NetTracer

Spies on python scripts to see what they request in the network/internet!

# nettrace

A lightweight runtime monitor for Python scripts. Runs a target script and logs every network call, subprocess spawn, and socket connection it makes — no source modification required.

Think of it as an HTTP/process spy for Python: point it at a script and see exactly what it talks to before you trust it.

## Usage

```bash
python3 nettrace.py <script.py>

Example:

$ python3 nettrace.py suspicious_script.py
[22:17:26] START /path/to/suspicious_script.py
[22:17:26] GET https://raw.githubusercontent.com/user/repo/main/file.png
[22:17:26] EXIT 0
[22:17:26] DONE

What it captures

• HTTP/HTTPS requests — urllib, http.client, requests, httpx, aiohttp (method, URL, headers, body)
• Raw sockets — any socket.connect() call, including non-HTTP traffic
• Subprocess execution — subprocess.run and subprocess.Popen calls, with full command args
• Script lifecycle — start time, exit code, unhandled exceptions

How it works

nettrace monkeypatches the relevant standard library and third-party networking functions before running your target script via runpy. Every call is logged with a timestamp, then passed through to the real implementation — the target script behaves normally, you just get visibility into what it's doing.

Limitations — read this before relying on it

This is a monitoring tool, not a sandbox. It does not isolate or restrict the target script in any way — it only observes.

• It does not stop network access, file writes, or subprocess calls. It reports them after the fact.
• It only catches activity that goes through the patched Python APIs. Compiled extensions, ctypes, raw syscalls, or anything that bypasses these APIs won't be logged.
• A script that detects it's being monitored (inspects sys.modules, saves references to unpatched functions early, etc.) can evade logging entirely.
• Headers and request bodies are logged in full, unredacted. If the target script sends credentials, tokens, or secrets in a request, they will appear in plaintext in your terminal output and any logs/history you keep. Do not run scripts you don't already trust to some degree through this tool and assume the log is safe to share or store.

For genuinely untrusted code, run it inside proper isolation (a container with no network, a VM, firejail, nsjail, etc.) — nettrace is best used for quick auditing of scripts you're mostly trusting but want to double-check, not as a security boundary against hostile code.

Requirements

• Python 3.x
• requests, httpx, aiohttp are optional — only patched if installed

License

MIT