Sniffing an Android app to find API URL

。_饼干妹妹 提交于 2019-11-28 15:23:40
Alok Singh Mahor

you can do this with help of WireShark. I am listing steps here

  1. Install WireShark on your computer
  2. now we have to create Android virtual device(AVD) so we will download Android SDK from official site. Android SDK come with emulator for testing
  3. after setting up Android SDK, create a Android virtual Device(AVD) on which we will install app
  4. start that virtual device. you can use command line to start (emulator @<AVD name>)
  5. after creating virtual device install app using adb command adb install app_file_name.apk
  6. now we can start capturing the packets so I will suggest to close other application on your computer which are using network so our captured packets would be more relevant.
  7. now start wireshark with root access
  8. select interface which you want to capture and click start to start capturing.

  9. now start using that app so packets will transfer to and fro and wireshark will capture it.

  10. if you have used app covering all sort of activity then you can stop wireshark to capture packets.

  11. now start main business to analyse packets carefully but not all packets are usefull for our job. so lets filter packets which are relevant for you. lets your IP address is 192.168.0.32 then filter all the packets whose IP is this. so filter expression will be ip.addr==192.168.0.32 apply this filter. still we an apply another filter to list up only relevant packets only so possibly that app is accessing API with HTTP protocol so apply HTTP filter. expression would be http. you can apply both are filter at once ip.addr==192.168.0.32 and http press enter to apply.

  12. see the info carefully for listed packets you will see lot of important details, API keys, cookies etc

A very fast method.
Go to PlayStore, search for Packet Capture

Download, install and run.
It's easy simple and fast. It will give you details about the APIs, URLs and response with their headers.

This application follows the concept of Packet Sniffing. Thus, this might not work with much secured applications like WhatsApp, Facebook, Twitter.

UPDATE 1:
The Packet Capture is no more available in playstore, try OS Monitor

Use debug proxy. Click on the play Button and you will be able to capture URLs and view more details

https://play.google.com/store/apps/details?id=com.dans.apps.webd

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!