* Create rules to filter out the good traffic and easily spot anomalies * Dump the traffic to a PCAP file, download it from a browser, or stream it to a remote receiver for real-time analysis (e.g. * Decrypt the HTTPS/TLS traffic and export the SSLKEYLOGFILE * Inspect the full connections payload as hexdump/text * Inspect HTTP requests and replies thanks to the built-in decoders * Extract the SNI, DNS query, HTTP URL and the remote IP address * Log and examine the connections made by user and system apps
It does not use a remote VPN server, instead data is processed locally on the device.
PCAPdroid simulates a VPN in order to capture the network traffic without root. It also allows you to export a PCAP dump of the traffic, inspect HTTP, decrypt TLS traffic and much more. PCAPdroid is a privacy-friendly app which lets you track and analyze the connections made by the other apps in your device. Once the capture session has been completed, you can get the dump.pcap file using adb: adb pull /sdcard/dump.cap. Select onne of the available interface to capture (or use the "any" interface to capture ALL traffic on the device) # tcpdump -Dģ.any (Pseudo-device that captures on all interfaces) ħ.nflog (Linux netfilter log (NFLOG) interface)Ĩ.nfqueue (Linux netfilter queue (NFQUEUE) interface)Īnd start the capture, saving the output on /sdcard/dump.pcap # tcpdump -vv -i any -s 0 -w /sdcard/dump.pcap tcpdump /system/xbin/tcpdumpįinally, access to the shell on your device $ adb shell Then, install the tcpdump executable on your device: $ adb root So, first you need to obtain a tcpdump binary compiled for ARM architecture. Please refer to XDA forums in order to search the best method. In this case, can be helpful extract the network traffic using a local installation of tcpdump.īefore all: your device must be rooted. This operation is pretty simple when the device is connected to a wifi network managed by the analyst, but in some cases malware perform some type of operation only when the smartphone is connected to a mobile network. When performing the analysis of a malicious Android program directly on the device, often can be required to dump some network traffic.
0 kommentar(er)
