I want to sniff the websockets (ssl) webtraffic of an Android app by using Mitmproxy. Because Android (>=7) by default makes apps not trust user certificates anymore, my plan is to put my Mitmproxy certificate into the /system/etc/security/cacerts/ folder.

I'm right now stuck at two problems:

  • When I use the "Android API 30 (Google Play)" image, I can't run "adb root": https://stackoverflow.com/questions/43923996/adb-root-is-not-working-on-emulator-cannot-run-as-root-in-production-builds I actually do need to load the App that I want to sniff first from the appstore, but I might be able to get the APK from somewhere else as well, so I tried out the "Android 30 (Google APIs)" image.
  • Using that image, I end up not being able to mount /system with read/write permissions and thus not beeing able to push my certificate into the root certificates folder. Apparently Android has locked the r/w mount of /system since Android 10.

Is there right now a solution to sniff the websockets traffic of an app using Mitmproxy and Android 11?

  • adb root is very old. I don't think that this had worked the last 5 years. Only for custom ROMS that are compiled with adb insecure option this still works. You may want to check this: Rooting the Android emulator – Robert May 4 at 14:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.