Assuming you have a shell access on a rooted Android device. Let's say the shell was given upon an exploitation, eg. Android Webview vulnerability. The question is what is the best way to intercept HTTP/HTTPS traffic with shell access on a rooted Android device.

  • Just to speculate based on how certain things like the 'tether without root' app and Adblock work, you could set up an on-device proxy to route all traffic through, and create your own trusted key on your device. This isn't a simple shell command, though. – childofsoong Mar 6 '15 at 0:43

Simply use SandroProxy (on-device) or mitmproxy (off-device), these will help you perform a MITM attack by generating valid certificates on the fly.

Then use your root permissions to install the CA certificate for your MITM proxy to the system key store (which is located somewhere like /data/misc/keystore from memory) which will avoid the usual warning you get when you install additional certificates.

You should be able to create iptables rules to route traffic via your proxy, or modify the connection settings.

If you're just using it for debugging purposes and you don't mind if the user sees a warning then you don't actually need root, you can just add the CA certificate to the user store.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.