If you want another tool which can intercept HTTPS, then try OWASP ZAP, Burp Suite or mitmproxy. Wireshark can't be used as a proxy because wireshark only listens to traffic and does not alter or insert new requests. Therefore, Android forwards all packets to the app. (If you wouldn't trust the certificate, your phone would most likely throw a connection error.)īut how does the app get the packets? It probably uses the Android VPN API and presents itself to the Android system as a VPN tunnel. This only works because you trusted the certificate. This is similar to a Man-in-the-middle attack. It decrypts your traffic so that it can display the packet contents, and then re-encrypts it with its own secure connection to the web application.

Now the app can act as a proxy between your device and your web application. but its not right yet, I dont know about other rules mentioned there. Now your phone trusts everything it trusted before - plus all certificates signed by the 'packet capture certificate'. This is how far I got with Powershell: New-SelfSignedCertificate -DnsName 'WDACPolicy' -CertStoreLocation Cert:CurrentUserMy -Type Codesigning -KeyLength 2048 -KeyAlgorithm RSA. Your phone trusts only certificates signed by a certificate authority.īy installing the app you mentioned, you imported a 'packet capture certificate'.

To manage all this certification stuff, we use a Public key infrastructure. Encryption only (without this authentication) would be pretty useless, because it would be trivial to intercept and decrypt traffic. These certificates are meant to be a guarantee that you're talking to the right server (and not to the server of an intruder).

Wireshark certificate signed by