I'm curious as to how I could figure out the API URL an Android application (any app I have installed) uses if it makes API calls to some online server (a RESTful service for example). I presume I have to capture packets on the device and maybe analyse them in Wireshark or something to find the URL? I'm fairly competent in Java/Android development, but a bit lost when it comes to any sort of network analysis business.
8 Answers
A very fast method.
Go to PlayStore, search for Packet Capture
Download, install and run.
It's easy simple and fast. It will give you details about the APIs, URLs and response with their headers.
This application follows the concept of Packet Sniffing. Thus, this might not work with much secured applications like WhatsApp, Facebook, Twitter.
UPDATE 1:
The Packet Capture is no more available in playstore, try OS Monitor
UPDATE 2:
The Packet Capture is available again.
In windows 10 machine just follow the below steps:
Go to Settings > Network & Internet > Mobile hotspot and enable Share my internet connection with other devices.
Connect your Mobile Device to that shared hotspot.
Now for getting internet access in your mobile click on Change adapter options.
Go to properties by right click on the the Network Adapter from which the internet is being shared to your windows machine.
Tick the Internet Connection Sharing options in the Sharing tab by selecting the appropriate connection (Local Area Connection used by mobile device) and click ok.
Now you will be able to see all the network traffic of the mobile device in Wireshark if you select the Local Area Connection used by mobile. For filtering the result by http traffic you can enter http in the filter field and for https web traffic you can enter tls.handshake.type eq 1
Download Android +6.0 image for PC from this site: https://www.android-x86.org/.
For example: https://www.android-x86.org/releases/releasenote-6-0-r3.html
Make sure that your app works with this Android version -- you can check the minimum Android version on Google Play store --, and don't take a too high number for the Andriod version: the higher the number, the more security constraints is has.
Install VirtualBox, mount the ISO image, boot Android, and install the app through Google Play.
Now you have two options:
If traffic is unencrypted, you can log all NIC traffic to a text file. e.g.
VBoxManage modifyvm "vm-name" --nictrace1 on --nictracefile1 c:\file.pcap(cf. here)If traffic is encrypted, you can use a man-in-the-middle approach. An app that allows this is HttpCanary. It will make an VPN connection and redirect your traffic through that VPN. It decrypts and works well, but take care with your private data.
If the app is using certificate pinning, then it becomes more complicated. Read this blog. You will have to use this approach on x86 images. Note that in that article, the author is using Android x86 8.1 (not x64!) and Xposed Android SDK27. Good luck!!
try classic tcpdump
$ tcpdump -D
1.eth0 [Up, Running, Connected]
2.any (Pseudo-device that captures on all interfaces) [Up, Running]
3.lo [Up, Running, Loopback]
4.bluetooth-monitor (Bluetooth Linux Monitor) [Wireless]
5.usbmon2 (Raw USB traffic, bus number 2)
6.usbmon1 (Raw USB traffic, bus number 1)
7.usbmon0 (Raw USB traffic, all USB buses) [none]
8.nflog (Linux netfilter log (NFLOG) interface) [none]
9.nfqueue (Linux netfilter queue (NFQUEUE) interface) [none]
10.dbus-system (D-Bus system bus) [none]
11.dbus-session (D-Bus session bus) [none]
12.bluetooth0 (Bluetooth adapter number 0)
13.eth1 [none, Disconnected]
I know that this thread is quite old but in 2022 using Postman Proxy can help. Check this link out to see the simple steps https://blog.postman.com/using-postman-proxy-to-capture-and-inspect-api-calls-from-ios-or-android-devices/
see here to setup for https traffic https://learning.postman.com/docs/sending-requests/capturing-request-data/capturing-https-traffic/
Related