r0ysue/r0capture
R0capture
r0capture is a tool for intercepting network traffic from Android applications. It serves as a traffic interceptor, packet sniffer, and client certificate exporter used to analyze application-layer communication on Android devices.
The project provides mechanisms to bypass SSL pinning and certificate validation, allowing the decryption of encrypted traffic without modifying device trust stores. It also enables the extraction of client-side certificates from application memory for saving to local device storage.
Captured network data is serialized into PCAP files to support offline protocol analysis. The tool identifies specific functions responsible for sending and receiving packets to capture data across various application-layer frameworks and protocols.
Features
- Android Traffic Analysis Tools - Intercepts and inspects network requests within Android applications to understand server communication.
- Application-Layer Interceptions - Captures data across various application-layer frameworks and redirects it into a standard packet format.
- Application-Layer Captures - Captures network data at the app level to analyze traffic across different protocols and encryption versions.
- Packet Capture Utilities - Records and saves network traffic from identified Android functions into PCAP files for offline analysis.
- Traffic Interceptors - Serves as a tool for capturing and analyzing application-layer network traffic on Android devices.
- Dynamic Process Instrumentation - Implements runtime code injection into Android processes to intercept network calls without modifying the app binary.
- Certificate Pinning Bypasses - Forcefully disables certificate validation logic during execution to allow decryption of HTTPS traffic.
- Mobile App Security Auditing - Provides tools for analyzing network behavior and extracting credentials to identify mobile application security vulnerabilities.
- Dynamic Function Interception - Captures plaintext network data by intercepting specific sending and receiving functions at runtime.
- Mobile Application Debugging - Enables detailed offline analysis of Android app network traffic by exporting data to PCAP files.
- Memory-Based Certificate Extractions - Extracts client-side certificates from application memory for storage and inspection.
- Runtime Certificate Extractions - Extracts client-side certificates from application memory and saves them to local device storage.
- Memory-Based Extractions - Extracts client certificates by reading the application's process memory space.
- Application Layer Protocol Dissectors - Hooks application-layer frameworks on mobile devices to intercept and decode network data across multiple protocols.
- PCAP File Exports - Serializes captured network buffers into standard PCAP files for offline analysis.
- Mobile App Analysis Tools - Universal tool for capturing traffic from Android applications.
