Capture APP packets based on transparent proxy on Android

brief description

Use iptables to transfer all the tcp traffic of the mobile phone to the specified transparent proxy;
then use redsocks to forward the traffic to the forward proxy, such as Charles's socks5 proxy

Based on iptables + redsocks2 + Charles, the Android APP is finally realized to capture packets, and the APP has no perception
, that is, the APP cannot judge whether there is packet capture behavior by checking the system proxy or VPN

Prepare

One rooted Android phone, one computer
redsocks2 download address: https://fh0.github.io/assets/android-redsocks2.tgz

step

Create a configuration file named redsocks.conf with the following content:

base {
    log_debug = off;
    log_info = on;
    log = stderr;
    daemon = off;
    redirector = iptables;
}

redsocks {
    bind = "127.0.0.1:8080";
    relay = "192.168.0.132:7777";
    type = socks5;
    autoproxy = 0;
    timeout = 10;
}

Among them, bind is the transparent proxy address, and relay is the proxy address of Charles.

Open the terminal adb shell to connect to the phone

save existing iptables rules

iptables-save > /data/local/tmp/iptables.rules

If you want to restore the rules, you need to restart the phone or enter

iptables-restore /data/local/tmp/iptables.rules

Upload files and enable transparent proxy

adb push redsocks2_arm64 /data/local/tmp/redsocks
adb shell chmod +x /data/local/tmp/redsocks
adb shell
su
cd /data/local/tmp
iptables -t nat -A OUTPUT -p tcp ! -d 127.0.0.1 -m multiport --dports 80,443 -j DNAT --to-destination 127.0.0.1:8080
./redsocks

Charles sets Socks5 proxy port 7777

Designated port, App

After the above steps are completed, the goal of capturing the app without perception is achieved.
If you don’t want the global traffic to go through the proxy

Designated port
In fact, it has been written above, currently it is the designated port 80, 443, you can also specify 0-65535, just change it to --dports 0:65535
Specifies that the App
must first find the uid of the App

First open your APP, then use the ps -ef command to find the line with your application package name, the first column is uid,
usually you see something like u0_a428, then the following commands, uid-related can be written as u0_a428, or Write it as 10428
and then replace the command with

iptables -t nat -A OUTPUT -p tcp ! -d 127.0.0.1 -m owner --uid-owner 10428 --dports 80,443 -j DNAT --to-destination 127.0.0.1:8080

Reference
https://blog.seeflower.dev/archives/207/
https://mp.weixin.qq.com/s/P0ESUUXBmq2aQnrqDHsDaw
https://blog.mythsman.com/post/62791fb4b5467000017d5c6e/