emanuele-f/PCAPdroid

Features

• Android Network Monitoring - Captures and analyzes network traffic specifically from Android applications without requiring root access.
• Local-VPN Packet Processing - Captures and filters network traffic using a local VPN implementation to operate without root access.
• Local Packet Captures - Intercepts network packets from system and user applications locally without requiring root access.
• Pcapng File Exports - Saves network traffic in pcapng format, embedding decryption secrets for external analysis.
• Traffic Captures - Writes captured network traffic directly to local files for offline analysis.
• Packet Capture Engines - Ships a capture engine that can be controlled remotely via intents or command line instructions.
• Packet Capture Utilities - Records network traffic in PCAPng format for deep offline analysis in external packet inspection tools.
• Pcapng Serialization - Saves captured network packets and metadata in the standardized Pcapng binary format.
• Protocol Payload Inspectors - Decodes HTTP messages and displays connection payloads as text or hexdumps.
• SOCKS5 Proxy VPN Clients - Routes all device traffic through a SOCKS5 proxy by running a local VPN service.
• Traffic Interception - Intercepts all device network traffic by creating a local VPN tunnel through a virtual interface.
• Domain Name Blocking - Restricts internet access for specific apps or domains by blocking DNS resolution or connection attempts.
• Traffic Decryption - Decrypts HTTPS traffic by acting as a man-in-the-middle with a custom certificate authority.
• Transparent HTTPS Inspections - Implements a proxy-based system that transparently decrypts HTTPS traffic for inspection of mobile application communications.
• Endpoint Identification - Extracts DNS queries, server names, and IP addresses to identify destination endpoints for applications.
• Local Filtering Firewalls - Functions as a VPN-based firewall that blocks connections to malicious hosts or specific domains.
• Application Connection Monitors - Tracks network activity from user and system applications to identify where data is transmitted.
• DNS Query Monitoring - Inspects DNS queries, including encrypted requests, to track how domains are resolved.
• PCAP File Exports - Dumps captured network traffic into PCAP files for deep packet analysis in external tools.
• Traffic Data Export - Provides utilities to save captured network data to local files or stream it to remote receivers.
• Intent-Based Command Dispatchers - Supports triggering capture operations and configuration changes via Android intents and ADB shell commands.
• Traffic Routing Proxies - Redirects device network traffic through Tor or SOCKS5 proxies to anonymize identity and bypass restrictions.
• Network Troubleshooting Tools - Diagnoses Android connectivity issues by monitoring DNS and using proxy-based packet inspection.
• Offline IP Geolocation - Resolves remote IP addresses to geographic locations and autonomous system numbers using offline lookup tables.
• Proxy Routing - Implements logic to route device network traffic through external proxy servers for decryption and modification.
• Traffic Filtering Engines - Implements mechanisms to isolate specific network traffic based on configurable criteria for focused analysis.
• Traffic Filters - Filters network traffic to hide irrelevant connections based on IP, host, protocol, or application.
• Application Filters - Allows limiting network traffic capture to specific applications or lists of package names.
• Production Traffic Modifications - Intercepts and modifies live HTTP request and response data using custom scripts.
• Anonymity Network Routing - Routes device network traffic through the Tor network to anonymize the user's identity and location.
• Malicious Host Detection - Identifies and blocks connections to known malicious domains by cross-referencing traffic with third-party blacklists.
• Malicious String Heuristics - Identifies connections to malicious servers by comparing live traffic patterns against threat intelligence.
• Malware Analysis - Identifies connections to malicious hosts and analyzes data exfiltration patterns for mobile malware analysis.
• Mobile App Security Auditing - Provides capabilities for decrypting TLS and inspecting HTTP requests to audit mobile applications for vulnerabilities.
• Traffic Interception and Modification - Intercepts and modifies live HTTP requests and responses using custom scripts during network capture.
• Developer Tools - Network traffic analysis and packet capture tool for Android.
• Mobile Device Management and Utilities - Network monitor and packet dumper for non-rooted Android devices.
• System Utilities - Network traffic analysis and monitoring.
• Traffic Capture Frameworks - Android-based network traffic monitoring and export tool.

Star history