httptoolkit / httptoolkit-android

Automatic Android interception & debugging with HTTP Toolkit, for Android

httptoolkit-android

Automatic interception of Android HTTP with HTTP Toolkit, for inspection, debugging & mocking.

Looking to file bugs, request features or send feedback? File an issue or vote on existing ones at github.com/httptoolkit/feedback.

What is this?

HTTP Toolkit is primarily a desktop application. This repo contains the Android app, which connects to that desktop application, and forwards HTTP traffic there.

The Android itself is effectively two parts:

• An outer wrapper, which shows the UI, scans QR codes, retrieves proxy config from HTTP Toolkit, ensures the device trusts HTTP Toolkit's CA certificate, and starts and stops a VPN.
• A VPN, which receives every IP packet sent by the device, parses them, rewrites some of them to go to HTTP Toolkit, and then sends the parsed requests on via the real network (and forwards responses back)

Contributing

If you're looking to contribute to the Android app itself, you're in the right place. If you're looking to explore or change how the ADB-based Android setup works, you want to take a look at HTTP Toolkit server instead.

You can build and test this Android app in Android studio, like any other. It's half in Kotlin (the outer wrapper) and half in Java (most of the VPN code).

To test the app you can either set up the other components of HTTP Toolkit for development on your machine, or use it with any standard install of HTTP Toolkit. A rooted device isn't required for testing, but you will find that it helps, as you can test with a wider variety of real app traffic.

httptoolkit-android's Issues

可以做到完全本地一个应用运行吗？即APP拿到流量直接本地转发到原始地址去，不经过任何服务器

Waydroid support

Because Waydroid cannot use camera or Wi-Fi. Is there any plan to add support of scanning the QR-code by image file?

Get Hostname/Domain from the TCP packet

Hi, thanks for the amazing work on this tool 😄

I'm trying to test the VPN package individually as a separate Android app.

Can you please tell what is the best way to get the hostname or FQDN of the request being tunneled from the VPN?

For context - I'm trying to use it for a use case where I don't have any external VPN server. I just want to log all network traffic in the Android device itself once the local VPN is active.

This is what I tried in SessionHandler.handleTCPPacket -
Log.d(TAG, "Hostname: " + InetAddress.getByName(PacketUtil.intToIPAddress(destinationIP)).getHostName());

But this code mostly returns the IP address. Only rarely I'm able to see certain domain names, but those domain names are usually pretty long and seem like CDNs etc. I know that HTTPToolkit shows the complete domain, I'm wondering how to go about that. Thank you!!

Certificate rejected arbitrarily after showing "System Trust Enabled"

I get to this screen after I run install with adb:

This is the output window for HTTP toolkit

Emulator is user dev build with Magisk installed as root and working fine.

My device is an emulator on Android 12 x86_64 running on Pixel 6 6.4(1080x2400 420 dpi)(no playstore)

It works sometimes(1 in 10 maybe) and then all of a sudden "Certificate rejected". I have verified that my certificate is present in the /system/etc/security/cacerts but for some reason it does not show in the Trusted Certificates section. I tried to run the script manually with burp suite and it got installed in the folder but not showing in the Trusted Certificates on the device.

The format of the certificate is PEM converted to (.0 android) and I observed that the certificate created by us only has certificate begin and end but the certificates that are working example(Starfield Class 2 Certification Authority) has a lot more standard data about the certificate with SHA1 Fingerprint.

Can someone from the team help me in debugging this.

[Android TV] Certificate rejected/Aborted connection after showing "System Trust Enabled"

Android TV 11, API 30, Magisk 27

User/System Trust is Enabled, but it doesn't seem to be the case

Android command [ 'su', '-c', 'am force-stop com.android.chrome' ] returned ``
Android Chrome flags set
Android command [ 'sh', '/data/local/tmp/htk-root-test.sh' ] returned `shell`
Android command [ 'su', '-c', 'sh /data/local/tmp/htk-root-test.sh' ] returned `root`
Android command [ 'su', '-c', 'sh', '/data/local/tmp/htk-root-test.sh' ] returned `root`
Android command [ 'su', 'root', 'sh', '/data/local/tmp/htk-root-test.sh' ] threw Timeout for ADB command su,root,sh,/data/local/tmp/htk-root-test.sh
Error: Timeout for ADB command su,root,sh,/data/local/tmp/htk-root-test.sh
    at C:\Users\Max\AppData\Local\Programs\httptoolkit\resources\httptoolkit-server\bundle\index.js:944:19931
    at runNextTicks (node:internal/process/task_queues:60:5)
    at listOnTimeout (node:internal/timers:540:9)
    at process.processTimers (node:internal/timers:514:7)
    at async Promise.all (index 3)
    at async e.getRootCommand (C:\Users\Max\AppData\Local\Programs\httptoolkit\resources\httptoolkit-server\bundle\index.js:944:21810)
    at async e.AndroidAdbInterceptor.injectSystemCertIfPossible (C:\Users\Max\AppData\Local\Programs\httptoolkit\resources\httptoolkit-server\bundle\index.js:944:30737)
    at async e.AndroidAdbInterceptor.activate (C:\Users\Max\AppData\Local\Programs\httptoolkit\resources\httptoolkit-server\bundle\index.js:944:28565)
    at async e.ApiModel.activateInterceptor (C:\Users\Max\AppData\Local\Programs\httptoolkit\resources\httptoolkit-server\bundle\index.js:890:743387)
    at async C:\Users\Max\AppData\Local\Programs\httptoolkit\resources\httptoolkit-server\bundle\index.js:944:3509
    at async C:\Users\Max\AppData\Local\Programs\httptoolkit\resources\httptoolkit-server\bundle\index.js:944:2198
Android command [ 'su', 'root', 'sh /data/local/tmp/htk-root-test.sh' ] threw Timeout for ADB command su,root,sh /data/local/tmp/htk-root-test.sh
Error: Timeout for ADB command su,root,sh /data/local/tmp/htk-root-test.sh
    at C:\Users\Max\AppData\Local\Programs\httptoolkit\resources\httptoolkit-server\bundle\index.js:944:19931
    at async Promise.all (index 4)
    at async e.getRootCommand (C:\Users\Max\AppData\Local\Programs\httptoolkit\resources\httptoolkit-server\bundle\index.js:944:21810)
    at async e.AndroidAdbInterceptor.injectSystemCertIfPossible (C:\Users\Max\AppData\Local\Programs\httptoolkit\resources\httptoolkit-server\bundle\index.js:944:30737)
    at async e.AndroidAdbInterceptor.activate (C:\Users\Max\AppData\Local\Programs\httptoolkit\resources\httptoolkit-server\bundle\index.js:944:28565)
    at async e.ApiModel.activateInterceptor (C:\Users\Max\AppData\Local\Programs\httptoolkit\resources\httptoolkit-server\bundle\index.js:890:743387)
    at async C:\Users\Max\AppData\Local\Programs\httptoolkit\resources\httptoolkit-server\bundle\index.js:944:3509
    at async C:\Users\Max\AppData\Local\Programs\httptoolkit\resources\httptoolkit-server\bundle\index.js:944:2198
Cert already installed, nothing to do
Android command [ 'rm', '-f', '/data/local/tmp/htk-root-test.sh' ] returned ``
Android command [ 'su', '-c', 'sh /data/local/tmp/htk-set-chrome-flags.sh' ] returned `Chrome flags script completed`
Chrome flags script completed

Error ERR_CERT_DATE_INVALID when using ADB method

Hi, I'm trying out the app to capture traffic from my android phone and it looks pretty cool, but have a small issue with certs.

I tried first to use the user certificate method and it didn't work because I'm running an android version 7+. Later I tried the ADB method, as my phone is rooted, and it successfully works in terms of the certificate injection, but then I noticed that it cannot use the certificate because of the aforementioned error ERR_CERT_DATE_INVALID, even when trying the the "amiusing" site.

Inspecting the cert, I can verify that is using the mocked cert CN: HTTP Toolkit CA, with the following validity period:

Issued: Dec 31, 2020
Expires: Jan 1, 2021

I'm trying this out today, of course. Not sure if those dates or the change of year has any effect.

I installed the apk directly from the releases site in this repo.

Certificates rejected with app saying system trusted enabled

Hello.

I'm trying to use HTTPToolkit, together with KernelSU. I've installed the app, granted root permissions via ksu app to both shell and the app itself, opened the desktop app and clicked the connect via adb, Android.

However, it still doesn't capture, giving certificates rejected for anything besides Chrome.

Here are the logs:

Android command [ 'su', '-c', 'sh', '/data/local/tmp/htk-root-test.sh' ] returned `root`
Android command [ 'su', '-c', 'sh /data/local/tmp/htk-root-test.sh' ] returned `root`
Android command [ 'su', 'root', 'sh', '/data/local/tmp/htk-root-test.sh' ] threw Timeout for ADB command su,root,sh,/data/local/tmp/htk-root-test.sh
Error: Timeout for ADB command su,root,sh,/data/local/tmp/htk-root-test.sh
    at /opt/HTTP Toolkit/resources/httptoolkit-server/bundle/index.js:944:19743
    at runNextTicks (node:internal/process/task_queues:60:5)
    at listOnTimeout (node:internal/timers:540:9)
    at process.processTimers (node:internal/timers:514:7)
    at async Promise.all (index 3)
    at async e.getRootCommand (/opt/HTTP Toolkit/resources/httptoolkit-server/bundle/index.js:944:21622)
    at async e.AndroidAdbInterceptor.injectSystemCertIfPossible (/opt/HTTP Toolkit/resources/httptoolkit-server/bundle/index.js:944:30549)
    at async e.AndroidAdbInterceptor.activate (/opt/HTTP Toolkit/resources/httptoolkit-server/bundle/index.js:944:28377)
    at async e.ApiModel.activateInterceptor (/opt/HTTP Toolkit/resources/httptoolkit-server/bundle/index.js:890:742658)
    at async /opt/HTTP Toolkit/resources/httptoolkit-server/bundle/index.js:944:3509
    at async /opt/HTTP Toolkit/resources/httptoolkit-server/bundle/index.js:944:2198
Android command [ 'su', 'root', 'sh /data/local/tmp/htk-root-test.sh' ] threw Timeout for ADB command su,root,sh /data/local/tmp/htk-root-test.sh
Error: Timeout for ADB command su,root,sh /data/local/tmp/htk-root-test.sh
    at /opt/HTTP Toolkit/resources/httptoolkit-server/bundle/index.js:944:19743
    at async Promise.all (index 4)
    at async e.getRootCommand (/opt/HTTP Toolkit/resources/httptoolkit-server/bundle/index.js:944:21622)
    at async e.AndroidAdbInterceptor.injectSystemCertIfPossible (/opt/HTTP Toolkit/resources/httptoolkit-server/bundle/index.js:944:30549)
    at async e.AndroidAdbInterceptor.activate (/opt/HTTP Toolkit/resources/httptoolkit-server/bundle/index.js:944:28377)
    at async e.ApiModel.activateInterceptor (/opt/HTTP Toolkit/resources/httptoolkit-server/bundle/index.js:890:742658)
    at async /opt/HTTP Toolkit/resources/httptoolkit-server/bundle/index.js:944:3509
    at async /opt/HTTP Toolkit/resources/httptoolkit-server/bundle/index.js:944:2198
Cert already installed, nothing to do
Android command [ 'rm', '-f', '/data/local/tmp/htk-root-test.sh' ] returned ``
Android command [ 'su', '-c', 'sh /data/local/tmp/htk-set-chrome-flags.sh' ] returned `Chrome flags script completed`
Chrome flags script completed

Android command [ 'su', '-c', 'am force-stop com.android.chrome' ] returned ``
Android Chrome flags set
Error: Aborted
    at IncomingMessage.o (/opt/HTTP Toolkit/resources/httptoolkit-server/bundle/index.js:890:38413)
    at Object.onceWrapper (node:events:632:28)
    at IncomingMessage.emit (node:events:530:35)
    at IncomingMessage.emit (node:domain:488:12)
    at IncomingMessage._destroy (node:_http_incoming:224:10)
    at _destroy (node:internal/streams/destroy:121:10)
    at IncomingMessage.destroy (node:internal/streams/destroy:83:5)
    at abortIncoming (node:_http_server:793:9)
    at socketOnClose (node:_http_server:787:3)
    at Socket.emit (node:events:530:35)
    at Socket.emit (node:domain:488:12)
    at TCP.<anonymous> (node:net:337:12)
Failed to handle request: aborted
INFO: Unparseable URL: http://
Android command [ 'sh', '/data/local/tmp/htk-root-test.sh' ] returned `shell`
Android command [ 'su', '-c', 'sh /data/local/tmp/htk-root-test.sh' ] returned `root`
Android command [ 'su', '-c', 'sh', '/data/local/tmp/htk-root-test.sh' ] returned `root`
Android command [ 'su', 'root', 'sh', '/data/local/tmp/htk-root-test.sh' ] threw Timeout for ADB command su,root,sh,/data/local/tmp/htk-root-test.sh
Error: Timeout for ADB command su,root,sh,/data/local/tmp/htk-root-test.sh
    at /opt/HTTP Toolkit/resources/httptoolkit-server/bundle/index.js:944:19743
    at runNextTicks (node:internal/process/task_queues:60:5)
    at listOnTimeout (node:internal/timers:540:9)
    at process.processTimers (node:internal/timers:514:7)
    at async Promise.all (index 3)
    at async e.getRootCommand (/opt/HTTP Toolkit/resources/httptoolkit-server/bundle/index.js:944:21622)
    at async e.AndroidAdbInterceptor.injectSystemCertIfPossible (/opt/HTTP Toolkit/resources/httptoolkit-server/bundle/index.js:944:30549)
    at async e.AndroidAdbInterceptor.activate (/opt/HTTP Toolkit/resources/httptoolkit-server/bundle/index.js:944:28377)
    at async e.ApiModel.activateInterceptor (/opt/HTTP Toolkit/resources/httptoolkit-server/bundle/index.js:890:742658)
    at async /opt/HTTP Toolkit/resources/httptoolkit-server/bundle/index.js:944:3509
    at async /opt/HTTP Toolkit/resources/httptoolkit-server/bundle/index.js:944:2198
Android command [ 'su', 'root', 'sh /data/local/tmp/htk-root-test.sh' ] threw Timeout for ADB command su,root,sh /data/local/tmp/htk-root-test.sh
Error: Timeout for ADB command su,root,sh /data/local/tmp/htk-root-test.sh
    at /opt/HTTP Toolkit/resources/httptoolkit-server/bundle/index.js:944:19743
    at async Promise.all (index 4)
    at async e.getRootCommand (/opt/HTTP Toolkit/resources/httptoolkit-server/bundle/index.js:944:21622)
    at async e.AndroidAdbInterceptor.injectSystemCertIfPossible (/opt/HTTP Toolkit/resources/httptoolkit-server/bundle/index.js:944:30549)
    at async e.AndroidAdbInterceptor.activate (/opt/HTTP Toolkit/resources/httptoolkit-server/bundle/index.js:944:28377)
    at async e.ApiModel.activateInterceptor (/opt/HTTP Toolkit/resources/httptoolkit-server/bundle/index.js:890:742658)
    at async /opt/HTTP Toolkit/resources/httptoolkit-server/bundle/index.js:944:3509
    at async /opt/HTTP Toolkit/resources/httptoolkit-server/bundle/index.js:944:2198
Cert already installed, nothing to do
Android command [ 'rm', '-f', '/data/local/tmp/htk-root-test.sh' ] returned ``
Android command [ 'su', '-c', 'sh /data/local/tmp/htk-set-chrome-flags.sh' ] returned `Chrome flags script completed`
Chrome flags script completed

Android command [ 'su', '-c', 'am force-stop com.android.chrome' ] returned ``
Android Chrome flags set

As said in the logs, root is available.

Android 14, A53 5G with custom OneUI ROM.

Android TV compatibility

Please consider an Android TV compatible client.

There is no easy solution to debug an Android TV app:

• Android Studio Network profiler is useless - never works
• OkHttp Profiler - plugin fails badly - itkacher/OkHttpProfiler#42
• Facebook Stetho + Chrome DevToos - used to work, but recent Chrome/Brave/Edge updates broke DevTools, i.e. inspect#devices does not show anymore Android apps
• Facebook Flipper - well, does not work, just like all above
• Charles Proxy / Proxyman - very cumbersome approach, but the only one working currently

Your approach may look feasible to solve thie annoying Android TV pain.

F-Droid inclusion

Would you consider publishing this app on F-Droid please?

According to Izzy scanner report :

Offending libs:
---------------
* Play Install Referrer Library (/com/android/installreferrer): NonFreeDep,NonFreeNet,Tracking
* Android Market (/com/google/android/finsky): NonFreeNet
* Google Mobile Services (/com/google/android/gms): NonFreeDep
* Firebase (/com/google/firebase): NonFreeNet,NonFreeDep
* Sentry SDK for Java (/io/sentry): Tracking

5 offenders.

As Izzy pointed out there, any possibility of keeping FOSS flavour without these libraries for F-Droid?

CA Location?

I prompted to manually install ca file, but i can't find it anywhere, where is the location in android device?

Intercepting Windows Subsystem for Android (WSA) with HTTP Toolkit

Unable to start http toolkit on windows subsystem for Android on windows 11 . Getting the following error

Anyway to resolve it?

Doesn't work properly in andriod rooted using Magisk

HTTP Toolkit is currently one of the best MITM proxy tools used for application development, reverse engineering, etc... However, at the moment there is a small issue with magisk rooted phone. Even though the phone is rooted, it seems CA certificates don't seem to be installed properly.

Disable always-on VPN

I'm trying to intercept all HTTP requests for my custom AOSP device. This does no have the Settings APK for tweaking n/w related things.

When I connect to my device and invoke "Android device connected via ADB" from my PC I get the below error.

Any idea how to resolve this and start intercepting requests?

Logs here
logs.txt

httptookit on emulator

Hi,

I noticed the ADB option is disabled; I couldn’t find why or how to fix it.

Thanks

PIN-protect autostart

Is there a way to PIN-protect autostarting the app so it runs on boot and can't be disabled until a user enters a predefined PIN code (different than native android device lock screen code)? Perhaps a Pro feature? I need to run long uninterrupted proxy sessions.

Oh no! We couldn't connect to HTTP Toolkit. Is it running, and connected to the same network as this device?

Hello. Whenever I launch the Android app and try connecting it to my Windows machine (which is on the same network) I get the error stated in the title. I haven't found myself having any issues with other apps. I have a Xiaomi Note 11 running Android version 11 RKQ1.200826.002 and MIUI-Version MIUI Global 12.5.7 Stable 12.5.7.0(RKFEUXM). My phone isn't rooted.
If you guys need any more info from me I would be happy to provide it.