13 ms·

What I’d love to see is a containerized android that can be fired up on a Mac (using docker desktop or orbstack or whatever) that I can modify the docker image

by dchuk 2y ago

What I’d love to see is a containerized android that can be fired up on a Mac (using docker desktop or orbstack or whatever) that I can modify the docker image of to have rooted man in the middle proxy already setup, making it much easier to drop an Android app onto to observe the network traffic and api calls.

CartwheelLinux 2y ago
If you want to do this now with little setup, run waydroid and then run wireshark inside the network namespace that is created for waydroid sudo ip netns exec <netns> wireshark
- jeroenhd 2y ago
  Wireshark is nice, but for HTTPS MitM you'll need a tool like mitmproxy/Burp to do the proxying and either modifications to the system image or a Frida daemon running as root to make most apps trust the MitM'd certificates. To get the traffic routed right, the Wireguard option for mitmproxy is pretty useful in my experience. Not sure how well Waydroid + Android VPNs work together, though.
  - feanaro 2y ago
    What do you mean by the Wireguard option for mitmproxy? EDIT: Oh, look at this https://mitmproxy.org/posts/wireguard-mode/ https://mitmproxy.org/posts/wireguard-mode/. TIL.
    - jeroenhd 2y ago
      It's a pretty neat feature! I think it's in beta but it works flawlessly in my experience. Sure is a lot easier than setting up a separate (W)LAN with iptables rules to force redirect traffic.
  - deleted 2y ago
    [deleted]
  - wraptile 2y ago
    There's also certificate pinning which is done by basically every modern android app so you often need to modify apk to remove that. Httptoolkit has a good blog on the process: https://httptoolkit.com/blog/frida-certificate-pinning/ https://httptoolkit.com/blog/frida-certificate-pinning/
    - jeroenhd 2y ago
      With root access, Frida can patch applications in memory, so you don't need to mess with the APK file. If root is not an option, injecting Frida into the APK will work (but that might break applications that verify signatures).
bbogdn2 2y ago
Not sure about the proxy setup, but redroid is basically android in a docker container.

by dchuk 2y ago

CartwheelLinux 2y ago

If you want to do this now with little setup, run waydroid and then run wireshark inside the network namespace that is created for waydroid sudo ip netns exec <netns> wireshark

jeroenhd 2y ago
Wireshark is nice, but for HTTPS MitM you'll need a tool like mitmproxy/Burp to do the proxying and either modifications to the system image or a Frida daemon running as root to make most apps trust the MitM'd certificates. To get the traffic routed right, the Wireguard option for mitmproxy is pretty useful in my experience. Not sure how well Waydroid + Android VPNs work together, though.
- feanaro 2y ago
  What do you mean by the Wireguard option for mitmproxy? EDIT: Oh, look at this https://mitmproxy.org/posts/wireguard-mode/ https://mitmproxy.org/posts/wireguard-mode/. TIL.
  - jeroenhd 2y ago
    It's a pretty neat feature! I think it's in beta but it works flawlessly in my experience. Sure is a lot easier than setting up a separate (W)LAN with iptables rules to force redirect traffic.
- deleted 2y ago
  [deleted]
- wraptile 2y ago
  There's also certificate pinning which is done by basically every modern android app so you often need to modify apk to remove that. Httptoolkit has a good blog on the process: https://httptoolkit.com/blog/frida-certificate-pinning/ https://httptoolkit.com/blog/frida-certificate-pinning/
  - jeroenhd 2y ago
    With root access, Frida can patch applications in memory, so you don't need to mess with the APK file. If root is not an option, injecting Frida into the APK will work (but that might break applications that verify signatures).

bbogdn2 2y ago

Not sure about the proxy setup, but redroid is basically android in a docker container.