Android uses Fiddler to capture network data packets

It mainly introduces how to capture network data packets on Android and IPhone mobile phones. For example, we can use this method to capture the network communication request of an application (Weibo, WeChat, Moji Weather).

Compared with tcpdump and wireshark, the advantages of capturing packets are: (1) No root is required (2) It is also applicable to Android and Iphone (3) The operation is simpler and more convenient (the first installation and configuration, the second time you only need to set the proxy) ( 4) The viewing of data packets is clearer and easier to understand, and the UI of Fiddler is simpler and clearer (5) HTTPS requests can be viewed. Also visible if you insist on using tcpdump: grab network packets with tcpdump and wireshark.



PS: 1 PC is needed for assistance, and the PC needs to be in the same local area network as the mobile phone or has an independent public network ip
1. Install Fiddler on the PC
Download address: Fiddler.exe, the following is a brief introduction of Fiddler:
Fiddler is powerful and easy to use One of the most popular web debugging tools, it can log client and server http and https requests, allowing you to monitor, set breakpoints, and even modify input and output data, Fiddler includes a powerful event-based scripting subsystem, and can use The .net language is extended, and it is often used with firebug in web development and tuning.
The operating mechanism of Fiddler is actually an HTTP proxy listening on port 8888 on the machine. When the PC-side Fiddler starts, the default IE proxy is set to 127.0.0.1:8888, and other browsers need to be set manually, so if you need to monitor the PC-side Chrome network request, change its proxy to 127.0.0.1:8888. The data can be monitored, and the mobile phone can complete the http proxy of the entire system according to the following settings.



2. Configure Fiddler on PC and mobile phone
(1) Configure Fiddler to allow https monitoring
Open the Fiddler menu item Tools->Fiddler Options, select decrypt https traffic and ignore server certificate errors, as shown below:
fiddler https options
will prompt whether to trust the fiddler certificate and security reminder for the first time. Managed in certificate management.



(2) Configure Fiddler to allow remote connections. Click connections in the menu
above , select allow remote computers to connect, and the default listening port is 8888. If it is occupied, it can also be set. After configuration, you need to restart Fiddler, as shown below:
fiddler remote connect



( 3) Configure
the command line ipconfig on the PC side of the mobile phone to view the ip of the machine where Fiddler is located. The ip of this machine is 10.0.4.37. As shown in the figure below, the
ipconfig
mobile browser accesses http://10.0.4.37:8888, that is, the ip of the machine where Fiddler is located plus the port , the proxy goes online. The following page is displayed:
fiddler certifacate
Click FiddlerRoot certificate to download the certificate and rename

it . If the screen lock password is not set, it may prompt "You need to set the screen lock password before using the credential storage", click OK to set.
Then open the wifi connected to the same local area network, and modify the wifi network details -> show advanced options, select manual proxy settings, fill in the ip of the machine where Fiddler is located for the host name, and fill in the Fiddler port for the port, the default is 8888, as shown below:
android network proxy

At this time, the network access on the mobile phone can be viewed in Fiddler, as shown in the following figure: Weibo and WeChat network requests:
WeChat capture data packets
You can double-click a network request in the above figure, and the specific request content will be displayed on the right side (Request Header) and return content (Response Header and Content), as shown below:
Weibo network interception
It can be found that Fiddler can view the data returned by network requests in various formats, including Header, TextView (text), ImageView (picture), HexView (ten Hexadecimal), WebView (web page form), Auth (Proxy-Authenticate Header), Caching (Header cache), Cookies, Raw (raw data format), JSON (json format), XML (xml format) are very convenient.



If you stop network monitoring, you can remove the wifi proxy settings, otherwise the phone will not be able to access the Internet after Fiddler exits.

If you need to restore the mobile phone without a password, you can go to System Settings-Security-Trusted Credentials-Users on the Android side, click Certificate to delete or Clear Credentials to delete all user certificates, and then set the password to None.

Reprint!