rahzu@localhost:~$ cat research/wsddntf/poc/sniff
espionagem de tráfego
enquanto o usuário b usa a máquina, navega e resolve domínios, o processo de a lê o tráfego em tempo real: consultas DNS em claro, nomes de servidor TLS (SNI), destinos e tempos. o sensor é o próprio driver de segurança. no controle, com a captura desligada no driver, a tela permanece vazia sob o mesmo tráfego.
while user b uses the machine, browses and resolves domains, a's process reads the traffic in real time: plaintext DNS queries, TLS server names (SNI), endpoints and timing. the sensor is the security driver itself. in the control run, with capture switched off in the driver, the screen stays empty under the same traffic.