Comments for "Sniffing TLS traffic on Android"

[nibarius]

Comments made here will be shown on the "Sniffing TLS traffic on Android" article.

https://nibarius.github.io/learning-frida/2022/05/21/sniffing-tls-traffic

[Rhynorater]

Great article! Very informative and simple approach - just makes sense. I was struggling to decrypt Android traffic for a while and when I read this I was like "Duh". Hahaha Thanks fro the article!

[npendlington]

So, I've always used and preferred fiddler, so on the information from your Android 11 guide, and the fact I am using a physical device, I tried to get that working. Fiddler would only see and decrypt traffic from Chrome and not other applications (although interestingly I could see the SSL CONNECTs being logged.
Before I embark on using PolarProxy for the first time, I wonder if this is more a security feature of Android 13 and I'm not going to get any further. What do you think?

[nibarius]

I haven't started using Android 13 myself yet, but I'm not aware of any particular security features on Android 13 that should make things more difficult than they were on Android 11. So I'm hoping things will work the same.

[tranxuanloc]

I have followed the article but can't get decrypted info on pcap file. One thing I don't clear is set up Access Point on Android to use our proxy. Do you guys know what is server IP and Port should I enter? Thank you!!

[nibarius]

You should not use any proxy at all in the Access Point settings on Android. PolarProxy is a transparent proxy, so your Android phone doesn't know that it's talking to a proxy. It thinks it's making a normal request directly to the target server. It's the adb reverse and iptables rules that makes sure that the traffic is re-routed to the PolarProxy server on it's way to the remote server.

[tranxuanloc]

Oh thank you! I have thought that the problem is APN because after set up proxy, Android 11 can not access to the internet, I have created a same virtual Android 11 without connect to proxy and it can access to internet. If traffic go through PolarProxy, Android say no connection to the internet. Do you face the internet problem on Android 11?

Some information captured into pcap file but do not decrypt. I don't know where my wrong.

[nibarius]

I'm using Android 11 on my emulator and I don't have the same internet problem. The important thing when using PolarProxy is to not set up any proxy at all on the emulator. First time I was specifying a proxy in the APN settings, but that wasn't working. When I removed all proxy settings from my emulator and just relied on adb reverse + iptables I got it working.

[tranxuanloc]

Unfortunately, I still can't get decrypted data. I have removed my custom APN. But still have default APN, so I use emulator setting and set it to No proxy.