Guides/Monitoring network traffic from an Android app
To monitor and view network traffic in an Android application, you can use a proxy server. This guide will help set up your device and view network traffic from a specific Android app.
Prerequisites
To follow this guide, you have to have:
- an Android device (you do not need root access),
- a computer (with any operating system),
- a USB cable to connect your mobile device to the computer.
- access to a Wi-Fi network that you can connect to with the computer and the mobile device.
Step 1. Install a proxy server
In this guide, we will use the Charles proxy server. There may be other, better alternatives that I have not tried using. Feel free to edit this guide if you feel like you have a better proxy server.
Note: The free trial version of Charles only allows for 30-minute sessions. After that time passes, you can reopen Charles to continue using it.
- Go to https://www.charlesproxy.com/download/ on your computer, and download the version of Charles for your operating system.
- Launch Charles.
- At the top bar, select the option Help > SSL Proxying > Install Charles Root Certificate on a Mobile Device or Remote Browser.
This will show a message box with your computer's local IP address and a port. In the next step, we will use this information to connect the mobile device to the proxy server.
In this example, the IP shown on the pop-up is: 192.168.3.57, and the port is: 8888.
Step 2. Set up proxy settings on the mobile device
To make network traffic go from the device to your proxy server, you have to set proxy settings on your mobile device.
- On your mobile device, go to Settings > Wi-Fi and select your Wi-Fi network.
- Under Advanced settings, change Proxy to Manual
- Set the Host Name and Port settings to the IP address and port displayed in the Charles pop-up window in step 1.
- Save the settings.
- If everything was done correctly, a pop-up should appear in Charles, informing of a new connection. Click on "Allow" to allow the proxy connection. If you click "Deny" on accident, you can simply restart Charles and try to connect to the proxy again.
This pop-up window should appear on your computer after saving proxy settings on the mobile device. - After clicking allow, you can see some network traffic going through. You can try opening apps on your phone, and new entries will appear.
Network traffic from your mobile device, shown on your computer.
You can also enable Sequence view by clicking the Sequence tab on the top. This will show all of the network traffic in chronological order, with the most recent requests on the bottom.
Now we have set-up our proxy server. However, even though we can see some host names and parts of requests, we cannot actually see the contents of most of the requests. This is because all modern applications use the HTTPS protocol to communicate; this protocol encrypts the data to prevent man-in-the-middle attacks.
This current setup will still work for HTTP requests. If you try to access a website via HTTP on the mobile device, you will be able to see the contents of the request, as well as the response in Charles. This is because, unlike HTTPS, HTTP is not encrypted, and the proxy server can read requests and responses sent via HTTP. You can try this yourself by opening an HTTP website (such as http://example.com/) in a web browser on your mobile device. You should see something similar to this:
(Note: You may need to scroll down to see the newest requests in Sequence view.)
In the next steps, we will install a custom certificate and modify an application, which will allow us to intercept HTTPS requests as well.
Step 3. Install a certificate to the mobile device
This page has some work to do. Help the wiki by editing this page!
This guide is unfinished, I will finish it in a bit.