android app network monitor with mitmweb

 

1.  Install root Mitm CA  cert

  - Installing the mitmproxy CA as a user certificate (via http://mitm.it)

   - In your AVD, go to Settings → Security → Advanced → Encryption & credentials → Trusted credentials. Find your certificate (default name is mitmproxy) in the list.

REF: https://docs.mitmproxy.org/stable/howto/install-system-trusted-ca-android/

 

NOTE: you will see chrome can proxy by mitmweb, but other apps don't. cause other apps don't use system certs.  so you should update app network security config.

 

2.  rebuild app with network_security_config.xml

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <base-config>
        <trust-anchors>
            <certificates src="system" />
            <certificates src="user" overridePins="true" />
        </trust-anchors>
    </base-config>
</network-security-config>

　　REF: 

            - https://httptoolkit.com/docs/guides/android/ 

            - https://developer.android.com/privacy-and-security/security-config

 

3.  add latency for app

import asyncio
from mitmproxy import ctx, http

# --- Configuration ---------------------------------------------------------
# Exact hostnames to match
HOST_LIST = {
    "meshstage.lessen.com"
}

# Default delays (seconds)
DEFAULT_REQUEST_DELAY = 5   # delay before forwarding request to upstream
DEFAULT_RESPONSE_DELAY = 601  # delay before sending response back to client

# Optional per-host overrides (host -> (request_delay, response_delay))
# If a host is not listed here, defaults are used.
HOST_DELAY_MAP = {
    # "api.example.com": (0.05, 0.05),
    # "example.com": (0.5, 0.5),
}

# Whether to match by exact host OR by regex patterns
USE_REGEX_MATCHING = False
# ---------------------------------------------------------------------------


def _match_host(host: str) -> bool:
    """Return True if the host matches our lists or regexes."""
    if not host:
        return False
    if host in HOST_LIST:
        return True
    return False


def _get_delays_for_host(host: str):
    """Return (request_delay, response_delay) for host."""
    if host in HOST_DELAY_MAP:
        return HOST_DELAY_MAP[host]
    return DEFAULT_REQUEST_DELAY, DEFAULT_RESPONSE_DELAY


class ThrottleLatency:
    def __init__(self):
        ctx.log.info("throttle_latency addon loaded")
        ctx.log.info(f"Hosts exact: {sorted(HOST_LIST)}")

    async def request(self, flow: http.HTTPFlow) -> None:
        """
        Called when a client request has been received.
        We add delay BEFORE the request is forwarded to upstream.
        """
        host = flow.request.host or flow.request.headers.get("host", "")
        if _match_host(host):
            req_delay, _ = _get_delays_for_host(host)
            if req_delay and req_delay > 0:
                ctx.log.info(f"Delaying request to {host} by {req_delay}s")
                await asyncio.sleep(req_delay)

    async def response(self, flow: http.HTTPFlow) -> None:
        """
        Called when a response has been received from upstream.
        We add delay BEFORE the response is sent back to the client.
        """
        host = flow.request.host or flow.request.headers.get("host", "")
        if _match_host(host):
            _, resp_delay = _get_delays_for_host(host)
            if resp_delay and resp_delay > 0:
                ctx.log.info(f"Delaying response from {host} by {resp_delay}s")
                await asyncio.sleep(resp_delay)


addons = [ThrottleLatency()]

./mitmweb -s ./throttle_latency.py