PCAPdroid

https://emanuele-f.github.io/PCAPdroid/
Admin
PCAPdroid is a network monitoring and traffic analysis tool for Android, providing features like...
Tokens:4,826
Snippets:79
Trust Score:9.7
Update:3 months ago
Show doc for...
Tokens:
Raw
### Install mitmproxy on Android via Termux

Source: https://emanuele-f.github.io/PCAPdroid/tls_decryption

Commands to install mitmproxy 7.0.4 on Android using Termux, avoiding Rust dependencies.

```bash
pkg update
pkg install python openssl-1.1-static
python3 -m pip install --upgrade pip

CRYPTOGRAPHY_DONT_BUILD_RUST=1 CRYPTOGRAPHY_SUPPRESS_LINK_FLAGS=1 \
  LDFLAGS="$PREFIX/lib/openssl-1.1/libssl.a $PREFIX/lib/openssl-1.1/libcrypto.a" \
  CFLAGS="-I$PREFIX/include/openssl-1.1" \
  pip install mitmproxy==7.0.4
```

--------------------------------

### Analyze PCAPdroid traffic with Wireshark

Source: https://emanuele-f.github.io/PCAPdroid/dump_modes

Use netcat to listen on a port and pipe the stream directly into Wireshark for real-time analysis.

```bash
nc -lvp 1234 | wireshark -k -i -
```

--------------------------------

### Monitor connections with ntopng

Source: https://emanuele-f.github.io/PCAPdroid/dump_modes

Pipe the UDP stream into ntopng to monitor active connections and peers.

```bash
udp_receiver.py -p 1234 | ntopng -m “10.215.173.0/24” -i -
```

--------------------------------

### Analyze PCAP in real-time with Wireshark

Source: https://emanuele-f.github.io/PCAPdroid/dump_modes

Use this command on Linux to pipe the HTTP server stream directly into Wireshark for real-time analysis.

```bash
curl -NLs http://192.168.1.10:8080 | wireshark -k -i -
```

--------------------------------

### Capture UDP traffic using socat

Source: https://emanuele-f.github.io/PCAPdroid/dump_modes

Use socat as an alternative to the Python script, ensuring the buffer size is set to 65535.

```bash
socat -b 65535 - udp4-listen:1234
```

--------------------------------

### Analyze UDP traffic with Wireshark

Source: https://emanuele-f.github.io/PCAPdroid/dump_modes

Pipe the output of the UDP receiver script directly into Wireshark for real-time analysis.

```bash
udp_receiver.py -p 1234 | wireshark -k -i -
```

--------------------------------

### Define a Javascript Injection Script

Source: https://emanuele-f.github.io/PCAPdroid/advanced_features

Use metadata headers to define script properties and match patterns. The script executes on pages matching the specified URL pattern.

```js
// @name Alert test
// @description Displays an alert dialog on google.it
// @author Emanuele Faranda
// @version 1.0
// @match *://www.google.it/*

alert("Js Injector works");
```

--------------------------------

### Modify HTTP Response with mitmproxy Addon

Source: https://emanuele-f.github.io/PCAPdroid/tls_decryption

This script demonstrates how to intercept and modify the content of an HTTP response for a specific URL. Ensure the addon is enabled and TLS decryption is active for the target domain.

```python
# Modify HTTP.py

class ModifyHttp:
    def done(self):
        # addon unloaded, close global resources (e.g. open files) here
        pass

    def response(self, flow):
        if flow.request.pretty_url == "https://example.com/":
            flow.response.content = flow.response.content.replace(
                b"Example Domain",
                b"Modified by PCAPdroid mitm")

            print("HTTP response modified")

addons = [ModifyHttp()]
```

--------------------------------

### Write traffic to a PCAP file

Source: https://emanuele-f.github.io/PCAPdroid/dump_modes

Capture the UDP stream and save it to a file using tcpdump.

```bash
udp_receiver.py -p 1234 | tcpdump -w dump.pcap -r -
```
Tokens:
Raw