PCAPdroid mitm

PCAPdroid captures your phone’s network traffic without root, using a local VPN. On its own it shows which apps connect where, but the contents of HTTPS connections stay encrypted. This addon adds decryption. It runs mitmproxy on the phone, so PCAPdroid can show the decrypted requests and responses.

It is an addon, not a standalone app. You need PCAPdroid installed as well; it is available on F-Droid and Google Play.

How it works

The addon bundles a complete Python runtime, through the open-source Chaquopy framework, with mitmproxy and its dependencies pre-built. That is why it is 28.0 MB. Most of that is Python.

When decryption is on, PCAPdroid hands TLS connections to the addon, and mitmproxy decrypts them using its own certificate authority.

Before you start

• You have to install mitmproxy’s CA certificate on the phone, and PCAPdroid guides you through it.
• Many apps won’t be decryptable. Since Android 7, apps by default don’t trust certificates the user installed, and apps with certificate pinning reject any certificate other than their own. Browsers and some apps work. Many banking and social apps don’t.
• Only decrypt traffic from apps and accounts that are yours.

What stands out in the APK

• No trackers.
• All-files access is its one special permission, along with storage permissions that ask first. It most likely uses them to write captures and keys to files. There is also a special foreground service and a battery-optimisation exemption request, so long captures aren’t cut off.

Installing it

1. Install PCAPdroid.
2. Install this addon.
3. In PCAPdroid’s settings, turn on TLS decryption and follow its prompts to set up the certificate.
4. Start a capture, select the target app, and open it.

CPU types in this build: arm64-v8a (64-bit ARM, almost every phone since 2017).