<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Analyzing Mobile Network Traffic

## mitmproxy / mitmdump
```bash
mitmproxy -p 8080                        # Interactive proxy
mitmdump -p 8080 -w traffic.flow         # Dump to file
mitmdump -r traffic.flow                 # Replay/read flow
mitmdump -r traffic.flow "~d target.com" # Filter by domain
mitmdump -r traffic.flow "~m POST"       # Filter by method
mitmdump -r traffic.flow "~scheme http"  # Cleartext only
mitmdump -r traffic.flow "~c 401"        # Filter by status
mitmdump -r traffic.flow "~websocket"    # WebSocket traffic
mitmdump -r traffic.flow --set flow_detail=3  # Full detail
```

## Burp Suite
```bash
# Proxy: 127.0.0.1:8080
# Export CA: http://burp/cert
# Scope: Target > Scope > Add
# Intercept: Proxy > Intercept > On
# History: Proxy > HTTP history
# Repeater: right-click request > Send to Repeater
```

## tcpdump (on-device)
```bash
adb shell tcpdump -i wlan0 -w /sdcard/capture.pcap
adb pull /sdcard/capture.pcap
tcpdump -r capture.pcap -A 'port 80'     # Read cleartext
```

## openssl
```bash
openssl s_client -connect host:443 -tls1_2
openssl s_client -connect host:443 -showcerts
openssl x509 -in cert.pem -text -noout
```

## testssl.sh
```bash
testssl.sh target.com                     # Full scan
testssl.sh --protocols target.com         # Protocol check only
testssl.sh --headers target.com           # Security headers
```
