Packet Capture is a perfect tool to capture and record all your traffic using Android.ĭecrypting SSL communication using MITM attack(Man in the middle) is not an easy task but packet capture has made it work too. The tool uses a VPN(Virtual Private Network) to perform the tasks. As compared to WireShark this tool has something different to offer.

Uses lots of resources out of your Android.Īs the name suggests itself Packet Capture is a magnificent tool for network packet capture and monitoring.

Can compromise the device security as it is easy to get penetrated.

Note: In case you are getting a JavaScript error, you have to edit ssl_logger.py and insert a line with var addresses, SSL_get_fd, SSL_get_session, SSL_SESSION_get_id, getpeername, getsockname before the line with function initializeGlobals.Hijack the network session completely and control the network traffic using your Android phone.

You then have a file log.pcap which you can analyze in Wireshark.

Let it run until you are done, quit with Ctrl+C.

You can add -verbose to see live traffic output.

(Note that -remote is not explained in the readme, but it's necessary!.)

Run python ssl_logger.py -pcap log.pcap -remote on your computer.

Forward Frida's ports: adb forward tcp:27042 tcp:27042 adb forward tcp:27043 tcp:27043.

List processes to see if everything works, by running frida-ps -U on your computer with the phone connected.

On your computer, install frida-tools using pip install -user frida-tools.Run /data/local/tmp/frida-server on the phone.Push to /data/local/tmp of Android (as root), make executable ( chmod 755).To know which CPU architecture your device is using (for getting the right download), you can run getprop ro. on the phone.Download frida-server for the right CPU architecture from.You have to install Frida Android server: This works by hooking functions inside OpenSSL so that the raw traffic can be dumped before encryption/after decryption. Take a look at (5alt's fork works with Android). If you want to avoid changing the certificate (which won't work with many applications), you could try injecting code into the Android app to sniff and dump SSL traffic.

Wireshark android dump