Monitoring API Requests of Mobile Application

[vulmux]

Hey XSS members,

I want to monitor the API requests from an app and capture the payloads and other data of any request originated from an app installed on my phone.

I tried mitmproxy but it only works for few apps and doesn't show api requests from apps which are using SSL pinning.

I am using an Android phone.

Help me.

 

[DimmuBurgor]

Are you looking for network dpi or sdk api calls because i would intuitively presume the former would be easily handled with wireshark/emulation/vpn in some combination, no?

 

[vulmux]

Are you looking for network dpi or sdk api calls because i would intuitively presume the former would be easily handled with wireshark/emulation/vpn in some combination, no?

I am looking for the api calls made by app to different websites. Tried the wireshark and mitmproxy but it only shows the requests that are not using SSL Pinning.

 

[DimmuBurgor]

Use a module or modify the apk would be my suggestion
stepany4 Veil gliderexpert are some of the most knowledgeable experts on the topic of general teleco and peripheral tech for future ref btw

 

[DimmuBurgor]

ð Frida's Gadget Injection on Android: No Root, 2 Methods

You will learn how to inject Frida's Gadget into Android application (APK) using 2 different methods without having to root your Android device.

fadeevab.com

GitHub - Fuzion24/JustTrustMe: An xposed module that disables SSL certificate checking for the purposes of auditing an app with cert pinning

An xposed module that disables SSL certificate checking for the purposes of auditing an app with cert pinning - Fuzion24/JustTrustMe

github.com

for example

 

[stepany4]

Use a module or modify the apk would be my suggestion
Veil gliderexpert are some of the most knowledgeable experts on the topic of general teleco and peripheral tech for future ref btw

Скажу латинянски - perfecto

 

[DimmuBurgor]

I'll say in Latin - perfecto

↑ ↑ ↑

Knows a thing or two about copper wires and other alchemy, too!
*nauka- mnejal, drugya
Cool share!