Security Scope: By targeting CurrentUser rather than LocalMachine, we limit the trust radius to your specific user profile, reducing system-wide risk.
    • Browser Acceptance: Chrome, Edge, and IE inherit this trust store. Firefox requires a separate toggle (security.enterprise_roots.enabled) to respect Windows trust store.
  3. Removal: npm run untrust provides a clean teardown.
    • Identification: Scripts locate the certificate by its unique FriendlyName ("PacketPirateRoot"), ensuring we never touch other user certificates.
    • Verification: Performs a check after removal to confirm the certificate thumbprint is no longer present in the registry.

🎓 Educational: How We Built It

This project is a practical example of System Programming using Node.js. It moves beyond typical web servers to interact with the Operating System and Network Stack at a lower level.

Architecture

root@kitploit:~
participant App as Application (VS Code)
participant OS as Windows OS
participant Proxy as Proxy Server
participant MITM as MITM Server
participant Web as Internet

Note over App,Proxy: 1. Plain HTTP Tunneling
App->>Proxy: CONNECT google.com:443
Proxy-->>App: 200 Connection Established

Note over Proxy,MITM: 2. The "Hand-Off" Trick
Proxy->>MITM: Pipe socket data (raw encrypted bytes)

Note over App,MITM: 3. TLS Handshake and Decryption
MITM-->>App: ServerHello (signed by local root CA)
App->>MITM: Encrypted request (GET /)

Note over MITM: 4. Interception Logic
MITM->>MITM: Decrypt → Inspect headers → Log

Note over MITM,Web: 5. Upstream Forwarding
MITM->>Web: New HTTPS request (GET /)
Web-->>MITM: Response
MITM-->>App: Response

Core Concepts

PacketPirate

1. The "Dual Server" Pattern

Node.js's standard http module cannot handle the CONNECT method (used for HTTPS tunnels) and normal HTTPS traffic on the same server instance easily.

  • Server A (Net/HTTP): Listens on port 8080. It handles the initial CONNECT request. It acts as a dumb TCP pipe.
  • Server B (HTTPS): It exists only in memory (or on a random port). It holds the private key.
  • The Trick: When Server A gets a connection, it "emits" the socket to Server B. Server B thinks it just got a new connection and starts the SSL handshake. This allows us to decrypt traffic seamlessly.

2. Process Attribution (The netstat Hack)

How do we know which app is sending traffic? The TCP packets themselves don't have a "Process ID" sticker on them.

  • Ephemeral Ports: Every outgoing connection uses a random high-numbered port (e.g., 54321).
  • Correlation: We shell out to netstat -ano to find which PID owns port 54321.
  • Optimization: Doing this for every packet is slow, so we cache the results or only check when necessary.

3. Stream Forking

We use Node.js Streams to handle data efficiently. Instead of waiting for the full 10MB response to download before showing it, we "fork" the stream:

  • Pipe 1: Goes to the Client (so the app keeps working).
  • Pipe 2: Goes to our Logger (so we can save it to disk). This is done using PassThrough streams, allowing real-time monitoring with minimal added latency.

License

GNU GPL v3.0

Download Tool