NetHook
inject · intercept · modify · capture
A Windows network-hooking framework that captures, inspects and rewrites a process's traffic - before it is encrypted.
Free 7-day trial · Windows 10 / 11 · 64-bit · CLI included: NetHookCli.exe
Script it
Automate NetHook with the SDK
Everything the GUI does, driven from code. The SDK talks to a hooked process over its named-pipe control channel, so you can script captures, interception and automated workflows in Python or C#.
NetHook SDK
A programmable interface to a hooked process. The SDK connects to NetHook's per-injection named pipe and exposes the same control surface the UI uses - stream captured events, hold and rewrite packets, toggle intercept and block, and adjust which APIs are hooked - all from your own scripts. Ships as a Python library and a C# library so you can build repeatable, automated testing and analysis around any target.
See it in action
One process, fully owned
A live session: the process list on the left, captured traffic in the middle, and the selected event decoded in the right-hand pane - here an SSL_write caught in the clear, before TLS.
Command line
NetHookCli.exe ships with every install
The installer drops NetHookCli.exe right next to the GUI in the installation folder. Same hooking engine, same coverage, no window.
Script & automate
Pipe output into other tools, chain it in a shell pipeline, or drive it from a CI job. No GUI means no user session required.
Headless & remote
Run it over SSH, RDP, or on a server with no desktop. Captures and intercepts work exactly as they do in the GUI.
Same license
The CLI uses the same license key as the GUI. No separate purchase, no extra activation.
Why NetHook
Everything you need to own a process's traffic
From plaintext capture across every major crypto stack to live interception, auto-injection and capture-to-disk - built to be complete.
Plaintext, before encryption
Hooks sit at the application boundary, so you read and rewrite data before it is wrapped in TLS - and after it is unwrapped on the way back.
Multi-library hooking
One tool covers nine network & crypto stacks:
OpenSSL (SSL_write/read + the _ex variants),
Schannel (EncryptMessage/DecryptMessage),
GnuTLS, wolfSSL,
NSS/NSPR (Firefox), plus WinSock,
WinINet, WinHTTP and File I/O.
Watch & auto-inject on launch
Match processes by name and NetHook injects the instant one starts - optionally attaching a live session automatically. Rules persist across runs, so a target is hooked before it sends its first byte.
IAT hooking, done right
NetHook rewrites Import Address Table thunks instead of patching function prologues - no thread freezing, no prologue corruption - and works uniformly across MSVC-, GCC- and Clang-built targets.
Catches late & dynamic loads
A LoadLibrary re-scan hooks modules loaded after injection, and a
GetProcAddress redirect catches APIs resolved dynamically - so nothing
slips through by loading or resolving late.
Intercept & modify live
Hold each packet, edit it in hex or text, then forward, drop or rewrite it on the fly - with find-in-packet search - or block a process entirely.
Capture to disk
Record sessions to .pcap (IP/TCP synthesised so Wireshark reassembles the
streams) and to clean, parseable .raw dumps - bounded by a configurable
max bytes per event.
32- & 64-bit, any target
Inject into either architecture from one UI - a 64-bit GUI drives 32-bit targets and vice-versa - and elevate to SYSTEM for privileged processes.
Many processes, in parallel
Attach to multiple processes at once - each gets its own live session, tab and control pipe. A licensed install runs unlimited targets; the trial does one at a time.
Global & per-injection settings
Set capture, intercept, block, size limits and exactly which APIs to hook as global defaults - then override any of them live, per process, without re-attaching.
Hardened for hostile targets
Every PE header and import table is bounds-checked against the module's
SizeOfImage before it's touched, so walking malformed or hostile memory
never destabilises the host process.
Designed to be functional
Include built-in shortcuts to facilitate usability and efficient work.
CLI included
NetHookCli.exe ships in the installation folder alongside the GUI. Same engine, no window - pipe it into scripts, chain it in a shell, or run it headless on a remote box.