<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-mobile-network-traffic
description: >-
  Intercept, inspect, and analyze mobile application network traffic using proxy
  tools, Frida hooks, and packet capture. Covers certificate pinning bypass,
  API endpoint discovery, sensitive data in transit, and WebSocket analysis.
domain: cybersecurity
subdomain: mobile-security
tags:
  - network-traffic
  - burp-suite
  - mitmproxy
  - certificate-pinning
  - ssl-bypass
  - packet-capture
  - api-interception
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1040", "T1557", "T1573"]
  owasp-mobile: ["M3", "M5"]
  tools: ["burp-suite", "mitmproxy", "frida", "objection", "tcpdump", "wireshark"]
---

# Analyzing Mobile Network Traffic

## Overview

Mobile network traffic analysis intercepts app-to-server communication to identify
cleartext data transmission, weak TLS configurations, API vulnerabilities, sensitive
data leaks, and improper certificate validation—requiring proxy setup and
certificate pinning bypass.

## Prerequisites

```bash
pip install mitmproxy frida-tools objection
# Burp Suite (Community or Pro)
# Device configured to use proxy (WiFi settings or iptables)
```

## Workflow

### Step 1: Proxy Setup

```bash
# mitmproxy — start proxy
mitmproxy -p 8080
mitmdump -p 8080 -w traffic.flow    # Save traffic

# Install CA certificate on device
# Android: Settings > Security > Install from storage
# iOS: Download profile > Settings > General > VPN & Device Management

# Android 7+: System CA via Magisk module or network_security_config.xml patch
# Patch: add trust-anchors user certs to decompiled APK, rebuild, resign

# Set device proxy
# Android: WiFi settings > Proxy > Manual > host:8080
# iOS: WiFi settings > HTTP Proxy > Manual > host:8080
```

### Step 2: Certificate Pinning Bypass

```bash
# Objection — universal bypass
objection -g com.target.app explore -s "android sslpinning disable"
objection -g com.target.app explore -s "ios sslpinning disable"

# Frida script for custom pinning implementations
frida -U -f com.target.app -l ssl_pinning_bypass.js --no-pause
```

```javascript
// Universal Android SSL pinning bypass
Java.perform(function() {
    // OkHttp CertificatePinner
    try {
        var CertificatePinner = Java.use('okhttp3.CertificatePinner');
        CertificatePinner.check.overload('java.lang.String', 'java.util.List')
            .implementation = function(hostname, peerCertificates) {
            console.log('[*] Bypassed OkHttp pinning for: ' + hostname);
        };
    } catch(e) {}

    // TrustManagerImpl
    try {
        var TrustManagerImpl = Java.use('com.android.org.conscrypt.TrustManagerImpl');
        TrustManagerImpl.verifyChain.implementation = function() {
            console.log('[*] Bypassed TrustManagerImpl');
            return arguments[0];
        };
    } catch(e) {}
});
```

### Step 3: Traffic Analysis

```bash
# Filter traffic in mitmproxy
# Flow filters: ~d target.com | ~m POST | ~c 401 | ~t json

# Export specific flows
mitmdump -r traffic.flow -w filtered.flow "~d api.target.com"

# Dump request/response bodies
mitmdump -r traffic.flow --set flow_detail=3

# Look for sensitive data
mitmdump -r traffic.flow -s filter_sensitive.py

# tcpdump on device (rooted Android)
adb shell tcpdump -i wlan0 -w /sdcard/capture.pcap
adb pull /sdcard/capture.pcap

# Wireshark analysis
wireshark capture.pcap
# Filter: ip.addr == TARGET_IP && tls
```

### Step 4: API Endpoint Discovery

```bash
# Extract all unique endpoints from captured traffic
mitmdump -r traffic.flow --set flow_detail=1 | grep -oE 'https?://[^ ]+' | sort -u

# Check for cleartext HTTP
mitmdump -r traffic.flow "~scheme http" --set flow_detail=2

# Identify authentication tokens
mitmdump -r traffic.flow -s extract_tokens.py

# WebSocket traffic
mitmdump -r traffic.flow "~websocket"
```

### Step 5: TLS Configuration Audit

```bash
# Check server TLS version
openssl s_client -connect api.target.com:443 -tls1_2
openssl s_client -connect api.target.com:443 -tls1_1  # Should fail

# testssl.sh comprehensive scan
testssl.sh api.target.com

# Check for certificate transparency
curl -s "https://crt.sh/?q=target.com&output=json" | jq '.[0:5]'
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Cleartext HTTP | Traffic capture | Sensitive data unencrypted |
| Weak TLS | Server scan | TLS 1.0/1.1 supported |
| Token in URL | Proxy logs | Auth tokens in query params |
| Missing HSTS | Response headers | No Strict-Transport-Security |

```yaml
title: Mobile Network Traffic Detection
id: 737de836-779b-4b81-8831-04fca98791b4
status: experimental
description: Detects suspicious activity related to analyzing mobile network traffic techniques in mobile security context
logsource:
  category: application
  product: android
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1040
  - attack.t1557
  - attack.t1573
  - attack.initial_access
falsepositives:
  - Mobile device management platform enforcing security policies
```

## Verification

- [ ] Proxy configured and intercepting traffic
- [ ] Certificate pinning bypassed (if present)
- [ ] All API endpoints cataloged
- [ ] Sensitive data in transit identified
- [ ] TLS configuration audited
- [ ] Authentication token handling reviewed

## References

- [OWASP MASTG — Network Communication Testing](https://mas.owasp.org/MASTG/techniques/android/MASTG-TECH-0010/)
- [mitmproxy](https://mitmproxy.org/)
- [Burp Suite Mobile Testing](https://portswigger.net/burp/documentation/desktop/mobile)
- [MITRE T1040](https://attack.mitre.org/techniques/T1040/)
