{"id":3042,"date":"2026-05-13T02:06:53","date_gmt":"2026-05-13T02:06:53","guid":{"rendered":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th\/"},"modified":"2026-05-13T02:06:53","modified_gmt":"2026-05-13T02:06:53","slug":"proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th","status":"publish","type":"post","link":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th\/","title":{"rendered":"Proxying the Unproxyable? Sending EXE traffic to a Proxy, (Wed, May 13th)"},"content":{"rendered":"
\n

.. if \u201cunproxyable\u201d is a word that is ..<\/span><\/span><\/span><\/p>\n

I had a recent engagement where I had to look at the network traffic generated by a Windows executable.\u00a0 Unfortunately, it was all TLS, and all TLS1.3 to boot.\u00a0 So from a PCAP all I got was a whole lot of \u201cyup, that\u2019s encrypted\u201d, and since it was TLSv1.3 all I really had to work with was the IP addresses, not even server names in the server hello packets to help out.\u00a0 And the IP addresses involved were those \u201c500 DNS names AWS\u201d shotgun addresses, so no help there.<\/span><\/span><\/span><\/p>\n

What I really needed was something to take specific traffic, say traffic from an executable, and redirect that to a proxy.\u00a0 If that proxy is then burp suite, then Bob\u2019s yer Uncle, now I can look at the traffic!!\u00a0 If you\u2019d rather use fiddler or some other proxy, go for it, anything will work.<\/span><\/span><\/span><\/p>\n

A few minutes of Googling, and I found Proxifier (https:\/\/www.proxifier.com\/<\/a>)<\/span><\/span><\/span><\/p>\n

Proxifier allows you set up rules, for instance \u201csend traffic from abc.exe to proxy A\u201d, \u201csend traffic from def.exe to proxy B\u201d, or \u201csend everything else direct\u201d, or any combination.\u00a0 Proxies can be direct or Socks5.<\/span><\/span><\/span><\/p>\n

In my case, I was looking at a client executable, and was able to follow all the API calls and data transferred, it was EXACTLY what I needed that day.<\/span><\/span><\/span><\/p>\n

I can\u2019t show you the client output – watching the API\u2019s roll by was as cool as it gets though, and the proxy intercept in burp lets you \u201cplay\u201d with individual calls if that\u2019s what you need.\u00a0 But I can certainly show you how this works, let\u2019s use curl as our example exe.\u00a0 <\/span><\/span><\/span><\/p>\n

Let’s start in proxifier.\u00a0 First you need to set up your proxy(s).\u00a0 In this case I’m using Burp Suite Pro running locally, so the proxy is:<\/span><\/span><\/span><\/p>\n

\"\"<\/p>\n

Next, we\u2019ll set up the rules:<\/span><\/span><\/span><\/p>\n

The first rule says \u201canything to my own machine, send direct\u201d.\u00a0 Given how much loopback cruft happens on a typical Windows box, this rule is gold (unless that\u2019s what you are looking for that is).<\/span><\/span><\/span><\/p>\n

The second rule is \u201canything from curl.exe, send to the proxy we just defined\u201d (or whatever your executable is).<\/span><\/span><\/span><\/p>\n

You can have multiple of these rules doing different things.<\/span><\/span><\/span><\/p>\n

The final rule is \u201ceverything else, send direct\u201d<\/span><\/span><\/span><\/p>\n

\"\"<\/span><\/span><\/span><\/p>\n

Now, let\u2019s run a test with curl:<\/span><\/span><\/span><\/p>\n

\"\"<\/span><\/span><\/span>
\n(and so on)<\/p>\n

On proxifier, you see the transaction happen in real time:<\/span><\/span><\/span><\/p>\n

\"\"<\/p>\n

The top pane shows the executable, target and so on.\u00a0 It\u2019s somewhat ephemeral, it\u2019ll show the live view, then will go grey after the transaction complets, then after a few second disappears.\u00a0 The bottom pane scrolls in a more \u201clog like\u201d manner.\u00a0 <\/span><\/span><\/span><\/p>\n

Over in Burp, you see all the business that most sites have as their lead page:<\/span><\/span><\/span><\/p>\n

\"\"<\/span><\/span><\/span><\/p>\n

Which is exactly what you need, and can’t get these days from a packet capture!<\/span><\/span><\/span><\/p>\n

What else does Proxifier do?\u00a0 It also spits out a configurable log file, you can configure what\u2019s in the logs and where to send it:<\/span><\/span><\/span><\/p>\n

\u00a0\"\"<\/span><\/span><\/span><\/p>\n

You can set similar sensitivity on the live on-screen log.<\/span><\/span><\/span><\/p>\n

All in all, this tool was a life-saver for me, I\u2019ve used it for a few years now and keep coming up with things that it can bail me out of!<\/span><\/span><\/span><\/p>\n

Got a cool use for a tool like this?\u00a0 Give it a try and share your experiences in our comment form below (please keep any NDA\u2019s in mind).<\/span><\/span><\/span><\/p>\n

Do you have a similar or better tool for this, again, by all means share in our comment form!<\/span><\/span><\/span><\/p>\n

===============
\nRob VandenBrink
\nrob@coherentsecurity.com<\/p>\n

(c) SANS Internet Storm Center. https:\/\/isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"

.. if \u201cunproxyable\u201d is a word that is .. I had a recent engagement where I had to look at the network traffic generated by a Windows executable.\u00a0 Unfortunately, it was all TLS, and all TLS1.3 to boot.\u00a0 So from a PCAP all I got was a whole lot of \u201cyup, that\u2019s encrypted\u201d, and since […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-container-style":"default","site-container-layout":"default","site-sidebar-layout":"default","disable-article-header":"default","disable-site-header":"default","disable-site-footer":"default","disable-content-area-spacing":"default","footnotes":""},"categories":[90],"tags":[91],"class_list":["post-3042","post","type-post","status-publish","format-standard","hentry","category-cybersecurity","tag-cybersecurity"],"yoast_head":"\nProxying the Unproxyable? Sending EXE traffic to a Proxy, (Wed, May 13th) - Imperative Business Ventures Limited<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Proxying the Unproxyable? Sending EXE traffic to a Proxy, (Wed, May 13th) - Imperative Business Ventures Limited\" \/>\n<meta property=\"og:description\" content=\".. if \u201cunproxyable\u201d is a word that is .. I had a recent engagement where I had to look at the network traffic generated by a Windows executable.\u00a0 Unfortunately, it was all TLS, and all TLS1.3 to boot.\u00a0 So from a PCAP all I got was a whole lot of \u201cyup, that\u2019s encrypted\u201d, and since […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th\/\" \/>\n<meta property=\"og:site_name\" content=\"Imperative Business Ventures Limited\" \/>\n<meta property=\"article:published_time\" content=\"2026-05-13T02:06:53+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/isc.sans.edu\/diaryimages\/images\/proxy_setup(1).png\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th\/\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\"},\"headline\":\"Proxying the Unproxyable? Sending EXE traffic to a Proxy, (Wed, May 13th)\",\"datePublished\":\"2026-05-13T02:06:53+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th\/\"},\"wordCount\":645,\"image\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/isc.sans.edu\/diaryimages\/images\/proxy_setup(1).png\",\"keywords\":[\"Cybersecurity\"],\"articleSection\":[\"Cybersecurity\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th\/\",\"url\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th\/\",\"name\":\"Proxying the Unproxyable? Sending EXE traffic to a Proxy, (Wed, May 13th) - Imperative Business Ventures Limited\",\"isPartOf\":{\"@id\":\"https:\/\/blog.ibvl.in\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/isc.sans.edu\/diaryimages\/images\/proxy_setup(1).png\",\"datePublished\":\"2026-05-13T02:06:53+00:00\",\"author\":{\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th\/#primaryimage\",\"url\":\"https:\/\/isc.sans.edu\/diaryimages\/images\/proxy_setup(1).png\",\"contentUrl\":\"https:\/\/isc.sans.edu\/diaryimages\/images\/proxy_setup(1).png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.ibvl.in\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Proxying the Unproxyable? Sending EXE traffic to a Proxy, (Wed, May 13th)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.ibvl.in\/#website\",\"url\":\"https:\/\/blog.ibvl.in\/\",\"name\":\"Imperative Business Ventures Limited\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.ibvl.in\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"sameAs\":[\"https:\/\/blog.ibvl.in\"],\"url\":\"https:\/\/blog.ibvl.in\/index.php\/author\/admin_hcbs9yw6\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Proxying the Unproxyable? Sending EXE traffic to a Proxy, (Wed, May 13th) - Imperative Business Ventures Limited","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th\/","og_locale":"en_US","og_type":"article","og_title":"Proxying the Unproxyable? Sending EXE traffic to a Proxy, (Wed, May 13th) - Imperative Business Ventures Limited","og_description":".. if \u201cunproxyable\u201d is a word that is .. I had a recent engagement where I had to look at the network traffic generated by a Windows executable.\u00a0 Unfortunately, it was all TLS, and all TLS1.3 to boot.\u00a0 So from a PCAP all I got was a whole lot of \u201cyup, that\u2019s encrypted\u201d, and since […]","og_url":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th\/","og_site_name":"Imperative Business Ventures Limited","article_published_time":"2026-05-13T02:06:53+00:00","og_image":[{"url":"https:\/\/isc.sans.edu\/diaryimages\/images\/proxy_setup(1).png","type":"","width":"","height":""}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th\/#article","isPartOf":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th\/"},"author":{"name":"admin","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02"},"headline":"Proxying the Unproxyable? Sending EXE traffic to a Proxy, (Wed, May 13th)","datePublished":"2026-05-13T02:06:53+00:00","mainEntityOfPage":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th\/"},"wordCount":645,"image":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th\/#primaryimage"},"thumbnailUrl":"https:\/\/isc.sans.edu\/diaryimages\/images\/proxy_setup(1).png","keywords":["Cybersecurity"],"articleSection":["Cybersecurity"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th\/","url":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th\/","name":"Proxying the Unproxyable? Sending EXE traffic to a Proxy, (Wed, May 13th) - Imperative Business Ventures Limited","isPartOf":{"@id":"https:\/\/blog.ibvl.in\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th\/#primaryimage"},"image":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th\/#primaryimage"},"thumbnailUrl":"https:\/\/isc.sans.edu\/diaryimages\/images\/proxy_setup(1).png","datePublished":"2026-05-13T02:06:53+00:00","author":{"@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02"},"breadcrumb":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th\/#primaryimage","url":"https:\/\/isc.sans.edu\/diaryimages\/images\/proxy_setup(1).png","contentUrl":"https:\/\/isc.sans.edu\/diaryimages\/images\/proxy_setup(1).png"},{"@type":"BreadcrumbList","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/proxying-the-unproxyable-sending-exe-traffic-to-a-proxy-wed-may-13th\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.ibvl.in\/"},{"@type":"ListItem","position":2,"name":"Proxying the Unproxyable? Sending EXE traffic to a Proxy, (Wed, May 13th)"}]},{"@type":"WebSite","@id":"https:\/\/blog.ibvl.in\/#website","url":"https:\/\/blog.ibvl.in\/","name":"Imperative Business Ventures Limited","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.ibvl.in\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g","caption":"admin"},"sameAs":["https:\/\/blog.ibvl.in"],"url":"https:\/\/blog.ibvl.in\/index.php\/author\/admin_hcbs9yw6\/"}]}},"_links":{"self":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts\/3042","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/comments?post=3042"}],"version-history":[{"count":0,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts\/3042\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/media?parent=3042"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/categories?post=3042"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/tags?post=3042"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}