Projects sharing features with R0capture

PCAPdroid is an Android network traffic analyzer and packet capture tool that operates without requiring root access. It functions as a VPN-based firewall and network controller, capable of recording traffic in PCAPng format and blocking connections to specific domains or malicious hosts. The project distinguishes itself through a proxy-based system for decrypting TLS traffic and routing device network traffic through SOCKS5 proxies or the Tor network. It further allows for the modification of live HTTP requests and responses via custom scripts. Its capabilities cover application connection

Xposed is a native Android runtime hooking framework and instrumentation tool. It provides a modified version of the Android app process binary to intercept and modify the behavior of system and application processes at the binary level. The framework enables Android operating system customization by altering internal function calls and runtime execution flow. It achieves this through native process instrumentation, allowing for the modification of functionality without altering original application files. The tool covers several low-level capabilities, including native library injection and

Mitmproxy is an interactive, programmable network proxy engine designed for traffic analysis and protocol manipulation. It functions as a gateway that intercepts, inspects, and modifies network traffic in real-time, supporting HTTP, HTTPS, WebSocket, DNS, and generic TCP or UDP streams. By acting as a trusted certificate authority, the proxy can dynamically generate and sign certificates to decrypt and analyze secure TLS-encrypted connections. The project distinguishes itself through a highly extensible, event-driven architecture that allows users to automate traffic transformation using cust

APKLab is an integrated security analysis platform and reverse engineering IDE for Android applications. It provides a unified environment for decompiling binaries into source code, repackaging modified applications into signed installers, and performing comprehensive security analysis. The platform distinguishes itself by combining static and dynamic analysis workflows. It enables the injection of runtime hooks and gadget libraries to monitor application behavior, while providing specialized patching capabilities to intercept and decrypt encrypted network traffic via a proxy. The toolkit co

GT is an on-device mobile debugging tool designed to capture network packets, analyze system logs, and profile hardware performance directly on a smartphone. It provides a portable suite of utilities for identifying software bugs and processing bottlenecks without requiring a connection to a host computer. The project features a plugin-based debugging framework that allows for the development of custom functional extensions to implement project-specific debugging logic. It also enables real-time parameter tuning and injection, allowing internal application settings to be modified during execu

Apkleaks is a static analysis tool and security auditor designed to extract hardcoded secrets, API endpoints, and sensitive data from Android application packages. It operates as a secret scanner that analyzes compiled binaries without executing them to identify potential information leaks and insecure endpoints. The tool utilizes a regex-based data extraction engine to identify sensitive strings within decompiled code. It supports customization through JSON-defined search patterns and provides configuration flags to tune the behavior of the underlying disassembler. The analysis pipeline enc

spy-debugger is an HTTP proxy debugging tool designed for intercepting and analyzing network traffic from mobile devices, WebViews, and mobile browsers. It functions as a network packet capture tool and a remote browser inspector, allowing users to monitor HTTP and HTTPS requests wirelessly without the need for USB cables. The project distinguishes itself by using script injection to enable remote debugging. It injects JavaScript into HTTP response bodies, providing the ability to inspect HTML and CSS elements and perform live page content editing directly on the mobile screen. Additionally,

apk-mitm is a command-line utility designed to modify Android APK files to enable HTTPS traffic inspection via a proxy. It functions as a network security patcher and certificate pinning bypass tool, automating the process of altering application packages to allow man-in-the-middle traffic analysis. The tool modifies compiled Android packages by unpacking them, altering internal files, and re-encoding the binary. It specifically focuses on disabling certificate pinning and injecting network security configurations into the application manifest, which permits the use of proxy certificates on b

WAuxiliary_Public is a dynamic code instrumentation framework and application plugin framework designed to intercept and alter the execution flow of compiled applications. It functions as a process injection toolkit and software reverse engineering tool, enabling the injection of custom logic into active application memory spaces to extend functionality without requiring original source code. The framework specifically provides capabilities for extending the WeChat desktop client. It achieves this through runtime process injection and software reverse engineering to modify internal operations

Wireshark is a network protocol analyzer and traffic inspector used for capturing and inspecting network traffic. It functions as a packet capture tool that intercepts live data from network interfaces and a TCP/IP dissector that decodes network protocol layers to translate raw binary packets into human-readable fields. The system provides capabilities for protocol stream reconstruction, grouping related packets into cohesive conversations between endpoints. It also operates as a packet file converter, allowing for the reading, modification, and conversion of network capture files across vari

Res-downloader is a network proxy utility designed to intercept, analyze, and extract multimedia assets from web traffic. It functions as a gateway that captures video, audio, and image files directly from data streams for local storage and offline access. The tool employs man-in-the-middle interception to decrypt and inspect network packets, allowing it to identify media resources through pattern matching and content type filtering. It integrates proxy-based routing to manage outgoing requests, enabling the retrieval of content that may be subject to regional restrictions or network-level ac

rdpwrap is a set of system utilities and services designed to enable, configure, and manage remote desktop protocol access and video compression settings. It functions as a service and manager that allows remote desktop connections on operating system versions where the feature is restricted or disabled by the vendor. The project provides tools to override system-level restrictions for remote access and activate remote desktop protocol services on unsupported versions. It includes a configuration tool for managing H.264 video compression and encoding settings to balance visual quality, networ

XposedBridge is an Android Java hooking framework and bytecode instrumentation engine. It functions as a runtime system for intercepting and modifying Java method calls within the Android operating system and installed applications. The project provides a mechanism for zygote process injection, ensuring that all spawned applications inherit the instrumentation logic. It enables the modification of internal Android system behaviors through method proxying and Java reflection to access private internal system members. The framework supports dynamic Android instrumentation and runtime analysis,

Objection is a dynamic instrumentation framework and runtime exploration toolkit for mobile application security analysis. It provides a command-line interface to interact with the memory and state of iOS and Android applications during active execution, serving as a toolkit for runtime analysis and security testing. The project distinguishes itself by providing specialized capabilities to bypass common mobile security controls, including SSL pinning, biometric authentication, and root or jailbreak detection. It enables the extraction of sensitive credentials and data from secure storage syst

Detours is a library for intercepting Win32 API calls and redirecting function calls at runtime on Windows, enabling binary-level instrumentation without requiring access to the original source code. It functions as an API hooking library and binary instrumentation toolkit, allowing developers to monitor or modify the behavior of compiled Windows binaries by hooking into their function execution paths. The project achieves this through detour-based function interception, where the first few instructions of a target function are replaced with a jump to a user-supplied detour function, while pr

Dexposed is a set of runtime tools and engines designed for dynamic patching, framework interception, and code instrumentation on Android devices. It functions as a hooking framework and instrumentation tool used to load custom code into running processes to alter logic without modifying the original bytecode. The project enables the interception and modification of method behavior within both Android applications and the system framework. It specifically provides capabilities for bypassing operating system limitations by overriding framework calls and applying hot patches to live processes w

Chromatic is a Chromium runtime modifier and JavaScript engine injector designed to alter the low-level operational characteristics of Chromium and its embedded V8 engine. It functions as a tool for injecting custom logic into the V8 JavaScript engine to change application behavior at runtime. The project provides mechanisms for browser engine instrumentation and V8 runtime manipulation. It enables the modification of the internal execution flow of JavaScript within Chromium-based environments to extend native browser capabilities or bypass standard limitations.

GoReplay is a network traffic recording and replay tool used to capture live HTTP and binary protocol requests. It functions as a traffic shadowing proxy that duplicates incoming network requests to test environments and a utility for recording traffic to local or cloud storage for later analysis and playback. The system is capable of processing non-textual data formats, such as Thrift and Protocol Buffers, allowing for the capture and replay of specialized application-to-application communication. The tool supports live traffic capture and asynchronous duplication to validate infrastructure

Ettercap is a network utility tool used for ARP spoofing, packet filtering, traffic interception, passive scanning, and DHCP hijacking. It functions as a network traffic interceptor and man-in-the-middle packet filter to monitor and manipulate live TCP/UDP connections on a local area network. The project provides specialized capabilities for traffic redirection via ARP cache poisoning, DHCP server spoofing, ICMP redirects, and switch port stealing. It also enables the emulation of rogue services and the decryption of SSH1 session streams by substituting public keys. Additional capabilities i

Dobby is a dynamic function hooking framework and binary instrumentation tool designed to intercept and redirect function calls in compiled binaries. It serves as a cross-platform and cross-architecture library that provides a unified interface for modifying program execution flow across different operating systems and CPU architectures. The library enables low-level binary instrumentation and runtime application instrumentation by injecting custom handlers into live processes. It is used for software reverse engineering to observe real-time data flow and logic by hooking internal functions.

Moloch is a full packet capture system and network forensics platform designed for large scale network traffic recording and indexing. It functions as a distributed packet indexer that stores raw data in PCAP format for deep packet analysis and security investigations. The system distinguishes itself through a decentralized architecture that distributes capture and viewing components across multiple nodes to handle high volumes of network traffic. It utilizes a web-based management interface for browsing network sessions and provides a programmable API for exporting captured traffic and metad

ESP32Marauder is a suite of specialized firmware images and tools designed for wireless network auditing, packet sniffing, and Bluetooth scanning on ESP32 hardware. It functions as a wireless penetration tool used to analyze network security and monitor signal traffic. The project includes capabilities for capturing wireless handshakes and simulating access points to test infrastructure resilience. It also features a Bluetooth low energy scanner used to identify hardware signatures and detect unauthorized signals or skimming devices. The firmware supports broader security operations includin

LSPosed is an Android runtime hooking framework and in-memory code modifier. It functions as a system hooking tool that intercepts and modifies system and application methods in memory to change behavior without altering original installation files. The project provides a standardized interface through the Xposed Module API, allowing for the development of plugins that alter the behavior of the Android operating system and installed applications. The framework covers a range of capabilities including runtime function interception, Android system debugging, and application customization. Thes

Netch is a multi-protocol proxy client and network traffic interceptor designed to route internet traffic through VPN and proxy tunnels. It functions as a connection manager that tunnels outbound data to modify network paths and bypass network restrictions. The project supports a wide range of tunneling protocols, including Socks5, Shadowsocks, WireGuard, Trojan, VMess, and VLESS. It distinguishes itself by offering the ability to distribute established proxy connections to other devices on a local network and by providing UDP FullCone NAT support to maintain stable peer-to-peer connectivity

Piko is a collection of specialized Android utilities designed for binary patching, user interface customization, media downloading, and application debugging. It functions as an APK modification framework that alters application metadata and binary resources to modify internal logic and bypass version locks. The project differentiates itself through deep application modification capabilities, including bytecode-level instruction patching, DEX file manipulation, and a dynamic hooking engine. It enables the overriding of resource files and the injection of permissions via the application manif

Arkime is a distributed packet analysis platform and full packet capture system designed for recording raw network traffic, indexing metadata, and performing network forensics. It functions as a network traffic indexer and security tool that enables the monitoring, querying, and browsing of large-scale network traffic across multi-cluster architectures. The platform distinguishes itself through its ability to manage distributed capture clusters from a centralized administrative dashboard. It integrates external data feeds with internal traffic logs to identify known threats and provides a pro

The Mobile Application Security Testing Guide is a comprehensive manual and compliance framework for verifying the security of mobile applications. It provides a standardized reference for identifying and validating common software security weaknesses and performing reverse engineering based on industry standards. The project provides a structured set of technical processes and checklists used to audit applications against established security weakness enumerations. It encompasses guidance for analyzing application binaries and runtime behavior to identify hidden functionality and security ga