This article summarizes and records 5 ways to capture packets. If you master one, you can practice it. Everyone is welcome to communicate and share. Wireshark supports the most protocols, and is more underlying, powerful, but too heavy.

summary

During reverse analysis and mobile development, it is always necessary to monitor and test the network behavior of the APP. This article summarizes some ideas for packet capture and practices its usage methods

in the packet capture industry. Wireshark should be regarded as the comprehensive ranking tool (in fact, the command line tool tshark comes with Wireshark is more awesome)

This article summarizes and records 5 packet capture methods. Master one of them can be practiced. Everyone is welcome to communicate and share

1, based on Wireshark

Experiment steps:

.1 Use tools such as Cheetah Wifi on the computer host to turn on the hotspot, connect the mobile phone you want to test to the hotspot, record its IP address

.2 Use Wireshark to capture the above IP address

Capture—Options

.3 Summary

This method is simple, crude and efficient, and can save the captured data packets at any time, which is convenient for subsequent analysis or PCAP visual analysis.

. About the command line tool tshark will not be described here. Interested readers will study it for themselves.

2, based on tcpdump

experimental environment:

download and install Genymotion Android virtual machine, perform practical operations in this emulator environment (the same is true based on physical mobile phones, assuming that the mobile phone must obtain root)

The author only tested on the Android system, and did not experiment on the iOS system

Experimental steps:

2.1 Description The tcpdump tool that comes with

emulator is located at: /system/xbin/

2.2 packet capture

can be connected to the emulator in CMD mode through the adb shell command, su to root mode to capture packets

#!basshtcpdump -vv -s 0 -i eth1 -w /sdcard/capture.pcap

Parameter description:

• -vv: Get detailed package information (note that two vs are not w)
• -s 0: Unlimited packet length. If not added, only the packet header
• -w xxx.pcap: Capture the packet name and storage location (in this case, it is saved in the sdcard path, the packet name is capture.pcap)
• -i eth1: Capture the established network card (in the genymotion virtual machine, use the busybox ifconfig command to view relevant information. Generally, the genymotion IP address is 10.xx.xx.x)

If you want to specify the captured packet length, you can use the -c parameter (for example -c 128) After the capture is over, press Ctrl + C directly to

2.3 Data analysis

drag the captured data packet to the local area and use Wireshark to view:

#!bashadb pull /sdcard/capture.pcap C:\tmp

TIPS: Push the packet file to the mobile phone and the command is

#!bashadb push C:\tmp\capture.pcap /sdcard/

3, based on Fiddler 4

Experimental steps:

3.1 Download FIddler 4

3.2 Set Fiddler 4

Open Fiddler, Tools- Fiddler Options (Remember to restart Fiddler after configuration is completed)

3.3 Set mobile proxy

First, get the corresponding IP address (ipconfig) of the PC where Fiddler 4 is installed:

Ensure the mobile phone and PC It is connected to the same LAN! ! ! Set up the phone below

(the author uses Xiaomi test machine): Click "Settings" in the phone - Wi-Fi - select the connected wifi - change the proxy settings to manual

Download Fiddler's security certificate

Use the mobile browser to access: http://10.2.145.187:8888, click "FiddlerRoot certificate", and then install the certificate.

has been set up at this point.

3.4 Packet capture

Reopen Fiddler 4, then open the browser in the phone and visit any URL. The Fiddler packet capture information is as follows:

Enjoy!

4, based on Charles

experimental environment:

win7 + Charles v3.11

generally use Charles is based on MAC OS. The author has tried both on the mac platform and on the windows platform. The operation process and ideas are basically the same. Therefore, this article uses win7 as the test environment

experimental steps:

4.1 to capture the

mobile settings proxy:

open Charles can capture data packets (Proxy ——Proxy Settings):

4.2 Capture https packets

Mobile installation certificate:

Android mobile phone or iPhone can be accessed directly at http://www.charlesproxy.com/ssl.zip, and then click the certificate to install

settings Charles:

Select Proxy — SSL Proxying Settings — Locations — Add

Fill in the Host domain name (that is, the host name you want to catch the packet) in the pop-up form, and the corresponding Port port (which is equivalent to filtering here)

Of course, you can use a more crude method: use the wildcard , for example, if you want to capture all https packages, you can also directly be empty here, indicating that you capture all hosts and ports; or fill in the "*" asterisks separately to match all characters, and capture all https.

5, based on Burpsuite

Experimental steps:

5.1 Capture the http data packet

PC terminal Burpsuite Settings:

Mobile proxy settings are the same as above 3.3 4.1

Open Burpsuite to capture the http data packet:

5.2 Capture https data packet

After setting up the proxy on the mobile phone, use the browser to access: http://burp/

There is a problem here: the downloaded certificate is in der format, and the one installed on our mobile phone is in crt format. You need to use the firefox browser to change the format: you can first export the der format certificate in Brupsuite, then import the Firefox browser, and then export the certificate format from Firefox browser as crt

Open Firefox browser: Tools - Options - Advanced - Certificate - View certificate

Successfully captured the https data packet

6, Summary

When we stop capturing the data packet, Fiddler or Charles are closed. At this time, the mobile phone cannot access the network normally because the proxy is set. At this time, the proxy needs to be closed to browse the web page normally

For most applications that go through proxy, you can choose Fiddler or Charles, no root, one-time configuration, lifelong use; for apps that do not use agents, you can use tcpdump to capture packets, and then use Wireshark to view; the easiest and convenient method is the first method "0x01. Based on Wireshark", all tools above have their own advantages and disadvantages. Readers can use them according to the working environment and on demand. Personally, I think that in general, Wireshark + Fiddler or Wireshark + Charles You can complete the packet capture analysis tasks of each platform. Among the above tools, only BurpSuite can operate the packet capture process interactively; Wireshark supports the most protocols, is more underlying, and has powerful functions, but it is too heavy.

is not within the scope of the discussion of the relevant tools involved in this article (Charles free version is actually quite generous. If you need it severely, it is recommended to purchase the genuine version). This article aims to briefly analyze the methods and ideas for capturing mobile terminal data packets.

Original reprint:: https://wooyun.kieran.top/#!/drops/1024. A brief analysis of mobile phone packet capture methods practice