[TOOL][HTTP/HTTPS analyzer]SandroProxy

Search This thread
By:
Advanced…
SandroBSupp

SandroBSupp

Senior Member
Sep 27, 2011
333
103
code.google.com

Proxy, http analyzer, mitm, transparent proxy

NO NEED FOR ROOTED PHONE

Why would you use it:
- behind corporate firewall/proxy, needing to connect to squid, isa/forefront proxy with authentication
http://code.google.com/p/sandrop/wiki/HowToConnectToOtherProxy
- developer to examine http traffic, with embedded chrome devtools that can be used as ide
- security analyst examining how apps communicate with servers
- ...

Features:
- can act as pass-through proxy, traffic is not stored, ssl tunnel remains the same to server.
- capture,intercept request/response, replay, change before sending further
- can use client certificate to make connection to web server
- creates server certificates on the fly with proper host name
- transparent proxy needs superuser, su, iptables (1.4.10 or higher) to listens on port 80, 443
- request/response are stored as files so can be examined later on
- can bind only local or on all adapters
- client cache headers can be removed so content is always fetched from server (no 304 Not Modified responses)
- custom proxy plugins http://code.google.com/p/sandrop/issues/detail?id=31
- custom search criteria on show request/responses with scripting
- can connect to another proxy (Squid, ISA proxy, ForeFront TMG proxy) (basic, digest, ntlm authentication supported)
- can act as web server to filter/examine captured data
- can connect to insecure sites, switch on/off in preferences
- can use chrome devtools to examine captured data
- chorme devtools 3D panel
- websockets support

!!!!
there are ads on log tab and google analytic events on switching tabs
sorry for that
!!!!
chrome_devtools_3d.png
chorme_devtools_gui.jpg
data_tab_show_pictures.png
log_tab_phone.png
apps_tab.png
data_tab_phone.png
settings_transparent_proxy.png
log_transparent_proxy.png


custom proxy plugins:

plugin_import.png
plugin_list.png


manual requests:

manual_request_small.png



market.android.com/details?id=org.sandroproxy

http://code.google.com/p/sandrop/

Proxy acts as SSL man-in-the-middle. It generates sites certificates on the fly.
Issuer is named UNTRUSTED.
Based on WebScarab so all credits goes there.
www.owasp.org/index.php/Category:eek:WASP_WebScarab_Project


********************
Requests/Responses are stored in getExternalCacheDir()

/mnt/sdcard/Android/data/org.sandroproxy/cache

http://developer.android.com/reference/android/content/Context.html#getExternalCacheDir()

There is no security enforced with these files. All applications can read and write files placed here.

********************

Use stock browser and change that wi-fi uses proxy on localhost:8008
code.google.com/p/sandrob/issues/detail?id=41#c27

Copy from app thread, because it can also be used as development tool.
For example to store application/server http/https comunication.

 
Last edited:
  • Like
Reactions: asalvi0, Aniruddha10, Krishna_MDual and 12 others
S

soulbkd

Member
Jun 14, 2010
29
6
East Java
wow.. this is what I'm looking for...! thanks, downloading it.

is it tracking request from internet browser only or any request from every app and any protocol maybe? in spite of the title HTTP/HTTPS analyzer :D
 
SandroBSupp

SandroBSupp

Senior Member
Sep 27, 2011
333
103
code.google.com
Just for http/https.

It can act as
proxy -> you must specify proxy in browser settings
transparent proxy -> you must somehow change where tcp packets are going (iptables)
http://www.cyberciti.biz/tips/linux-setup-transparent-proxy-squid-howto.html

Now I am working on tab where redirection on phone can be done from gui for all processes that have network permissions.
It creates iptable rules as:
iptables -t nat -A OUTPUT -m owner --uid-owner <xxxxx> -p tcp --dport 80 -j DNAT --to 127.0.0.1:8009

But still long way to make it work properly...

apps_tab.png
 
SandroBSupp

SandroBSupp

Senior Member
Sep 27, 2011
333
103
code.google.com
New feature: gui for process->trasparent proxy redirection

It activated additional iptables rules so the process is redirected to transparent proxy.

iptables -t nat -A OUTPUT -m owner --uid-owner <xxxxx> -p tcp --dport 80 -j DNAT --to 127.0.0.1:8009



apps_tab.png
 
C

chareos12

Senior Member
Sep 8, 2010
700
52
dumb question: would your app help to make gTalk work on corporate networks protected by Forefront ?

Many thanks
 
P

Pons

Senior Member
Sep 2, 2010
3,932
2,067
MemoryController said:
I can't find it on the Market/Play crap.
Device: GT-i9100 on 4.0.3 rooted. Country: Greece
Current Operator:Vodafone GR, tried also with GR COSMOTE. Any ideas?
Click to expand...
Click to collapse

I'm assuming you clicked on he link in the OP? Have you tried searching the Play Store from a browser while logged into Google? It will tell you if your device is compatible or not.
 
SandroBSupp

SandroBSupp

Senior Member
Sep 27, 2011
333
103
code.google.com
New feature: user custom CA certificate, import CA to android store

User can set custom CA for generating site certificates.
Or use generated one.
Password can be set. if not, default ("password") will be used.
There is option to store SandroProxy certificate in android store.
If custom, not generated is used, be careful that it contains BasicConstraints with isCA flag set to true.
Otherwise will not be recognised as CA certificate.
 
P

Publiuss

Senior Member
Jun 29, 2012
948
171
It does nothing...

Hi

I'm on a rooted xperia SK17i, I set it as transparent proxy, but it does collect nothing, does not display any app...

Should I use an external proxy app to redirect traffic on a specific port (for ex. 8008) on which sandroproxy is listening?
 
SandroBSupp

SandroBSupp

Senior Member
Sep 27, 2011
333
103
code.google.com
Transparent proxy setup for app


How to redirect app on device to local sandroproxy:
1. first you check on which app would you like to redirect to transparent proxy. APPS tab
2. check in preferences that transparent proxy is enabled. Transparent proxy = ON
3. check version of iptables. It should not be 1.3.x because have problems with nat table.
----You can fix iptables with this app from market
----https://play.google.com/store/apps/details?id=com.mgranja.iptables
4. start proxy

You can check iptables rules when proxy is active with Info Menu action.
Or from adb shell:
iptables -L
iptables -t nat -L






Publiuss said:
Hi

I'm on a rooted xperia SK17i, I set it as transparent proxy, but it does collect nothing, does not display any app...

Should I use an external proxy app to redirect traffic on a specific port (for ex. 8008) on which sandroproxy is listening?
Click to expand...
Click to collapse
 
Last edited:
L

Losik

Member
Nov 23, 2005
14
8
Tried this on ICS9, iptables -V = 1.4.x, transparent proxy
HTTP traffic is pushing through the App with no problems. But HTTPS traffic capturing seems like not working...
Saw some FIX ME! comments in the log, maybe that's the reason?...

Proxy listening on 127.0.0.1:8010
Proxy listening on 127.0.0.1:8009
Proxy listening on 127.0.0.1:8008
Finished loading session from /mnt/sdcard/Android/data/org.sandroproxy/cache
Done!
Loading cookies
Loading urls
Loading conversations
Loading session from /mnt/sdcard/Android/data/org.sandroproxy/cache
Using CA from file: /mnt/sdcard/Android/data/org.sandroproxy/cache/.keystoreca
CA cert exported to /mnt/sdcard/Android/data/org.sandroproxy/cache/.keystoreca_export.crt
Loading keys from /mnt/sdcard/Android/data/org.sandroproxy/cache/.keystoreca
Using /mnt/sdcard/Android/data/org.sandroproxy/cache for data storage
client cert file name is not valid so it will not be used:/mnt/sdcard/cert.p12
#attach sandroproxy to INPUT chain
iptables -A INPUT -j sandroproxy
- successful.
#attach sandroproxy to nat PREROUTING chain
iptables -t nat -A PREROUTING -j sandroproxy
- successful.
#attach sandrop_proc to nat OUTPUT chain
iptables -t nat -A OUTPUT -j sandrop_proc
- successful.
#redirect outbound port from 443 to 127.0.0.1:8010
iptables -t nat -A sandrop_proc -m owner --uid-owner 10099 -p tcp --dport 443 -j DNAT --to 127.0.0.1:8010
FIX ME! implement getprotobyname() bionic/libc/bionic/stubs.c:450
- successful.
#logging before redirection is made to /proc/kmsg
iptables -t nat -A sandrop_proc -m owner --uid-owner 10099 -p tcp --dport 443 -j LOG --log-level debug --log-prefix "[NewConnection]" --log-uid
FIX ME! implement getprotobyname() bionic/libc/bionic/stubs.c:450
- successful.
#redirect outbound port from 80 to 127.0.0.1:8009
iptables -t nat -A sandrop_proc -m owner --uid-owner 10099 -p tcp --dport 80 -j DNAT --to 127.0.0.1:8009
FIX ME! implement getprotobyname() bionic/libc/bionic/stubs.c:450
- successful.
#logging before redirection is made to /proc/kmsg
iptables -t nat -A sandrop_proc -m owner --uid-owner 10099 -p tcp --dport 80 -j LOG --log-level debug --log-prefix "[NewConnection]" --log-uid
FIX ME! implement getprotobyname() bionic/libc/bionic/stubs.c:450
- successful.
#create sandro_proc chain
iptables -t nat --new sandrop_proc
iptables: Chain already exists.
- failed!
Error executing superuser commands: length=4096; regionStart=0; regionLength=-1
#redirect outbound port from 80 to 127.0.0.1:8009
iptables -t nat -A sandrop_proc -m owner --uid-owner 10052 -p tcp --dport 80 -j DNAT --to 127.0.0.1:8009
FIX ME! implement getprotobyname() bionic/libc/bionic/stubs.c:450
- successful.
#logging before redirection is made to /proc/kmsg
iptables -t nat -A sandrop_proc -m owner --uid-owner 10052 -p tcp --dport 80 -j LOG --log-level debug --log-prefix "[NewConnection]" --log-uid
FIX ME! implement getprotobyname() bionic/libc/bionic/stubs.c:450
- successful.
#create sandro_proc chain
iptables -t nat --new sandrop_proc
- successful.
#list of iptables
iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
all -- anywhere anywhere owner socket exists
sandroproxy all -- anywhere anywhere

Chain FORWARD (policy DROP)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
all -- anywhere anywhere owner socket exists

Chain costly_shared (0 references)
target prot opt source destination
all -- anywhere anywhere owner socket exists
ACCEPT all -- anywhere anywhere

Chain sandroproxy (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:www
ACCEPT tcp -- anywhere anywhere tcp dpt:https
FIX ME! implement getprotobynumber() bionic/libc/bionic/stubs.c:456
FIX ME! implement getprotobynumber() bionic/libc/bionic/stubs.c:456
- successful.
#list of iptables nat
iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
sandroproxy all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination

Chain sandroproxy (1 references)
target prot opt source destination
REDIRECT tcp -- anywhere anywhere tcp dpt:www redir ports 8009
REDIRECT tcp -- anywhere anywhere tcp dpt:https redir ports 8010
FIX ME! implement getprotobynumber() bionic/libc/bionic/stubs.c:456
FIX ME! implement getprotobynumber() bionic/libc/bionic/stubs.c:456
- successful.
#redirect 443 to 8010
iptables -A sandroproxy -t nat -p tcp --dport 443 -j REDIRECT --to-port 8010
FIX ME! implement getprotobyname() bionic/libc/bionic/stubs.c:450
- successful.
#redirect 80 to 8009
iptables -A sandroproxy -t nat -p tcp --dport 80 -j REDIRECT --to-port 8009
FIX ME! implement getprotobyname() bionic/libc/bionic/stubs.c:450
- successful.
#create sandroproxy chain, , it could fail if already exist
iptables -t nat --new sandroproxy
iptables: Chain already exists.
- failed!
#accept connection on port 443
iptables -A sandroproxy -p tcp --dport 443 -j ACCEPT
FIX ME! implement getprotobyname() bionic/libc/bionic/stubs.c:450
- successful.
#accept connection on port 80
iptables -A sandroproxy -p tcp --dport 80 -j ACCEPT
FIX ME! implement getprotobyname() bionic/libc/bionic/stubs.c:450
- successful.
#create sandroproxy chain, it could fail if already exist
iptables --new sandroproxy
iptables: Chain already exists.
- failed!


Attaching iptables -L -t nat command
 

Attachments

  • iptables.jpg
    iptables.jpg
    144.2 KB · Views: 395
SandroBSupp

SandroBSupp

Senior Member
Sep 27, 2011
333
103
code.google.com
Capturing https is more tricky. It can be done but with some additional stuff.
When app make ssl request it states hostname.
If ssl server side certificate is not for the same hostname, by default connection is not trusted and dropped.

Sandroproxy has in settings that you can state name for generated certificate.
http://code.google.com/p/sandrop/issues/detail?id=40

Also you should put sandroproxy CA to android store.
http://code.google.com/p/sandrop/issues/detail?id=2

You can test if app will work if you make same request from browser and no popup that something is wrong with ssl appears.
If you redirect browser (native, opera, ...) to sandroproxy, and click continue on ssl popup, it will proceed.

To find out what kind of request app makes on ssl you should check in /proc/kmsg where iptables puts some info.
Or with this app.
https://play.google.com/store/apps/details?id=com.googlecode.networklog

FIX ME is from iptables command and will probably be gone in some new version.


Losik said:
Tried this on ICS9, iptables -V = 1.4.x, transparent proxy
HTTP traffic is pushing through the App with no problems. But HTTPS traffic capturing seems like not working...
Saw some FIX ME! comments in the log, maybe that's the reason?...
Attaching iptables -L -t nat command
Click to expand...
Click to collapse
 
L

Losik

Member
Nov 23, 2005
14
8
Unfortunately...
I verified hostname by the NetworkLog app that you gave me... set it up in SandroProxy, checked HTTPS next to App, started service, exported and loaded sandroproxy CA... but app doesn't let me through, anyway. In Logs, app seems like trying to change SSL, maybe succeeds, maybe fails, I don't know:

Code: 
Reading reqest from browser
Finished negotiating SSL - algorithm is SSL_RSA_WITH_RC4_128_MD5
Intercepting SSL connection!

However, browser works, and says certificate is valid for that hostname.
So... something's wrong with SSL. I guess I'll have to find other ways around (

Anyway, thanks for trying to help me, I appreciate donate it.
 
You must log in or register to reply here.

Similar threads

capslock66
[Tool][Windows Only][Root] Android Reverse Tethering 3.19
Replies
2K
Views
2M
lenigma1too
lenigma1too
iBotPeaches
[UTIL][JAN 20, 2024] Apktool - Tool for reverse engineering apk files
Replies
6K
Views
2M
Z
Zhelkek
osm0sis
[TOOL] Android Image Kitchen - Unpack/Repack Kernel Ramdisk [Win/Android/Linux/Mac]
Replies
3K
Views
1M
osm0sis
osm0sis
mauronofrio
[TOOL] TOOL ALL IN ONE (Drivers|Unlock|TWRP|Factory Image|Stock Recovery)
Replies
840
Views
834K
B
Bifek
Flextrick
[TOOL][WINDOWS] Android Multitool
Replies
1K
Views
932K
MegaHz
MegaHz

Top Liked Posts

24 Hours All time

New posts