In order to capture the HTTP/HTTPS message in physical Android Devices or Android Emulators, please navigate to:

• Certificate Menu -> Install Certificate on Android -> Device

• Certificate Menu -> Install Certificate on Android -> Emulator

Android Setup Guide

The following photo describes thee steps:

1. Install Root Proxyman Certificate on your machine: You can follow the macOS Guide.

2. Config the HTTP Proxy on your device: You can find it in Setting app -> Wifi -> Select the current Wifi -> Config the HTTP Proxy by following the next tables.

3. Open http://proxy.man/ssl from the native web browser on your Android Devices in order to install the Proxyman Certificate.

Please make sure to install the Certificate and select the VPN and App Section.

4. From Android N, we have to trust the Proxyman Certificate in your app by adding the following code: It means that you can only use SSL Proxying in apps, which you are in control

• Add res/xml/network_security_config.xml

network_security_config.xml
<network-security-config>
    <debug-overrides>
        <trust-anchors>
            <!-- Trust user added CAs while debuggable only -->
            <certificates src="user" />
            <certificates src="system" />
        </trust-anchors>
    </debug-overrides>
    
    <base-config cleartextTrafficPermitted="true">
        <trust-anchors>
            <certificates src="system" />
        </trust-anchors>
    </base-config>
​
    <domain-config>
        <!-- Make sure your URL Server here -->
        <domain includeSubdomains="true">your_production_domain</domain>
        <trust-anchors>
            <certificates src="user"/>
            <certificates src="system"/>
        </trust-anchors>
    </domain-config>
</network-security-config>

• Add to AndroidManifest.xml

manifest.xml
<?xml version="1.0" encoding="utf-8"?>
<manifest ... >
    <application android:networkSecurityConfig="@xml/network_security_config" ... >
    ...
    </application>
</manifest>

5. If it's Android Emulator, please restart the emulator

6. Try to open your app, and intercept your domain, which is added on the network_security_config.xml

Troubleshooting

Please check out this troubleshooting section.​

Sample Android Project

If you've struggled to config XML settings, let check out this simple project that we've configured:

Intercept Traffic from embedding WebView

Some Android apps have embedded WebView that requires extra steps in order to intercept the HTTPS traffic.

1. Make sure you're able to see other HTTPS traffic from your Android app. It means that you've set up the certificate properly

2. Inject the following code to your WebView

if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.KITKAT) {
    WebView.setWebContentsDebuggingEnabled(true);
}
​
// The following two lines help with disabling asset caching
webView.getSettings().setAppCacheEnabled(false);
webView.getSettings().setCacheMode(WebSettings.LOAD_NO_CACHE);

3. Open a new Chrome tab on your computer and navigate to chrome://inspect

4. When you open the WebView, the view will appear in your Chrome tab, then you can simply click inspect to start using the remote debugger.

SSL Proxying using Root Device

Credit for Shirshak​

If your Android version is below 7 you don't need to do this step. Google added extra security that doesn't allow man-in-middle-app to attack after Android 6. i.e unable to do MITM attack to android apps.

We don't bear any responsibility for problems due to rooting phones. So please follow the guide at your own risk.

1. Root your phone with magisk framework.

2. Install the Root file browser so you can copy and paste files in a restricted system folder.

3. Type the following script in the command line

   $ cd ~/.proxyman
   // We copy certificate to another file name just so we may need it later
   $ cp proxyman-ca.pem temp.pem
   $ hash=$(openssl x509 -inform PEM -subject_hash_old -in temp.pem | head -1)
   $ mv temp.pem "$hash.0"

4. If you go to ~/.proxyman folder you must notice a file name starting with numbers with extension

5. Copy that file to your Andriod.

6. Using root file browser transfer that file to /system/etc/security/cacerts/

7. Enjoy proxying.

Addition resources

• Mitmproxy has a useful tutorial on how to install Certificate on Android Emulator: https://docs.mitmproxy.org/stable/howto-install-system-trusted-ca-android/​